diff --git a/Cargo.lock b/Cargo.lock
index 287a23f0c..5faa6567a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1442,7 +1442,7 @@ dependencies = [
  "itertools",
  "log",
  "profiling",
- "resvg",
+ "resvg 0.45.1",
 ]
 
 [[package]]
@@ -4438,11 +4438,29 @@ dependencies = [
  "pico-args",
  "rgb",
  "svgtypes 0.15.3",
- "tiny-skia",
+ "tiny-skia 0.11.4",
  "usvg 0.45.1",
  "zune-jpeg 0.4.21",
 ]
 
+[[package]]
+name = "resvg"
+version = "0.48.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67e3803f97b999e80cbf7c6ecdd07a8102204d92e1633cf48783720c521196bd"
+dependencies = [
+ "bytemuck",
+ "gif 0.14.2",
+ "image-webp",
+ "log",
+ "pico-args",
+ "rgb",
+ "svgtypes 0.16.1",
+ "tiny-skia 0.12.0",
+ "usvg 0.48.1",
+ "zune-jpeg 0.5.15",
+]
+
 [[package]]
 name = "rfd"
 version = "0.17.2"
@@ -4727,7 +4745,7 @@ checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec"
 dependencies = [
  "log",
  "smithay-client-toolkit 0.19.2",
- "tiny-skia",
+ "tiny-skia 0.11.4",
 ]
 
 [[package]]
@@ -5593,6 +5611,21 @@ dependencies = [
  "tiny-skia-path 0.11.4",
 ]
 
+[[package]]
+name = "tiny-skia"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47ffee5eaaf5527f630fb0e356b90ebdec84d5d18d937c5e440350f88c5a91ea"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "png 0.18.1",
+ "tiny-skia-path 0.12.0",
+]
+
 [[package]]
 name = "tiny-skia-path"
 version = "0.11.4"
@@ -6235,7 +6268,9 @@ version = "0.21.0"
 dependencies = [
  "image",
  "kurbo 0.13.1",
+ "resvg 0.48.1",
  "serde_json",
+ "svgtypes 0.16.1",
  "vectorcraft-color",
  "vectorcraft-doc",
  "vectorcraft-geom",
@@ -6491,7 +6526,7 @@ dependencies = [
  "image",
  "kurbo 0.13.1",
  "proptest",
- "resvg",
+ "resvg 0.45.1",
  "serde",
  "serde_json",
  "simplecss",
diff --git a/apps/vectorcraft-cli/src/main.rs b/apps/vectorcraft-cli/src/main.rs
index 6f41d65ee..0140d6e9c 100644
--- a/apps/vectorcraft-cli/src/main.rs
+++ b/apps/vectorcraft-cli/src/main.rs
@@ -1,6 +1,7 @@
 //! `vectorcraft-cli`: VectorCraft from the command line.
 //!
 //! ```text
+//! vectorcraft-cli --safe-mode SUBCOMMAND ...
 //! vectorcraft-cli mcp [--connect 127.0.0.1:7979 | --headless] [--automation-read-root DIR]... [--automation-write-root DIR]...
 //! vectorcraft-cli run [--in FILE] [--cmd id [--params '{json}'] | --commands FILE|-]... [--export out.svg]... [--scale 2] [--ppi 300]
 //! vectorcraft-cli commands
@@ -72,6 +73,11 @@ const USAGE: &str = "\
 vectorcraft-cli — VectorCraft automation
 
 USAGE:
+  vectorcraft-cli --safe-mode SUBCOMMAND ...
+      Run any subcommand without plug-ins: none loads or runs, and plug-in commands report that
+      Safe Mode is on. Plug-ins stay installed. `--safe-mode mcp` serves a headless session and
+      does not take --connect.
+
   vectorcraft-cli mcp [--connect ADDR | --headless] [--automation-read-root DIR]... [--automation-write-root DIR]... [--allow-plugin-grants]
       Run the MCP server on stdio. Default: connect to a running app at 127.0.0.1:7979
       (vectorcraft --control 7979), falling back to a headless in-process session.
@@ -134,12 +140,17 @@ USAGE:
       Render FILE (any readable format) fitted to WxH (default 2880x1800) and print ms per frame
       (warm), multithreaded and single-threaded.
 
-  vectorcraft-cli perf [--paths N] [--deep]
+  vectorcraft-cli perf [--paths N] [--deep] [--native-io [--artboards 1..4]]
       Check the performance budgets (render, pan, hit test, save/load, SVG, Pathfinder, handle
       and segment drags) on a synthetic N-path document (default 50000). Exits non-zero if a
       budget is exceeded, unless the report says the machine is busy. --deep also times work with
       no budget yet and prints memory use (the working set on Windows), with the peak so far on
       Windows and Linux.
+      --native-io instead measures the application's native save/open commands (one warmup,
+      five samples, no disk I/O), including preview, PDF, compression and API base64 costs.
+      It reports the default and explicit PDF opt-out, with and without preview/compression;
+      --artboards repeats the same artwork
+      on 1 to 4 overlapping artboards. This mode allows at most 50000 paths.
 ";
 
 /// The usage text plus the formats `document.open` reads and `document.export` writes.
@@ -181,12 +192,18 @@ fn main() -> ExitCode {
     #[cfg(target_os = "macos")]
     mac_fonts::install();
     prefs_dir::install_fonts();
-    let args: Vec<String> = std::env::args().skip(1).collect();
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    // Before any subcommand attaches the plug-in folder.
+    let safe_mode = args.first().is_some_and(|a| a == "--safe-mode");
+    if safe_mode {
+        args.remove(0);
+        vectorcraft_engine::cmd::plugin::start_in_safe_mode();
+    }
     let r = match args.first().map(String::as_str) {
         // `commands` and `info` take no options, so `--help` or `-h` anywhere after them prints the
         // usage. The other subcommands check for it themselves.
         Some("commands" | "info") if help_requested(&args[1..], &[]) => help(),
-        Some("mcp") => mcp(&args[1..]),
+        Some("mcp") => mcp(&args[1..], safe_mode),
         Some("run") => run(&args[1..]),
         Some("commands") => commands(),
         Some("convert") => convert(&args[1..]),
@@ -227,7 +244,9 @@ fn accepting_grants(mut h: Headless, allow: bool) -> Headless {
     h
 }
 
-fn mcp(args: &[String]) -> Result<(), String> {
+/// `mcp`. With `--safe-mode` (`safe_mode`) it serves a headless session: a running app loads its own
+/// plug-ins, so `--connect` is refused and the default does not connect.
+fn mcp(args: &[String], safe_mode: bool) -> Result<(), String> {
     if help_requested(args, &["--connect", "--automation-read-root", "--automation-write-root"]) {
         return help();
     }
@@ -259,6 +278,9 @@ fn mcp(args: &[String]) -> Result<(), String> {
     if allow_grants && connect.is_some() {
         return Err("--allow-plugin-grants applies to the headless server; in a running app a person approves each plug-in".into());
     }
+    if safe_mode && connect.is_some() {
+        return Err("--safe-mode runs a headless session without plug-ins; a running app loads its own: start it with `vectorcraft --safe-mode --control <port>`".into());
+    }
     let read: Vec<&Path> = read_roots.iter().map(Path::new).collect();
     let write: Vec<&Path> = write_roots.iter().map(Path::new).collect();
     let roots = AutomationRoots::new(&read, &write)?;
@@ -271,7 +293,7 @@ fn mcp(args: &[String]) -> Result<(), String> {
         file_access::confine_process(roots.clone());
         eprintln!("vectorcraft-cli: files confined: {}", roots.describe());
         Box::new(accepting_grants(Headless::with_document().with_automation_roots(Some(roots)), allow_grants))
-    } else if headless || allow_grants {
+    } else if headless || safe_mode || allow_grants {
         Box::new(accepting_grants(with_stores(Headless::with_document()), allow_grants))
     } else if let Some(addr) = connect {
         // Explicit address: fail loudly if the app isn't there.
diff --git a/apps/vectorcraft-cli/src/perf.rs b/apps/vectorcraft-cli/src/perf.rs
index 3ff82512d..e533d00b7 100644
--- a/apps/vectorcraft-cli/src/perf.rs
+++ b/apps/vectorcraft-cli/src/perf.rs
@@ -64,6 +64,61 @@ fn median_ms(runs: usize, mut f: impl FnMut()) -> f64 {
     v.get(v.len() / 2).copied().unwrap_or(0.0)
 }
 
+/// Exercise the application's native save/open commands, including previews, PDF output,
+/// compression and API base64 conversion. Session setup and validation are outside timing.
+/// Five measured runs follow one warmup; no filesystem or GPU window is involved.
+fn native_io(doc: &Document) -> Result<(), String> {
+    for (label, compatible, preview) in [
+        ("default options", None, false),
+        ("PDF disabled", Some(false), false),
+        ("preview+gzip", None, true),
+        ("preview+gzip, PDF disabled", Some(false), true),
+    ] {
+        let mut session = vectorcraft_engine::Session::new();
+        session.add_document(doc.clone(), None);
+        let mut params = json!({"format":"vectorcraft","modified":null,"preview":preview,"compress":preview});
+        if let Some(value) = compatible {
+            params["pdfCompatible"] = json!(value);
+        }
+        let (mut saves, mut opens) = (Vec::new(), Vec::new());
+        let (mut size, mut has_pdf, mut compressed) = (0, false, false);
+        for run in 0..6 {
+            let start = Instant::now();
+            let saved = session.execute("file.saveAs", &params).map_err(|e| e.to_string())?;
+            let save_ms = start.elapsed().as_secs_f64() * 1000.0;
+            let data = saved["dataBase64"].as_str().ok_or("native save returned no dataBase64")?;
+            let bytes = vectorcraft_format::base64_decode(data).ok_or("native save returned invalid base64")?;
+            size = bytes.len();
+            has_pdf = vectorcraft_format::pdf_content(&bytes).is_some();
+            if compatible == Some(false) && has_pdf {
+                return Err("native save ignored the explicit PDF opt-out".into());
+            }
+            compressed = vectorcraft_format::is_compressed(&bytes);
+            if compressed != preview || vectorcraft_format::preview(&bytes).is_some() != preview {
+                return Err("native save did not apply the requested preview/compression options".into());
+            }
+            let args = json!({"name":"perf.vectorcraft","dataBase64":data});
+            let mut opened = vectorcraft_engine::Session::new();
+            let start = Instant::now();
+            opened.execute("document.open", &args).map_err(|e| e.to_string())?;
+            let open_ms = start.elapsed().as_secs_f64() * 1000.0;
+            if opened.doc().map_err(|e| e.to_string())?.doc.artboards.len() != doc.artboards.len() {
+                return Err("native round trip changed the artboard count".into());
+            }
+            if run > 0 {
+                saves.push(save_ms);
+                opens.push(open_ms);
+            }
+        }
+        saves.sort_by(f64::total_cmp);
+        opens.sort_by(f64::total_cmp);
+        let save = saves.get(2).copied().ok_or("no save measurements")?;
+        let open = opens.get(2).copied().ok_or("no open measurements")?;
+        outln!("  native {label}: save {save:.2} ms, open {open:.2} ms, {size} bytes, PDF {has_pdf}, compressed {compressed}");
+    }
+    Ok(())
+}
+
 /// 1-minute load average (macOS / Linux), if available.
 #[cfg(not(windows))]
 fn load_average() -> Option<f64> {
@@ -393,19 +448,36 @@ fn deep(n: usize) -> Result<(), String> {
 }
 
 pub fn run(args: &[String]) -> Result<(), String> {
-    if crate::help_requested(args, &["--paths"]) {
+    if crate::help_requested(args, &["--paths", "--artboards"]) {
         return crate::help();
     }
     let mut n = 50_000usize;
     let mut want_deep = false;
+    let mut want_native = false;
+    let mut artboards = None::<usize>;
     let mut it = args.iter();
     while let Some(a) = it.next() {
         match a.as_str() {
             "--deep" => want_deep = true,
+            "--native-io" => want_native = true,
+            "--artboards" => {
+                artboards =
+                    Some(it.next().and_then(|v| v.parse().ok()).filter(|n| (1..=4).contains(n)).ok_or("--artboards needs a number from 1 to 4")?)
+            }
             "--paths" => n = it.next().and_then(|v| v.parse().ok()).ok_or("--paths needs a number")?,
             other => return Err(format!("unknown perf option `{other}`")),
         }
     }
+    if want_native && n > 50_000 {
+        return Err("--native-io allows at most 50000 paths".into());
+    }
+    if want_native && want_deep {
+        return Err("--native-io and --deep are separate measurement modes".into());
+    }
+    if artboards.is_some() && !want_native {
+        return Err("--artboards requires --native-io".into());
+    }
+    let artboards = artboards.unwrap_or(1);
     let cores = std::thread::available_parallelism().map_or(1, |c| c.get());
     // The figure is the 1-minute load average, or on Windows the cores busy over one second.
     #[cfg(not(windows))]
@@ -418,8 +490,20 @@ pub fn run(args: &[String]) -> Result<(), String> {
         outln!("WARNING: the machine is busy; wall-clock timings below are not trustworthy.");
     }
     let t = Instant::now();
-    let doc = synthetic(n)?;
+    let mut doc = synthetic(n)?;
     outln!("  (built in {:.0} ms)", t.elapsed().as_secs_f64() * 1000.0);
+    if want_native {
+        let first = doc.artboards.first().cloned().ok_or("synthetic document has no artboard")?;
+        // Overlapping artboards intentionally repeat the same paths on every PDF page.
+        for index in 1..artboards {
+            let mut page = first.clone();
+            page.id = first.id.checked_add(index as u32).ok_or("artboard id overflow")?;
+            page.name = format!("Perf {}", index + 1);
+            doc.artboards.push(page);
+        }
+        outln!("  application native I/O: {artboards} overlapping artboard(s), one warmup + five samples; medians; no disk I/O");
+        return native_io(&doc);
+    }
 
     let mut rows: Vec<(&str, f64, f64)> = vec![];
     let opts = RenderOptions::default();
@@ -513,6 +597,24 @@ pub fn run(args: &[String]) -> Result<(), String> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn native_io_exercises_the_application_save_and_open_commands() {
+        native_io(&synthetic(3).unwrap()).unwrap();
+    }
+
+    #[test]
+    fn native_io_rejects_conflicting_modes_and_excessive_workloads() {
+        for (args, expected) in [
+            (vec!["--native-io", "--deep"], "separate measurement modes"),
+            (vec!["--native-io", "--paths", "50001"], "at most 50000"),
+            (vec!["--native-io", "--artboards", "5"], "1 to 4"),
+            (vec!["--artboards", "1"], "requires --native-io"),
+            (vec!["--artboards", "2"], "requires --native-io"),
+        ] {
+            assert!(run(&args.into_iter().map(str::to_owned).collect::<Vec<_>>()).unwrap_err().contains(expected));
+        }
+    }
+
     #[test]
     fn busy_share_leaves_out_idle_time() {
         // In one second four processors log 40,000,000 ticks of 100 ns of kernel and user time,
diff --git a/apps/vectorcraft-cli/tests/it/cli.rs b/apps/vectorcraft-cli/tests/it/cli.rs
index 8053737b9..e7853700f 100644
--- a/apps/vectorcraft-cli/tests/it/cli.rs
+++ b/apps/vectorcraft-cli/tests/it/cli.rs
@@ -308,6 +308,22 @@ fn mcp_headless_over_stdio() {
     assert_eq!(replies[3]["result"]["content"][0]["type"], "image");
 }
 
+/// `--safe-mode mcp` serves a headless session without plug-ins: it refuses `--connect`, and by
+/// default it does not connect to an app listening on the default address, which loads its own
+/// plug-ins.
+#[test]
+fn safe_mode_mcp_does_not_connect_to_a_running_app() {
+    let out = Command::new(BIN).args(["--safe-mode", "mcp", "--connect", "127.0.0.1:9"]).env("VECTORCRAFT_NO_PREFS", "1").output().unwrap();
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(!out.status.success() && err.contains("--safe-mode runs a headless session"), "{err}");
+    // Something listening on the default address, as a running app does; a running app or another
+    // program already holding it serves as well.
+    let _app = std::net::TcpListener::bind(vectorcraft_mcp::DEFAULT_ADDR);
+    let out = Command::new(BIN).args(["--safe-mode", "mcp"]).env("VECTORCRAFT_NO_PREFS", "1").stdin(Stdio::null()).output().unwrap();
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(out.status.success() && err.contains("MCP server on stdio (headless)"), "{err}");
+}
+
 /// `mcp --automation-read-root` / `--automation-write-root` (#832): the flags are checked before the
 /// server starts, and the process then reads and writes only inside its roots.
 #[test]
diff --git a/apps/vectorcraft/src/app.rs b/apps/vectorcraft/src/app.rs
index 3d9fef45c..2dfc4e6f4 100644
--- a/apps/vectorcraft/src/app.rs
+++ b/apps/vectorcraft/src/app.rs
@@ -8,6 +8,7 @@ use super::windows_stylus;
 use super::{App, VectorcraftApp, file_access, window};
 #[cfg(target_os = "macos")]
 use super::{mac_menu, mac_window, open_documents};
+use vectorcraft_ui_egui::dialogs::safe_mode;
 
 /// The parts of [`App::raw_input_hook`] that every window needs, for the OS windows of floating
 /// panels: a click or Escape that closes the macOS menu bar's open menu, and the pen barrel
@@ -113,16 +114,26 @@ impl App {
             vectorcraft_ui_egui::background::wait_all(&mut self.app);
             return;
         }
+        // An app that stays in Safe Mode leaves later launches to start their own app with plug-ins.
+        #[cfg(not(target_os = "macos"))]
+        if safe_mode::staying_on(&self.app) {
+            single_instance::resign();
+        }
         // Files from the Finder and the Dock (macOS) or from later launches (#4892) wait while a file
-        // dialog is open: what asked for it runs again on its document when it answers.
-        if !self.app.file_dialog_open() {
+        // dialog is open: what asked for it runs again on its document when it answers. They also
+        // wait for the choice about a stopped plug-in, so they open after the plug-ins it loads, as
+        // do the command line's files held back for it. Files later launches handed over before the
+        // choice ended in Safe Mode open in a new app with plug-ins.
+        if !self.app.file_dialog_open() && !safe_mode::choosing(&self.app) {
+            let held = std::mem::take(&mut self.held_files);
             #[cfg(target_os = "macos")]
             let files = open_documents::take();
             #[cfg(not(target_os = "macos"))]
-            let files = single_instance::take();
+            let files = single_instance::take_for_frame(safe_mode::staying_on(&self.app), single_instance::launch_with_plug_ins);
             if !files.is_empty() {
                 bring_window_forward(ctx);
             }
+            open_files(&mut self.app, held);
             open_files(&mut self.app, files);
         }
         let (now, zoom) = (ctx.input(|i| i.time), ctx.zoom_factor());
@@ -151,13 +162,15 @@ impl App {
 /// On macOS with accessibility, end the process once the app has saved what it keeps on quitting,
 /// before eframe tears the window down (#661). AccessKit then gives the window's content view back
 /// its own class, which AppKit's Touch Bar support was observing it under, and AppKit aborts the
-/// app as it quits on Macs with a Touch Bar. Nothing after the window is needed on a normal quit.
+/// app as it quits on Macs with a Touch Bar. On a normal quit, only the launch marker is needed
+/// after the window, so it is ended here as `main` ends it after the window on other platforms.
 /// Not while the window is still starting up (`frames` below [`gpu::STARTUP_FRAMES`]): a graphics
 /// failure then starts the app again on another adapter (#651).
 #[allow(unused_variables)]
 fn end_before_teardown(frames: u64) {
     #[cfg(all(target_os = "macos", feature = "accessibility", feature = "wgpu"))]
     if frames >= gpu::STARTUP_FRAMES {
+        safe_mode::end_launch();
         log::info!("quitting");
         log::logger().flush();
         std::process::exit(0);
@@ -172,6 +185,16 @@ pub(crate) fn bring_window_forward(ctx: &egui::Context) {
     ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
 }
 
+/// Open the command line's `files` now, or, while the choice about a stopped plug-in is up
+/// ([`safe_mode::choosing`]), return them to open once it is made, with the plug-ins it loads.
+pub(crate) fn open_or_hold(app: &mut VectorcraftApp, files: Vec<String>) -> Vec<String> {
+    if safe_mode::choosing(app) {
+        return files;
+    }
+    open_files(app, files);
+    Vec::new()
+}
+
 /// Open files handed to the app (command line, macOS Finder and Dock, later launches) as documents. A file that
 /// can't be opened is reported to the user and on stderr; the others still open.
 pub(crate) fn open_files(app: &mut VectorcraftApp, files: Vec<String>) {
diff --git a/apps/vectorcraft/src/main.rs b/apps/vectorcraft/src/main.rs
index 112c71370..b3a1fd06b 100644
--- a/apps/vectorcraft/src/main.rs
+++ b/apps/vectorcraft/src/main.rs
@@ -1,7 +1,10 @@
 //! VectorCraft desktop app.
 //!
 //! Usage: `vectorcraft [--control <port> [--automation-read-root <dir>]... [--automation-write-root <dir>]...]
-//! [--in-window-menus] [--new-instance] [files…]`, `vectorcraft --version`, `vectorcraft --help` (or `-h`)
+//! [--in-window-menus] [--new-instance] [--safe-mode] [--] [files…]`, `vectorcraft --version`, `vectorcraft --help` (or `-h`)
+//!
+//! Any other argument starting with '-' (not `-` alone) is an error; after `--`, every argument is
+//! a file.
 //!
 //! Files given while VectorCraft already runs open in that window, unless `--new-instance` is given
 //! (Windows and Linux; `single_instance`).
@@ -65,6 +68,7 @@ mod xwayland;
 use vectorcraft_engine::Session;
 use vectorcraft_engine::cmd::fileio;
 use vectorcraft_engine::file_access::{self, AutomationRoots};
+use vectorcraft_ui_egui::dialogs::safe_mode;
 use vectorcraft_ui_egui::graphics::GraphicsLoss;
 use vectorcraft_ui_egui::picks::PickRequest;
 use vectorcraft_ui_egui::{ClipboardProbeFactory, FilePick, Services, VectorcraftApp};
@@ -77,7 +81,7 @@ mod titlebar;
 #[cfg(all(test, feature = "wgpu"))]
 use app::bring_window_forward;
 use app::native_input_hook;
-use app::open_files;
+use app::open_or_hold;
 use host_services::services;
 #[cfg(all(test, feature = "wgpu"))]
 use prefs::{KEEP_UI_PREFS, decode_saved_prefs, keep_prefs_copy, prefs_bytes};
@@ -92,7 +96,9 @@ use titlebar::custom_titlebar_from;
 use titlebar::opted_into_system_title_bar;
 #[cfg(windows)]
 use titlebar::set_taskbar_icon;
-use titlebar::{custom_titlebar, native_options};
+#[cfg(all(test, feature = "wgpu"))]
+use titlebar::{app_draws_frame, opted_into_app_title_bar, start_frame};
+use titlebar::{custom_titlebar, native_options, titlebar_from_env};
 
 struct App {
     app: VectorcraftApp,
@@ -111,6 +117,8 @@ struct App {
     pending_maximize: bool,
     /// Frames left to retry [`window::apply_pending_maximize`].
     maximize_tries: u8,
+    /// The command line's files, held back until the choice about a stopped plug-in is made.
+    held_files: Vec<String>,
     /// The time and UI zoom of the last monitor list ([`window::monitors_due`]).
     monitors_listed: Option<(f64, f32)>,
 }
@@ -132,13 +140,89 @@ Options:
                                  (or VECTORCRAFT_IN_WINDOW_MENUS=1)
   --new-instance                 Open the files in a new window even when VectorCraft
                                  already runs (Windows and Linux)
+  --safe-mode                    Start without plug-ins: none loads or runs until
+                                 VectorCraft starts normally (Help › Safe Mode); the
+                                 files open in a new window, as with --new-instance
   --version                     Print the version and exit
   -h, --help                     Print this help and exit
+  --                             Treat every argument after it as a file
+
+Any other argument starting with '-' is an error.
 
 Without a window (converting, scripting, the MCP server), use vectorcraft-cli:
   vectorcraft-cli --help
 ";
 
+/// The command line's options other than the automation roots and the control port.
+struct CommandLine {
+    files: Vec<String>,
+    in_window_menus: bool,
+    new_instance: bool,
+    /// `--safe-mode`: no plug-in loads or runs in this launch.
+    safe_mode: bool,
+}
+
+/// Reads the arguments after the program name. The automation roots and the control port go into
+/// `roots_args` and `control`. `Err` is the exit code when the process ends here: `--version` and
+/// `--help` print and succeed; a bad automation option or an unknown option prints an error and fails.
+fn read_command_line(
+    mut args: impl Iterator<Item = String>,
+    control: &mut automation_args::ControlArg,
+    roots_args: &mut automation_args::AutomationArgs,
+) -> Result<CommandLine, std::process::ExitCode> {
+    let mut files = Vec::new();
+    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
+    let mut new_instance = false;
+    let mut safe_mode = false;
+    let mut unknown = None;
+    while let Some(a) = args.next() {
+        // After `--`, every argument is a file, even one whose name starts with '-'.
+        if a == "--" {
+            files.extend(args.by_ref());
+            break;
+        }
+        match roots_args.consume(&a, &mut args).and_then(|root| if root { Ok(true) } else { control.consume(&a, &mut args) }) {
+            Ok(true) => continue,
+            Ok(false) => {}
+            Err(e) => {
+                eprintln!("vectorcraft: {e}");
+                return Err(std::process::ExitCode::FAILURE);
+            }
+        }
+        match a.as_str() {
+            "--in-window-menus" => in_window_menus = true,
+            "--new-instance" => new_instance = true,
+            "--safe-mode" => safe_mode = true,
+            "--version" => {
+                println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
+                return Err(std::process::ExitCode::SUCCESS);
+            }
+            // Before anything starts, like `--version`: from a terminal or an agent's shell the app
+            // used to open (or hang without a display) instead (#2110).
+            "--help" | "-h" => {
+                // Not `print!`, which panics when standard output is closed (`| head -0`):
+                // there is nothing left to tell then.
+                let _ = std::io::Write::write_all(&mut std::io::stdout(), USAGE.as_bytes());
+                return Err(std::process::ExitCode::SUCCESS);
+            }
+            // The process serial number older macOS versions pass to an app the Finder starts.
+            #[cfg(target_os = "macos")]
+            _ if a.starts_with("-psn_") => {}
+            // An option this version doesn't know (a typo such as `--safe-mod`) is an error, not a
+            // file to open. Reported after the loop, so a later `--help` or `--version` still wins.
+            _ if a.starts_with('-') && a != "-" => {
+                unknown.get_or_insert(a);
+            }
+            _ => files.push(a),
+        }
+    }
+    if let Some(a) = unknown {
+        eprintln!("vectorcraft: unknown option {a}; see vectorcraft --help, or put -- before a file whose name starts with '-'");
+        return Err(std::process::ExitCode::FAILURE);
+    }
+    Ok(CommandLine { files, in_window_menus, new_instance, safe_mode })
+}
+
 fn main() -> std::process::ExitCode {
     // Windows: the update helper is a copy of this program started with `--finish-update`.
     #[cfg(windows)]
@@ -154,37 +238,11 @@ fn main() -> std::process::ExitCode {
     let root_env = |name: &str| std::env::var_os(name).filter(|v| !v.is_empty()).map(std::path::PathBuf::from);
     let mut roots_args =
         automation_args::AutomationArgs::new(root_env("VECTORCRAFT_AUTOMATION_READ_ROOT"), root_env("VECTORCRAFT_AUTOMATION_WRITE_ROOT"));
-    let mut files = Vec::new();
-    let mut in_window_menus = std::env::var_os("VECTORCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
-    let mut new_instance = false;
-    let mut args = std::env::args().skip(1);
-    while let Some(a) = args.next() {
-        match roots_args.consume(&a, &mut args).and_then(|root| if root { Ok(true) } else { control.consume(&a, &mut args) }) {
-            Ok(true) => continue,
-            Ok(false) => {}
-            Err(e) => {
-                eprintln!("vectorcraft: {e}");
-                return std::process::ExitCode::FAILURE;
-            }
-        }
-        match a.as_str() {
-            "--in-window-menus" => in_window_menus = true,
-            "--new-instance" => new_instance = true,
-            "--version" => {
-                println!("vectorcraft {}", env!("CARGO_PKG_VERSION"));
-                return std::process::ExitCode::SUCCESS;
-            }
-            // Before anything starts, like `--version`: from a terminal or an agent's shell the app
-            // used to open (or hang without a display) instead (#2110).
-            "--help" | "-h" => {
-                // Not `print!`, which panics when standard output is closed (`| head -0`):
-                // there is nothing left to tell then.
-                let _ = std::io::Write::write_all(&mut std::io::stdout(), USAGE.as_bytes());
-                return std::process::ExitCode::SUCCESS;
-            }
-            _ => files.push(a),
-        }
-    }
+    let CommandLine { files, in_window_menus, new_instance, safe_mode: safe_mode_flag } =
+        match read_command_line(std::env::args().skip(1), &mut control, &mut roots_args) {
+            Ok(command_line) => command_line,
+            Err(code) => return code,
+        };
     let automation_args::AutomationArgs { read_roots, write_roots, .. } = roots_args;
     // After the arguments: `--control` and `--version` win over a bad environment value.
     let control_port = match control.port {
@@ -202,10 +260,10 @@ fn main() -> std::process::ExitCode {
     // Files opened from the file manager while VectorCraft runs open in its window (#4892). Before
     // the log file is attached: a launch that hands its files over leaves the running app's log be.
     #[cfg(not(target_os = "macos"))]
-    let instance = match single_instance::start(control_port.is_some(), new_instance, &files) {
+    match single_instance::start(control_port.is_some(), new_instance, safe_mode_flag, &files) {
         single_instance::Start::Forwarded => return std::process::ExitCode::SUCCESS,
-        single_instance::Start::Running(primary) => primary,
-    };
+        single_instance::Start::Running(primary) => single_instance::hold(primary),
+    }
     #[cfg(target_os = "macos")]
     let _ = new_instance;
     vectorcraft_ui_egui::i18n::detect_system_lang_in_background();
@@ -396,10 +454,15 @@ fn main() -> std::process::ExitCode {
                 let mut session = Session::new();
                 // The profiles loaded before come back before the preferences name any of them.
                 prefs_dir::attach_profile_store(&mut session);
+                // Before any plug-in loads: this launch's marker in the Launch folder next to the
+                // preferences (none for runs without preferences), and Safe Mode.
+                let launch_dir = prefs_path().filter(|_| prefs_enabled()).and_then(|p| Some(p.parent()?.join("Launch")));
+                let stopped = safe_mode::begin_launch(launch_dir.as_deref(), safe_mode_flag);
                 prefs_dir::attach_plugin_store(&mut session);
                 let mut app = VectorcraftApp::new(session, services(cc.winit_window().cloned(), cc.egui_ctx.clone()));
                 app.set_startup_update_check(true);
                 load_prefs(&mut app, saved);
+                safe_mode::after_start(&mut app, stopped);
                 // The saved PDF presets live in their own folder (also read by vectorcraft-cli),
                 // which takes over from the copy the preferences file used to hold.
                 prefs_dir::attach_pdf_preset_store(&mut app.session);
@@ -466,6 +529,7 @@ fn main() -> std::process::ExitCode {
                     let (loss, ctx) = (graphics_loss.clone(), cc.egui_ctx.clone());
                     rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
                 }
+                app.titlebar_from_env = titlebar_from_env();
                 app.custom_titlebar = custom_titlebar;
                 app.desktop_frame = !custom_titlebar;
                 if let Some(port) = control_port {
@@ -492,7 +556,7 @@ fn main() -> std::process::ExitCode {
                     single_instance::set_ui(&cc.egui_ctx);
                 }
                 app.services.native_input_hook = native_input_hook(&app);
-                file_access::unconfined(|| open_files(&mut app, files));
+                let held_files = file_access::unconfined(|| open_or_hold(&mut app, files));
                 // The first frame is due from now (`gpu::watch_first_frame`).
                 #[cfg(feature = "wgpu")]
                 created.ready();
@@ -508,6 +572,7 @@ fn main() -> std::process::ExitCode {
                     winit_window,
                     pending_maximize,
                     maximize_tries: 8,
+                    held_files,
                     monitors_listed: None,
                 }))
             }),
@@ -516,7 +581,9 @@ fn main() -> std::process::ExitCode {
     // The window is gone: later launches start their own app, including the one a graphics
     // failure starts again below.
     #[cfg(not(target_os = "macos"))]
-    drop(instance);
+    single_instance::resign();
+    // The process ends normally from here: this launch didn't stop while a plug-in was loading.
+    safe_mode::end_launch();
     #[cfg(feature = "wgpu")]
     let outcome = gpu::finish(outcome, &startup);
     #[cfg(not(feature = "wgpu"))]
diff --git a/apps/vectorcraft/src/single_instance.rs b/apps/vectorcraft/src/single_instance.rs
index 5ced4aef3..37a836f6f 100644
--- a/apps/vectorcraft/src/single_instance.rs
+++ b/apps/vectorcraft/src/single_instance.rs
@@ -12,8 +12,12 @@
 //! as its own app, which replaces a stale file. Nothing received is ever run.
 //!
 //! Runs that start many apps side by side (`--control`, `VECTORCRAFT_NO_PREFS`) neither forward
-//! nor listen, and `--new-instance` opens a launch's files in an app of its own. macOS hands files
-//! opened from Finder to the running app itself (`open_documents`), so this is off there.
+//! nor listen, and neither does a `--safe-mode` launch, which opens its files in an app of its own
+//! and leaves later launches to start theirs with plug-ins. `--new-instance` opens a launch's files
+//! in an app of its own. An app that stays in Safe Mode after the choice about a stopped plug-in
+//! stops listening ([`resign`]), and files later launches handed it before then open in a new app
+//! with plug-ins ([`take_for_frame`]). macOS hands files opened from Finder to the running app itself
+//! (`open_documents`), so this is off there.
 
 use std::fs::{self, OpenOptions};
 use std::hash::{BuildHasher as _, RandomState};
@@ -43,6 +47,8 @@ const CLIENT_TIMEOUT: Duration = Duration::from_secs(5);
 
 /// Paths handed over by later launches that the UI hasn't opened yet.
 static PENDING: Mutex<Vec<String>> = Mutex::new(Vec::new());
+/// This app while it is the one later launches hand their files to ([`hold`]).
+static HELD: Mutex<Option<Primary>> = Mutex::new(None);
 /// The UI to wake when files arrive (unset until the window exists; the first frame opens them).
 static UI: OnceLock<egui::Context> = OnceLock::new();
 
@@ -56,23 +62,46 @@ pub enum Start {
 
 /// Hand `files` to the app already running, or become the app later launches hand theirs to.
 /// `automation`: started with `--control`.
-pub fn start(automation: bool, new_instance: bool, files: &[String]) -> Start {
+pub fn start(automation: bool, new_instance: bool, safe_mode: bool, files: &[String]) -> Start {
     if automation || !prefs_enabled() {
         return Start::Running(None);
     }
     let Some(path) = prefs_path().and_then(|p| Some(p.parent()?.join(FILE_NAME))) else { return Start::Running(None) };
+    start_at(&path, new_instance, safe_mode, files)
+}
+
+/// [`start`] with the endpoint file `path`. A launch with `--new-instance` or `--safe-mode` keeps
+/// its files and runs as its own app: a running app would open them with its plug-ins loaded. A
+/// `--safe-mode` launch never becomes the app later launches hand their files to, which would open
+/// them without plug-ins.
+fn start_at(path: &Path, new_instance: bool, safe_mode: bool, files: &[String]) -> Start {
+    if safe_mode {
+        return Start::Running(None);
+    }
     // With nothing to hand over, the same exchange only asks whether an app is running.
     let send: &[String] = if new_instance { &[] } else { files };
-    match forward(&path, send) {
+    match forward(path, send) {
         Ok(()) if send.is_empty() => Start::Running(None),
         Ok(()) => Start::Forwarded,
         Err(e) => {
             log::debug!("no running VectorCraft to hand files to ({e})");
-            Start::Running(listen(&path, queue))
+            Start::Running(listen(path, queue))
         }
     }
 }
 
+/// Keep `primary` ([`start`]'s) until [`resign`].
+pub fn hold(primary: Option<Primary>) {
+    *HELD.lock().unwrap_or_else(PoisonError::into_inner) = primary;
+}
+
+/// Later launches start their own app from now on: the endpoint file goes. The app calls it when
+/// its window is gone, and when it stays in Safe Mode after the choice about a stopped plug-in.
+pub fn resign() {
+    let primary = HELD.lock().unwrap_or_else(PoisonError::into_inner).take();
+    drop(primary);
+}
+
 /// Wake `ctx` when files arrive from later launches.
 pub fn set_ui(ctx: &egui::Context) {
     // Set once; a second call would hand over the same context.
@@ -84,6 +113,43 @@ pub fn take() -> Vec<String> {
     std::mem::take(&mut *PENDING.lock().unwrap_or_else(PoisonError::into_inner))
 }
 
+/// The paths later launches handed over since the last call, to open in this app. An app that
+/// stays in Safe Mode (`safe_mode`) resigns and hands them to a new app with plug-ins (`launch`,
+/// [`launch_with_plug_ins`] in the app) instead: they arrived while it was the primary, before the
+/// choice about a stopped plug-in ended in Safe Mode, or just before it resigned. When `launch`
+/// fails (logged), they open here.
+pub fn take_for_frame(safe_mode: bool, launch: impl FnOnce(&[String]) -> io::Result<()>) -> Vec<String> {
+    let files = take();
+    if !safe_mode {
+        return files;
+    }
+    // First, so the new app becomes the primary instead of handing the files back.
+    resign();
+    if files.is_empty() {
+        return files;
+    }
+    match launch(&files) {
+        Ok(()) => Vec::new(),
+        Err(e) => {
+            log::warn!("couldn't start VectorCraft with plug-ins for the files another launch opened: {e}");
+            files
+        }
+    }
+}
+
+/// Start this program again, with plug-ins, on `files`.
+pub fn launch_with_plug_ins(files: &[String]) -> io::Result<()> {
+    app_with_plug_ins(&std::env::current_exe()?, files).spawn().map(drop)
+}
+
+/// The command [`launch_with_plug_ins`] runs: `exe -- files…`, so a file whose name starts with '-'
+/// stays a file.
+fn app_with_plug_ins(exe: &Path, files: &[String]) -> std::process::Command {
+    let mut command = std::process::Command::new(exe);
+    command.arg("--").args(files);
+    command
+}
+
 fn queue(files: Vec<String>) {
     PENDING.lock().unwrap_or_else(PoisonError::into_inner).extend(files);
     if let Some(ctx) = UI.get() {
@@ -263,6 +329,13 @@ mod tests {
 
     use super::*;
 
+    /// Held by the tests that use the process-wide [`HELD`] and [`PENDING`], one at a time.
+    static GLOBALS: Mutex<()> = Mutex::new(());
+
+    fn globals() -> std::sync::MutexGuard<'static, ()> {
+        GLOBALS.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
     struct TestDir(tempfile::TempDir);
 
     impl std::ops::Deref for TestDir {
@@ -313,6 +386,72 @@ mod tests {
         assert!(!path.exists(), "the endpoint file goes with the app");
     }
 
+    #[test]
+    fn a_new_instance_or_safe_mode_launch_keeps_its_files() {
+        let (path, _dir, file) = folder("own");
+        let (primary, rx) = primary(&path);
+        for (new_instance, safe_mode) in [(true, false), (false, true)] {
+            let start = start_at(&path, new_instance, safe_mode, std::slice::from_ref(&file));
+            assert!(matches!(start, Start::Running(None)), "runs as its own app (new instance {new_instance}, Safe Mode {safe_mode})");
+        }
+        assert!(matches!(start_at(&path, false, false, std::slice::from_ref(&file)), Start::Forwarded));
+        assert_eq!(rx.recv_timeout(CLIENT_TIMEOUT).unwrap(), std::slice::from_ref(&file));
+        assert!(rx.try_recv().is_err(), "only the plain launch handed its file over");
+        drop(primary);
+    }
+
+    #[test]
+    fn a_safe_mode_launch_leaves_later_launches_their_own_app() {
+        let _globals = globals();
+        let (path, _dir, file) = folder("safe-mode-alone");
+        // With no app running, a Safe Mode launch runs without listening.
+        assert!(matches!(start_at(&path, false, true, std::slice::from_ref(&file)), Start::Running(None)));
+        assert!(!path.exists(), "a Safe Mode launch records no endpoint");
+        // A plain launch after it starts its own app and takes later launches' files.
+        let Start::Running(Some(primary)) = start_at(&path, false, false, std::slice::from_ref(&file)) else {
+            panic!("the plain launch runs and listens")
+        };
+        assert!(path.exists());
+        // An app that stays in Safe Mode after the choice gives that up.
+        hold(Some(primary));
+        resign();
+        assert!(!path.exists(), "the endpoint file goes with resign");
+    }
+
+    #[test]
+    fn files_handed_to_an_app_staying_in_safe_mode_go_to_a_new_app_with_plug_ins() {
+        let _globals = globals();
+        // Nothing left over from a test that failed.
+        resign();
+        drop(take());
+        let (path, _dir, file) = folder("safe-mode-later");
+        let Start::Running(Some(primary)) = start_at(&path, false, false, &[]) else { panic!("the first launch listens") };
+        hold(Some(primary));
+        // A later launch handed its file over while the choice about a stopped plug-in was up.
+        queue(vec![file.clone()]);
+        let mut launched = Vec::new();
+        let here = take_for_frame(true, |files| {
+            launched = files.to_vec();
+            Ok(())
+        });
+        assert!(here.is_empty(), "nothing opens in the Safe Mode app");
+        assert_eq!(launched, std::slice::from_ref(&file), "a new app with plug-ins opens it");
+        assert!(!path.exists(), "the app resigned before starting the new one");
+        // When the new app can't start, the file opens here rather than being lost.
+        queue(vec![file.clone()]);
+        assert_eq!(take_for_frame(true, |_| Err(io::Error::other("no program"))), std::slice::from_ref(&file));
+        // An app with plug-ins opens what it is handed.
+        queue(vec![file.clone()]);
+        assert_eq!(take_for_frame(false, |_| panic!("no new app")), [file]);
+    }
+
+    #[test]
+    fn the_new_app_takes_every_name_as_a_file() {
+        let command = app_with_plug_ins(Path::new("vectorcraft"), &["-a.svg".to_owned(), "b.svg".to_owned()]);
+        let args: Vec<_> = command.get_args().collect();
+        assert_eq!(args, ["--", "-a.svg", "b.svg"]);
+    }
+
     #[test]
     fn a_wrong_token_garbage_and_oversized_messages_are_refused() {
         let (path, _dir, file) = folder("refused");
diff --git a/apps/vectorcraft/src/tests.rs b/apps/vectorcraft/src/tests.rs
index 116651fc8..555d829e0 100644
--- a/apps/vectorcraft/src/tests.rs
+++ b/apps/vectorcraft/src/tests.rs
@@ -36,6 +36,33 @@ fn shortcut_overrides_from_an_earlier_version_load() {
     assert!(km.problems().iter().any(|p| format!("{p:?}") == r#"UnknownCommand { key: "test.unknown" }"#), "reported");
 }
 
+/// The command line's files wait for the choice about a stopped plug-in, so they open with the
+/// plug-ins it loads; with no choice up they open at once.
+#[test]
+fn command_line_files_wait_for_the_choice_about_a_stopped_plug_in() {
+    let temp = tempfile::Builder::new().prefix("vectorcraft-held-files-").tempdir().unwrap();
+    let file = temp.path().join("a.svg");
+    std::fs::write(&file, r#"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"/>"#).unwrap();
+    let files = vec![file.to_string_lossy().into_owned()];
+    // The files the app reads to open them.
+    let read = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
+    let reads = read.clone();
+    let services = vectorcraft_ui_egui::Services {
+        read: Some(Box::new(move |p: &str| {
+            reads.borrow_mut().push(p.to_owned());
+            std::fs::read(p).map_err(|e| e.to_string())
+        })),
+        ..Default::default()
+    };
+    let mut app = VectorcraftApp::new(vectorcraft_engine::Session::new(), services);
+    app.ui.stopped_plugin = Some(serde_json::json!({"id": "test.held", "name": "Held"}));
+    assert_eq!(open_or_hold(&mut app, files.clone()), files, "held while the choice is up");
+    assert!(read.borrow().is_empty(), "nothing opened before the choice");
+    app.ui.stopped_plugin = None;
+    assert!(open_or_hold(&mut app, files.clone()).is_empty());
+    assert_eq!(*read.borrow(), files, "opened with no choice up");
+}
+
 #[test]
 fn opening_files_unminimizes_and_focuses_the_window() {
     let ctx = egui::Context::default();
@@ -164,6 +191,60 @@ fn the_system_title_bar_preference_keeps_the_window_decorations() {
     assert_eq!(super::native_options(true).viewport.decorations, Some(false));
 }
 
+/// Preferences › User Interface › VectorCraft Title Bar on Every Desktop gives the app frame where
+/// the probe chose the desktop's (KDE, X11, a window opened through XWayland); without it the probe
+/// decides, and `VECTORCRAFT_TITLEBAR` takes precedence over both.
+#[test]
+fn the_app_title_bar_preference_gives_the_app_frame_on_desktop_frames() {
+    assert!(!super::opted_into_app_title_bar(None), "no preferences: the default");
+    let off = ui_state_with_prefs(serde_json::json!({"appTitleBar": false}));
+    assert!(!super::opted_into_app_title_bar(Some(&off)));
+    let on = ui_state_with_prefs(serde_json::json!({"appTitleBar": true}));
+    assert!(super::opted_into_app_title_bar(Some(&on)));
+
+    // (probed_app, overridden, forced_to_x11): without the preference, then with it.
+    let cases = [
+        ((false, None, false), false, true),        // KDE, Sway, X11: the desktop frame
+        ((true, None, false), true, true),          // GNOME on Wayland: the app frame either way
+        ((true, None, true), false, true),          // GNOME, the window opened through XWayland
+        ((false, Some(true), false), true, true),   // VECTORCRAFT_TITLEBAR=app
+        ((false, Some(true), true), true, true),    // VECTORCRAFT_TITLEBAR=app, the window opened through XWayland
+        ((true, Some(false), false), false, false), // VECTORCRAFT_TITLEBAR=desktop takes precedence over the preference
+        ((false, Some(false), true), false, false),
+    ];
+    for ((probed_app, overridden, forced_to_x11), without, with) in cases {
+        assert_eq!(super::app_draws_frame(probed_app, overridden, forced_to_x11, false), without, "{probed_app} {overridden:?} {forced_to_x11}");
+        assert_eq!(super::app_draws_frame(probed_app, overridden, forced_to_x11, true), with, "{probed_app} {overridden:?} {forced_to_x11}");
+    }
+}
+
+/// The frame a start uses: the preference turns the desktop frame the probe chose into the app frame
+/// with the default window buttons, a probed app frame keeps its own buttons, and the desktop frame
+/// stays where the app frame is not drawn. System Title Bar takes precedence over the preference.
+#[test]
+fn the_start_frame_applies_the_app_title_bar_preference() {
+    use craft_window::{Button, Frame, Layout};
+    let gnome = Layout { left: vec![Button::Close], right: vec![] };
+    let cases = [
+        // (probed, overridden, forced_to_x11, opted_into_app), expected
+        ((Frame::Desktop, None, false, false), Frame::Desktop),
+        ((Frame::Desktop, None, false, true), Frame::App(Layout::default())),
+        ((Frame::Desktop, None, true, true), Frame::App(Layout::default())),
+        ((Frame::App(gnome.clone()), None, false, false), Frame::App(gnome.clone())),
+        ((Frame::App(gnome.clone()), None, true, false), Frame::Desktop),
+        ((Frame::App(gnome.clone()), None, true, true), Frame::App(gnome.clone())),
+        ((Frame::Desktop, Some(false), false, true), Frame::Desktop),
+        ((Frame::App(gnome.clone()), Some(true), true, false), Frame::App(gnome.clone())),
+    ];
+    for ((probed, overridden, forced_to_x11, opted_into_app), expected) in cases {
+        let label = format!("{probed:?} {overridden:?} {forced_to_x11} {opted_into_app}");
+        assert_eq!(super::start_frame(probed, overridden, forced_to_x11, opted_into_app), expected, "{label}");
+    }
+    // With both preferences on, System Title Bar takes precedence: the desktop draws the frame.
+    let both = super::start_frame(Frame::Desktop, None, false, true);
+    assert!(!super::custom_titlebar_from(&both, true), "System Title Bar takes precedence over the app title bar preference");
+}
+
 /// The file extensions the macOS bundle declares: its document types and its own exported type.
 fn plist_extensions(plist: &str) -> Vec<&str> {
     ["<key>CFBundleTypeExtensions</key>", "<key>public.filename-extension</key>"]
diff --git a/apps/vectorcraft/src/titlebar.rs b/apps/vectorcraft/src/titlebar.rs
index 63c9f7c13..6e7451ed9 100644
--- a/apps/vectorcraft/src/titlebar.rs
+++ b/apps/vectorcraft/src/titlebar.rs
@@ -46,6 +46,53 @@ pub(crate) fn opted_into_system_title_bar(saved: Option<&vectorcraft_ui_egui::Ui
     saved.map(|ui| ui.engine_prefs.get("systemTitleBar").and_then(serde_json::Value::as_bool).unwrap_or(false)).unwrap_or(false)
 }
 
+/// Whether the user asked for VectorCraft's own title bar in Preferences › User Interface ›
+/// VectorCraft Title Bar on Every Desktop (Linux and the BSDs). Read like
+/// [`opted_into_system_title_bar`]; a missing or unreadable value is `false` (the default).
+pub(crate) fn opted_into_app_title_bar(saved: Option<&vectorcraft_ui_egui::UiState>) -> bool {
+    saved.map(|ui| ui.engine_prefs.get("appTitleBar").and_then(serde_json::Value::as_bool).unwrap_or(false)).unwrap_or(false)
+}
+
+/// Whether the app draws the frame on this start, before the System Title Bar preference is
+/// applied ([`custom_titlebar_from`]). `probed_app` is the `craft-window` probe's answer and
+/// `overridden` its `VECTORCRAFT_TITLEBAR` override. In order: the override decides when it is
+/// set; VectorCraft Title Bar on Every Desktop (`opted_into_app`) gives the app frame; a window
+/// that opens through XWayland (`forced_to_x11`) gets the desktop frame; otherwise the probe
+/// decides.
+pub(crate) fn app_draws_frame(probed_app: bool, overridden: Option<bool>, forced_to_x11: bool, opted_into_app: bool) -> bool {
+    match overridden {
+        Some(app) => app,
+        None => opted_into_app || (probed_app && !forced_to_x11),
+    }
+}
+
+/// The frame this start uses, before the System Title Bar preference is applied
+/// ([`custom_titlebar_from`]): [`app_draws_frame`] applied to the frame the probe chose. A probed
+/// app frame keeps its window-button layout; an app frame the probe did not choose gets the default
+/// layout, since `custom_titlebar_from` reads only which frame it is.
+pub(crate) fn start_frame(probed: craft_window::Frame, overridden: Option<bool>, forced_to_x11: bool, opted_into_app: bool) -> craft_window::Frame {
+    let probed_app = matches!(probed, craft_window::Frame::App(_));
+    match (app_draws_frame(probed_app, overridden, forced_to_x11, opted_into_app), probed) {
+        (true, frame @ craft_window::Frame::App(_)) => frame,
+        (true, craft_window::Frame::Desktop) => craft_window::Frame::App(craft_window::Layout::default()),
+        (false, _) => craft_window::Frame::Desktop,
+    }
+}
+
+/// The `craft-window` probe's answer for this process (its override variable is
+/// `VECTORCRAFT_TITLEBAR`). The probe runs once; on a Wayland session it opens a connection.
+fn probed_choice() -> &'static craft_window::Choice {
+    static CHOICE: std::sync::OnceLock<craft_window::Choice> = std::sync::OnceLock::new();
+    CHOICE.get_or_init(|| craft_window::Choice::probe(craft_window::Prefix::new("VECTORCRAFT")))
+}
+
+/// Whether `VECTORCRAFT_TITLEBAR` chose this window's frame (Linux and the BSDs), so Preferences ›
+/// User Interface › VectorCraft Title Bar on Every Desktop does not apply while it is set. Always
+/// `false` on macOS and Windows.
+pub(crate) fn titlebar_from_env() -> bool {
+    cfg!(not(any(target_os = "macos", target_os = "windows"))) && probed_choice().overridden().is_some()
+}
+
 /// Whether this start draws its own title bar, given the frame the shared `craft-window` crate
 /// decided and the user's System Title Bar preference.
 ///
@@ -82,24 +129,27 @@ pub(crate) fn custom_titlebar_from(_frame: &craft_window::Frame, opted_into_syst
 /// On Linux, Preferences › Performance › Linux Display Server › X11 opens the window through
 /// XWayland (below). A GNOME/Wayland probe would say `Frame::App` there, but the window really runs
 /// on X11, whose window manager draws the frame — so when XWayland is being forced, keep the native
-/// frame, the same as a real X11 session. An explicit `VECTORCRAFT_TITLEBAR` override still wins.
+/// frame, the same as a real X11 session. An explicit `VECTORCRAFT_TITLEBAR` override still wins,
+/// and so does VectorCraft Title Bar on Every Desktop ([`app_draws_frame`]).
 pub(crate) fn custom_titlebar(saved: Option<&vectorcraft_ui_egui::UiState>) -> bool {
-    let choice = craft_window::Choice::probe(craft_window::Prefix::new("VECTORCRAFT"));
+    let choice = probed_choice();
     let opted_into_system = opted_into_system_title_bar(saved);
+    // macOS and Windows never read VectorCraft Title Bar on Every Desktop (`custom_titlebar_from`
+    // ignores the frame there).
+    let opted_into_app = cfg!(not(any(target_os = "macos", target_os = "windows"))) && opted_into_app_title_bar(saved);
     #[cfg(target_os = "linux")]
-    {
+    // When the window will actually open on X11 (XWayland) — the user asked for it *and* the X11
+    // libraries are present, the same two conditions the launch path checks below — that run is
+    // effectively X11, so keep the native frame. If the libraries are missing, startup stays on
+    // Wayland, so the probe's own decision (app-drawn on GNOME) must stand.
+    let forced_to_x11 = {
         let pref = saved.and_then(|ui| ui.engine_prefs.get("linuxDisplayServer")).and_then(serde_json::Value::as_str);
-        // `overridden() == None` means the probe decided (no VECTORCRAFT_TITLEBAR). When the window
-        // will actually open on X11 (XWayland) — the user asked for it *and* the X11 libraries are
-        // present, the same two conditions the launch path checks below — that run is effectively
-        // X11, so keep the native frame. If the libraries are missing, startup stays on Wayland, so
-        // the probe's own decision (app-drawn on GNOME) must stand.
-        let forced_to_x11 = xwayland::wanted(pref, |name| std::env::var_os(name), xwayland::pen_attached) && xwayland::x11_libraries_found();
-        if choice.overridden().is_none() && forced_to_x11 {
-            return custom_titlebar_from(&craft_window::Frame::Desktop, opted_into_system);
-        }
-    }
-    custom_titlebar_from(choice.frame(), opted_into_system)
+        xwayland::wanted(pref, |name| std::env::var_os(name), xwayland::pen_attached) && xwayland::x11_libraries_found()
+    };
+    #[cfg(not(target_os = "linux"))]
+    let forced_to_x11 = false;
+    let frame = start_frame(choice.frame().clone(), choice.overridden(), forced_to_x11, opted_into_app);
+    custom_titlebar_from(&frame, opted_into_system)
 }
 
 pub(crate) fn native_options(custom_titlebar: bool) -> eframe::NativeOptions {
diff --git a/apps/vectorcraft/tests/it/help.rs b/apps/vectorcraft/tests/it/help.rs
index 059b9c476..ece66b98a 100644
--- a/apps/vectorcraft/tests/it/help.rs
+++ b/apps/vectorcraft/tests/it/help.rs
@@ -54,7 +54,7 @@ fn prints_usage(args: &[&str], env: &[(&str, &str)]) {
     assert!(out.status.success(), "{args:?}: {}", String::from_utf8_lossy(&out.stderr));
     assert!(out.stderr.is_empty(), "{args:?}: {}", String::from_utf8_lossy(&out.stderr));
     assert!(stdout.starts_with("Usage: vectorcraft "), "{args:?}: {stdout}");
-    for flag in ["--control", "--automation-read-root", "--automation-write-root", "--in-window-menus", "--version", "--help"] {
+    for flag in ["--control", "--automation-read-root", "--automation-write-root", "--in-window-menus", "--safe-mode", "--version", "--help"] {
         assert!(stdout.contains(flag), "{args:?}: usage doesn't mention {flag}: {stdout}");
     }
     // Headless work is the CLI's: the usage says where to go.
@@ -74,3 +74,27 @@ fn help_prints_usage_and_exits_before_startup() {
 fn help_wins_over_a_bad_control_port_variable() {
     prints_usage(&["--help"], &[("VECTORCRAFT_CONTROL_PORT", "abc")]);
 }
+
+/// An option the app doesn't know (a typo of `--safe-mode`) is an error, not a file to open with
+/// plug-ins; a later `--help` still wins.
+#[test]
+fn an_unknown_option_is_an_error_and_not_a_file() {
+    for args in [&["--safe-mod"][..], &["drawing.svg", "--safe-mod"], &["-x"]] {
+        let out = run(args, &[]);
+        assert!(!out.status.success(), "{args:?}");
+        assert!(out.stdout.is_empty(), "{args:?}");
+        let stderr = String::from_utf8(out.stderr).unwrap();
+        let unknown = args.iter().find(|a| a.starts_with('-')).unwrap();
+        assert_eq!(
+            stderr,
+            format!("vectorcraft: unknown option {unknown}; see vectorcraft --help, or put -- before a file whose name starts with '-'\n"),
+            "{args:?}"
+        );
+    }
+    prints_usage(&["--safe-mod", "--help"], &[]);
+    // After `--`, a name starting with '-' is a file: the run goes on to the control port, which
+    // `run` makes fail.
+    let out = run(&["--", "-x.svg"], &[]);
+    let stderr = String::from_utf8(out.stderr).unwrap();
+    assert!(stderr.contains("VECTORCRAFT_CONTROL_PORT") && !stderr.contains("unknown option"), "{stderr}");
+}
diff --git a/crates/cad/src/lib.rs b/crates/cad/src/lib.rs
index 3fc4bcb3b..603521160 100644
--- a/crates/cad/src/lib.rs
+++ b/crates/cad/src/lib.rs
@@ -308,6 +308,78 @@ impl Default for DxfOptions {
     }
 }
 
+/// A named set of DXF options (the `dxfPreset` param): the options it sets, and the ones a set of
+/// options matches.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum DxfPreset {
+    /// The options as chosen (the export's defaults for those left out).
+    #[default]
+    Custom,
+    /// For CNC and CAM cutting software: version 2000 (the oldest version that has both lightweight
+    /// polylines and lineweights), 1 mm = 1 unit, 256 indexed colors (all version 2000 holds), Maximize
+    /// Editability with Alter Paths off (every stroke a center line), Outline Text (type as paths),
+    /// and placed images as PNG.
+    Cnc,
+}
+
+impl DxfPreset {
+    pub const ALL: [Self; 2] = [Self::Custom, Self::Cnc];
+
+    /// The `dxfPreset` param value.
+    pub fn id(self) -> &'static str {
+        match self {
+            Self::Custom => "custom",
+            Self::Cnc => "cnc",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Custom => "Custom",
+            Self::Cnc => "CNC / CAM",
+        }
+    }
+
+    /// A preset by id (`custom`, `cnc`), any case.
+    pub fn from_id(s: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|p| s.trim().eq_ignore_ascii_case(p.id()))
+    }
+
+    /// The options the preset sets (Custom: the defaults); the region and crop are the defaults.
+    pub fn options(self) -> DxfOptions {
+        match self {
+            Self::Custom => DxfOptions::default(),
+            Self::Cnc => DxfOptions {
+                version: DxfVersion::R2000,
+                unit: Unit::Millimeters,
+                scale: 1.0,
+                scale_lineweights: false,
+                colors: ColorDepth::Aci256,
+                raster: RasterFormat::Png,
+                preserve: Preserve::Editability,
+                alter_paths: false,
+                outline_text: true,
+                ..DxfOptions::default()
+            },
+        }
+    }
+
+    /// The preset `o` matches: CNC / CAM when every option it sets is as it sets it, else Custom.
+    pub fn of(o: &DxfOptions) -> Self {
+        let c = Self::Cnc.options();
+        let same = o.version == c.version
+            && o.unit == c.unit
+            && o.scale == c.scale
+            && o.scale_lineweights == c.scale_lineweights
+            && o.colors == c.colors
+            && o.raster == c.raster
+            && o.preserve == c.preserve
+            && o.alter_paths == c.alter_paths
+            && o.outline_text == c.outline_text;
+        if same { Self::Cnc } else { Self::Custom }
+    }
+}
+
 /// An image file a drawing links to, to be written next to it under `name`.
 #[derive(Clone, Debug)]
 pub struct DxfImage {
diff --git a/crates/cad/src/tests.rs b/crates/cad/src/tests.rs
index d99858511..5c57fa634 100644
--- a/crates/cad/src/tests.rs
+++ b/crates/cad/src/tests.rs
@@ -823,6 +823,30 @@ fn units_scale_coordinates_and_set_insunits() {
     assert!(export(&d, &DxfOptions { scale: f64::NAN, ..opts(&d) }).is_err());
 }
 
+#[test]
+fn the_cnc_preset_writes_version_2000_in_millimeters_with_type_as_paths_and_strokes_as_lines() {
+    let mut d = text_doc("Cut", 20.0);
+    let layer = d.layers[0].id;
+    let frame = path(&mut d, shapes::rectangle(Rect::new(5.0, 5.0, 195.0, 95.0)), Paint::None, Paint::solid(Color::BLACK), 10.0);
+    d.insert(Some(layer), usize::MAX, frame).unwrap();
+    let o = DxfOptions { region: d.artboards[0].rect, ..DxfPreset::Cnc.options() };
+    let out = export(&d, &o).unwrap();
+    let p = pairs(&out.bytes);
+    assert_eq!(header(&p, "$ACADVER").as_deref(), Some("AC1015"));
+    assert_eq!(header(&p, "$INSUNITS").as_deref(), Some("4"));
+    let k = kinds(&out);
+    assert!(!k.iter().any(|k| matches!(k.as_str(), "TEXT" | "MTEXT" | "IMAGE")), "type is paths: {k:?}");
+    assert!(k.len() > 2, "the glyphs' outlines: {k:?}");
+    // The 10 pt stroke (wider than the widest lineweight) is one center line, not a filled outline.
+    assert_eq!(k.last().map(String::as_str), Some("LWPOLYLINE"), "{k:?}");
+    assert_ne!(k.get(k.len() - 2).map(String::as_str), Some("LWPOLYLINE"), "{k:?}");
+    assert!(out.images.is_empty());
+    assert_eq!(DxfPreset::of(&o), DxfPreset::Cnc);
+    assert_eq!(DxfPreset::of(&DxfOptions { colors: ColorDepth::True, ..o.clone() }), DxfPreset::Custom);
+    assert_eq!(DxfPreset::of(&DxfOptions::default()), DxfPreset::Custom);
+    assert_eq!(DxfPreset::from_id(" CNC "), Some(DxfPreset::Cnc));
+}
+
 #[test]
 fn layers_become_dxf_layers() {
     let mut d = shapes_doc();
diff --git a/crates/doc/src/appearance.rs b/crates/doc/src/appearance.rs
index 81b9aaaf5..09e8154c9 100644
--- a/crates/doc/src/appearance.rs
+++ b/crates/doc/src/appearance.rs
@@ -296,6 +296,28 @@ impl Appearance {
             scale(e, s);
         }
     }
+    /// The id of Effect › SVG Filters' effect, whose `origin` parameter is a point of the document.
+    pub const SVG_FILTER: &str = "svg.filter";
+
+    /// Does any effect (the object's or a fill's or stroke's) hold an SVG filter?
+    pub fn has_svg_filter(&self) -> bool {
+        self.effects.iter().chain(self.items.iter().flat_map(|i| i.effects().iter())).any(|e| e.id == Self::SVG_FILTER)
+    }
+
+    /// Move the `origin` of every SVG filter effect (where its user space starts in the document)
+    /// by `a`, as the object it is on moves.
+    pub fn transform_svg_filters(&mut self, a: kurbo::Affine) {
+        let items = self.items.iter_mut().flat_map(|i| i.effects_mut().iter_mut());
+        for e in self.effects.iter_mut().chain(items).filter(|e| e.id == Self::SVG_FILTER) {
+            let at =
+                |i: usize| e.params.get("origin").and_then(|o| o.get(i)).and_then(serde_json::Value::as_f64).filter(|v| v.is_finite()).unwrap_or(0.0);
+            let p = a * kurbo::Point::new(at(0), at(1));
+            if p.x.is_finite() && p.y.is_finite() && e.params.is_object() {
+                e.params["origin"] = serde_json::json!([p.x, p.y]);
+            }
+        }
+    }
+
     /// Gradient paints of the fills and strokes.
     fn gradients_mut(&mut self) -> impl Iterator<Item = &mut vectorcraft_color::GradientPaint> {
         self.items.iter_mut().filter_map(|i| match i {
diff --git a/crates/doc/src/artboard.rs b/crates/doc/src/artboard.rs
index 6d5d50d4d..d7bfcafca 100644
--- a/crates/doc/src/artboard.rs
+++ b/crates/doc/src/artboard.rs
@@ -106,6 +106,60 @@ impl super::Document {
         d.layers.insert(0, Arc::new(layer));
         Some(d)
     }
+
+    /// Where an artboard the size of artboard `i` goes on `side` of it, [`ARTBOARD_GAP`] away,
+    /// when there is room for it there: every side within [`crate::MAX_COORD`] of the origin and
+    /// no other artboard overlapping it (touching edges don't overlap). `None` when there is no
+    /// such artboard or no room.
+    pub fn room_beside_artboard(&self, i: usize, side: ArtboardSide) -> Option<Rect> {
+        let src = self.artboards.get(i)?.rect;
+        let r = src + side.offset(src);
+        let in_canvas = [r.x0, r.y0, r.x1, r.y1].iter().all(|v| v.is_finite() && v.abs() <= crate::MAX_COORD);
+        let clear = self.artboards.iter().all(|a| !(r.x0 < a.rect.x1 && a.rect.x0 < r.x1 && r.y0 < a.rect.y1 && a.rect.y0 < r.y1));
+        (in_canvas && clear).then_some(r)
+    }
+}
+
+/// The space between an artboard and one added or duplicated beside it (VectorCraft's own value,
+/// the space New Artboard and Duplicate Artboards leave right of the last artboard).
+pub const ARTBOARD_GAP: f64 = 20.0;
+
+/// A side of an artboard, where an artboard added or duplicated beside it goes.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ArtboardSide {
+    Left,
+    Right,
+    Top,
+    Bottom,
+}
+
+impl ArtboardSide {
+    pub const ALL: [Self; 4] = [Self::Top, Self::Right, Self::Bottom, Self::Left];
+
+    /// The side a command's `side` param names: "left", "right", "top" or "bottom".
+    pub fn parse(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|s| s.name() == name)
+    }
+
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Left => "left",
+            Self::Right => "right",
+            Self::Top => "top",
+            Self::Bottom => "bottom",
+        }
+    }
+
+    /// How far a copy of `r` moves to sit on this side of it, [`ARTBOARD_GAP`] away (y down).
+    pub fn offset(self, r: Rect) -> vectorcraft_geom::Vec2 {
+        let (w, h) = (r.width() + ARTBOARD_GAP, r.height() + ARTBOARD_GAP);
+        match self {
+            Self::Left => vectorcraft_geom::Vec2::new(-w, 0.0),
+            Self::Right => vectorcraft_geom::Vec2::new(w, 0.0),
+            Self::Top => vectorcraft_geom::Vec2::new(0.0, -h),
+            Self::Bottom => vectorcraft_geom::Vec2::new(0.0, h),
+        }
+    }
 }
 
 /// A document's locked artboards ([`Document::locked_artboards`]).
diff --git a/crates/doc/src/assets.rs b/crates/doc/src/assets.rs
index 3c4451d54..824f3ebea 100644
--- a/crates/doc/src/assets.rs
+++ b/crates/doc/src/assets.rs
@@ -11,12 +11,16 @@ use serde::{Deserialize, Serialize};
 use crate::{Document, NodeId};
 
 /// One asset: what it is called (its files' names) and the objects it exports, cropped to their
-/// visual bounds.
+/// visual bounds, or for a 3D asset its object's solids as a mesh file.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct ExportAsset {
     pub id: u64,
     pub name: String,
     pub nodes: Vec<NodeId>,
+    /// A 3D asset's mesh format (`usda`, `usdz`, `gltf` or `obj`): its object exports as a 3D
+    /// file. `None` for art exported as pictures.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub format_3d: Option<String>,
 }
 
 /// What the assets are named when they aren't named after their object: `Asset 1`, `Asset 2`…
diff --git a/crates/doc/src/canvas_range.rs b/crates/doc/src/canvas_range.rs
index cf85507c7..114235696 100644
--- a/crates/doc/src/canvas_range.rs
+++ b/crates/doc/src/canvas_range.rs
@@ -313,8 +313,8 @@ mod tests {
         d.guides = vec![Guide { layer: Some(NodeId(40)), ..Guide::new(false, 5.0) }, Guide { layer: Some(d.layers[0].id), ..Guide::new(true, 5.0) }];
         d.saved_selections = vec![crate::records::SavedSelection { name: "s".into(), objects: vec![NodeId(10), NodeId(11)] }].into();
         d.assets = vec![
-            crate::assets::ExportAsset { id: 1, name: "far".into(), nodes: vec![NodeId(11)] },
-            crate::assets::ExportAsset { id: 2, name: "both".into(), nodes: vec![NodeId(10), NodeId(11)] },
+            crate::assets::ExportAsset { id: 1, name: "far".into(), nodes: vec![NodeId(11)], format_3d: None },
+            crate::assets::ExportAsset { id: 2, name: "both".into(), nodes: vec![NodeId(10), NodeId(11)], format_3d: None },
         ];
         d.variables.bindings.insert(NodeId(11), ["v".to_string()].into());
         d.variables.bindings.insert(NodeId(10), ["w".to_string()].into());
diff --git a/crates/doc/src/document.rs b/crates/doc/src/document.rs
index 78f90dac6..287a6b2aa 100644
--- a/crates/doc/src/document.rs
+++ b/crates/doc/src/document.rs
@@ -68,6 +68,7 @@ impl Document {
             print_setup,
             assets,
             svg_scripts,
+            svg_filters,
             puppet,
             new_art,
             dimensions,
@@ -135,6 +136,7 @@ impl Document {
             && *print_setup == other.print_setup
             && *assets == other.assets
             && *svg_scripts == other.svg_scripts
+            && *svg_filters == other.svg_filters
             && match (puppet, &other.puppet) {
                 (Some(a), Some(b)) => Arc::ptr_eq(a, b),
                 (a, b) => a.is_none() && b.is_none(),
@@ -245,6 +247,7 @@ impl Document {
             print_setup: None,
             assets: vec![],
             svg_scripts: vec![],
+            svg_filters: vec![],
             puppet: None,
             new_art: Default::default(),
             dimensions: false,
diff --git a/crates/doc/src/document_ext.rs b/crates/doc/src/document_ext.rs
index efd7f80b2..c40dcf9f2 100644
--- a/crates/doc/src/document_ext.rs
+++ b/crates/doc/src/document_ext.rs
@@ -123,6 +123,39 @@ impl Document {
         std::borrow::Cow::Owned(d)
     }
 
+    /// Does `wants` hold for a node anywhere in the document's art: the layers, symbol definitions,
+    /// graph designs, pattern swatches (the one being edited included) and their opacity masks?
+    pub fn any_node(&self, wants: impl Fn(&Node) -> bool) -> bool {
+        let roots = self
+            .layers
+            .iter()
+            .chain(self.symbols.iter().map(|s| &s.art))
+            .chain(self.graph_designs.iter().map(|g| &g.art))
+            .chain(self.patterns.iter().flat_map(|p| p.art.iter()))
+            .chain(self.pattern_edit.iter().filter_map(|pe| pe.original.as_ref()).flat_map(|p| p.art.iter()));
+        let mut any = false;
+        for root in roots {
+            crate::swatches::walk_with_masks(root, &mut |n| any |= wants(n));
+        }
+        any
+    }
+
+    /// Change with `f` every node for which `wants` holds, anywhere in the document's art (as
+    /// [`Self::any_node`] looks). Only the trees that hold such a node are copied out of the art
+    /// they share.
+    pub fn edit_nodes_where(&mut self, wants: impl Fn(&Node) -> bool, mut f: impl FnMut(&mut Node)) {
+        let roots = self
+            .layers
+            .iter_mut()
+            .chain(self.symbols.iter_mut().map(|s| &mut s.art))
+            .chain(self.graph_designs.iter_mut().map(|g| &mut g.art))
+            .chain(self.patterns.iter_mut().flat_map(|p| p.art.iter_mut()))
+            .chain(self.pattern_edit.iter_mut().filter_map(|pe| pe.original.as_mut()).flat_map(|p| p.art.iter_mut()));
+        for root in roots {
+            edit_branches_where(root, &wants, &mut f);
+        }
+    }
+
     /// Round every path's anchors and handles to `decimals` decimal places: path objects (with
     /// Live Corners' uncut outlines), blend spines, envelopes' top-object outlines and Intertwine
     /// areas, in the layers, symbol definitions, graph designs, pattern swatches (the one being
@@ -164,7 +197,7 @@ impl Document {
                     }
                 }
                 NodeKind::Envelope { kind, .. } => {
-                    if let EnvelopeKind::TopObject { path } = kind.as_mut() {
+                    if let EnvelopeKind::TopObject { path, .. } = kind.as_mut() {
                         round_path(path);
                     }
                 }
@@ -194,6 +227,26 @@ impl Document {
     }
 }
 
+/// Change with `f` the nodes of `n`'s tree (opacity-mask art included) for which `wants` holds,
+/// copying out of the shared art only the branches that hold one.
+fn edit_branches_where(n: &mut Arc<Node>, wants: &impl Fn(&Node) -> bool, f: &mut impl FnMut(&mut Node)) {
+    let mut any = false;
+    crate::swatches::walk_with_masks(n, &mut |c| any |= wants(c));
+    if !any {
+        return;
+    }
+    let node = Arc::make_mut(n);
+    if wants(node) {
+        f(node);
+    }
+    if let Some(m) = node.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        edit_branches_where(&mut m.art, wants, f);
+    }
+    for c in node.children_mut().into_iter().flatten() {
+        edit_branches_where(c, wants, f);
+    }
+}
+
 /// Round with `round` the anchors of the paths in `v`, nodes in their file form kept as JSON: every
 /// `{"subpaths": [{"anchors": [{"p", "in", "out"}]}]}` outside type (`{"type": "text"}`), as
 /// [`Document::round_geometry`] rounds the nodes it holds.
diff --git a/crates/doc/src/hit.rs b/crates/doc/src/hit.rs
index b3b4394a2..ea3575bf6 100644
--- a/crates/doc/src/hit.rs
+++ b/crates/doc/src/hit.rs
@@ -936,6 +936,257 @@ fn hit_any(n: &Node, p: Point, opt: HitOptions, symbols: &SymbolBoxes) -> Option
     }
 }
 
+/// The art of a symbol instance with its own appearance changes, in the symbol's coordinates, and
+/// how the canvas places each object of it: through the symbol's 9-slice guides when the instance
+/// is scaled by them ([`Document::place_symbol_art`]), otherwise by the instance's transform.
+struct InstanceArt {
+    art: Node,
+    map: Option<crate::NineSliceMap>,
+    xf: vectorcraft_geom::Affine,
+}
+
+impl InstanceArt {
+    /// The art of symbol instance `inst`. `None` for anything else, a missing symbol, or art that
+    /// placing through the guides could make more than [`crate::MAX_SYMBOL_NODES`] objects of,
+    /// which [`Document::place_symbol_art`] does not place and the canvas does not draw.
+    fn of(doc: &Document, inst: &Node) -> Option<Self> {
+        let NodeKind::SymbolInstance { symbol, xf } = &inst.kind else { return None };
+        let sym = doc.symbols.iter().find(|s| s.name == *symbol)?;
+        let art = crate::symbol_overrides::dynamic_art(&sym.art, inst);
+        let map = doc.symbol_slice_map(symbol, *xf);
+        if map.as_ref().is_some_and(|m| m.most_placed(&art, doc) > crate::MAX_SYMBOL_NODES) {
+            return None;
+        }
+        Some(Self { art, map, xf: *xf })
+    }
+
+    /// The map that the objects inside group or layer `n` are moved by as one piece: `whole`, the
+    /// map of an object around `n` that is moved as one piece, or else the map of the 9-slice cell
+    /// `n` lies in ([`crate::NineSliceMap::one_cell`]). `None` when `n` is placed through the guides
+    /// object by object.
+    fn whole(&self, n: &Node, doc: &Document, whole: Option<vectorcraft_geom::Affine>) -> Option<vectorcraft_geom::Affine> {
+        whole.or_else(|| self.map.as_ref()?.one_cell(n, doc))
+    }
+
+    /// Object `n` of the art placed on the canvas as it is drawn, clip groups included: moved by
+    /// `whole` when an object around it is moved as one piece ([`Self::whole`]). `None` when
+    /// placing it through the guides could make more than [`crate::MAX_SYMBOL_NODES`] objects, as
+    /// [`Document::place_symbol_art`] refuses it.
+    fn place(&self, n: &Node, doc: &Document, whole: Option<vectorcraft_geom::Affine>) -> Option<Node> {
+        match (&self.map, whole) {
+            (_, Some(a)) => Some(moved(n, a)),
+            (Some(m), None) => (m.most_placed(n, doc) <= crate::MAX_SYMBOL_NODES).then(|| m.place(n, doc)),
+            (None, None) => Some(moved(n, self.xf)),
+        }
+    }
+
+    /// Object `n` of the art placed on the canvas without clip groups
+    /// ([`crate::NineSliceMap::place_unclipped`]), as [`Self::place`] places it and within the
+    /// same limit ([`Document::place_symbol_art_unclipped`]).
+    fn place_unclipped(&self, n: &Node, doc: &Document, whole: Option<vectorcraft_geom::Affine>) -> Option<Node> {
+        match (&self.map, whole) {
+            (_, Some(a)) => Some(moved(n, a)),
+            (Some(m), None) => (m.most_placed_unclipped(n, doc) <= crate::MAX_SYMBOL_NODES).then(|| m.place_unclipped(n, doc)),
+            (None, None) => Some(moved(n, self.xf)),
+        }
+    }
+}
+
+/// `n` transformed by `xf`, its strokes at their own weight.
+fn moved(n: &Node, xf: vectorcraft_geom::Affine) -> Node {
+    let mut out = n.clone();
+    out.transform(xf, false);
+    out
+}
+
+/// The object of symbol instance `inst`'s art under `p`, for Direct Selection on a dynamic symbol's
+/// instance: its path of child indices from the art's root ([`crate::symbol_overrides::part`]), the
+/// topmost object hit inside the art's groups. With [`HitOptions::clip_outlines`], a press on the
+/// outline of the clipping path of a clip group or a clipping layer picks that path before the art
+/// it clips, as [`hit_test`] does outside symbols. Hidden, locked and template objects are passed
+/// over, as [`hit_test`] passes over them when it looks for editable objects, and so are a Shaper
+/// group's original shapes, which the canvas does not draw, and guide paths with
+/// [`HitOptions::skip_guides`]. Nothing is picked in art that placing through the symbol's 9-slice
+/// guides could make more than [`crate::MAX_SYMBOL_NODES`] objects of, which the canvas does not
+/// draw. `None` when `inst` is not a symbol instance or no editable object of its art is under `p`.
+pub fn symbol_part_at(doc: &Document, inst: &Node, p: Point, opt: HitOptions) -> Option<Vec<u32>> {
+    struct Find<'a> {
+        doc: &'a Document,
+        art: &'a InstanceArt,
+        p: Point,
+        opt: HitOptions,
+        symbols: &'a SymbolBoxes<'a>,
+    }
+    impl Find<'_> {
+        fn hit(&self, n: &Node, whole: Option<vectorcraft_geom::Affine>) -> bool {
+            self.art.place(n, self.doc, whole).is_some_and(|n| hit_any(&n, self.p, self.opt, self.symbols).is_some())
+        }
+        fn skips_guide(&self, n: &Node) -> bool {
+            self.opt.skip_guides && matches!(n.kind, NodeKind::Path { guide: true, .. })
+        }
+        fn find(&self, n: &Node, path: &mut Vec<u32>, whole: Option<vectorcraft_geom::Affine>) -> bool {
+            if !n.visible || n.locked || n.is_template() || self.skips_guide(n) {
+                return false;
+            }
+            let (NodeKind::Group { children, .. } | NodeKind::Layer { children, .. }) = &n.kind else { return self.hit(n, whole) };
+            if path.len() >= crate::symbol_overrides::MAX_PATH_DEPTH {
+                return self.hit(n, whole);
+            }
+            let whole = self.art.whole(n, self.doc, whole);
+            if n.clips()
+                && let Some(first) = children.first()
+            {
+                let Some(clip) = self.art.place_unclipped(first, self.doc, whole) else { return false };
+                if self.opt.clip_outlines
+                    && first.visible
+                    && !first.locked
+                    && !self.skips_guide(first)
+                    && clip_outline(&clip, self.p, self.opt).is_some()
+                {
+                    path.push(0);
+                    return true;
+                }
+                if !clip_contains(&clip, self.p) {
+                    return false;
+                }
+            }
+            for (i, c) in children.iter().enumerate().rev() {
+                // A Shaper group's original shapes are not drawn; symbol art has no isolation scope.
+                if shaper_hides(n, i, None) {
+                    continue;
+                }
+                let Ok(i) = u32::try_from(i) else { continue };
+                path.push(i);
+                if self.find(c, path, whole) {
+                    return true;
+                }
+                path.pop();
+            }
+            false
+        }
+    }
+    let art = InstanceArt::of(doc, inst)?;
+    let symbols = doc.symbol_boxes();
+    let mut path = vec![];
+    Find { doc, art: &art, p, opt, symbols: &symbols }.find(&art.art, &mut path, None).then_some(path)
+}
+
+/// The outlines of the object at `path` in symbol instance `inst`'s art (see [`symbol_part_at`]),
+/// placed on the canvas as it is drawn: its paths' outlines, and the bounds of objects without a
+/// path. Inside a clip group (an object drawn once in each 9-slice cell it reaches is one clip
+/// group per cell) they are cut to the bounds of the group's clip path, which is not outlined. An
+/// object inside a clip group or a clipping layer of the art, other than its clipping path, is cut
+/// to the bounds of that clipping path as well, which contain the region where [`symbol_part_at`]
+/// picks it.
+/// `None` for art past the 9-slice object limit that [`symbol_part_at`] applies.
+pub fn symbol_part_outline(doc: &Document, inst: &Node, path: &[u32]) -> Option<BezPath> {
+    let art = InstanceArt::of(doc, inst)?;
+    let part = crate::symbol_overrides::part(&art.art, path)?;
+    let mut out = BezPath::new();
+    let mut limit = None;
+    let mut whole = None;
+    let mut n = &art.art;
+    for &i in path {
+        let children = n.children()?;
+        whole = art.whole(n, doc, whole);
+        if i != 0
+            && n.clips()
+            && let Some(first) = children.first()
+            && let Some(clip) = art.place_unclipped(first, doc, whole)?.geometric_bounds()
+        {
+            match meet(Some(clip), limit) {
+                Some(r) => limit = Some(r),
+                None => return Some(out),
+            }
+        }
+        n = children.get(usize::try_from(i).ok()?)?;
+    }
+    outline_within(&art.place(part, doc, whole)?, limit, &mut out);
+    Some(out)
+}
+
+/// [`symbol_part_outline`] for placed object `n`, cut to `limit` when there is one.
+fn outline_within(n: &Node, limit: Option<Rect>, out: &mut BezPath) {
+    use vectorcraft_geom::kurbo::Shape;
+    if let Some(pd) = n.path_data() {
+        match limit {
+            Some(r) => push_cut(out, &pd.to_bezpath(), r),
+            None => out.extend(pd.to_bezpath()),
+        }
+    } else if n.children().is_none()
+        && let Some(b) = n.geometric_bounds()
+        && let Some(b) = meet(Some(b), limit)
+    {
+        out.extend(b.to_path(0.1));
+    }
+    let Some(children) = n.children() else { return };
+    if n.clips()
+        && let Some((first, rest)) = children.split_first()
+    {
+        let inner = match first.geometric_bounds() {
+            Some(c) => match meet(Some(c), limit) {
+                Some(r) => Some(r),
+                None => return,
+            },
+            None => limit,
+        };
+        rest.iter().for_each(|c| outline_within(c, inner, out));
+        return;
+    }
+    children.iter().for_each(|c| outline_within(c, limit, out));
+}
+
+/// The overlap of `a` and `b` (`a` alone without `b`), `None` when they do not overlap.
+fn meet(a: Option<Rect>, b: Option<Rect>) -> Option<Rect> {
+    let a = a?;
+    let Some(b) = b else { return Some(a) };
+    let r = Rect::new(a.x0.max(b.x0), a.y0.max(b.y0), a.x1.min(b.x1), a.y1.min(b.y1));
+    (r.x0 <= r.x1 && r.y0 <= r.y1).then_some(r)
+}
+
+/// The parts of path `p`, flattened to lines, that lie inside `r`, appended to `out`.
+fn push_cut(out: &mut BezPath, p: &BezPath, r: Rect) {
+    use vectorcraft_geom::kurbo::PathEl;
+    let (mut at, mut start, mut last) = (Point::ZERO, Point::ZERO, None::<Point>);
+    vectorcraft_geom::kurbo::flatten(p.iter(), 0.1, |el| {
+        let to = match el {
+            PathEl::MoveTo(q) => {
+                (at, start, last) = (q, q, None);
+                return;
+            }
+            PathEl::LineTo(q) => q,
+            PathEl::ClosePath => start,
+            _ => return,
+        };
+        if let Some((a, b)) = cut_segment(at, to, r) {
+            if last != Some(a) {
+                out.move_to(a);
+            }
+            out.line_to(b);
+            last = Some(b);
+        }
+        at = to;
+    });
+}
+
+/// The part of segment `a` to `b` inside `r`, `None` when none of it is.
+fn cut_segment(a: Point, b: Point, r: Rect) -> Option<(Point, Point)> {
+    let d = b - a;
+    let (mut t0, mut t1) = (0.0_f64, 1.0_f64);
+    for (p, q) in [(-d.x, a.x - r.x0), (d.x, r.x1 - a.x), (-d.y, a.y - r.y0), (d.y, r.y1 - a.y)] {
+        if p.abs() < 1e-12 {
+            if q < 0.0 {
+                return None;
+            }
+        } else if p < 0.0 {
+            t0 = t0.max(q / p);
+        } else {
+            t1 = t1.min(q / p);
+        }
+    }
+    (t0 <= t1).then(|| (a + d * t0, a + d * t1))
+}
+
 /// The path of compound path `n` under `p`, for the Group Selection tool: the one whose outline is
 /// within `tol`, else the innermost one whose area holds `p` (a hole inside an outer shape, an
 /// island inside a hole). `None` when `n` isn't a compound path or no part is under `p`.
diff --git a/crates/doc/src/hit/tests.rs b/crates/doc/src/hit/tests.rs
index 9a5c40478..495dc227b 100644
--- a/crates/doc/src/hit/tests.rs
+++ b/crates/doc/src/hit/tests.rs
@@ -1373,3 +1373,128 @@ fn cull_box_holds_the_reach_of_paths_and_compound_paths() {
     assert!(holds(cull, reach), "{cull:?} does not hold {reach:?}");
     assert_eq!(checked, 201);
 }
+
+/// In a dynamic symbol's art, a layer with a clipping mask clips its objects as a clip group does:
+/// Direct Selection picks an object only where the mask shows it, and outlines it there.
+#[test]
+fn an_object_a_clipping_layer_in_symbol_art_hides_is_not_picked_there() {
+    let mut d = Document::new(300.0, 200.0);
+    let l = d.layers[0].id;
+    let (mask, art) = half_clipped(&mut d);
+    let mut layer = Node::layer(d.alloc_id(), "Masked", crate::LayerColor::Preset(2));
+    if let NodeKind::Layer { children, .. } = &mut layer.kind {
+        *children = vec![Arc::new(mask), Arc::new(art)];
+    }
+    layer.set_clips(true);
+    let root = Node::group(d.alloc_id(), vec![Arc::new(layer)]);
+    d.symbols.push(crate::Symbol { dynamic: true, name: "Clipped".into(), art: Arc::new(root) });
+    let inst = d.alloc_id();
+    d.insert(Some(l), 0, Node::new(inst, NodeKind::SymbolInstance { symbol: "Clipped".into(), xf: vectorcraft_geom::Affine::IDENTITY })).unwrap();
+    let n = d.node(inst).unwrap();
+    let opt = HitOptions::default();
+    assert_eq!(symbol_part_at(&d, n, Point::new(50.0, 50.0), opt), Some(vec![0, 1]), "where the mask shows the art");
+    assert_eq!(symbol_part_at(&d, n, Point::new(150.0, 50.0), opt), None, "where the mask hides it");
+    let b = vectorcraft_geom::kurbo::Shape::bounding_box(&symbol_part_outline(&d, n, &[0, 1]).unwrap());
+    assert!((b.x1 - 100.0).abs() < 1e-6, "the outline is cut to the mask: {b:?}");
+    // Its outline inside the group around the layer is cut too.
+    let b = vectorcraft_geom::kurbo::Shape::bounding_box(&symbol_part_outline(&d, n, &[0]).unwrap());
+    assert!((b.x1 - 100.0).abs() < 1e-6, "the layer's outline is cut to the mask: {b:?}");
+}
+
+/// In a dynamic symbol's art that placing through its 9-slice guides could make more than
+/// [`crate::MAX_SYMBOL_NODES`] objects of, Direct Selection picks and outlines nothing, as the
+/// canvas draws nothing of it. At the art's natural size the same art is picked.
+#[test]
+fn symbol_art_past_the_object_limit_picks_nothing() {
+    use vectorcraft_color::{Gradient, GradientPaint};
+    let mut d = Document::new(400.0, 400.0);
+    let l = d.layers[0].id;
+    let leaf = Arc::new(Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 1.0, 1.0)), Appearance::default_art()));
+    let inner = Arc::new(Node::group(d.alloc_id(), vec![leaf; 1_800]));
+    let mut mask = crate::OpacityMask::new(Node::group(d.alloc_id(), vec![inner; 1_800]), true);
+    mask.linked = false;
+    let gradient = Paint::Gradient(Box::new(GradientPaint::new(Gradient::default())));
+    // Drawn in six cells, each with its own copy of the mask's 3,240,000 squares.
+    let mut big = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 50.0)), Appearance::basic(gradient, Paint::None, 0.0));
+    big.extras_mut().mask = Some(Box::new(mask));
+    let plain = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 50.0, 100.0, 100.0)), Appearance::default_art());
+    let root = Node::group(d.alloc_id(), vec![Arc::new(plain), Arc::new(big)]);
+    d.symbols.push(crate::Symbol { dynamic: true, name: "Big".into(), art: Arc::new(root) });
+    d.set_symbol_nine_slice("Big", Some(crate::SymbolNineSlice::default()));
+    let scaled = d.alloc_id();
+    let natural = d.alloc_id();
+    let xf = vectorcraft_geom::Affine::scale_non_uniform(2.0, 1.5);
+    d.insert(Some(l), 0, Node::new(scaled, NodeKind::SymbolInstance { symbol: "Big".into(), xf })).unwrap();
+    d.insert(Some(l), 0, Node::new(natural, NodeKind::SymbolInstance { symbol: "Big".into(), xf: vectorcraft_geom::Affine::IDENTITY })).unwrap();
+    assert!(d.place_symbol_art("Big", &d.symbols[0].art, xf).is_none(), "the art is past the limit");
+    let opt = HitOptions::default();
+    let n = d.node(scaled).unwrap();
+    assert_eq!(symbol_part_at(&d, n, Point::new(100.0, 110.0), opt), None, "the plain square");
+    assert_eq!(symbol_part_at(&d, n, Point::new(100.0, 40.0), opt), None, "the masked path");
+    assert!(symbol_part_outline(&d, n, &[0]).is_none());
+    assert!(symbol_part_outline(&d, n, &[1]).is_none());
+    let n = d.node(natural).unwrap();
+    assert_eq!(symbol_part_at(&d, n, Point::new(50.0, 75.0), opt), Some(vec![0]));
+    assert!(symbol_part_outline(&d, n, &[0]).is_some());
+}
+
+/// A clip group that lies in one 9-slice cell is moved by that cell as one piece, everything in it
+/// included, so an object in it is picked and outlined there even when placing that object through
+/// the guides on its own would pass [`crate::MAX_SYMBOL_NODES`] objects.
+#[test]
+fn objects_of_a_clip_group_in_one_cell_are_placed_with_it() {
+    use vectorcraft_color::{Gradient, GradientPaint};
+    let mut d = Document::new(400.0, 400.0);
+    let l = d.layers[0].id;
+    let leaf = Arc::new(Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 1.0, 1.0)), Appearance::default_art()));
+    let inner = Arc::new(Node::group(d.alloc_id(), vec![leaf; 1_800]));
+    let mut mask = crate::OpacityMask::new(Node::group(d.alloc_id(), vec![inner; 1_800]), true);
+    mask.linked = false;
+    let gradient = Paint::Gradient(Box::new(GradientPaint::new(Gradient::default())));
+    let mut big = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::basic(gradient, Paint::None, 0.0));
+    big.extras_mut().mask = Some(Box::new(mask));
+    let clip = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 20.0, 20.0)), Appearance::default_art());
+    let mut group = Node::group(d.alloc_id(), vec![Arc::new(clip), Arc::new(big.clone())]);
+    group.set_clips(true);
+    let frame = Node::path(d.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default_art());
+    let root = Node::group(d.alloc_id(), vec![Arc::new(frame), Arc::new(group)]);
+    d.symbols.push(crate::Symbol { dynamic: true, name: "Corner".into(), art: Arc::new(root) });
+    d.set_symbol_nine_slice("Corner", Some(crate::SymbolNineSlice::default()));
+    let inst = d.alloc_id();
+    let xf = vectorcraft_geom::Affine::scale_non_uniform(2.0, 1.5);
+    d.insert(Some(l), 0, Node::new(inst, NodeKind::SymbolInstance { symbol: "Corner".into(), xf })).unwrap();
+    let m = d.symbol_slice_map("Corner", xf).unwrap();
+    assert!(m.most_placed(&big, &d) > crate::MAX_SYMBOL_NODES, "the object alone is past the limit");
+    assert!(d.place_symbol_art("Corner", &d.symbols[0].art, xf).is_some(), "the art is drawn");
+    let n = d.node(inst).unwrap();
+    assert_eq!(symbol_part_at(&d, n, Point::new(10.0, 10.0), HitOptions::default()), Some(vec![1, 1]));
+    let b = vectorcraft_geom::kurbo::Shape::bounding_box(&symbol_part_outline(&d, n, &[1, 1]).unwrap());
+    assert!((b.x1 - 20.0).abs() < 1e-6 && (b.y1 - 20.0).abs() < 1e-6, "cut to the clip in its corner: {b:?}");
+}
+
+/// In a dynamic symbol's art, Direct Selection does not pick a Shaper group's original shapes,
+/// which the canvas does not draw: a click over an original shape whose face the group erased
+/// picks nothing, and a click over the face it shows picks the face.
+#[test]
+fn a_shaper_groups_original_shapes_in_symbol_art_are_not_picked() {
+    let mut d = Document::new(300.0, 200.0);
+    let l = d.layers[0].id;
+    let square = |x: f64| shapes::rectangle(Rect::new(x, 0.0, x + 100.0, 100.0));
+    let a = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+    let b = Node::path(d.alloc_id(), square(50.0), Appearance::default_art());
+    let mut sources = Node::group(d.alloc_id(), vec![Arc::new(a), Arc::new(b)]);
+    sources.name = Some(crate::shaper::SOURCES.into());
+    sources.opacity = 0.0;
+    let mut face = Node::path(d.alloc_id(), square(0.0), Appearance::default_art());
+    face.name = Some(format!("{}0", crate::shaper::FILL_PREFIX));
+    let mut group = Node::group(d.alloc_id(), vec![Arc::new(sources), Arc::new(face)]);
+    group.extras_mut().shaper = Some(Box::default());
+    let root = Node::group(d.alloc_id(), vec![Arc::new(group)]);
+    d.symbols.push(crate::Symbol { dynamic: true, name: "Shaped".into(), art: Arc::new(root) });
+    let inst = d.alloc_id();
+    d.insert(Some(l), 0, Node::new(inst, NodeKind::SymbolInstance { symbol: "Shaped".into(), xf: vectorcraft_geom::Affine::IDENTITY })).unwrap();
+    let n = d.node(inst).unwrap();
+    let opt = HitOptions::default();
+    assert_eq!(symbol_part_at(&d, n, Point::new(130.0, 50.0), opt), None, "over the erased original shape");
+    assert_eq!(symbol_part_at(&d, n, Point::new(50.0, 50.0), opt), Some(vec![0, 1]), "over the shown face");
+}
diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs
index bff8e40f3..8a866256e 100644
--- a/crates/doc/src/lib.rs
+++ b/crates/doc/src/lib.rs
@@ -109,7 +109,7 @@ pub use placed_document::{PageBox, PlacedDocument};
 pub use profiles::ColorProfiles;
 pub use puppet::{PuppetPin, PuppetPins};
 pub use rastersettings::{RasterColorModel, RasterEffectsSettings};
-pub use selection::{AnchorRef, SegmentRef, Selection};
+pub use selection::{AnchorRef, SegmentRef, Selection, SymbolPart};
 pub use setup::{Background, DocSetup, ExportText, GridSize, Quotes};
 pub use slices::{CellAlign, CellVAlign, Slice, SliceArea, SliceKind, SliceOptions, SliceSource};
 pub use style_libs::StyleLibrary;
@@ -141,7 +141,7 @@ mod limits;
 mod records;
 mod units;
 
-pub use artboard::{Artboard, LockedArtboards, RetiredArtboardId, VIDEO_PIXEL_ASPECT_RANGE, VIDEO_SAFE_INSETS};
+pub use artboard::{ARTBOARD_GAP, Artboard, ArtboardSide, LockedArtboards, RetiredArtboardId, VIDEO_PIXEL_ASPECT_RANGE, VIDEO_SAFE_INSETS};
 pub use canvas_range::BeyondCanvas;
 #[cfg(test)]
 use document_ext::free_id;
@@ -150,7 +150,7 @@ pub use guides::{GridPrefs, Guide, RulerMode};
 #[cfg(test)]
 use limits::MAX_NEXT_ID;
 pub use limits::{DocError, FORMAT_VERSION, MAX_COORD};
-pub use records::{ImageBlob, MaskEdit, NewArtIds, SavedSelection, SavedView, Symbol, SymbolEdit};
+pub use records::{ImageBlob, MaskEdit, NewArtIds, SavedSelection, SavedView, SvgFilter, Symbol, SymbolEdit};
 pub use units::{ColorMode, Unit, parse_number};
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -310,6 +310,10 @@ pub struct Document {
     /// given) SVG export links with `<script>` elements, in order.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub svg_scripts: Vec<String>,
+    /// Effect › SVG Filters: the SVG filters the document holds (at most [`SvgFilter::MAX`]), in
+    /// the order the submenu lists them.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub svg_filters: Vec<SvgFilter>,
     /// Puppet Warp pins on the selected artwork while the tool edits it ([`PuppetPins`]): editing
     /// state, never saved.
     #[serde(skip)]
diff --git a/crates/doc/src/live.rs b/crates/doc/src/live.rs
index 508ce247f..4a864a6e9 100644
--- a/crates/doc/src/live.rs
+++ b/crates/doc/src/live.rs
@@ -174,6 +174,303 @@ mod tests {
         assert!((c.x - 105.0).abs() < 1e-6 && (c.y + 10.0).abs() < 1e-6, "{c:?}");
     }
 
+    /// A 100 × 50 outline whose top side runs (0,0) → (30,0) → (100,0) as two straight segments.
+    fn top_split_at_30() -> PathData {
+        let a = |x: f64, y: f64| Anchor::corner(Point::new(x, y));
+        PathData::single(SubPath::new(vec![a(0.0, 0.0), a(30.0, 0.0), a(100.0, 0.0), a(100.0, 50.0), a(0.0, 50.0)], true))
+    }
+
+    /// The length of `c`'s control polygon.
+    fn polygon(c: CubicBez) -> f64 {
+        c.p0.distance(c.p1) + c.p1.distance(c.p2) + c.p2.distance(c.p3)
+    }
+
+    /// An anchor and its incoming and outgoing handles.
+    type Knot = ((f64, f64), (f64, f64), (f64, f64));
+
+    /// A closed path through `pts`.
+    fn outline(pts: &[Knot]) -> PathData {
+        let a = |&(p, i, o): &Knot| Anchor { p: p.into(), h_in: i.into(), h_out: o.into(), ..Anchor::corner(p.into()) };
+        PathData::single(SubPath::new(pts.iter().map(a).collect(), true))
+    }
+
+    #[test]
+    fn a_top_object_side_of_straight_segments_spreads_by_length() {
+        // The top side runs (0,0) → (30,0) → (100,0): each straight piece takes its length's share.
+        let kind = EnvelopeKind::TopObject { path: top_split_at_30(), corners: None };
+        let map = envelope_mapper(&kind, Rect::new(0.0, 0.0, 100.0, 50.0));
+        for (q, want) in [((50.0, 0.0), (50.0, 0.0)), ((15.0, 0.0), (15.0, 0.0)), ((80.0, 0.0), (80.0, 0.0)), ((50.0, 25.0), (50.0, 25.0))] {
+            let p = map(Point::new(q.0, q.1));
+            assert!(p.distance(Point::new(want.0, want.1)) < 1e-6, "{q:?} → {p:?}, want {want:?}");
+        }
+    }
+
+    #[test]
+    fn a_top_object_shares_a_side_by_control_polygon_length() {
+        // Two curves of unequal polygons make the top side; the anchor between them lands at the
+        // first one's share, and inside each curve the content follows its parameter.
+        let first = CubicBez::new((0.0, 0.0), (10.0, -20.0), (30.0, -20.0), (40.0, 0.0));
+        let second = CubicBez::new((40.0, 0.0), (60.0, 10.0), (90.0, 10.0), (100.0, 0.0));
+        let path = outline(&[
+            ((0.0, 0.0), (0.0, 0.0), (10.0, -20.0)),
+            ((40.0, 0.0), (30.0, -20.0), (60.0, 10.0)),
+            ((100.0, 0.0), (90.0, 10.0), (100.0, 0.0)),
+            ((100.0, 80.0), (100.0, 80.0), (100.0, 80.0)),
+            ((0.0, 80.0), (0.0, 80.0), (0.0, 80.0)),
+        ]);
+        let c = Coons::from_top_object(&path, None).unwrap();
+        let share = polygon(first) / (polygon(first) + polygon(second));
+        assert!(c.eval(share, 0.0).distance(Point::new(40.0, 0.0)) < 1e-9, "{:?}", c.eval(share, 0.0));
+        for f in [0.25, 0.5, 0.75] {
+            let p = c.eval(share * f, 0.0);
+            assert!(p.distance(first.eval(f)) < 1e-9, "first curve at {f}: {p:?}");
+            let p = c.eval(share + (1.0 - share) * f, 0.0);
+            assert!(p.distance(second.eval(f)) < 1e-9, "second curve at {f}: {p:?}");
+        }
+    }
+
+    #[test]
+    fn a_rounded_rectangle_top_object_stays_close_to_the_identity() {
+        // The corners fall at the middle of each corner arc. Each half arc takes the share of its
+        // control polygon, so the straight edges stay close to where the content was.
+        let r = Rect::new(0.0, 0.0, 200.0, 100.0);
+        let path = shapes::rounded_rectangle(r, 10.0);
+        let c = Coons::from_top_object(&path, None).unwrap();
+        let [tl, tr, br, bl] = c.corners();
+        let k = 10.0 * (1.0 - std::f64::consts::FRAC_1_SQRT_2);
+        for (p, want) in [(tl, (k, k)), (tr, (200.0 - k, k)), (br, (200.0 - k, 100.0 - k)), (bl, (k, 100.0 - k))] {
+            assert!(p.distance(Point::from(want)) < 0.01, "corner {p:?}, want {want:?}");
+        }
+        for (u, v) in [(0.25, 0.0), (0.5, 0.0), (0.8, 1.0), (0.0, 0.5), (0.5, 0.5), (1.0, 0.3)] {
+            let p = c.eval(u, v);
+            assert!(p.distance(Point::new(200.0 * u, 100.0 * v)) < 3.0, "({u}, {v}) → {p:?}");
+        }
+        // The top edge starts after the first half arc's share.
+        let sp = &path.subpaths[0];
+        let edge = Point::new(10.0, 0.0);
+        let arc = (0..sp.segment_count())
+            .filter(|i| !sp.segment_is_line(*i))
+            .map(|i| sp.segment(i))
+            .find(|s| s.p0.distance(edge) < 1e-9 || s.p3.distance(edge) < 1e-9)
+            .unwrap();
+        let half = polygon(if arc.p3.distance(edge) < 1e-9 { arc.subsegment(0.5..1.0) } else { arc.subsegment(0.0..0.5) });
+        let p = c.eval(half / (2.0 * half + 180.0), 0.0);
+        assert!(p.distance(Point::new(10.0, 0.0)) < 1e-6, "{p:?}");
+    }
+
+    #[test]
+    fn a_top_object_corner_inside_a_bulging_curve_is_the_nearest_outline_point() {
+        // The top left anchor's handle bulges out past the corner, so the anchor turns inward
+        // there and the corner falls inside the curve.
+        // The outline's bounding box starts at (-7.957, -22.222); the top curve's point nearest
+        // that corner, found by sampling the curve 2,000,000 times, is (-5.072093, -18.127254).
+        let path = outline(&[
+            ((0.0, 0.0), (0.0, 0.0), (-50.0, -50.0)),
+            ((200.0, 0.0), (150.0, 0.0), (200.0, 0.0)),
+            ((200.0, 100.0), (200.0, 100.0), (200.0, 100.0)),
+            ((0.0, 100.0), (0.0, 100.0), (0.0, 100.0)),
+        ]);
+        let want = Point::new(-5.072093, -18.127254);
+        let tl = Coons::from_top_object(&path, None).unwrap().corners()[0];
+        assert!(tl.distance(want) < 1e-5, "{tl:?}, want {want:?}");
+        assert!(tl.distance(Point::ZERO) > 1.0, "{tl:?}");
+    }
+
+    #[test]
+    fn a_top_object_corner_takes_an_anchor_only_near_its_box_corner() {
+        // A chamfered top left corner of a 200 × 100 outline. With both chamfer anchors within
+        // 47.5% of the box from its corner, the nearer anchor is the corner.
+        let chamfer = |a: (f64, f64), b: (f64, f64)| {
+            let c = |p: (f64, f64)| (p, p, p);
+            outline(&[c(a), c(b), c((200.0, 0.0)), c((200.0, 100.0)), c((0.0, 100.0))])
+        };
+        let tl = Coons::from_top_object(&chamfer((0.0, 46.0), (94.0, 0.0)), None).unwrap().corners()[0];
+        assert!(tl.distance(Point::new(0.0, 46.0)) < 1e-9, "{tl:?}");
+        // Farther out, neither anchor counts: the corner is the chamfer's point nearest the box corner.
+        let tl = Coons::from_top_object(&chamfer((0.0, 50.0), (100.0, 0.0)), None).unwrap().corners()[0];
+        assert!(tl.distance(Point::new(20.0, 40.0)) < 1e-6, "{tl:?}");
+    }
+
+    #[test]
+    fn a_top_object_corner_skips_smooth_and_inward_anchors() {
+        // A top left anchor whose outgoing handle turns from its incoming one by `deg` degrees
+        // (positive turns out of the outline). The top side bulges up past it.
+        let shape = |deg: f64| {
+            let a = deg.to_radians();
+            let (hx, hy) = (50.0 * a.cos() + 40.0 * a.sin(), 40.0 * a.cos() - 50.0 * a.sin());
+            outline(&[
+                ((50.0, -300.0), (25.0, -280.0), (50.0 + hx, -300.0 - hy)),
+                ((250.0, -300.0), (200.0, -340.0), (250.0, -300.0)),
+                ((250.0, -200.0), (250.0, -200.0), (250.0, -200.0)),
+                ((50.0, -200.0), (50.0, -200.0), (50.0, -230.0)),
+            ])
+        };
+        let corner = |deg: f64| Coons::from_top_object(&shape(deg), None).unwrap().corners()[0];
+        let anchor = Point::new(50.0, -300.0);
+        for deg in [0.0, 0.4, 0.6, -1.5] {
+            assert!(corner(deg).distance(anchor) > 1.0, "{deg}°: {:?}", corner(deg));
+        }
+        for deg in [0.9, 1.5, 10.0] {
+            assert!(corner(deg).distance(anchor) < 1e-9, "{deg}°: {:?}", corner(deg));
+        }
+    }
+
+    #[test]
+    fn a_top_object_corner_skips_an_inward_anchor_between_straight_segments() {
+        // A 200 × 100 outline of straight segments with a notch at its top left: (40,40) is the
+        // anchor nearest the box corner, but it turns into the outline, so (60,0) is the corner.
+        let c = |p: (f64, f64)| (p, p, p);
+        let path = outline(&[c((60.0, 0.0)), c((200.0, 0.0)), c((200.0, 100.0)), c((0.0, 100.0)), c((0.0, 60.0)), c((40.0, 40.0))]);
+        let tl = Coons::from_top_object(&path, None).unwrap().corners()[0];
+        assert!(tl.distance(Point::new(60.0, 0.0)) < 1e-9, "{tl:?}");
+    }
+
+    #[test]
+    fn a_top_object_corner_tie_goes_to_the_first_anchor() {
+        // Both chamfer anchors lie 30 from the box corner: the first one along the outline, in
+        // the order it was drawn, wins.
+        let c = |p: (f64, f64)| (p, p, p);
+        let tl = |pts: &[Knot]| Coons::from_top_object(&outline(pts), None).unwrap().corners()[0];
+        let from_left = tl(&[c((0.0, 30.0)), c((30.0, 0.0)), c((100.0, 0.0)), c((100.0, 100.0)), c((0.0, 100.0))]);
+        assert!(from_left.distance(Point::new(0.0, 30.0)) < 1e-9, "{from_left:?}");
+        let from_top = tl(&[c((30.0, 0.0)), c((100.0, 0.0)), c((100.0, 100.0)), c((0.0, 100.0)), c((0.0, 30.0))]);
+        assert!(from_top.distance(Point::new(30.0, 0.0)) < 1e-9, "{from_top:?}");
+        // Drawn counter-clockwise, the anchor met first in that order wins.
+        let back = tl(&[c((0.0, 100.0)), c((100.0, 100.0)), c((100.0, 0.0)), c((30.0, 0.0)), c((0.0, 30.0))]);
+        assert!(back.distance(Point::new(30.0, 0.0)) < 1e-9, "{back:?}");
+        let back = tl(&[c((0.0, 30.0)), c((0.0, 100.0)), c((100.0, 100.0)), c((100.0, 0.0)), c((30.0, 0.0))]);
+        assert!(back.distance(Point::new(0.0, 30.0)) < 1e-9, "{back:?}");
+    }
+
+    #[test]
+    fn a_reflected_top_object_keeps_the_corners_a_file_gives() {
+        // Reflecting the outline across x = 0 keeps its anchors in the same order, now running
+        // counter-clockwise: the corners stay on the same anchors, so the content is reflected too.
+        let mut path = top_split_at_30();
+        path.transform(Affine::FLIP_X);
+        let c = Coons::from_top_object(&path, Some([1, 2, 3, 4])).unwrap();
+        let want = [(-30.0, 0.0), (-100.0, 0.0), (-100.0, 50.0), (0.0, 50.0)].map(Point::from);
+        assert!(c.corners().iter().zip(want).all(|(p, q)| p.distance(q) < 1e-9), "{:?}", c.corners());
+        let p = c.eval(0.5, 0.5);
+        assert!(p.distance(Point::new(-50.0, 17.5)) < 1e-9, "{p:?}");
+    }
+
+    #[test]
+    fn a_top_object_keeps_the_corners_a_file_gives() {
+        let same = |a: [Point; 4], b: [Point; 4]| a.iter().zip(b).all(|(p, q)| p.distance(q) < 1e-9);
+        let want = [(30.0, 0.0), (100.0, 0.0), (100.0, 50.0), (0.0, 50.0)].map(Point::from);
+        let c = Coons::from_top_object(&top_split_at_30(), Some([1, 2, 3, 4])).unwrap();
+        assert!(same(c.corners(), want), "{:?}", c.corners());
+        // Drawn the other way round, with the corners counted along that order.
+        let mut back = top_split_at_30();
+        back.subpaths[0].reverse();
+        let c = Coons::from_top_object(&back, Some([3, 2, 1, 0])).unwrap();
+        assert!(same(c.corners(), want), "{:?}", c.corners());
+        // Corners that repeat, run out of order or go past the outline are found from it instead.
+        let found = [(0.0, 0.0), (100.0, 0.0), (100.0, 50.0), (0.0, 50.0)].map(Point::from);
+        for bad in [[0, 0, 3, 4], [2, 1, 3, 4], [1, 2, 3, 9]] {
+            let c = Coons::from_top_object(&top_split_at_30(), Some(bad)).unwrap();
+            assert!(same(c.corners(), found), "{bad:?}: {:?}", c.corners());
+        }
+    }
+
+    #[test]
+    fn a_split_curve_moves_the_top_object_share_to_its_new_anchor() {
+        // Splitting the top curve at t = 0.3 keeps its shape but changes the polygon shares: the
+        // new anchor lands at the first piece's share, not at u = 0.3.
+        let top = CubicBez::new((0.0, 0.0), (40.0, -40.0), (160.0, -40.0), (200.0, 0.0));
+        let (a, b) = (top.subsegment(0.0..0.3), top.subsegment(0.3..1.0));
+        let path = outline(&[
+            ((0.0, 0.0), (0.0, 0.0), a.p1.into()),
+            (a.p3.into(), a.p2.into(), b.p1.into()),
+            ((200.0, 0.0), b.p2.into(), (200.0, 0.0)),
+            ((200.0, 100.0), (200.0, 100.0), (200.0, 100.0)),
+            ((0.0, 100.0), (0.0, 100.0), (0.0, 100.0)),
+        ]);
+        let c = Coons::from_top_object(&path, None).unwrap();
+        let share = polygon(a) / (polygon(a) + polygon(b));
+        assert!(c.eval(share, 0.0).distance(a.p3) < 1e-9, "{:?}", c.eval(share, 0.0));
+        assert!((share - 0.3).abs() > 0.01, "{share}");
+    }
+
+    #[test]
+    fn a_rectangle_top_object_is_the_identity() {
+        let r = Rect::new(10.0, 20.0, 110.0, 70.0);
+        let c = Coons::from_top_object(&shapes::rectangle(r), None).unwrap();
+        for (u, v) in [(0.125, 0.3), (0.9, 0.05), (0.37, 0.81)] {
+            let p = c.eval(u, v);
+            assert!(p.distance(Point::new(10.0 + 100.0 * u, 20.0 + 50.0 * v)) < 1e-9, "({u}, {v}) → {p:?}");
+        }
+    }
+
+    #[test]
+    fn a_straight_line_top_object_maps_onto_its_bounding_box() {
+        let line = PathData::single(SubPath::new(vec![Anchor::corner(Point::new(0.0, 0.0)), Anchor::corner(Point::new(100.0, 40.0))], false));
+        let p = Coons::from_top_object(&line, None).unwrap().eval(0.25, 0.75);
+        assert!(p.distance(Point::new(25.0, 30.0)) < 1e-9, "{p:?}");
+    }
+
+    #[test]
+    fn a_top_object_spreads_a_segment_by_its_parameter() {
+        // The top side is one straight segment whose handles sit at 60 and 80: its parameter
+        // reaches the middle at x = 63.75, not at 45.
+        let mut top = vec![Anchor::corner(Point::new(0.0, 0.0)), Anchor::corner(Point::new(90.0, 0.0))];
+        top[0].h_out = Point::new(60.0, 0.0);
+        top[1].h_in = Point::new(80.0, 0.0);
+        top.extend([Anchor::corner(Point::new(90.0, 40.0)), Anchor::corner(Point::new(0.0, 40.0))]);
+        let kind = EnvelopeKind::TopObject { path: PathData::single(SubPath::new(top, true)), corners: None };
+        let map = envelope_mapper(&kind, Rect::new(0.0, 0.0, 10.0, 10.0));
+        let p = map(Point::new(5.0, 0.0));
+        assert!(p.distance(Point::new(63.75, 0.0)) < 1e-6, "{p:?}");
+        let p = map(Point::new(5.0, 10.0));
+        assert!(p.distance(Point::new(45.0, 40.0)) < 1e-6, "{p:?}");
+    }
+
+    #[test]
+    fn a_top_object_follows_a_curved_side_by_its_parameter() {
+        // The top side bends down from (0,0) to (100,0) through handles at (20,30) and (90,30):
+        // halfway along its parameter it passes (53.75, 22.5).
+        let mut top = vec![Anchor::corner(Point::new(0.0, 0.0)), Anchor::corner(Point::new(100.0, 0.0))];
+        top[0].h_out = Point::new(20.0, 30.0);
+        top[1].h_in = Point::new(90.0, 30.0);
+        top.extend([Anchor::corner(Point::new(100.0, 80.0)), Anchor::corner(Point::new(0.0, 80.0))]);
+        let path = PathData::single(SubPath::new(top, true));
+        let c = Coons::from_top_object(&path, None).unwrap();
+        for (u, t) in [(0.5, 0.5), (0.25, 0.25), (0.8125, 0.8125)] {
+            let want = CubicBez::new((0.0, 0.0), (20.0, 30.0), (90.0, 30.0), (100.0, 0.0)).eval(t);
+            let p = c.eval(u, 0.0);
+            assert!(p.distance(want) < 1e-6, "u {u}: {p:?} vs {want:?}");
+        }
+        // Drawn the other way round, the outline gives the same patch.
+        let mut back = path.clone();
+        back.subpaths[0].reverse();
+        let p = Coons::from_top_object(&back, None).unwrap().eval(0.5, 0.0);
+        assert!(p.distance(Point::new(53.75, 22.5)) < 1e-6, "{p:?}");
+    }
+
+    #[test]
+    fn a_top_object_side_of_many_segments_keeps_each_corner() {
+        // The top side zigzags through `n` straight segments, between y = 0 and y = 2.
+        for n in [3, 100] {
+            let w = f64::from(n);
+            let zig = |i: i32| Point::new(f64::from(i) * 100.0 / w, if i % 2 == 1 { 2.0 } else { 0.0 });
+            let mut pts: Vec<Anchor> = (0..=n).map(|i| Anchor::corner(zig(i))).collect();
+            pts.extend([Anchor::corner(Point::new(100.0, 50.0)), Anchor::corner(Point::new(0.0, 50.0))]);
+            let c = Coons::from_top_object(&PathData::single(SubPath::new(pts, true)), None).unwrap();
+            for i in (1..n).filter(|i| n < 10 || [1, 37, 38, 99].contains(i)) {
+                let p = c.eval(f64::from(i) / w, 0.0);
+                assert!(p.distance(zig(i)) < 1e-9, "{n} segments, anchor {i}: {p:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn a_gradient_mesh_outline_keeps_its_sides_measured_by_length() {
+        let c = Coons::from_path(&top_split_at_30()).unwrap();
+        let p = c.eval(0.5, 0.0);
+        assert!(p.distance(Point::new(50.0, 0.0)) < 1e-6, "{p:?}");
+    }
+
     #[test]
     fn grid_identity() {
         let r = Rect::new(0.0, 0.0, 100.0, 100.0);
diff --git a/crates/doc/src/live/envelope.rs b/crates/doc/src/live/envelope.rs
index a58ae9c27..3fdddd680 100644
--- a/crates/doc/src/live/envelope.rs
+++ b/crates/doc/src/live/envelope.rs
@@ -32,7 +32,14 @@ pub enum EnvelopeKind {
         handles: Vec<[Vec2; 4]>,
     },
     /// The content's bounding box maps onto the outline of this path.
-    TopObject { path: PathData },
+    TopObject {
+        path: PathData,
+        /// The anchors (indices into the outline, the path's largest subpath, in its own order)
+        /// at the top left, top right, bottom right and bottom left corners, as a saved file gives
+        /// them. `None`: the corners are found from the outline.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        corners: Option<[u32; 4]>,
+    },
 }
 
 /// Envelope Options → Preserve Shape Using: how a distorted raster keeps the envelope's shape.
@@ -518,7 +525,7 @@ pub fn envelope_overlay(n: &Node) -> Option<(PathData, Option<GradientMesh>)> {
             Some((grid.lines(), Some(grid)))
         }
         EnvelopeKind::Warp { .. } => Some((EnvelopeMap::of(n)?.surface_mesh(4, 4, Color::BLACK).lines(), None)),
-        EnvelopeKind::TopObject { path } => Some((path.clone(), None)),
+        EnvelopeKind::TopObject { path, .. } => Some((path.clone(), None)),
     }
 }
 
@@ -642,7 +649,7 @@ pub fn envelope_bounds(content: &[Arc<Node>], kind: &EnvelopeKind, frame: Affine
             let first = *points.first()?;
             Some(points.iter().fold(Rect::from_points(first, first), |r, p| r.union_pt(*p)))
         }
-        EnvelopeKind::TopObject { path } => path.bounds(),
+        EnvelopeKind::TopObject { path, .. } => path.bounds(),
         EnvelopeKind::Warp { .. } => EnvelopeMap::new(content, kind, frame, options)?.bounds(),
     }
 }
diff --git a/crates/doc/src/live/mesh.rs b/crates/doc/src/live/mesh.rs
index a87cbd9b4..ca08a3a2a 100644
--- a/crates/doc/src/live/mesh.rs
+++ b/crates/doc/src/live/mesh.rs
@@ -73,13 +73,16 @@ const SIDE: usize = 65;
 
 /// Four boundary curves (top TL→TR, right TR→BR, bottom BL→BR, left TL→BL), each resampled to
 /// [`SIDE`] points, from the outline of a closed path split at the points nearest its bounding
-/// box corners.
+/// box corners. [`Coons::from_top_object`] samples its sides at the places `knots` gives instead.
 #[derive(Clone, Debug)]
 pub struct Coons {
     top: Vec<Point>,
     right: Vec<Point>,
     bottom: Vec<Point>,
     left: Vec<Point>,
+    /// Where along its side (0 to 1, rising) each point of the top, right, bottom and left side
+    /// lies; `None` when the points are evenly spaced.
+    knots: Option<Box<[Vec<f64>; 4]>>,
 }
 
 impl Coons {
@@ -87,9 +90,11 @@ impl Coons {
     pub fn rect(r: Rect) -> Self {
         let line = |a: Point, b: Point| (0..SIDE).map(|i| a.lerp(b, i as f64 / (SIDE - 1) as f64)).collect::<Vec<_>>();
         let (tl, tr, br, bl) = (Point::new(r.x0, r.y0), Point::new(r.x1, r.y0), Point::new(r.x1, r.y1), Point::new(r.x0, r.y1));
-        Self { top: line(tl, tr), right: line(tr, br), bottom: line(bl, br), left: line(tl, bl) }
+        Self { top: line(tl, tr), right: line(tr, br), bottom: line(bl, br), left: line(tl, bl), knots: None }
     }
 
+    /// The patch of `path`'s outline, each side measured by its length: equal steps in `u` or `v`
+    /// cover equal lengths of the side.
     pub fn from_path(path: &PathData) -> Option<Self> {
         // The largest subpath is the outline.
         let sp = path.subpaths.iter().filter(|s| s.anchors.len() >= 2).max_by(|a, b| a.area().abs().total_cmp(&b.area().abs()))?;
@@ -136,7 +141,145 @@ impl Coons {
         bottom.reverse();
         let mut left = resample(&arc(bl, tl), SIDE);
         left.reverse();
-        Some(Self { top, right, bottom, left })
+        Some(Self { top, right, bottom, left, knots: None })
+    }
+
+    /// The patch of a top object's outline (the largest subpath of `path`), split into four sides
+    /// at its corners. Each piece of a side between two anchors or corners takes a share of `u` or
+    /// `v` in proportion to the length of its control polygon, spread along the piece by its own
+    /// curve parameter. A segment without handles counts as a cubic with its handles a third of
+    /// the way along, so the content spreads evenly along it. `corners` are the anchors (indices
+    /// into the outline, in its own order) at the top left, top right, bottom right and bottom
+    /// left, as a saved file gives them. They stay on those anchors when they run the way the
+    /// outline does or the opposite way, so a reflected outline keeps them; without them, or when
+    /// they don't fit the outline, each corner is found from the outline ([`top_object_corner`]).
+    /// A straight segment closes an open subpath, and segments of no length are left out. A top
+    /// object's envelope maps onto this patch.
+    pub fn from_top_object(path: &PathData, corners: Option<[u32; 4]>) -> Option<Self> {
+        let sp = path.subpaths.iter().filter(|s| s.anchors.len() >= 2).max_by(|a, b| a.area().abs().total_cmp(&b.area().abs()))?;
+        let mut sp = sp.clone();
+        let count = sp.anchors.len();
+        // Stored corners count only when they are distinct anchors met in order around the outline.
+        let fits = |c: &[usize; 4]| {
+            if !c.iter().all(|i| *i < count) {
+                return false;
+            }
+            let gaps: Vec<usize> = (0..4).map(|k| (c[(k + 1) % 4] + count - c[k]) % count).collect();
+            gaps.iter().all(|g| *g > 0) && gaps.iter().sum::<usize>() == count
+        };
+        let given = corners.map(|c| c.map(|i| i as usize));
+        // Stored corners met in the outline's own order keep it as drawn, even counter-clockwise
+        // (a reflected outline). Otherwise orient it clockwise in y-down (TL → TR → BR → BL).
+        let mut corners = given.filter(fits);
+        let reversed = corners.is_none() && sp.signed_area() < 0.0;
+        if reversed {
+            sp.reverse();
+            corners = given.map(|c| c.map(|i| count.saturating_sub(1).saturating_sub(i))).filter(fits);
+        }
+        // Each segment, and whether it is straight: a straight one's parameter runs evenly along it.
+        let line = |a: Point, b: Point| (CubicBez::new(a, a.lerp(b, 1.0 / 3.0), a.lerp(b, 2.0 / 3.0), b), true);
+        let mut segs: Vec<(usize, (CubicBez, bool))> = (0..sp.segment_count())
+            .map(|i| {
+                let c = sp.segment(i);
+                (i, if sp.segment_is_line(i) { line(c.p0, c.p3) } else { (c, false) })
+            })
+            .collect();
+        if !sp.closed
+            && let (Some(a), Some(b)) = (sp.anchors.last(), sp.anchors.first())
+        {
+            segs.push((count.saturating_sub(1), line(a.p, b.p)));
+        }
+        segs.retain(|(_, (c, _))| [c.p1, c.p2, c.p3].iter().any(|p| p.distance(c.p0) > 1e-9));
+        // The kept segment that anchor `k` starts (a segment of no length starts where the next begins).
+        let starts: Vec<usize> = segs.iter().map(|(i, _)| *i).collect();
+        // Where each kept segment and the anchor it starts at come in the outline as drawn: a tie
+        // between corners goes to the one met first there.
+        let order: Vec<(usize, usize)> = starts
+            .iter()
+            .map(|&i| if reversed { (count.saturating_sub(1).saturating_sub(i), (2 * count).saturating_sub(2 + i) % count.max(1)) } else { (i, i) })
+            .collect();
+        let segs: Vec<(CubicBez, bool)> = segs.into_iter().map(|(_, s)| s).collect();
+        let r = segs.iter().map(|(c, _)| c.bounding_box()).reduce(|a, b| a.union(b)).or_else(|| path.bounds())?;
+        // An outline of fewer than three points (a straight line there and back) maps onto its
+        // bounding box, as in `from_path`.
+        if segs.len() < 2 || (segs.len() == 2 && segs.iter().all(|(_, straight)| *straight)) {
+            return Some(Self::rect(r));
+        }
+        let n = segs.len() as f64;
+        let at = |s: f64| {
+            let s = s.rem_euclid(n);
+            let i = (s.floor() as usize).min(segs.len() - 1);
+            segs.get(i).map_or(Point::ZERO, |(c, _)| c.eval((s - i as f64).clamp(0.0, 1.0)))
+        };
+        // The side from `a` to `b`: its points, and where along it (0 to 1) each lies. It runs
+        // through pieces of segments, split at `a` and `b`. Each piece takes its share of the side
+        // by the length of its control polygon and holds points at even steps of its parameter
+        // (at least 16, and at least `SIDE` points on the side), its ends included. A side of
+        // many pieces takes fewer points in each, so it holds at most `MAX_SIDE_POINTS` points,
+        // or one for each piece when it has more pieces than that.
+        let side = |a: f64, b: f64| {
+            let span = (b - a).rem_euclid(n);
+            if !(span.is_finite() && span > 0.0) {
+                return (vec![at(a), at(a)], vec![0.0, 1.0]);
+            }
+            let mut pieces: Vec<CubicBez> = vec![];
+            let (mut s, end) = (a, a + span);
+            while s < end - 1e-12 && pieces.len() <= segs.len() {
+                let i = s.floor();
+                let next = (i + 1.0).min(end);
+                if let Some((c, _)) = segs.get((i as usize) % segs.len()) {
+                    pieces.push(c.subsegment((s - i).clamp(0.0, 1.0)..(next - i).clamp(0.0, 1.0)));
+                }
+                s = next;
+            }
+            let polygon = |c: &CubicBez| c.p0.distance(c.p1) + c.p1.distance(c.p2) + c.p2.distance(c.p3);
+            let mut weights: Vec<f64> = pieces.iter().map(polygon).collect();
+            let mut total: f64 = weights.iter().sum();
+            if !(total.is_finite() && total > 0.0) {
+                weights.iter_mut().for_each(|w| *w = 1.0);
+                total = weights.len().max(1) as f64;
+            }
+            let count = pieces.len().max(1);
+            let per = 16usize.max((SIDE - 1).div_ceil(count));
+            let per = if count * per < MAX_SIDE_POINTS { per } else { (MAX_SIDE_POINTS / count).max(1) };
+            let mut pts = vec![pieces.first().map_or_else(|| at(a), |c| c.p0)];
+            let mut knots = vec![0.0];
+            let mut before = 0.0;
+            for (c, w) in pieces.iter().zip(&weights) {
+                for k in 1..=per {
+                    let f = k as f64 / per as f64;
+                    pts.push(c.eval(f));
+                    knots.push((before + w * f) / total);
+                }
+                before += w;
+            }
+            if let Some(last) = knots.last_mut() {
+                *last = 1.0;
+            }
+            (pts, knots)
+        };
+        let (tl, tr, br, bl) = match corners {
+            // Anchor `k` sits at the start of the first kept segment from it on.
+            Some(c) => {
+                let place = |k: usize| starts.iter().position(|i| *i >= k).unwrap_or(0) as f64;
+                (place(c[0]), place(c[1]), place(c[2]), place(c[3]))
+            }
+            None => {
+                let corner = |q: Point| top_object_corner(&segs, &order, r, q);
+                (corner(Point::new(r.x0, r.y0)), corner(Point::new(r.x1, r.y0)), corner(Point::new(r.x1, r.y1)), corner(Point::new(r.x0, r.y1)))
+            }
+        };
+        let flip = |(mut p, mut u): (Vec<Point>, Vec<f64>)| {
+            p.reverse();
+            u.reverse();
+            u.iter_mut().for_each(|x| *x = 1.0 - *x);
+            (p, u)
+        };
+        let (top, top_u) = side(tl, tr);
+        let (right, right_u) = side(tr, br);
+        let (bottom, bottom_u) = flip(side(br, bl));
+        let (left, left_u) = flip(side(bl, tl));
+        Some(Self { top, right, bottom, left, knots: Some(Box::new([top_u, right_u, bottom_u, left_u])) })
     }
 
     /// The point at `u` along a side; past its ends the end segments go on straight (art an
@@ -147,10 +290,36 @@ impl Coons {
         side[i].lerp(side[i + 1], s - i as f64)
     }
 
+    /// The point at `u` along a side whose points lie at `knots` (rising, 0 to 1); past its ends
+    /// the end segments go on straight, as in [`Self::sample`].
+    fn sample_at(side: &[Point], knots: &[f64], u: f64) -> Point {
+        if side.len() < 2 || side.len() != knots.len() {
+            return side.first().copied().unwrap_or_default();
+        }
+        let i = knots.partition_point(|k| *k <= u).clamp(1, side.len() - 1) - 1;
+        let (k0, k1) = (knots[i], knots[i + 1]);
+        let f = if k1 > k0 { (u - k0) / (k1 - k0) } else { 0.0 };
+        side[i].lerp(side[i + 1], f)
+    }
+
+    /// The point at `u` along side `which` (0 top, 1 right, 2 bottom, 3 left).
+    fn side_at(&self, which: usize, u: f64) -> Point {
+        let side = match which {
+            0 => &self.top,
+            1 => &self.right,
+            2 => &self.bottom,
+            _ => &self.left,
+        };
+        match self.knots.as_deref().and_then(|k| k.get(which)) {
+            Some(knots) => Self::sample_at(side, knots, u),
+            None => Self::sample(side, u),
+        }
+    }
+
     /// The surface point at (u, v) ∈ [0,1]².
     pub fn eval(&self, u: f64, v: f64) -> Point {
-        let (t, b, l, r) = (Self::sample(&self.top, u), Self::sample(&self.bottom, u), Self::sample(&self.left, v), Self::sample(&self.right, v));
-        let (p00, p10, p01, p11) = (self.top[0], self.top[SIDE - 1], self.bottom[0], self.bottom[SIDE - 1]);
+        let (t, b, l, r) = (self.side_at(0, u), self.side_at(2, u), self.side_at(3, v), self.side_at(1, v));
+        let [p00, p10, p11, p01] = self.corners();
         let c = (1.0 - v) * t.to_vec2() + v * b.to_vec2() + (1.0 - u) * l.to_vec2() + u * r.to_vec2()
             - ((1.0 - u) * (1.0 - v) * p00.to_vec2() + u * (1.0 - v) * p10.to_vec2() + (1.0 - u) * v * p01.to_vec2() + u * v * p11.to_vec2());
         c.to_point()
@@ -158,7 +327,93 @@ impl Coons {
 
     /// The four corners TL, TR, BR, BL.
     pub fn corners(&self) -> [Point; 4] {
-        [self.top[0], self.top[SIDE - 1], self.bottom[SIDE - 1], self.bottom[0]]
+        let end = |side: &[Point]| side.last().copied().unwrap_or_default();
+        [self.top[0], end(&self.top), end(&self.bottom), self.bottom[0]]
+    }
+}
+
+/// The most points one side of [`Coons::from_top_object`] holds while it adds points between its
+/// anchors.
+const MAX_SIDE_POINTS: usize = 1 << 16;
+
+/// How far into the outline's bounding box, as a share of its width and of its height, a corner
+/// of a top object looks for an anchor.
+const CORNER_REACH: f64 = 0.475;
+
+/// A handle this long (in points) or shorter makes its anchor a corner of a top object.
+const SHORT_HANDLE: f64 = 0.01;
+
+/// An anchor whose tangent directions, as unit vectors, differ by less than this in x and in y is
+/// smooth, and is not a corner of a top object.
+const SMOOTH_TURN: f64 = 0.01;
+
+/// A top object's corner this close (in curve parameter) to either end of its segment moves onto
+/// the anchor there.
+const CORNER_END_SNAP: f64 = 0.005;
+
+/// Is the anchor at `a`, reached by handle `h_in` and left by handle `h_out` on an outline that
+/// runs clockwise on screen, a corner of a top object? A handle of [`SHORT_HANDLE`] or shorter
+/// makes it one. Otherwise its tangent directions must differ by [`SMOOTH_TURN`] or more and turn
+/// clockwise, so it points out of the outline. A straight segment's handles here are the ones
+/// [`Coons::from_top_object`] gives it, a third of the way along, so an anchor between two
+/// straight segments longer than three times [`SHORT_HANDLE`] is a corner only when it turns out
+/// of the outline.
+fn top_object_corner_anchor(h_in: Point, a: Point, h_out: Point) -> bool {
+    let (vin, vout) = (a - h_in, h_out - a);
+    let (len_in, len_out) = (vin.hypot(), vout.hypot());
+    if len_in <= SHORT_HANDLE || len_out <= SHORT_HANDLE {
+        return true;
+    }
+    let (ui, uo) = (vin / len_in, vout / len_out);
+    if (ui.x - uo.x).abs() < SMOOTH_TURN && (ui.y - uo.y).abs() < SMOOTH_TURN {
+        return false;
+    }
+    ui.cross(uo) >= 0.0
+}
+
+/// Where along `segs` (segment index + parameter, in [0, n)) the corner of a top object nearest
+/// corner `q` of its bounding box `r` lies, for an outline that runs clockwise on screen. It is
+/// the nearest anchor to `q` that is a corner ([`top_object_corner_anchor`]) and lies within
+/// [`CORNER_REACH`] of the box's width and height from `q`. Without one, it is the nearest point
+/// of the outline to `q`, moved onto its segment's anchor when within [`CORNER_END_SNAP`] of
+/// either end. `order` gives where each segment's first anchor and the segment itself come in the
+/// outline as drawn, which may run the other way; on a tie the one met first there wins.
+fn top_object_corner(segs: &[(CubicBez, bool)], order: &[(usize, usize)], r: Rect, q: Point) -> f64 {
+    use vectorcraft_geom::kurbo::ParamCurveNearest;
+    let n = segs.len();
+    if n == 0 {
+        return 0.0;
+    }
+    let rank = |i: usize| order.get(i).copied().unwrap_or((i, i));
+    let (reach_x, reach_y) = (r.width() * CORNER_REACH, r.height() * CORNER_REACH);
+    let mut best: Option<(f64, usize, usize)> = None;
+    for i in 0..n {
+        let (Some((prev, _)), Some((cur, _))) = (segs.get((i + n - 1) % n), segs.get(i)) else { continue };
+        let a = cur.p0;
+        if (a.x - q.x).abs() > reach_x || (a.y - q.y).abs() > reach_y || !top_object_corner_anchor(prev.p2, a, cur.p1) {
+            continue;
+        }
+        let (d, k) = (a.distance_squared(q), rank(i).0);
+        if best.is_none_or(|(b, bk, _)| d < b || (d == b && k < bk)) {
+            best = Some((d, k, i));
+        }
+    }
+    if let Some((_, _, i)) = best {
+        return i as f64;
+    }
+    let tol = (r.width() + r.height()).max(1e-6) * 1e-9;
+    let nearest = segs
+        .iter()
+        .enumerate()
+        .map(|(i, (c, _))| (c.nearest(q, tol), i))
+        .min_by(|a, b| a.0.distance_sq.total_cmp(&b.0.distance_sq).then(rank(a.1).1.cmp(&rank(b.1).1)));
+    let Some((near, i)) = nearest else { return 0.0 };
+    if near.t > CORNER_END_SNAP && near.t < 1.0 - CORNER_END_SNAP {
+        i as f64 + near.t
+    } else if near.t < 0.5 {
+        i as f64
+    } else {
+        ((i + 1) % n) as f64
     }
 }
 
@@ -1033,7 +1288,7 @@ pub(super) fn surface_of<'a>(kind: &'a EnvelopeKind, src: Rect, frame: Affine) -
             let (rows, cols) = (*rows as usize, *cols as usize);
             Box::new(move |u: f64, v: f64| grid_eval(rows, cols, points, u, v))
         }
-        EnvelopeKind::TopObject { path } => match Coons::from_path(path) {
+        EnvelopeKind::TopObject { path, corners } => match Coons::from_top_object(path, *corners) {
             Some(co) => Box::new(move |u: f64, v: f64| co.eval(u, v)),
             None => Box::new(flat),
         },
diff --git a/crates/doc/src/node/extras.rs b/crates/doc/src/node/extras.rs
index 90b2726d3..6865ff7e6 100644
--- a/crates/doc/src/node/extras.rs
+++ b/crates/doc/src/node/extras.rs
@@ -69,6 +69,9 @@ pub struct NodeExtras {
     /// As an envelope with margins in Edit Contents, the margins its strokes gave when Edit Contents
     /// began ([`crate::live::EnvelopeOptions::bounds_margin`]).
     pub envelope_edit_margin: Option<[f32; 4]>,
+    /// Transform panel › Align to Pixel Grid: the path's or compound path's horizontal and vertical
+    /// segments stay on the pixel grid when it is transformed.
+    pub pixel_aligned: bool,
 }
 
 /// No extras: what [`Node::extras`] gives for a node without any.
@@ -95,6 +98,7 @@ pub(super) static NO_EXTRAS: NodeExtras = NodeExtras {
     shape_mode: crate::ShapeMode::Add,
     symbol_overrides: Vec::new(),
     envelope_edit_margin: None,
+    pixel_aligned: false,
 };
 
 /// A node's [`NodeExtras`], if it has any ([`Node::extras`]). Extras that are all unset equal
diff --git a/crates/doc/src/node/ops.rs b/crates/doc/src/node/ops.rs
index 2b2bef296..0af1d0d79 100644
--- a/crates/doc/src/node/ops.rs
+++ b/crates/doc/src/node/ops.rs
@@ -448,6 +448,9 @@ impl Node {
         if self.appearance.gradients().next().is_some() {
             self.appearance.transform_gradients(a);
         }
+        if self.appearance.has_svg_filter() {
+            self.appearance.transform_svg_filters(a);
+        }
         if sc.patterns {
             crate::pattern::transform_pattern_paints(self, a);
         }
@@ -508,7 +511,7 @@ impl Node {
                             *h = (lin * h.to_point()).to_vec2();
                         }
                     }
-                    EnvelopeKind::TopObject { path } => path.transform(a),
+                    EnvelopeKind::TopObject { path, .. } => path.transform(a),
                     EnvelopeKind::Warp { .. } => {}
                 }
             }
diff --git a/crates/doc/src/node/tests.rs b/crates/doc/src/node/tests.rs
index ee29f75eb..43a8ac97b 100644
--- a/crates/doc/src/node/tests.rs
+++ b/crates/doc/src/node/tests.rs
@@ -22,6 +22,7 @@ fn extras_are_written_flat_in_order() {
         e.compound_shape = true;
         e.shape_mode = crate::ShapeMode::Exclude;
         e.envelope_edit_margin = Some([0.5, 0.5, 0.25, 0.25]);
+        e.pixel_aligned = true;
     }
     /// The top-level keys of a JSON object, in the order written.
     struct Keys(Vec<String>);
@@ -67,9 +68,11 @@ fn extras_are_written_flat_in_order() {
         "compound_shape",
         "shape_mode",
         "envelope_edit_margin",
+        "pixel_aligned",
     ];
     assert_eq!(keys, order);
     assert_eq!(v["shape_mode"], "exclude");
+    assert_eq!(v["pixel_aligned"], true);
     assert_eq!(serde_json::from_value::<Node>(v).unwrap(), n);
     let plain = Node::path(NodeId(9), shapes::rectangle(Rect::new(0.0, 0.0, 4.0, 2.0)), Appearance::default_art());
     let back: Node = serde_json::from_value(serde_json::to_value(&plain).unwrap()).unwrap();
diff --git a/crates/doc/src/node/wire.rs b/crates/doc/src/node/wire.rs
index 32191f58c..b54d3f4b8 100644
--- a/crates/doc/src/node/wire.rs
+++ b/crates/doc/src/node/wire.rs
@@ -54,6 +54,7 @@ impl Serialize for Node {
             is_default(&e.shape_mode),
             e.symbol_overrides.is_empty(),
             e.envelope_edit_margin.is_none(),
+            is_default(&e.pixel_aligned),
         ];
         let mut st = s.serialize_struct("Node", skips.iter().filter(|s| !**s).count())?;
         let mut skip = skips.into_iter();
@@ -96,6 +97,7 @@ impl Serialize for Node {
         field!("shape_mode", &e.shape_mode);
         field!("symbol_overrides", &e.symbol_overrides);
         field!("envelope_edit_margin", &e.envelope_edit_margin);
+        field!("pixel_aligned", &e.pixel_aligned);
         st.end()
     }
 }
@@ -236,6 +238,8 @@ pub(super) struct NodeWire {
     symbol_overrides: Vec<crate::SymbolOverride>,
     #[serde(default)]
     envelope_edit_margin: Option<[f32; 4]>,
+    #[serde(default)]
+    pixel_aligned: bool,
 }
 
 impl From<NodeWire> for Node {
@@ -263,6 +267,7 @@ impl From<NodeWire> for Node {
             shape_mode: w.shape_mode,
             symbol_overrides: w.symbol_overrides,
             envelope_edit_margin: w.envelope_edit_margin,
+            pixel_aligned: w.pixel_aligned,
         };
         Node {
             id: w.id,
diff --git a/crates/doc/src/records.rs b/crates/doc/src/records.rs
index a6988f502..00c79a6d2 100644
--- a/crates/doc/src/records.rs
+++ b/crates/doc/src/records.rs
@@ -126,6 +126,23 @@ impl SavedSelection {
     }
 }
 
+/// An SVG filter the document holds (Effect › SVG Filters): a `<filter>` element named by its
+/// `id`, listed in the SVG Filters submenu and in Apply SVG Filter.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SvgFilter {
+    /// The filter element's `id`.
+    pub name: String,
+    /// The `<filter>` element's XML, as it was written.
+    pub xml: String,
+}
+
+impl SvgFilter {
+    /// Most SVG filters a document holds.
+    pub const MAX: usize = 64;
+    /// Longest filter element, in bytes.
+    pub const MAX_XML: usize = 64 * 1024;
+}
+
 /// A symbol definition.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Symbol {
diff --git a/crates/doc/src/selection.rs b/crates/doc/src/selection.rs
index f03402791..643f81c36 100644
--- a/crates/doc/src/selection.rs
+++ b/crates/doc/src/selection.rs
@@ -54,6 +54,20 @@ pub struct Selection {
     /// the engine then sets the document's from it. Editing state, never saved.
     #[serde(skip)]
     pub new_art: Arc<HashSet<NodeId>>,
+    /// An object of a dynamic symbol instance's art, selected with Direct Selection: the instance
+    /// is the one selected object, and solid fill and stroke changes go to its own appearance for
+    /// that object ([`crate::symbol_overrides`]). Any other selection change clears it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub symbol_part: Option<SymbolPart>,
+}
+
+/// See [`Selection::symbol_part`].
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SymbolPart {
+    /// The symbol instance.
+    pub instance: NodeId,
+    /// The object in the symbol's art, as [`crate::symbol_overrides::part`] names it.
+    pub path: Vec<u32>,
 }
 
 impl Selection {
@@ -79,6 +93,13 @@ impl Selection {
         self.slices.clear();
         self.guides.clear();
         self.key_guide = None;
+        self.symbol_part = None;
+    }
+    /// Select only instance `instance`, with the object at `path` of its symbol's art (see
+    /// [`Selection::symbol_part`]).
+    pub fn set_symbol_part(&mut self, instance: NodeId, path: Vec<u32>) {
+        self.set([instance]);
+        self.symbol_part = Some(SymbolPart { instance, path });
     }
     /// Is there a key for Align: an object or a guide?
     pub fn has_key(&self) -> bool {
@@ -93,6 +114,7 @@ impl Selection {
     pub fn add(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.symbol_part = None;
         if !self.objects.contains(&id) {
             self.objects.push(id);
         }
@@ -100,6 +122,7 @@ impl Selection {
     pub fn remove(&mut self, id: NodeId) {
         self.target = None;
         self.slices.clear();
+        self.symbol_part = None;
         self.objects.retain(|x| *x != id);
         self.anchors.remove(&id);
         self.segments.remove(&id);
@@ -128,6 +151,7 @@ impl Selection {
     /// Add ruler guide `i` to the selection, or take it out, keeping the selected objects (a
     /// Shift-click on a guide).
     pub fn toggle_guide(&mut self, i: usize) {
+        self.symbol_part = None;
         if let Some(k) = self.guides.iter().position(|g| *g == i) {
             self.guides.remove(k);
             if self.key_guide == Some(i) {
@@ -207,6 +231,27 @@ impl Selection {
         if self.key.is_some() || self.objects.is_empty() || self.key_guide.is_some_and(|k| !self.guides.contains(&k)) {
             self.key_guide = None;
         }
+        // A selected part needs its instance selected alone, with no guides, its symbol dynamic
+        // and the object still in the symbol's art as a path, compound path or type, where neither
+        // it nor a group or layer around it is hidden, locked or a template.
+        let editable_part = |art: &crate::Node, path: &[u32]| {
+            crate::symbol_overrides::part(art, path).is_some_and(crate::symbol_overrides::takes_part_paint)
+                && (0..=path.len())
+                    .all(|k| crate::symbol_overrides::part(art, &path[..k]).is_some_and(|n| n.visible && !n.locked && !n.is_template()))
+        };
+        let part_kept = self.symbol_part.as_ref().is_some_and(|sp| {
+            self.objects == [sp.instance]
+                && self.guides.is_empty()
+                && found.get(&sp.instance).and_then(|p| doc.node_at(p)).is_some_and(|n| match &n.kind {
+                    NodeKind::SymbolInstance { symbol, .. } => {
+                        doc.symbols.iter().find(|s| s.name == *symbol).is_some_and(|s| s.dynamic && editable_part(&s.art, &sp.path))
+                    }
+                    _ => false,
+                })
+        });
+        if !part_kept {
+            self.symbol_part = None;
+        }
     }
     /// Deselect the objects that are hidden or locked, themselves or through a group or layer
     /// around them (and so the key object when it is one): hidden or locked art can't stay
@@ -238,6 +283,9 @@ impl Selection {
         }
         self.target = None;
         self.slices.clear();
+        if self.symbol_part.as_ref().is_some_and(|sp| gone.contains(&sp.instance)) {
+            self.symbol_part = None;
+        }
         self.objects.retain(|o| !gone.contains(o));
         self.anchors.retain(|id, _| !gone.contains(id));
         self.segments.retain(|id, _| !gone.contains(id));
diff --git a/crates/doc/src/selection/tests.rs b/crates/doc/src/selection/tests.rs
index 5665f1140..7882fef73 100644
--- a/crates/doc/src/selection/tests.rs
+++ b/crates/doc/src/selection/tests.rs
@@ -41,6 +41,82 @@ fn guides_are_selected_on_their_own() {
     assert_eq!(s.guides, vec![0]);
 }
 
+/// A picked object of a dynamic symbol's instance stays picked while it and the groups and layers
+/// around it in the symbol's art are visible, unlocked and not a template. An art edit that hides
+/// or locks it, or one around it, or makes a layer around it a template, drops the pick.
+#[test]
+fn a_picked_symbol_part_is_dropped_once_it_cannot_be_edited() {
+    let rect = || vectorcraft_geom::shapes::rectangle(vectorcraft_geom::Rect::new(0.0, 0.0, 10.0, 10.0));
+    let mut d = Document::new(100.0, 100.0);
+    let l = d.layers[0].id;
+    let leaf = Node::path(d.alloc_id(), rect(), crate::Appearance::default_art());
+    let group = Node::group(d.alloc_id(), vec![Arc::new(leaf)]);
+    let layer = Node::layer(d.alloc_id(), "Inner", crate::LayerColor::Preset(2));
+    let root = Node::group(d.alloc_id(), vec![Arc::new(group), Arc::new(layer)]);
+    d.symbols.push(crate::Symbol { dynamic: true, name: "Parts".into(), art: Arc::new(root.clone()) });
+    let inst = d.alloc_id();
+    d.insert(Some(l), 0, Node::new(inst, NodeKind::SymbolInstance { symbol: "Parts".into(), xf: vectorcraft_geom::Affine::IDENTITY })).unwrap();
+    // The layer in the art holds a path too.
+    let in_layer = Node::path(d.alloc_id(), rect(), crate::Appearance::default_art());
+    let mut art = root;
+    if let Some(NodeKind::Layer { children, .. }) = art.children_mut().and_then(|c| c.get_mut(1)).map(|c| &mut Arc::make_mut(c).kind) {
+        children.push(Arc::new(in_layer));
+    }
+    d.symbols[0].art = Arc::new(art.clone());
+    let picked = |d: &Document, path: &[u32]| {
+        let mut s = Selection::default();
+        s.set_symbol_part(inst, path.to_vec());
+        s.prune(d);
+        s.symbol_part.is_some()
+    };
+    assert!(picked(&d, &[0, 0]) && picked(&d, &[1, 0]), "editable parts stay picked");
+    assert!(!picked(&d, &[0]) && !picked(&d, &[1]) && !picked(&d, &[]), "a group or layer does not stay picked");
+    let edited = |change: &dyn Fn(&mut Node)| {
+        let mut d = d.clone();
+        let mut art = art.clone();
+        change(&mut art);
+        d.symbols[0].art = Arc::new(art);
+        d
+    };
+    let child = |art: &mut Node, path: &[usize]| -> Node {
+        let mut n = &*art;
+        for &i in path {
+            n = &n.children().unwrap()[i];
+        }
+        n.clone()
+    };
+    let set = |art: &mut Node, path: &[usize], n: Node| {
+        let mut at = art;
+        for &i in path {
+            at = Arc::make_mut(&mut at.children_mut().unwrap()[i]);
+        }
+        *at = n;
+    };
+    let hidden = edited(&|art| {
+        let mut n = child(art, &[0, 0]);
+        n.visible = false;
+        set(art, &[0, 0], n);
+    });
+    assert!(!picked(&hidden, &[0, 0]), "the part is hidden");
+    let locked_group = edited(&|art| {
+        let mut n = child(art, &[0]);
+        n.locked = true;
+        set(art, &[0], n);
+    });
+    assert!(!picked(&locked_group, &[0, 0]), "the group around it is locked");
+    assert!(picked(&locked_group, &[1, 0]), "a part outside the locked group stays");
+    let template = edited(&|art| {
+        let mut n = child(art, &[1]);
+        if let NodeKind::Layer { template, .. } = &mut n.kind {
+            *template = true;
+        }
+        set(art, &[1], n);
+    });
+    assert!(!picked(&template, &[1, 0]), "the layer around it is a template");
+    let hidden_root = edited(&|art| art.visible = false);
+    assert!(!picked(&hidden_root, &[0, 0]), "the art is hidden");
+}
+
 #[test]
 fn guides_show_and_lock_with_their_layer() {
     let mut d = Document::new(100.0, 100.0);
diff --git a/crates/doc/src/swatches.rs b/crates/doc/src/swatches.rs
index 5caada836..5aa6147fa 100644
--- a/crates/doc/src/swatches.rs
+++ b/crates/doc/src/swatches.rs
@@ -176,7 +176,7 @@ impl Document {
     pub fn visit_paints(&self, f: &mut dyn FnMut(&Paint)) {
         let mut tree = |n: &Node| {
             walk_with_masks(n, &mut |m| {
-                node_paints(m).for_each(&mut *f);
+                node_paints(m).chain(override_paints(m)).for_each(&mut *f);
                 if let NodeKind::Mesh(mesh) = &m.kind {
                     mesh.points.iter().for_each(|p| f(&Paint::solid(p.color)));
                 }
@@ -275,10 +275,11 @@ fn map_style_paint(attrs: &mut serde_json::Map<String, serde_json::Value>, key:
 }
 
 /// Every colour in the subtree of `n` with the swatch it links to: solid fills, strokes, text runs
-/// and gradient stops (with their link), then mesh points (unlinked), in paint order.
+/// and gradient stops (with their link), a dynamic symbol instance's own paints
+/// ([`override_paints`]), then mesh points (unlinked), in paint order.
 pub fn node_colors(n: &Node, f: &mut dyn FnMut(&Color, Option<&str>)) {
     n.walk(&mut |m| {
-        for p in node_paints(m) {
+        for p in node_paints(m).chain(override_paints(m)) {
             match p {
                 Paint::Solid { color, swatch, .. } => f(color, swatch.as_deref()),
                 Paint::Gradient(g) => g.gradient.stops.iter().for_each(|s| f(&s.color, s.swatch.as_deref())),
@@ -315,6 +316,12 @@ pub fn node_paints(n: &Node) -> impl Iterator<Item = &Paint> {
     n.appearance.items.iter().map(item_paint).chain(runs.iter().flat_map(|r| [&r.style.fill, &r.style.stroke])).chain(n.extras().colorize.as_deref())
 }
 
+/// The paints a dynamic symbol instance keeps for objects of its art
+/// ([`crate::symbol_overrides`]), which [`node_paints`] leaves out.
+pub fn override_paints(n: &Node) -> impl Iterator<Item = &Paint> {
+    n.extras().symbol_overrides.iter().flat_map(|o| [o.fill.as_ref(), o.stroke.as_ref()]).flatten()
+}
+
 /// Mutable [`node_paints`], in the same order.
 pub fn node_paints_mut(n: &mut Node) -> impl Iterator<Item = &mut Paint> {
     let runs = match &mut n.kind {
@@ -353,6 +360,20 @@ fn map_node(n: &Node, f: &mut LinkFn) -> Option<(Node, usize)> {
         }
         out = Some(m);
     }
+    // A dynamic symbol instance's own paints for objects of its art (`symbol_overrides`).
+    if !n.extras().symbol_overrides.is_empty() {
+        let mut overrides = n.extras().symbol_overrides.clone();
+        let mut k = 0;
+        for p in overrides.iter_mut().flat_map(|o| [&mut o.fill, &mut o.stroke]).flatten() {
+            if matches!(p, Paint::Solid { .. } | Paint::Gradient(_)) && p.map_links(f) {
+                k += 1;
+            }
+        }
+        if k > 0 {
+            out.get_or_insert_with(|| n.clone()).extras_mut().symbol_overrides = overrides;
+            count += k;
+        }
+    }
     if let Some(ch) = n.children() {
         for (i, c) in ch.iter().enumerate() {
             if let Some((new, k)) = map_node(c, f) {
diff --git a/crates/doc/src/symbol_nine_slice.rs b/crates/doc/src/symbol_nine_slice.rs
index acc682872..995445f57 100644
--- a/crates/doc/src/symbol_nine_slice.rs
+++ b/crates/doc/src/symbol_nine_slice.rs
@@ -451,6 +451,18 @@ impl NineSliceMap {
         self.most_at(art, &boxes, 0)
     }
 
+    /// The affine map that [`Self::place`] and [`Self::place_unclipped`] move object `n` by as one
+    /// piece, with everything in it: the map of the cell its box lies in, or of the cell at the
+    /// origin when it has no box. `None` when its box crosses a guide.
+    pub fn one_cell(&self, n: &Node, doc: &Document) -> Option<Affine> {
+        let boxes = doc.symbol_boxes().quick();
+        let Some(b) = n.geometric(Some(&boxes)).map(|b| self.natural.transform_rect_bbox(b)).filter(|b| finite(*b)) else {
+            return Some(self.cell_at(Point::ZERO));
+        };
+        let (cols, rows) = (self.x.cells(b.x0, b.x1), self.y.cells(b.y0, b.y1));
+        (cols[0] == cols[1] && rows[0] == rows[1]).then(|| self.cell_xf(cols[0], rows[0]))
+    }
+
     /// [`Self::most_placed`] for [`Self::place_unclipped`]: the most objects it makes of `art`.
     pub fn most_placed_unclipped(&self, art: &Node, doc: &Document) -> u64 {
         Self { clips: false, ..*self }.most_placed(art, doc)
diff --git a/crates/doc/src/symbol_overrides.rs b/crates/doc/src/symbol_overrides.rs
index b4e3a726f..33f0fd769 100644
--- a/crates/doc/src/symbol_overrides.rs
+++ b/crates/doc/src/symbol_overrides.rs
@@ -49,6 +49,10 @@ impl SymbolOverride {
                     r.style.fill = p.clone();
                 }
                 if let Some(p) = &self.stroke {
+                    // A painted stroke on characters without a weight gets 1 pt, as a path's does.
+                    if !p.is_none() && r.style.stroke_width == 0.0 {
+                        r.style.stroke_width = 1.0;
+                    }
                     r.style.stroke = p.clone();
                 }
             }
@@ -57,6 +61,14 @@ impl SymbolOverride {
                 n.appearance.set_fill(p.clone());
             }
             if let Some(p) = &self.stroke {
+                // A stroke without paint has no weight; painting it gives it 1 pt.
+                if !p.is_none()
+                    && let Some(s) = n.appearance.stroke_mut()
+                    && s.paint.is_none()
+                    && s.width == 0.0
+                {
+                    s.width = 1.0;
+                }
                 n.appearance.set_stroke(p.clone());
             }
         }
@@ -69,6 +81,13 @@ impl SymbolOverride {
     }
 }
 
+/// Can Direct Selection select `n`, an object of a dynamic symbol's art, and change its fill and
+/// stroke for one instance? Paths, compound paths and type can; groups, images and every other
+/// object cannot.
+pub fn takes_part_paint(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. } | NodeKind::Text(_))
+}
+
 /// An override's path read from a file: at most [`MAX_PATH_DEPTH`] indices, so a compressed file
 /// of one endless path stays small once read.
 fn short_path<'de, D: serde::Deserializer<'de>>(d: D) -> Result<Vec<u32>, D::Error> {
@@ -180,6 +199,27 @@ mod tests {
         assert_eq!(kept.len(), 1);
     }
 
+    #[test]
+    fn a_stroke_on_type_without_a_weight_gets_one_point() {
+        let red = Paint::solid(Color::rgb(1.0, 0.0, 0.0));
+        let style = crate::CharStyle { stroke: Paint::None, stroke_width: 0.0, ..crate::CharStyle::default() };
+        let text = Node::new(NodeId(2), NodeKind::Text(Box::new(crate::TextObject::point(vectorcraft_geom::Point::ZERO, "Hi", style))));
+        let mut a = Node::group(NodeId(1), vec![Arc::new(text)]);
+        apply(&mut a, &[SymbolOverride { path: vec![0], stroke: Some(red.clone()), ..Default::default() }]);
+        let Some(NodeKind::Text(t)) = part(&a, &[0]).map(|n| &n.kind) else { panic!("type") };
+        assert!(t.runs.iter().all(|r| r.style.stroke == red && r.style.stroke_width == 1.0), "the stroke draws at 1 pt");
+
+        // A path whose stroke has neither paint nor weight gets 1 pt too.
+        let mut ap = Appearance::default_art();
+        if let Some(s) = ap.stroke_mut() {
+            (s.paint, s.width) = (Paint::None, 0.0);
+        }
+        let path = Node::path(NodeId(3), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), ap);
+        let mut a = Node::group(NodeId(1), vec![Arc::new(path)]);
+        apply(&mut a, &[SymbolOverride { path: vec![0], stroke: Some(red.clone()), ..Default::default() }]);
+        assert_eq!(part(&a, &[0]).unwrap().appearance.stroke_width(), 1.0);
+    }
+
     #[test]
     fn a_path_deeper_than_the_cap_does_not_read() {
         let deep = format!("{{\"path\":{:?}}}", vec![0; MAX_PATH_DEPTH + 1]);
diff --git a/crates/effects/Cargo.toml b/crates/effects/Cargo.toml
index 9abbc299f..407831285 100644
--- a/crates/effects/Cargo.toml
+++ b/crates/effects/Cargo.toml
@@ -17,6 +17,11 @@ vectorcraft-text = { workspace = true }
 vectorcraft-plugins = { workspace = true }
 image = { workspace = true }
 kurbo = { workspace = true }
+# Effect › SVG Filters draws its filters with resvg (MIT OR Apache-2.0), at the usvg version the
+# workspace reads SVG with; raster-images decodes the object's pixels it hands the filter as a PNG.
+resvg = { version = "0.48", default-features = false, features = ["raster-images"] }
+# The number lists of filter attributes, read as usvg reads them (MIT OR Apache-2.0; already used by usvg).
+svgtypes = "0.16"
 serde_json = { workspace = true }
 
 [dev-dependencies]
diff --git a/crates/effects/src/bake.rs b/crates/effects/src/bake.rs
index cdde7d135..3eaf685f0 100644
--- a/crates/effects/src/bake.rs
+++ b/crates/effects/src/bake.rs
@@ -28,7 +28,7 @@ use crate::distort::{transform_move, transform_offsets};
 use crate::group::{has_own_paint, paints};
 use crate::reshape::{as_art, geometry_effects, glyph_outlines, outline_nested_text, reshape_leaves};
 use crate::{
-    GeomContext, adjust_in_document, apply_geometry_with, crop_marks_art, evaluate_container, has_adjustment, has_crop_marks, has_geometry,
+    GeomContext, adjust_in_document, apply_geometry_carrying, crop_marks_art, evaluate_container, has_adjustment, has_crop_marks, has_geometry,
     has_item_geometry, has_pathfinder, is_geometry, is_pathfinder, merged_params, needs_outline, outline_text, reshape,
 };
 
@@ -71,12 +71,27 @@ fn geometry(n: &Node) -> Option<(PathData, FillRule)> {
     }
 }
 
-fn apply(effects: &[vectorcraft_doc::Effect], path: &PathData, ctx: &GeomContext) -> PathData {
+/// `path` with the geometry effects of `effects` applied, and how gradients follow them
+/// ([`crate::Carry`]).
+fn apply(effects: &[vectorcraft_doc::Effect], path: &PathData, ctx: &GeomContext) -> (PathData, crate::Carry) {
     if !has_geometry(effects) || path.is_empty() {
-        return path.clone();
+        return (path.clone(), crate::Carry::default());
     }
     let b = vectorcraft_geom::Shape::bounding_box(&path.to_bezpath());
-    apply_geometry_with(effects, path, b, ctx)
+    apply_geometry_carrying(effects, path, b, ctx)
+}
+
+/// The geometry `g` with the own effects of `item` (one of the fills and strokes `ctx` is the
+/// context of) applied, and `carried` (`item` as the object's effects left it) with its gradient
+/// moved along with them.
+fn apply_item(item: &AppearanceItem, carried: &AppearanceItem, g: &PathData, ctx: &GeomContext) -> (PathData, AppearanceItem) {
+    let (ig, carry) = apply(item_effects(item), g, &ctx.item(item));
+    let mut ap = Appearance { items: vec![carried.clone()], ..Default::default() };
+    if !carry.moves(&ap) {
+        return (ig, carried.clone());
+    }
+    carry.apply(&mut ap);
+    (ig, ap.items.pop().unwrap_or_else(|| carried.clone()))
 }
 
 /// A path node of `kind`'s flavour (compound when the result has several subpaths).
@@ -414,12 +429,15 @@ fn piece(d: &mut Document, n: &Node, path: PathData, rule: FillRule, item: Appea
 }
 
 /// `n`'s geometry with its object-level geometry effects applied, its fill rule, the context of
-/// its effects, and `n` without those effects.
+/// its effects, and `n` without those effects, its gradients moved along with them.
 fn leaf_base(n: &Node) -> Option<(PathData, FillRule, GeomContext<'_>, Node)> {
     let (base, rule) = geometry(n)?;
     let ctx = GeomContext::of(n);
-    let g = apply(&n.appearance.effects, &base, &ctx);
     let mut m = n.clone();
+    let (g, carry) = apply(&n.appearance.effects, &base, &ctx);
+    if carry.moves(&m.appearance) {
+        carry.apply(&mut m.appearance);
+    }
     m.appearance.effects.retain(|e| !is_geometry(&e.id));
     Some((g, rule, ctx, m))
 }
@@ -436,9 +454,9 @@ fn bake_leaf(d: &mut Document, n: &Node) -> Option<Node> {
         .appearance
         .items
         .iter()
-        .map(|item| {
-            let ig = apply(item_effects(item), &g, &ctx.item(item));
-            let mut it = item.clone();
+        .zip(&m.appearance.items)
+        .map(|(item, carried)| {
+            let (ig, mut it) = apply_item(item, carried, &g, &ctx);
             clear_item_effects(&mut it);
             Arc::new(piece(d, n, ig, rule, it))
         })
@@ -470,9 +488,8 @@ pub fn expand_leaf(d: &mut Document, n: &Node, stroke_art: StrokeArt) -> Option<
     let (g, rule, ctx, mut m) = leaf_base(n)?;
     m.appearance.effects.retain(|e| e.visible);
     let mut pieces = vec![];
-    for item in n.appearance.items.iter().filter(|i| paints(i)) {
-        let ig = apply(item.effects(), &g, &ctx.item(item));
-        let mut it = item.clone();
+    for (item, carried) in n.appearance.items.iter().zip(&m.appearance.items).filter(|(i, _)| paints(i)) {
+        let (ig, mut it) = apply_item(item, carried, &g, &ctx);
         clear_item_effects(&mut it);
         it.effects_mut().retain(|e| e.visible);
         let p = match &it {
@@ -562,9 +579,8 @@ pub fn bake_appearance(n: &Node) -> Option<Node> {
         Arc::new(p)
     };
     let mut pieces = vec![];
-    for item in n.appearance.items.iter().filter(|i| paints(i)) {
-        let ig = apply(item_effects(item), &g, &ctx.item(item));
-        let mut it = item.clone();
+    for (item, carried) in n.appearance.items.iter().zip(&m.appearance.items).filter(|(i, _)| paints(i)) {
+        let (ig, mut it) = apply_item(item, carried, &g, &ctx);
         clear_item_effects(&mut it);
         pieces.push(match &it {
             AppearanceItem::Stroke(st) if st.brush.is_none() => {
diff --git a/crates/effects/src/bake/tests.rs b/crates/effects/src/bake/tests.rs
index e16742270..0ff1cdac0 100644
--- a/crates/effects/src/bake/tests.rs
+++ b/crates/effects/src/bake/tests.rs
@@ -17,6 +17,20 @@ fn fx(id: &str, params: serde_json::Value) -> Effect {
     Effect { id: id.into(), params, visible: true }
 }
 
+/// Asserts that placed gradient `got` has `want`'s start, end, aspect and focal point, within 1e-6.
+fn assert_geom_near(got: vectorcraft_color::GradientGeom, want: vectorcraft_color::GradientGeom, what: &str) {
+    let near = |a: Point, b: Point| a.distance(b) < 1e-6;
+    let focal = match (got.focal, want.focal) {
+        (None, None) => true,
+        (Some(a), Some(b)) => near(a, b),
+        _ => false,
+    };
+    assert!(
+        near(got.start, want.start) && near(got.end, want.end) && (got.aspect - want.aspect).abs() < 1e-6 && focal,
+        "{what}: got {got:?}, want {want:?}"
+    );
+}
+
 fn doc_with(n: Node) -> Document {
     let mut d = Document::new(400.0, 400.0);
     let l = d.layers[0].id;
@@ -45,6 +59,157 @@ fn object_effects_become_geometry_and_raster_effects_stay() {
     assert_eq!(m.appearance.effects[0].id, "stylize.dropShadow");
 }
 
+#[test]
+fn a_baked_transform_moves_a_placed_gradient_with_the_path() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: Point::new(0.0, 50.0), end: Point::new(100.0, 50.0), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let placed_geom = |n: &Node| match n.appearance.fill_paint() {
+        Paint::Gradient(g) => g.geom.unwrap(),
+        p => panic!("a gradient: {p:?}"),
+    };
+    // A move 30 pt right, and a turn of 90° with the width halved about the center (50, 50): the
+    // square becomes 100 pt wide and 50 pt tall, and the gradient runs from the bottom up.
+    let moves = [
+        (json!({"moveH": 30.0}), Point::new(30.0, 0.0), GradientGeom { start: Point::new(30.0, 50.0), end: Point::new(130.0, 50.0), ..geom }),
+        (
+            json!({"rotate": 90.0, "scaleH": 50.0}),
+            Point::new(0.0, 25.0),
+            GradientGeom { start: Point::new(50.0, 75.0), end: Point::new(50.0, 25.0), ..geom },
+        ),
+    ];
+    // Alone, with a stroke whose own effect makes one path for each fill and stroke, and as the
+    // fill's own effect.
+    for (params, corner, want) in moves {
+        for (split, own) in [(false, false), (true, false), (true, true)] {
+            let mut ap = Appearance::basic(placed.clone(), Paint::solid(Color::BLACK), if split { 1.0 } else { 0.0 });
+            if split && let AppearanceItem::Stroke(s) = &mut ap.items[1] {
+                s.effects.push(fx("path.offsetPath", json!({"offset": 5.0})));
+            }
+            let transform = fx("distort.transform", params.clone());
+            if own {
+                ap.items[0].effects_mut().push(transform.clone());
+            }
+            let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), ap);
+            if !own {
+                n.appearance.effects.push(transform);
+            }
+            let d = bake_document(&doc_with(n)).unwrap();
+            let m = d.node(NodeId(50)).unwrap();
+            let fill: &Node = if split { &m.children().unwrap()[0] } else { m };
+            let b = fill.geometric_bounds().unwrap();
+            assert!(b.origin().distance(corner) < 1e-6, "{params}, split {split}, own {own}: {b:?}");
+            assert_geom_near(placed_geom(fill), want, &format!("{params}, split {split}, own {own}"));
+        }
+    }
+}
+
+/// A stroke's own Transform effect or Free Distort moves the gradient placed on that stroke.
+#[test]
+fn a_strokes_own_transform_and_free_distort_move_its_placed_gradient() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: Point::new(0.0, 50.0), end: Point::new(100.0, 50.0), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    // Moved 30 pt right by Transform, and one width (100 pt) right by Free Distort.
+    let moves = [
+        (fx("distort.transform", json!({"moveH": 30.0})), 30.0),
+        (fx("distort.freeDistort", json!({"corners": [[1.0, 0.0], [2.0, 0.0], [2.0, 1.0], [1.0, 1.0]]})), 100.0),
+    ];
+    for (e, moved) in moves {
+        let mut ap = Appearance::basic(Paint::None, placed.clone(), 4.0);
+        let Some(stroke) = ap.items.iter_mut().find(|i| matches!(i, AppearanceItem::Stroke(_))) else { panic!("a stroke") };
+        stroke.effects_mut().push(e.clone());
+        let n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), ap);
+        let d = bake_document(&doc_with(n)).unwrap();
+        let mut geoms = vec![];
+        d.node(NodeId(50)).unwrap().walk(&mut |c: &Node| {
+            for item in &c.appearance.items {
+                if let AppearanceItem::Stroke(s) = item
+                    && let Paint::Gradient(g) = &s.paint
+                {
+                    geoms.push(g.geom.unwrap());
+                }
+            }
+        });
+        assert!(!geoms.is_empty(), "{}: the stroke keeps its gradient", e.id);
+        let want = GradientGeom { start: Point::new(moved, 50.0), end: Point::new(100.0 + moved, 50.0), ..geom };
+        for g in geoms {
+            assert_geom_near(g, want, &e.id);
+        }
+    }
+}
+
+#[test]
+fn a_fills_gradient_follows_the_effects_around_its_transform_with_options() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: Point::new(0.0, 50.0), end: Point::new(100.0, 50.0), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let moved = fx("distort.transform", json!({"moveH": 30.0}));
+    let scales_strokes = fx("distort.transform", json!({"strokes": true}));
+    // A move before and a move after the fill's Transform effect with Scale Strokes & Effects on.
+    for fill_fx in [vec![moved.clone(), scales_strokes.clone()], vec![scales_strokes, moved]] {
+        let mut ap = Appearance::basic(placed.clone(), Paint::None, 0.0);
+        *ap.items[0].effects_mut() = fill_fx.clone();
+        let n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), ap);
+        let d = bake_document(&doc_with(n)).unwrap();
+        let mut found = vec![];
+        d.node(NodeId(50)).unwrap().walk(&mut |c: &Node| {
+            if let Paint::Gradient(g) = c.appearance.fill_paint() {
+                found.push((c.geometric_bounds().unwrap(), g.geom.unwrap()));
+            }
+        });
+        assert!(!found.is_empty(), "{fill_fx:?}: the fill keeps its gradient");
+        let want = GradientGeom { start: Point::new(30.0, 50.0), end: Point::new(130.0, 50.0), ..geom };
+        for (b, g) in found {
+            assert!(b.origin().distance(Point::new(30.0, 0.0)) < 1e-6, "{fill_fx:?}: {b:?}");
+            assert_geom_near(g, want, &format!("{fill_fx:?}"));
+        }
+    }
+}
+
+#[test]
+fn baked_free_distort_moves_placed_gradients_from_the_bounds_to_the_distorted_bounds() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = |kind| GradientPaint::new(Gradient::new(kind, stops.clone()));
+    let linear = GradientGeom { start: Point::new(20.0, 50.0), end: Point::new(80.0, 50.0), aspect: 1.0, focal: None };
+    let radial = GradientGeom { start: Point::new(40.0, 30.0), end: Point::new(60.0, 30.0), aspect: 0.5, focal: Some(Point::new(45.0, 32.0)) };
+    let placed_linear = Paint::Gradient(Box::new(GradientPaint { geom: Some(linear), ..ramp(GradientKind::Linear) }));
+    let placed_radial = Paint::Gradient(Box::new(GradientPaint { geom: Some(radial), ..ramp(GradientKind::Radial) }));
+    let fitted = Paint::Gradient(Box::new(ramp(GradientKind::Linear)));
+    let baked = |fill: &Paint, e: Effect| {
+        let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::basic(fill.clone(), Paint::None, 0.0));
+        n.appearance.effects.push(e);
+        let d = bake_document(&doc_with(n)).unwrap();
+        let m = d.node(NodeId(50)).unwrap();
+        match m.appearance.fill_paint() {
+            Paint::Gradient(g) => (m.geometric_bounds().unwrap(), (*g).clone()),
+            p => panic!("a gradient: {p:?}"),
+        }
+    };
+    let near = |a: Point, b: Point| a.distance(b) < 1e-6;
+    // The bottom right corner moves 50 pt right, so the bounds grow from 0..100 to 0..150 across.
+    let corners = json!({"corners": [[0.0, 0.0], [1.0, 0.0], [1.5, 1.0], [0.0, 1.0]]});
+    let distort = || fx("distort.freeDistort", corners.clone());
+    let (b, g) = baked(&placed_linear, distort());
+    assert!((b.x1 - 150.0).abs() < 1e-6, "{b:?}");
+    let geom = g.geom.unwrap();
+    assert!(near(geom.start, Point::new(30.0, 50.0)) && near(geom.end, Point::new(120.0, 50.0)), "{geom:?}");
+    // A radial gradient's center, focal point and ellipse take the same stretch: the radius along
+    // the vector grows from 20 to 30 pt and the 10 pt radius across it stays.
+    let (_, g) = baked(&placed_radial, distort());
+    let want = GradientGeom { start: Point::new(60.0, 30.0), end: Point::new(90.0, 30.0), aspect: 1.0 / 3.0, focal: Some(Point::new(67.5, 32.0)) };
+    assert_geom_near(g.geom.unwrap(), want, "radial");
+    // A fitted gradient stays fitted, and fits the distorted outline.
+    assert_eq!(baked(&fitted, distort()).1.geom, None);
+}
+
 #[test]
 fn item_effects_split_into_one_path_per_item() {
     let mut n = Node::path(NodeId(50), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default_art());
diff --git a/crates/effects/src/catalog.rs b/crates/effects/src/catalog.rs
index 844063932..07106ffc8 100644
--- a/crates/effects/src/catalog.rs
+++ b/crates/effects/src/catalog.rs
@@ -105,6 +105,8 @@ fn lengths_of(id: &str) -> Lengths {
         "sketch.waterPaper" => always(&["fiberLength"]),
         TRAP => always(&["thickness", "precision"]),
         RASTERIZE => always(&["addAround"]),
+        // The points one unit of the filter measures.
+        crate::SVG_FILTER => always(&["scale"]),
         _ => Lengths::default(),
     }
 }
@@ -223,7 +225,7 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "distort.freeDistort",
             "Free Distort…",
             DT,
-            "{corners: [[x,y]×4] (new positions of the bounding-box corners TL, TR, BR, BL in unit box coordinates; identity [[0,0],[1,0],[1,1],[0,1]])}",
+            "{corners: [[x,y]×4] (new positions of the bounding-box corners TL, TR, BR, BL in unit box coordinates; identity [[0,0],[1,0],[1,1],[0,1]]; placed gradients move and scale from the object's bounds to its distorted bounds)}",
             json!({"corners": [[0.0, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]]}),
         ),
         g("distort.puckerBloat", "Pucker & Bloat…", DT, "{amount: % (-200 pucker … 200 bloat, default 0)}", json!({"amount": 0.0})),
@@ -238,7 +240,7 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
             "distort.transform",
             "Transform…",
             DT,
-            "{scaleH: % (100), scaleV: % (100), moveH: pt (0; right = +), moveV: pt (0; down = +), rotate: deg (0; counter-clockwise), copies: 0..1000 (0; each copy transforms the last again), reflectX: bool (false; flips left to right), reflectY: bool (false; flips top to bottom), reference: 0..8 (4; the point of the bounds' 9-point grid it scales, rotates and reflects about: 0 top left, 4 centre, 8 bottom right), random: bool (false; each scale goes a random share of the way from 100 % to its value, each move and the angle a random share of theirs, differently for each object and the same on every redraw), objects: bool (true; Transform Objects: off, the geometry stays where it is and makes no copies, and only the two options below apply, once), patterns: bool (false; Transform Patterns: pattern fills and strokes transform along; with copies the original keeps its pattern and copy k takes the transformation k times), strokes: bool (false; Scale Strokes & Effects: stroke weights and dashes, and the distances of the effects on the fills and strokes, scale by the mean scale √|scaleH·scaleV|, copy k by its k-th power)}",
+            "{scaleH: % (100), scaleV: % (100), moveH: pt (0; right = +), moveV: pt (0; down = +), rotate: deg (0; counter-clockwise), copies: 0..1000 (0; each copy transforms the last again; placed gradients transform with the object and with each copy), reflectX: bool (false; flips left to right), reflectY: bool (false; flips top to bottom), reference: 0..8 (4; the point of the bounds' 9-point grid it scales, rotates and reflects about: 0 top left, 4 centre, 8 bottom right), random: bool (false; each scale goes a random share of the way from 100 % to its value, each move and the angle a random share of theirs, differently for each object and the same on every redraw), objects: bool (true; Transform Objects: off, the geometry stays where it is and makes no copies, and only the two options below apply, once), patterns: bool (false; Transform Patterns: pattern fills and strokes transform along; with copies the original keeps its pattern and copy k takes the transformation k times), strokes: bool (false; Scale Strokes & Effects: stroke weights and dashes, and the distances of the effects on the fills and strokes, scale by the mean scale √|scaleH·scaleV|, copy k by its k-th power)}",
             json!({"scaleH": 100.0, "scaleV": 100.0, "moveH": 0.0, "moveV": 0.0, "rotate": 0.0, "copies": 0, "reflectX": false, "reflectY": false, "reference": 4, "random": false, "objects": true, "patterns": false, "strokes": false}),
         ),
         g(
@@ -826,6 +828,13 @@ pub fn effect_catalog() -> Vec<EffectInfo> {
         "{colorModel: \"document\" (the document's mode, RGB or CMYK)|\"grayscale\"|\"bitmap\" (\"document\"), useDocumentResolution: bool (true: Document Raster Effects Settings › Resolution), resolution: ppi 1..2400 (72; with useDocumentResolution false), background: \"white\"|\"transparent\" (\"transparent\"), antiAlias: \"none\"|\"art\"|\"type\" (\"art\"; none: hard edges), clippingMask: bool (false; the image clipped to the art's outline), addAround: pt 0..1000 (0; room around the art)} draws the object as an image of square pixels over its bounds and the room around them, leaving its paths, type and other art as they are; when it is the object's only raster effect, Expand Appearance makes the image Object › Rasterize makes",
         json!({"colorModel": "document", "useDocumentResolution": true, "resolution": 72.0, "background": "transparent", "antiAlias": "art", "clippingMask": false, "addAround": 0.0}),
     ));
+    v.push(r(
+        crate::SVG_FILTER,
+        "SVG Filter",
+        &["Effect", "SVG Filters"],
+        "{name: string (the filter's id), xml: string (one SVG <filter> element with an id and 1..64 primitives, at most 64 KB), scale: number 0.001..1000 (1; points per unit of the filter's user space), origin: [x, y] pt ([0, 0]; where the filter's user space starts in the document)} runs the SVG filter on the object's pixels, its lengths in points times scale, at the Document Raster Effects resolution or finer; svgFilter.apply applies one of the document's filters (svgFilter.list)",
+        json!({"scale": 1.0, "origin": [0.0, 0.0]}),
+    ));
     v
 }
 
diff --git a/crates/effects/src/distort.rs b/crates/effects/src/distort.rs
index 1b496a9c5..c07045702 100644
--- a/crates/effects/src/distort.rs
+++ b/crates/effects/src/distort.rs
@@ -13,6 +13,21 @@ fn diag(b: Rect) -> f64 {
 /// Free Distort: bilinear map of the bounding box onto four new corners (unit box coordinates),
 /// making at most `max` anchors ([`map_nonlinear_within`]).
 pub fn free_distort(path: &PathData, b: Rect, p: &Value, max: usize) -> PathData {
+    let c = free_distort_corners(b, p);
+    let (w, h) = (b.width().max(1e-9), b.height().max(1e-9));
+    let f = |q: Point| {
+        let u = (q.x - b.x0) / w;
+        let v = (q.y - b.y0) / h;
+        let top = c[0].lerp(c[1], u);
+        let bot = c[3].lerp(c[2], u);
+        top.lerp(bot, v)
+    };
+    map_nonlinear_within(path, diag(b) / 16.0, max, f)
+}
+
+/// The four corners (top left, top right, bottom right, bottom left) Free Distort with params `p`
+/// moves bounding box `b`'s corners to, in the document.
+pub(crate) fn free_distort_corners(b: Rect, p: &Value) -> [Point; 4] {
     let mut c = [Point::new(0.0, 0.0), Point::new(1.0, 0.0), Point::new(1.0, 1.0), Point::new(0.0, 1.0)];
     if let Some(arr) = p.get("corners").and_then(Value::as_array) {
         for (i, v) in arr.iter().take(4).enumerate() {
@@ -26,16 +41,7 @@ pub fn free_distort(path: &PathData, b: Rect, p: &Value, max: usize) -> PathData
         }
     }
     let (w, h) = (b.width().max(1e-9), b.height().max(1e-9));
-    let to_doc = |q: Point| Point::new(b.x0 + q.x * w, b.y0 + q.y * h);
-    let c = c.map(to_doc);
-    let f = |q: Point| {
-        let u = (q.x - b.x0) / w;
-        let v = (q.y - b.y0) / h;
-        let top = c[0].lerp(c[1], u);
-        let bot = c[3].lerp(c[2], u);
-        top.lerp(bot, v)
-    };
-    map_nonlinear_within(path, diag(b) / 16.0, max, f)
+    c.map(|q| Point::new(b.x0 + q.x * w, b.y0 + q.y * h))
 }
 
 /// Pucker & Bloat: anchors move toward (bloat) or away from (pucker) the centre, handles the
diff --git a/crates/effects/src/geometry.rs b/crates/effects/src/geometry.rs
index f6f007b5c..715143e1a 100644
--- a/crates/effects/src/geometry.rs
+++ b/crates/effects/src/geometry.rs
@@ -157,6 +157,118 @@ pub(crate) fn optimize_geometry_effects<'a>(effects: &[&'a Effect], style_safe:
 /// [`apply_geometry_with`] whose effects keep to `budget`, raised to what `path` costs where that
 /// is more.
 pub(crate) fn apply_geometry_within(effects: &[Effect], path: &PathData, bounds: Rect, ctx: &GeomContext, budget: Budget) -> PathData {
+    apply_geometry_carrying_within(effects, path, bounds, ctx, budget, None)
+}
+
+/// [`apply_geometry_with`], and the [`Carry`] that moves the object's gradients along with the
+/// effects that move the object as a whole.
+pub fn apply_geometry_carrying(effects: &[Effect], path: &PathData, bounds: Rect, ctx: &GeomContext) -> (PathData, Carry) {
+    let mut carry = Carry::default();
+    let out = apply_geometry_carrying_within(effects, path, bounds, ctx, Budget::EFFECTS, Some(&mut carry));
+    (out, carry)
+}
+
+/// [`apply_geometry_carrying`] on kurbo paths.
+pub fn apply_geometry_bez_carrying(effects: &[Effect], path: &BezPath, bounds: Rect, ctx: &GeomContext) -> (BezPath, Carry) {
+    let (out, carry) = apply_geometry_carrying(effects, &PathData::from_bezpath(path), bounds, ctx);
+    (out.to_bezpath(), carry)
+}
+
+/// How placed gradients follow geometry effects. The Transform effect without copies maps them as
+/// it maps the object (with copies, `crate::reshape` gives each copy its own). Free Distort moves
+/// and scales them from the object's bounds before the effect to its bounds after it. For the
+/// other geometry effects it is empty. It does not change gradients fitted to the object.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Carry(Vec<CarryStep>);
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum CarryStep {
+    Affine(vectorcraft_geom::Affine),
+    /// From box `from` to box `to` (strokes: their stroke-inflated boxes).
+    Boxes {
+        from: Rect,
+        to: Rect,
+    },
+}
+
+impl Carry {
+    /// Does effect `id` with merged params `p` on geometry with reference box `b` (`seed` for
+    /// Random) move placed gradients? Free Distort does unless it leaves every corner in place;
+    /// the Transform effect does without copies (with copies the original stays where it is, and
+    /// `crate::reshape` gives each copy its own gradients).
+    pub(crate) fn follows(id: &str, p: &Value, b: Rect, seed: u64) -> bool {
+        match id {
+            "distort.transform" => {
+                let (m, copies) = distort::transform_map(b, p, seed);
+                copies == 0 && m != vectorcraft_geom::Affine::IDENTITY && m.is_finite()
+            }
+            "distort.freeDistort" => {
+                let corners = distort::free_distort_corners(b, p);
+                let tol = 1e-9 * b.width().hypot(b.height()).max(1.0);
+                let still =
+                    [(b.x0, b.y0), (b.x1, b.y0), (b.x1, b.y1), (b.x0, b.y1)].iter().zip(&corners).all(|(a, c)| c.distance((*a).into()) <= tol);
+                !still && corners.iter().all(|c| c.x.is_finite() && c.y.is_finite())
+            }
+            _ => false,
+        }
+    }
+
+    /// How placed gradients follow effect `id` (as [`Self::follows`]) on an object whose geometric
+    /// bounds are `from` before the effect and `to` after it; empty when they stay in place.
+    pub(crate) fn of(id: &str, p: &Value, b: Rect, from: Option<Rect>, to: Option<Rect>, seed: u64) -> Carry {
+        if !Self::follows(id, p, b, seed) {
+            return Carry::default();
+        }
+        let step = match id {
+            "distort.transform" => Some(CarryStep::Affine(distort::transform_map(b, p, seed).0)),
+            _ => match (from, to) {
+                (Some(from), Some(to)) if from != to && [to.x0, to.y0, to.x1, to.y1].iter().all(|v| v.is_finite()) => {
+                    Some(CarryStep::Boxes { from, to })
+                }
+                _ => None,
+            },
+        };
+        Carry(step.into_iter().collect())
+    }
+
+    /// Does it leave gradients where they are?
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    /// Does it move any of the gradients of `ap`? Callers check first, so an appearance shared
+    /// with other objects is not copied for nothing.
+    pub fn moves(&self, ap: &Appearance) -> bool {
+        !self.0.is_empty() && ap.has_placed_gradient()
+    }
+
+    /// Move the placed gradients of `ap` along, through each step in turn.
+    pub fn apply(&self, ap: &mut Appearance) {
+        if !self.moves(ap) {
+            return;
+        }
+        for s in &self.0 {
+            match *s {
+                CarryStep::Affine(m) => ap.transform_gradients(m),
+                CarryStep::Boxes { from, to } => crate::reshape::follow_boxes(ap, from, to),
+            }
+        }
+    }
+
+    pub(crate) fn push(&mut self, more: Carry) {
+        self.0.extend(more.0);
+    }
+}
+
+/// [`apply_geometry_within`], adding to `carry` how gradients follow each effect.
+pub(crate) fn apply_geometry_carrying_within(
+    effects: &[Effect],
+    path: &PathData,
+    bounds: Rect,
+    ctx: &GeomContext,
+    budget: Budget,
+    mut carry: Option<&mut Carry>,
+) -> PathData {
     // `budget` raised to what `path` costs, measured once, and only for a path that has geometry
     // effects.
     let has_stroke = match (ctx.item, ctx.appearance) {
@@ -185,6 +297,9 @@ pub(crate) fn apply_geometry_within(effects: &[Effect], path: &PathData, bounds:
         let p = merged_params(&e.id, &e.params);
         let limit = *limit.get_or_insert_with(|| budget.at_least(Budget::of(path)));
         if let Some(next) = apply_one(&e.id, &p, &cur, b, ctx, limit) {
+            if let Some(c) = carry.as_deref_mut() {
+                c.push(Carry::of(&e.id, &p, b, cur.bounds(), next.bounds(), ctx.seed));
+            }
             cur = next;
         }
     }
diff --git a/crates/effects/src/group.rs b/crates/effects/src/group.rs
index ce8c38077..a3f6859b8 100644
--- a/crates/effects/src/group.rs
+++ b/crates/effects/src/group.rs
@@ -198,7 +198,11 @@ fn reshaped_art(n: &Node, hook: Option<OutlineHook>, nodes: &SymbolNodes) -> Opt
             Some(area) => Some(reshaped(&area, n)),
             None => {
                 let mut m = crate::reshape::outlined_members_with(None, n, outline, nodes);
-                crate::reshape::reshape_leaves(&mut m, &fx);
+                let carry = crate::reshape::reshape_leaves_carrying(&mut m, &fx);
+                // The group's own fills and strokes follow the effects as its members do.
+                if carry.moves(&m.appearance) {
+                    carry.apply(&mut m.appearance);
+                }
                 without_geometry_effects(&mut m);
                 Some(m)
             }
@@ -210,7 +214,11 @@ fn reshaped_art(n: &Node, hook: Option<OutlineHook>, nodes: &SymbolNodes) -> Opt
             let art = h(n).filter(|art| nodes.charge(art))?;
             let mut art = crate::reshape::symbol_art_with(&art, h, nodes, symbol);
             crate::reshape::outline_nested_text(&mut art, false);
-            crate::reshape::reshape_leaves(&mut art, &fx);
+            let carry = crate::reshape::reshape_leaves_carrying(&mut art, &fx);
+            // The art's own fills and strokes follow the effects as its members do.
+            if carry.moves(&art.appearance) {
+                carry.apply(&mut art.appearance);
+            }
             (art.opacity, art.blend, art.isolate) = (n.opacity, n.blend, n.isolate);
             art.appearance.effects = n.appearance.effects.clone();
             without_geometry_effects(&mut art);
@@ -230,8 +238,12 @@ fn reshaped(src: &Node, n: &Node) -> Node {
     let mut m = src.clone();
     if let Some((path, rule)) = geometry(src) {
         let bounds = vectorcraft_geom::Shape::bounding_box(&path.to_bezpath());
-        let g = crate::apply_geometry_with(&n.appearance.effects, &path, bounds, &crate::GeomContext::of(n));
+        let (g, carry) = crate::apply_geometry_carrying(&n.appearance.effects, &path, bounds, &crate::GeomContext::of(n));
         m.kind = NodeKind::Path { path: g, rule, live: None, clipping: false, guide: false };
+        // Its gradients move with the outline, as the canvas paints them.
+        if carry.moves(&m.appearance) {
+            carry.apply(&mut m.appearance);
+        }
     }
     without_geometry_effects(&mut m);
     m
@@ -711,7 +723,12 @@ pub fn evaluate_container(doc: Option<&Document>, n: &Node) -> Option<Node> {
     }
     if !fx.is_empty() {
         m = crate::reshape::outlined_members(doc, &m);
-        crate::reshape::reshape_leaves(&mut m, &fx);
+        let carry = crate::reshape::reshape_leaves_carrying(&mut m, &fx);
+        // The group's own fills and strokes paint the members as a whole: their gradients follow
+        // the effects as the members' do.
+        if paint && carry.moves(&m.appearance) {
+            carry.apply(&mut m.appearance);
+        }
     }
     m.appearance.effects.retain(|e| !is_pathfinder(&e.id) && !crate::is_geometry(&e.id));
     if paint {
diff --git a/crates/effects/src/group/tests.rs b/crates/effects/src/group/tests.rs
index b67279bbb..a0cddc94d 100644
--- a/crates/effects/src/group/tests.rs
+++ b/crates/effects/src/group/tests.rs
@@ -248,7 +248,7 @@ fn hidden_effect_or_plain_group_is_untouched() {
 }
 
 #[test]
-fn a_transform_on_a_group_moves_the_gradients_of_its_type_and_not_those_placed_on_its_paths() {
+fn a_transform_on_a_group_moves_the_gradients_of_its_type_and_those_placed_on_its_paths() {
     if skip_without_craft_fonts() {
         return;
     }
@@ -273,7 +273,181 @@ fn a_transform_on_a_group_moves_the_gradients_of_its_type_and_not_those_placed_o
     let members = art.children().unwrap();
     let after = start(&members[1].children().unwrap()[0]);
     assert!((after - before - 30.0).abs() < 1e-6, "the type's gradient starts at {before}, then {after}");
-    assert_eq!(start(&members[0]), 0.0, "the square's gradient stays where it was placed");
+    assert!((start(&members[0]) - 30.0).abs() < 1e-6, "the square's gradient moves with it");
+}
+
+#[test]
+fn a_groups_transform_moves_the_gradient_of_its_own_fill() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: (0.0, 5.0).into(), end: (15.0, 5.0).into(), aspect: 1.0, focal: None };
+    let mut g = Node::group(NodeId(10), vec![sq(1, 0.0, Color::BLACK), sq(2, 5.0, Color::BLACK)]);
+    g.appearance
+        .items
+        .push(AppearanceItem::Fill(vectorcraft_doc::FillLayer::new(Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp })))));
+    g.appearance.effects.push(Effect { id: "distort.transform".into(), params: serde_json::json!({"moveH": 30}), visible: true });
+    let art = evaluate_container(None, &g).unwrap();
+    let mut starts = vec![];
+    art.walk(&mut |c: &Node| {
+        if let Paint::Gradient(p) = c.appearance.fill_paint() {
+            starts.push(p.geom.unwrap().start.x);
+        }
+    });
+    assert!(!starts.is_empty() && starts.iter().all(|s| (s - 30.0).abs() < 1e-6), "{starts:?}");
+}
+
+/// The art Pathfinder and compound shapes take (`shape_art`) paints as the canvas does: a path's
+/// gradient and a group's own fill move with a Transform effect.
+#[test]
+fn shape_art_moves_gradients_with_a_transform_effect() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let moved = || Effect { id: "distort.transform".into(), params: serde_json::json!({"moveH": 40}), visible: true };
+    let starts = |art: &Node| {
+        let mut out = vec![];
+        art.walk(&mut |c: &Node| {
+            for item in &c.appearance.items {
+                if let Paint::Gradient(p) = item.paint() {
+                    out.push(p.geom.unwrap().start.x);
+                }
+            }
+        });
+        out
+    };
+    let mut path = Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::basic(placed.clone(), Paint::None, 0.0));
+    path.appearance.effects.push(moved());
+    let got = starts(&shape_art(&path, None).unwrap());
+    assert!(got.len() == 1 && (got[0] - 40.0).abs() < 1e-6, "the path's gradient: {got:?}");
+    let mut g = Node::group(NodeId(10), vec![sq(2, 0.0, Color::BLACK)]);
+    g.appearance.items.push(AppearanceItem::Fill(vectorcraft_doc::FillLayer::new(placed)));
+    g.appearance.effects.push(moved());
+    let got = starts(&shape_art(&g, None).unwrap());
+    assert!(!got.is_empty() && got.iter().all(|s| (s - 40.0).abs() < 1e-6), "the group's own fill: {got:?}");
+}
+
+/// A symbol instance's Transform effect moves the gradient placed on its art's own fill in the
+/// art Pathfinder takes, as it moves its members.
+#[test]
+fn shape_art_moves_the_gradient_of_a_symbol_instances_art_with_its_transform() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let mut art = Node::group(NodeId(20), vec![sq(21, 0.0, Color::BLACK)]);
+    art.appearance.items.push(AppearanceItem::Fill(vectorcraft_doc::FillLayer::new(placed)));
+    let hook = move |_: &Node| Some(art.clone());
+    let mut instance = Node::new(NodeId(1), NodeKind::SymbolInstance { symbol: "s".into(), xf: vectorcraft_geom::Affine::IDENTITY });
+    instance.appearance.effects.push(Effect { id: "distort.transform".into(), params: serde_json::json!({"moveH": 30}), visible: true });
+    let out = shape_art(&instance, Some(&hook)).unwrap();
+    let Paint::Gradient(g) = out.appearance.fill_paint() else { panic!("a gradient: {:?}", out.appearance) };
+    assert!((g.geom.unwrap().start.x - 30.0).abs() < 1e-6, "{:?}", g.geom);
+    assert!((out.geometric_bounds().unwrap().x0 - 30.0).abs() < 1e-6, "the art moves");
+}
+
+#[test]
+fn a_groups_transform_and_free_distort_move_the_gradients_placed_on_its_paths() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let ends = |e: Effect| {
+        let square =
+            Arc::new(Node::path(NodeId(1), shapes::rectangle(Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::basic(placed.clone(), Paint::None, 0.0)));
+        let mut g = Node::group(NodeId(10), vec![square, sq(2, 20.0, Color::BLACK)]);
+        g.appearance.effects.push(e);
+        let art = evaluate_container(None, &g).unwrap();
+        match art.children().unwrap()[0].appearance.fill_paint() {
+            Paint::Gradient(g) => g.geom.map(|g| (g.start, g.end)).unwrap(),
+            p => panic!("a gradient: {p:?}"),
+        }
+    };
+    let near = |a: Point, b: Point| a.distance(b) < 1e-6;
+    // A quarter turn about the group's center (15, 5) takes (0, 5) to (15, 20) and (10, 5) to (15, 10).
+    let (s, e) = ends(Effect { id: "distort.transform".into(), params: serde_json::json!({"rotate": 90}), visible: true });
+    assert!(near(s, Point::new(15.0, 20.0)) && near(e, Point::new(15.0, 10.0)), "{s:?} {e:?}");
+    // Free Distort moving the group's top corners 10 pt right slants the square to 0..20 across:
+    // its gradient follows its own bounds (0..10 to 0..20), not the group's (0..30 to 0..40).
+    let corners = serde_json::json!({"corners": [[1.0 / 3.0, 0.0], [4.0 / 3.0, 0.0], [1.0, 1.0], [0.0, 1.0]]});
+    let (s, e) = ends(Effect { id: "distort.freeDistort".into(), params: corners, visible: true });
+    assert!(near(s, Point::new(0.0, 5.0)) && near(e, Point::new(20.0, 5.0)), "{s:?} {e:?}");
+}
+
+/// A group nested in a group with a Transform effect or Free Distort keeps its own placed gradient
+/// on its members: the Transform's map moves it, and Free Distort moves and scales it from the
+/// nested group's bounds before the effect to its bounds after it.
+#[test]
+fn a_nested_groups_own_gradient_follows_the_outer_groups_transform_and_free_distort() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let ends = |e: Effect| {
+        let mut inner = Node::group(NodeId(5), vec![sq(1, 0.0, Color::BLACK)]);
+        inner.appearance.items.push(AppearanceItem::Fill(vectorcraft_doc::FillLayer::new(placed.clone())));
+        let mut g = Node::group(NodeId(10), vec![Arc::new(inner), sq(2, 20.0, Color::BLACK)]);
+        g.appearance.effects.push(e);
+        let art = evaluate_container(None, &g).unwrap();
+        match art.children().unwrap()[0].appearance.fill_paint() {
+            Paint::Gradient(g) => g.geom.map(|g| (g.start, g.end)).unwrap(),
+            p => panic!("a gradient: {p:?}"),
+        }
+    };
+    let near = |a: Point, b: Point| a.distance(b) < 1e-6;
+    let (s, e) = ends(Effect { id: "distort.transform".into(), params: serde_json::json!({"moveH": 30}), visible: true });
+    assert!(near(s, Point::new(30.0, 5.0)) && near(e, Point::new(40.0, 5.0)), "{s:?} {e:?}");
+    let corners = serde_json::json!({"corners": [[1.0 / 3.0, 0.0], [4.0 / 3.0, 0.0], [1.0, 1.0], [0.0, 1.0]]});
+    let (s, e) = ends(Effect { id: "distort.freeDistort".into(), params: corners, visible: true });
+    assert!(near(s, Point::new(0.0, 5.0)) && near(e, Point::new(20.0, 5.0)), "{s:?} {e:?}");
+}
+
+/// An image or a symbol instance that a group's Transform effect moves takes the placed gradients
+/// of its own fills along, as a path does, and each copy takes them as many times as it takes the
+/// transform.
+#[test]
+fn a_groups_transform_moves_the_gradients_placed_on_an_images_own_fills() {
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    use vectorcraft_doc::ImageObject;
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    let geom = GradientGeom { start: (0.0, 5.0).into(), end: (10.0, 5.0).into(), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..ramp }));
+    let image = || {
+        NodeKind::Image(Box::new(ImageObject {
+            key: "k".into(),
+            width: 10,
+            height: 10,
+            xf: vectorcraft_geom::Affine::IDENTITY,
+            link: None,
+            placement: Default::default(),
+            pixels: None,
+        }))
+    };
+    let instance = || NodeKind::SymbolInstance { symbol: "s".into(), xf: vectorcraft_geom::Affine::IDENTITY };
+    let starts = |kind: NodeKind, params: serde_json::Value| {
+        let mut object = Node::new(NodeId(1), kind);
+        object.appearance = Appearance::basic(placed.clone(), Paint::None, 0.0).into();
+        let mut g = Node::group(NodeId(10), vec![Arc::new(object), sq(2, 20.0, Color::BLACK)]);
+        g.appearance.effects.push(Effect { id: "distort.transform".into(), params, visible: true });
+        let art = evaluate_container(None, &g).unwrap();
+        let mut out = vec![];
+        art.walk(&mut |c: &Node| {
+            if let (NodeKind::Image(_) | NodeKind::SymbolInstance { .. }, Paint::Gradient(p)) = (&c.kind, c.appearance.fill_paint()) {
+                out.push(p.geom.unwrap().start.x);
+            }
+        });
+        out
+    };
+    for kind in [image as fn() -> NodeKind, instance] {
+        assert_eq!(starts(kind(), serde_json::json!({"moveH": 30})), [30.0], "{:?}", kind());
+        assert_eq!(starts(kind(), serde_json::json!({"moveH": 30, "copies": 2})), [0.0, 30.0, 60.0], "{:?}", kind());
+    }
 }
 
 #[test]
diff --git a/crates/effects/src/lib.rs b/crates/effects/src/lib.rs
index b251b15a6..e4ca42a4e 100644
--- a/crates/effects/src/lib.rs
+++ b/crates/effects/src/lib.rs
@@ -7,7 +7,7 @@
 //!   Warp) rewrite a path: [`apply_geometry`] evaluates them in stack order.
 //! - **Raster effects** (Drop Shadow, Inner/Outer Glow, Feather, Gaussian Blur, Rasterize, and the
 //!   Photoshop-style filters of [`pixel`]: Radial Blur, Smart Blur, Color Halftone, Crystallize, Mezzotint, Pointillize, Halftone Pattern,
-//!   Unsharp Mask and Glowing Edges) are described by
+//!   Unsharp Mask and Glowing Edges, and the SVG filters of [`svg_filter`]) are described by
 //!   [`raster_effects`] and painted by the renderer; [`outset`] says how far they reach beyond
 //!   the geometry.
 //! - **Stroke geometry** ([`stroke`]): arrowheads, dash patterns and width profiles, shared by the
@@ -52,6 +52,7 @@ mod revolve;
 mod solids;
 pub mod stroke;
 mod stylize;
+pub mod svg_filter;
 pub mod trap;
 mod util;
 mod warp;
@@ -84,11 +85,13 @@ pub use reshape::{
 };
 pub use revolve::{REVOLVE, has_revolve, revolve_art, revolve_options, validate_revolve};
 pub use solids::{
-    EXTRUDE, INFLATE, ROTATE, ROTATION_PRESETS, SOLIDS, THREE_D_TYPES, extrude_options, has_solid, inflate_options, is_three_d, solid_art,
-    three_d_params_as, validate_solid, validate_three_d, view_options,
+    EXTRUDE, INFLATE, ROTATE, ROTATION_PRESETS, SOLIDS, SolidMesh, THREE_D_TYPES, extrude_options, has_solid, inflate_options, is_three_d, solid_art,
+    three_d_meshes, three_d_params_as, validate_solid, validate_three_d, view_options,
 };
 pub use stylize::{ScribbleSetting, scribble_setting_id, scribble_settings};
+pub use svg_filter::SVG_FILTER;
 pub use trap::TRAP;
+pub use vectorcraft_three_d::Mesh;
 pub use warp::{WarpStyle, warp_point};
 
 mod catalog;
@@ -97,7 +100,9 @@ mod params;
 
 pub use catalog::{EffectInfo, Lengths, WARP_STYLES, effect_catalog, effect_info, is_length, length_range, plugin_effects, raster_px_range};
 pub(crate) use geometry::{Budget, apply_one};
-pub use geometry::{GeomContext, apply_geometry, apply_geometry_bez, apply_geometry_with};
+pub use geometry::{
+    Carry, GeomContext, apply_geometry, apply_geometry_bez, apply_geometry_bez_carrying, apply_geometry_carrying, apply_geometry_with,
+};
 #[cfg(test)]
 pub(crate) use geometry::{MAX_EFFECT_LINES, apply_geometry_within};
 pub use params::{
diff --git a/crates/effects/src/params.rs b/crates/effects/src/params.rs
index fbf22ff6b..a178a7537 100644
--- a/crates/effects/src/params.rs
+++ b/crates/effects/src/params.rs
@@ -119,6 +119,7 @@ pub fn scale_effect(e: &mut Effect, s: f64) {
 pub fn is_raster(id: &str) -> bool {
     matches!(id, "stylize.dropShadow" | "stylize.innerGlow" | "stylize.outerGlow" | "stylize.feather" | "blur.gaussian" | RASTERIZE)
         || PIXEL_EFFECTS.contains(&id)
+        || id == crate::SVG_FILTER
 }
 
 /// Does `id` change geometry? (Crop Marks and Vector Halftone add art of their own instead,
diff --git a/crates/effects/src/pixel.rs b/crates/effects/src/pixel.rs
index 6be45756b..89eb541b1 100644
--- a/crates/effects/src/pixel.rs
+++ b/crates/effects/src/pixel.rs
@@ -287,6 +287,8 @@ pub enum PixelFx {
     DeInterlace { even: bool, interpolate: bool },
     /// Video › NTSC Colors: colours a television signal can't carry made less saturated.
     NtscColors,
+    /// Effect › SVG Filters: an SVG `<filter>` element run on the pixels.
+    Svg(crate::svg_filter::SvgFilterFx),
 }
 
 /// What a raster's colour channels hold, for the filters that treat them apart (Color Halftone
@@ -598,6 +600,7 @@ pub(crate) fn parse(id: &str, p: &Value) -> Option<PixelFx> {
             interpolate: text(p, "create", "duplication").eq_ignore_ascii_case("interpolation"),
         },
         "video.ntscColors" => PixelFx::NtscColors,
+        crate::SVG_FILTER => PixelFx::Svg(crate::svg_filter::SvgFilterFx::parse(p)?),
         _ => return None,
     })
 }
@@ -666,6 +669,7 @@ impl PixelFx {
             PixelFx::Crystallize { cell } | PixelFx::Pointillize { cell } | PixelFx::StainedGlass { cell, .. } => 1.5 * cell,
             // A square whose centre is on the object is drawn whole.
             PixelFx::Patchwork { square, .. } => square.max(1.0),
+            PixelFx::Svg(ref f) => f.outset(bounds),
         }
     }
 
@@ -745,12 +749,17 @@ impl PixelFx {
             // The lines above and below.
             PixelFx::DeInterlace { .. } => Some(video::MAX_LINE),
             PixelFx::NtscColors => Some(0.0),
+            // A filter's object bounding box is the whole object's.
+            PixelFx::Svg(_) => None,
         }
     }
 
     /// Run the effect on `data`, `w` × `h` premultiplied RGBA8 pixels lying in the document as
     /// `space` says. Does nothing when the sizes don't match.
     pub fn apply(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace) {
+        if let PixelFx::Svg(f) = self {
+            return f.apply(data, w, h, space);
+        }
         let Some(px) = pixels(data, w, h) else { return };
         let to_px = |len: f64| len / space.px.max(1e-9);
         match *self {
@@ -829,6 +838,7 @@ impl PixelFx {
             }
             PixelFx::DeInterlace { even, interpolate } => video::deinterlace(px, w, h, space, even, interpolate),
             PixelFx::NtscColors => video::ntsc(px),
+            PixelFx::Svg(_) => {}
         }
     }
 }
diff --git a/crates/effects/src/reshape.rs b/crates/effects/src/reshape.rs
index b3acf07a5..4ea3e4610 100644
--- a/crates/effects/src/reshape.rs
+++ b/crates/effects/src/reshape.rs
@@ -11,6 +11,7 @@
 //! strokes paint only the shape that a Convert to Shape or Outline Object effect on them gives
 //! them ([`image_rows`]).
 
+use std::collections::HashSet;
 use std::sync::Arc;
 
 use vectorcraft_doc::live::Hooks;
@@ -594,9 +595,15 @@ pub(crate) fn reshape_leaves(art: &mut Node, fx: &[&Effect]) {
     reshape_leaves_within(art, fx, Budget::EFFECTS);
 }
 
-/// [`reshape_leaves`] whose paths keep to `budget` together, or to what they cost.
-pub(crate) fn reshape_leaves_within(art: &mut Node, fx: &[&Effect], budget: Budget) {
-    reshape_leaves_apart(art, fx, budget, false);
+/// [`reshape_leaves`], and how gradients that paint the art as a whole (a group's own fills and
+/// strokes) follow the effects ([`crate::Carry`]).
+pub(crate) fn reshape_leaves_carrying(art: &mut Node, fx: &[&Effect]) -> crate::Carry {
+    reshape_leaves_within(art, fx, Budget::EFFECTS)
+}
+
+/// [`reshape_leaves_carrying`] whose paths keep to `budget` together, or to what they cost.
+pub(crate) fn reshape_leaves_within(art: &mut Node, fx: &[&Effect], budget: Budget) -> crate::Carry {
+    reshape_leaves_apart(art, fx, budget, false)
 }
 
 /// `art`, the group of the one piece a path's copies are made from ([`outline_art_with`]), holding
@@ -616,10 +623,12 @@ fn hoist_copies(art: &mut Node) {
 }
 
 /// [`reshape_leaves_within`]; with `apart`, a Transform effect's copies of each path are objects
-/// of their own ([`copy_leaf`]) whatever paints them, as Expand Appearance makes them.
-fn reshape_leaves_apart(art: &mut Node, fx: &[&Effect], budget: Budget, apart: bool) {
+/// of their own ([`copy_leaf`]) whatever paints them, as Expand Appearance makes them. Returns how
+/// gradients that paint the art as a whole follow the effects.
+fn reshape_leaves_apart(art: &mut Node, fx: &[&Effect], budget: Budget, apart: bool) -> crate::Carry {
+    let mut whole = crate::Carry::default();
     if fx.is_empty() {
-        return;
+        return whole;
     }
     let mut leaves_safe = true;
     for_each_leaf(art, &mut |leaf| {
@@ -638,15 +647,32 @@ fn reshape_leaves_apart(art: &mut Node, fx: &[&Effect], budget: Budget, apart: b
     let opt_fx = crate::geometry::optimize_geometry_effects(fx, style_safe);
     let fx = opt_fx.as_slice();
     let seed = art.id.0;
-    // The placed gradients of type's outlines in `art` (`outline_text`) move and scale with the
-    // pieces, from the outlines' bounds before the effects to their bounds after them.
-    let mut outlines = vec![];
-    type_outline_bounds(art, &mut outlines);
     let mut used = art_cost(art);
     let max = budget.at_least(used);
     for e in fx {
         let Some(bounds) = art.geometric_bounds() else { break };
         let params = merged_params(&e.id, &e.params);
+        // Placed gradients follow a Transform effect and Free Distort ([`crate::Carry`]): under
+        // Free Distort (`boxes`) each path's move and scale from its bounds before the effect to
+        // its bounds after it. Under that and the other effects, the placed gradients of type's
+        // outlines in `art` (`outline_text`) move and scale with the outlines' bounds.
+        let follows = crate::Carry::follows(&e.id, &params, bounds, seed);
+        let boxes = follows && e.id == "distort.freeDistort";
+        let mut outlines = vec![];
+        if !follows || boxes {
+            type_outline_bounds(art, &mut outlines);
+        }
+        let mut leaves = vec![];
+        if boxes {
+            leaf_bounds(art, &mut leaves);
+        }
+        let mut groups = vec![];
+        if follows {
+            group_marks(art, &mut vec![], &HashSet::new(), &mut groups);
+        }
+        // Whether a path kept its shape (past the budget), and the ids of those that did.
+        let mut kept = false;
+        let mut kept_ids = HashSet::new();
         let transform = (e.id == "distort.transform").then(|| {
             let (m, copies) = crate::distort::transform_map(bounds, &params, seed);
             let options = crate::distort::TransformOptions::of(&params);
@@ -668,8 +694,12 @@ fn reshape_leaves_apart(art: &mut Node, fx: &[&Effect], budget: Budget, apart: b
                         || leaf.appearance.has_placed_gradient()
                         || paints_copies_apart(&leaf.appearance, rule));
                 if options.reach_appearance() {
-                    let made = transform_leaf(leaf, &path, map, copies, options, room);
+                    let (made, moved) = transform_leaf(leaf, &path, map, copies, options, room);
                     used = used.minus(before).plus(made);
+                    if !moved {
+                        kept = true;
+                        kept_ids.insert(leaf.id);
+                    }
                     return;
                 }
                 if separate {
@@ -678,19 +708,41 @@ fn reshape_leaves_apart(art: &mut Node, fx: &[&Effect], budget: Budget, apart: b
                     return;
                 }
             }
-            let Some(out) = apply_one(&e.id, &params, &path, bounds, &GeomContext { seed, ..GeomContext::of(leaf) }, room) else { return };
+            let Some(out) = apply_one(&e.id, &params, &path, bounds, &GeomContext { seed, ..GeomContext::of(leaf) }, room) else {
+                kept = true;
+                kept_ids.insert(leaf.id);
+                return;
+            };
             used = used.minus(before).plus(Budget::of(&out));
+            if follows && !boxes && leaf.appearance.has_placed_gradient() {
+                crate::Carry::of(&e.id, &params, bounds, None, None, seed).apply(&mut leaf.appearance);
+            }
             set_geometry(leaf, out, rule);
         });
+        if boxes {
+            rebase_leaves(art, &mut leaves.into_iter());
+        }
         if let Some((m, copies, options, _)) = transform
             && options.objects
         {
             transform_placed(art, m, copies);
         }
+        if outlines.iter().any(Option::is_some) {
+            rebase_type_outlines(art, &mut outlines.into_iter());
+        }
+        // What paints the art as a whole, and the own fills and strokes of the groups inside it,
+        // follow their bounds under Free Distort (they stay when no path changed them). Each stays
+        // when a path under it kept its shape (past the budget).
+        if !groups.is_empty() {
+            let mut after = vec![];
+            group_marks(art, &mut vec![], &kept_ids, &mut after);
+            carry_groups(art, groups, after, &|from, to| crate::Carry::of(&e.id, &params, bounds, from, to, seed));
+        }
+        if follows && !kept {
+            whole.push(crate::Carry::of(&e.id, &params, bounds, Some(bounds), art.geometric_bounds(), seed));
+        }
     }
-    if outlines.iter().any(Option::is_some) {
-        rebase_type_outlines(art, &mut outlines.into_iter());
-    }
+    whole
 }
 
 /// Largest factor a Transform effect's Scale Strokes & Effects scales one object's strokes by
@@ -704,8 +756,16 @@ const MAX_STROKE_SCALE: f64 = 1.0e6;
 /// and the distances of the effects on its fills and strokes scale by `m`'s mean scale, and its
 /// pattern paints transform by `m`. With copies, the original keeps them and copy `k` takes them
 /// `k` times, each copy an object of its own ([`copy_leaf`], within `budget`). With Transform
-/// Objects off the geometry stays and the options apply once. Returns what the leaf costs after.
-fn transform_leaf(leaf: &mut Node, path: &PathData, m: Affine, copies: usize, options: crate::distort::TransformOptions, budget: Budget) -> Budget {
+/// Objects off the geometry stays and the options apply once. Returns what the leaf costs after,
+/// and `false` when the path kept its shape because the moved path would pass `budget`.
+fn transform_leaf(
+    leaf: &mut Node,
+    path: &PathData,
+    m: Affine,
+    copies: usize,
+    options: crate::distort::TransformOptions,
+    budget: Budget,
+) -> (Budget, bool) {
     let scaling = vectorcraft_doc::Scaling {
         strokes: options.strokes,
         effects: options.strokes.then_some(crate::scale_effect as fn(&mut Effect, f64)),
@@ -722,18 +782,18 @@ fn transform_leaf(leaf: &mut Node, path: &PathData, m: Affine, copies: usize, op
         if options.patterns {
             vectorcraft_doc::pattern::transform_pattern_paints(leaf, m);
         }
-        return Budget::of(path);
+        return (Budget::of(path), true);
     }
     if copies == 0 {
         // A path scaled up is drawn with more lines; past the budget it keeps its shape.
         let moved = path.transformed(m);
         if !budget.fits(Budget::of(&moved)) {
-            return Budget::of(path);
+            return (Budget::of(path), false);
         }
         leaf.transform(m, scaling);
-        return Budget::of(&moved);
+        return (Budget::of(&moved), true);
     }
-    copy_leaf(leaf, path, m, copies, scaling, budget)
+    (copy_leaf(leaf, path, m, copies, scaling, budget), true)
 }
 
 /// Replace `leaf` (a path or compound path with geometry `path`) by a group of it and `copies`
@@ -843,8 +903,10 @@ fn transform_item_leaf(leaf: &mut Node, max: Budget, used: &mut Budget) {
         let reserved = (0..later(i)).fold(Budget { anchors: 0, lines: 0 }, |r, _| r.plus(cost));
         let limit = max.minus(reserved);
         let room = limit.minus(*used);
+        // The fill's or stroke's gradient follows the geometry effects before the Transform effect.
+        let mut carry = crate::Carry::default();
         let g = if crate::has_geometry(before) && !path.is_empty() {
-            crate::geometry::apply_geometry_within(before, &path, bounds, &ctx.item(item), room)
+            crate::geometry::apply_geometry_carrying_within(before, &path, bounds, &ctx.item(item), room, Some(&mut carry))
         } else {
             path.clone()
         };
@@ -857,8 +919,11 @@ fn transform_item_leaf(leaf: &mut Node, max: Budget, used: &mut Budget) {
         let rest: Vec<Effect> = before.iter().filter(|e| !is_geometry(&e.id)).chain(&fx[at + 1..]).cloned().collect();
         *it.effects_mut() = rest;
         let mut p = piece(vec![it]);
+        if carry.moves(&p.appearance) {
+            carry.apply(&mut p.appearance);
+        }
         set_geometry(&mut p, g.clone(), rule);
-        let made = transform_leaf(&mut p, &g, map, copies, options, room);
+        let (made, _) = transform_leaf(&mut p, &g, map, copies, options, room);
         *used = used.plus(made);
         transform_piece(&mut p, ctx.seed, limit, used);
         pieces.push(Arc::new(p));
@@ -902,7 +967,7 @@ fn transform_piece(p: &mut Node, seed: u64, max: Budget, used: &mut Budget) {
                 let (_, copies) = crate::distort::transform_map(bounds, &params, seed);
                 let options = crate::distort::TransformOptions::of(&params);
                 let map = crate::distort::transform_affine(bounds, &params, seed);
-                let made = transform_leaf(leaf, &path, map, copies, options, room);
+                let (made, _) = transform_leaf(leaf, &path, map, copies, options, room);
                 *used = used.minus(before).plus(made);
                 return;
             }
@@ -912,8 +977,13 @@ fn transform_piece(p: &mut Node, seed: u64, max: Budget, used: &mut Budget) {
                 AppearanceItem::Fill(_) => None,
             };
             let ctx = GeomContext { stroke, rule, seed, appearance: Some(&appearance), item: Some(0) };
-            let out = crate::geometry::apply_geometry_within(std::slice::from_ref(&e), &path, bounds, &ctx, room);
+            let mut carry = crate::Carry::default();
+            let out = crate::geometry::apply_geometry_carrying_within(std::slice::from_ref(&e), &path, bounds, &ctx, room, Some(&mut carry));
             *used = used.minus(before).plus(Budget::of(&out));
+            // The fill's or stroke's gradient follows the effect as the object's does.
+            if carry.moves(&leaf.appearance) {
+                carry.apply(&mut leaf.appearance);
+            }
             set_geometry(leaf, out, rule);
         });
     }
@@ -957,11 +1027,128 @@ fn rebase_type_outlines(n: &mut Node, before: &mut std::vec::IntoIter<Option<Rec
     }
 }
 
+/// The geometric bounds of each path under `n` that [`for_each_leaf`] visits, outside groups of
+/// type's outlines (those follow the outlines' bounds, [`rebase_type_outlines`]).
+fn leaf_bounds(n: &Node, out: &mut Vec<Option<Rect>>) {
+    match &n.kind {
+        NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. } => out.push(n.geometric_bounds()),
+        NodeKind::Group { children, .. } | NodeKind::Layer { children, .. } if !n.extras().type_outlines => {
+            for c in children {
+                leaf_bounds(c, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// A group inside the art whose own fills and strokes [`carry_groups`] moves (groups of type's
+/// outlines follow the outlines' bounds, [`rebase_type_outlines`]).
+fn is_member_group(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::Group { .. } | NodeKind::Layer { .. }) && !n.extras().type_outlines
+}
+
+/// A group below the art that [`is_member_group`] takes and whose own fills or strokes hold a
+/// placed gradient: the child indices that lead to it from the art, its geometric bounds, and
+/// whether a path below it kept its shape.
+type GroupMark = (Vec<usize>, Option<Rect>, bool);
+
+/// The geometric bounds of `n` (as [`Node::geometric_bounds`] gives them) and whether a path or
+/// compound path below it is in `kept`, measured in one walk. Each group below `n` that
+/// [`GroupMark`] describes goes into `out`, reached from `n` through `at`.
+fn group_marks(n: &Node, at: &mut Vec<usize>, kept: &HashSet<NodeId>, out: &mut Vec<GroupMark>) -> (Option<Rect>, bool) {
+    match &n.kind {
+        NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. } => (n.geometric_bounds(), kept.contains(&n.id)),
+        NodeKind::Group { children, clip } | NodeKind::Layer { children, clip, .. } if !n.extras().type_outlines => {
+            let layer = matches!(n.kind, NodeKind::Layer { .. });
+            let skip = children.len().saturating_sub(n.editing_children().len());
+            let (mut bounds, mut held) = (None, false);
+            for (i, c) in children.iter().enumerate() {
+                at.push(i);
+                let (b, h) = group_marks(c, at, kept, out);
+                if is_member_group(c) && c.appearance.has_placed_gradient() {
+                    out.push((at.clone(), b, h));
+                }
+                at.pop();
+                held |= h;
+                let counts = if *clip { i == 0 } else { i >= skip && (c.visible || !layer) };
+                if counts {
+                    bounds = vectorcraft_geom::union_opt(bounds, b);
+                }
+            }
+            (bounds, held)
+        }
+        // Type's outlines: measured as a whole, with each outline that kept its shape counted.
+        NodeKind::Group { .. } | NodeKind::Layer { .. } => (n.geometric_bounds(), !kept.is_empty() && holds_kept(n, kept)),
+        _ => (n.geometric_bounds(), false),
+    }
+}
+
+/// Is a path or compound path below `n` (`n` included) in `kept`?
+fn holds_kept(n: &Node, kept: &HashSet<NodeId>) -> bool {
+    match &n.kind {
+        NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. } => kept.contains(&n.id),
+        _ => n.children().into_iter().flatten().any(|c| holds_kept(c, kept)),
+    }
+}
+
+/// Move the placed gradients of the own fills and strokes of each group in `after` (the groups of
+/// `before`, measured again once the paths changed) by what `carry` gives for its bounds before
+/// and after. A group with a path below it that kept its shape keeps them in place.
+fn carry_groups(art: &mut Node, before: Vec<GroupMark>, after: Vec<GroupMark>, carry: &dyn Fn(Option<Rect>, Option<Rect>) -> crate::Carry) {
+    for ((at, from, _), (at_after, to, held)) in before.into_iter().zip(after) {
+        if held || at != at_after {
+            continue;
+        }
+        let k = carry(from, to);
+        if k.is_empty() {
+            continue;
+        }
+        if let Some(n) = node_at(art, &at)
+            && is_member_group(n)
+            && k.moves(&n.appearance)
+        {
+            k.apply(&mut n.appearance);
+        }
+    }
+}
+
+/// The node below `n` that the child indices `at` lead to.
+fn node_at<'a>(n: &'a mut Node, at: &[usize]) -> Option<&'a mut Node> {
+    let Some((first, rest)) = at.split_first() else { return Some(n) };
+    let c = n.children_mut()?.get_mut(*first)?;
+    node_at(Arc::make_mut(c), rest)
+}
+
+/// Move and scale the placed gradients of each path under `n` that [`leaf_bounds`] lists from its
+/// bounds in `before` (before its geometry changed) to its bounds now.
+fn rebase_leaves(n: &mut Node, before: &mut std::vec::IntoIter<Option<Rect>>) {
+    if matches!(n.kind, NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. }) {
+        if let Some(Some(from)) = before.next()
+            && let Some(to) = n.geometric_bounds()
+            && from != to
+            && n.appearance.has_placed_gradient()
+        {
+            follow_boxes(&mut n.appearance, from, to);
+        }
+        return;
+    }
+    if n.extras().type_outlines {
+        return;
+    }
+    if let NodeKind::Group { children, .. } | NodeKind::Layer { children, .. } = &mut n.kind {
+        for c in children.iter_mut() {
+            if matches!(c.kind, NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. } | NodeKind::Group { .. } | NodeKind::Layer { .. }) {
+                rebase_leaves(Arc::make_mut(c), before);
+            }
+        }
+    }
+}
+
 /// Map the placed gradients of `ap` from box `from` to box `to` through the map that takes one box
 /// onto the other (strokes: their stroke-inflated boxes). The start and end go where
 /// [`Appearance::rebase_gradients`] puts them, and a radial's ellipse and a linear's isolines are
 /// mapped with them.
-fn follow_boxes(ap: &mut Appearance, from: Rect, to: Rect) {
+pub(crate) fn follow_boxes(ap: &mut Appearance, from: Rect, to: Rect) {
     for i in &mut ap.items {
         match i {
             AppearanceItem::Fill(f) => {
@@ -1036,6 +1223,10 @@ fn copy_placed(n: &mut Node, m: Affine, copies: usize, room: &mut usize) {
                 NodeKind::SymbolInstance { xf: at, .. } => *at = xf * *at,
                 _ => {}
             }
+            // The placed gradients of its own fills and strokes move with it, as a path's do.
+            if xf != Affine::IDENTITY && one.appearance.has_placed_gradient() {
+                one.appearance.transform_gradients(xf);
+            }
             one
         };
         if copies == 0 {
diff --git a/crates/effects/src/revolve.rs b/crates/effects/src/revolve.rs
index b2528818b..ba4b0e657 100644
--- a/crates/effects/src/revolve.rs
+++ b/crates/effects/src/revolve.rs
@@ -226,6 +226,45 @@ pub(crate) fn expand_revolve_art(n: &Node) -> Option<Node> {
     art(n, true)
 }
 
+/// The surfaces [`revolve_art`] draws, as meshes ([`crate::three_d_meshes`]): with the effect on
+/// the object, one in its top visible fill (else its stroke); with it on fills and strokes, one for
+/// each of them.
+pub(crate) fn revolve_meshes(n: &Node) -> Result<Vec<crate::SolidMesh>, String> {
+    let path = profile(n).ok_or("Revolve currently requires a path or compound path")?;
+    let ctx = GeomContext::of(n);
+    let mesh = |path: &PathData, fx: &Effect, item: &AppearanceItem| -> Result<crate::SolidMesh, String> {
+        let b = path.bounds().ok_or("Revolve requires a profile with at least two anchors")?;
+        let (paint, opacity, _) = paint_of(item);
+        let mesh = vectorcraft_three_d::revolve_mesh(path, b, revolve_options(&merged_params(REVOLVE, &fx.params)))?;
+        Ok(crate::SolidMesh { mesh, color: crate::solids::mesh_color(&paint, opacity) })
+    };
+    if let Some(index) = n.appearance.effects.iter().position(|e| e.visible && e.id == REVOLVE) {
+        let before = n.appearance.effects.get(..index).unwrap_or_default();
+        let Some(fx) = n.appearance.effects.get(index) else { return Ok(vec![]) };
+        let path = geometry(&path, before, &ctx);
+        let item = n
+            .appearance
+            .items
+            .iter()
+            .rev()
+            .find(|i| matches!(i, AppearanceItem::Fill(_)) && crate::paints(i))
+            .or_else(|| n.appearance.items.iter().rev().find(|i| crate::paints(i)))
+            .ok_or("the revolved object has no fill or stroke")?;
+        return Ok(vec![mesh(&path, fx, item)?]);
+    }
+    let path = geometry(&path, &n.appearance.effects, &ctx);
+    let mut out = vec![];
+    for item in n.appearance.items.iter().filter(|i| crate::paints(i)) {
+        if let Some(index) = item.effects().iter().position(|e| e.visible && e.id == REVOLVE)
+            && let Some(fx) = item.effects().get(index)
+        {
+            let p = geometry(&path, item.effects().get(..index).unwrap_or_default(), &ctx.item(item));
+            out.push(mesh(&p, fx, item)?);
+        }
+    }
+    Ok(out)
+}
+
 fn art(n: &Node, expand: bool) -> Option<Node> {
     if !has_revolve(n) {
         return None;
diff --git a/crates/effects/src/solids.rs b/crates/effects/src/solids.rs
index 3319d79af..09a2fc8ec 100644
--- a/crates/effects/src/solids.rs
+++ b/crates/effects/src/solids.rs
@@ -6,7 +6,7 @@ use serde_json::Value;
 use vectorcraft_doc::color::{BlendMode, Paint};
 use vectorcraft_doc::{Appearance, AppearanceItem, Effect, Node, NodeKind, StrokeLayer};
 use vectorcraft_geom::{FillRule, PathData, Rect};
-use vectorcraft_three_d::{Bevel, BevelShape, Extrude, Facet, Inflate, View};
+use vectorcraft_three_d::{Bevel, BevelShape, Extrude, Facet, Inflate, Mesh, View};
 
 #[cfg(test)]
 use vectorcraft_doc::color::Color;
@@ -221,6 +221,10 @@ fn union_bounds(shapes: &[Profile]) -> Option<Rect> {
 /// The most members a 3D effect on a group builds solids from.
 const MAX_MEMBERS: usize = 4096;
 
+/// The most triangles the meshes of one 3D effect hold together (about 290 MB of corners and
+/// normals): past it the object is too complex to export.
+const MAX_MESH_TRIANGLES: usize = 2_000_000;
+
 /// The shapes a 3D effect on group or layer `n` builds its solids from: every visible path,
 /// compound path and type in it, at any depth of its groups, each through its own geometry
 /// effects and painted with its own fills and strokes. Like the effect on a group in the
@@ -338,6 +342,38 @@ fn region(path: &PathData, rule: FillRule, item: &AppearanceItem) -> (PathData,
     }
 }
 
+/// The parts Extrude & Bevel and Inflate build solids from: each shape's top fill and its strokes,
+/// a group's members from the back up, each with its shape's opacity and the region it paints.
+/// The solids share the bounds of all their parts (`fallback` when none has any): one center to
+/// turn, twist and taper about, and Inflate's grid reaches over the strokes' outlines.
+fn solid_parts(shapes: &[Profile], fallback: Rect) -> (Vec<(&AppearanceItem, f32, PathData, FillRule)>, Rect) {
+    let parts: Vec<(&AppearanceItem, f32, PathData, FillRule)> = shapes
+        .iter()
+        .flat_map(|s| {
+            let top_fill = s.items.iter().rposition(|i| matches!(i, AppearanceItem::Fill(_)));
+            s.items.iter().enumerate().filter(move |(k, i)| Some(*k) == top_fill || matches!(i, AppearanceItem::Stroke(_))).map(|(_, i)| {
+                let (area, rule) = region(&s.path, s.rule, i);
+                (i, s.opacity, area, rule)
+            })
+        })
+        .collect();
+    let bounds = parts.iter().filter_map(|(_, _, area, _)| area.bounds()).reduce(|a, c| a.union(c)).unwrap_or(fallback);
+    (parts, bounds)
+}
+
+/// `shapes`, the members of group or layer `n`, reshaped by the visible geometry effects `before`
+/// its 3D effect, about the bounds of all of them.
+fn reshape_members(n: &Node, before: &[Effect], shapes: &mut [Profile]) {
+    if before.iter().any(|e| e.visible && is_geometry(&e.id))
+        && let Some(b) = union_bounds(shapes)
+    {
+        let ctx = GeomContext::of(n);
+        for s in shapes {
+            s.path = apply_geometry_with(before, &s.path, b, &ctx);
+        }
+    }
+}
+
 /// The 3D art of one effect `fx` on `path` (already through the effects before it).
 /// Rotate turns every fill and stroke, each in its own paint. Extrude & Bevel and Inflate build a
 /// solid from the path for the top visible fill and one from the outline of each visible stroke,
@@ -363,20 +399,7 @@ fn art_for(n: &Node, fx: &Effect, shapes: &[Profile]) -> Option<Vec<Arc<Node>>>
         }
         return Some(out);
     }
-    // Each shape's top fill and its strokes, a group's members from the back up.
-    let parts: Vec<(&AppearanceItem, f32, PathData, FillRule)> = shapes
-        .iter()
-        .flat_map(|s| {
-            let top_fill = s.items.iter().rposition(|i| matches!(i, AppearanceItem::Fill(_)));
-            s.items.iter().enumerate().filter(move |(k, i)| Some(*k) == top_fill || matches!(i, AppearanceItem::Stroke(_))).map(|(_, i)| {
-                let (area, rule) = region(&s.path, s.rule, i);
-                (i, s.opacity, area, rule)
-            })
-        })
-        .collect();
-    // The solids share the bounds of all their shapes: one center to turn, twist and taper about,
-    // and Inflate's grid reaches over the strokes' outlines.
-    let bounds = parts.iter().filter_map(|(_, _, area, _)| area.bounds()).reduce(|a, c| a.union(c)).unwrap_or(b);
+    let (parts, bounds) = solid_parts(shapes, b);
     let built = if fx.id == INFLATE {
         // One eye for every puff, as far away as the highest needs.
         let shapes: Vec<(&PathData, FillRule)> = parts.iter().map(|(_, _, area, rule)| (area, *rule)).collect();
@@ -493,14 +516,7 @@ pub fn solid_art(n: &Node) -> Option<Node> {
 fn group_solid_art(n: &Node) -> Option<Node> {
     let (index, fx) = solid(&n.appearance.effects)?;
     let mut shapes = members(n, "").ok()?;
-    let before = n.appearance.effects.get(..index)?;
-    if before.iter().any(|e| e.visible && is_geometry(&e.id)) {
-        let b = union_bounds(&shapes)?;
-        let ctx = GeomContext::of(n);
-        for s in &mut shapes {
-            s.path = apply_geometry_with(before, &s.path, b, &ctx);
-        }
-    }
+    reshape_members(n, n.appearance.effects.get(..index)?, &mut shapes);
     let children = art_for(n, fx, &shapes)?;
     let remaining =
         n.appearance.effects.iter().enumerate().filter(|(i, e)| *i != index && (!is_geometry(&e.id) || *i > index)).map(|(_, e)| e.clone()).collect();
@@ -510,5 +526,147 @@ fn group_solid_art(n: &Node) -> Option<Node> {
     Some(art)
 }
 
+/// One solid of a 3D object as a mesh, with the color it is painted.
+#[derive(Clone, Debug, PartialEq)]
+pub struct SolidMesh {
+    pub mesh: Mesh,
+    /// The paint's display color (sRGB, 0..1) and its opacity: a gradient's stops averaged, gray
+    /// for a pattern.
+    pub color: [f32; 4],
+}
+
+/// The color a mesh of `paint` at `opacity` takes ([`SolidMesh::color`]).
+pub(crate) fn mesh_color(paint: &Paint, opacity: f32) -> [f32; 4] {
+    let (rgb, alpha) = match paint {
+        Paint::Solid { color, .. } => (color.to_rgb(), 1.0),
+        Paint::Gradient(g) if !g.gradient.stops.is_empty() => {
+            let n = g.gradient.stops.len() as f32;
+            let mut sum = [0.0f32; 4];
+            for s in &g.gradient.stops {
+                let [r, gr, b] = s.color.to_rgb();
+                sum = [sum[0] + r, sum[1] + gr, sum[2] + b, sum[3] + s.opacity];
+            }
+            ([sum[0] / n, sum[1] / n, sum[2] / n], sum[3] / n)
+        }
+        _ => ([0.5; 3], 1.0),
+    };
+    let unit = |v: f32| if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 };
+    [unit(rgb[0]), unit(rgb[1]), unit(rgb[2]), unit(alpha * opacity)]
+}
+
+/// Add `mesh` to `out`, counting its triangles into `total`, or an error when that passes `limit`.
+pub(crate) fn keep_mesh(out: &mut Vec<SolidMesh>, total: &mut usize, mesh: SolidMesh, limit: usize) -> Result<(), String> {
+    *total = total.saturating_add(mesh.mesh.triangles.len());
+    if *total > limit {
+        return Err("The 3D object is too complex to export".into());
+    }
+    out.push(mesh);
+    Ok(())
+}
+
+/// The solids effect `fx` builds from `shapes`, as [`art_for`] draws them, as meshes: Rotate turns
+/// every fill and stroke; Extrude & Bevel and Inflate build one from each shape's top fill and one
+/// from the outline of each stroke. A stroke whose solid is past the limits is left out.
+fn meshes_for(fx: &Effect, shapes: &[Profile], total: &mut usize) -> Result<Vec<SolidMesh>, String> {
+    let label = crate::effect_info(&fx.id).map_or("This effect", |e| e.label.trim_end_matches('…'));
+    let b = union_bounds(shapes).ok_or_else(|| format!("{label} requires a shape with at least two anchors"))?;
+    let p = crate::merged_params(&fx.id, &fx.params);
+    let view = view_options(&p);
+    let mut out = vec![];
+    let mut keep = |out: &mut Vec<SolidMesh>, mesh: Mesh, color: [f32; 4]| keep_mesh(out, total, SolidMesh { mesh, color }, MAX_MESH_TRIANGLES);
+    if fx.id == ROTATE {
+        for s in shapes {
+            for item in &s.items {
+                let (paint, opacity, _) = paint_of(item, s.opacity);
+                let (area, rule) = region(&s.path, s.rule, item);
+                keep(&mut out, vectorcraft_three_d::plane_mesh(&area, rule, b, view)?, mesh_color(&paint, opacity))?;
+            }
+        }
+        return Ok(out);
+    }
+    let (parts, bounds) = solid_parts(shapes, b);
+    // Inflate lays out every puff at once (they share one eye); each mesh, and each Extrude &
+    // Bevel solid, is built as it is reached.
+    let mut inflated = (fx.id == INFLATE).then(|| {
+        let shapes: Vec<(&PathData, FillRule)> = parts.iter().map(|(_, _, area, rule)| (area, *rule)).collect();
+        vectorcraft_three_d::inflate_meshes(&shapes, bounds, inflate_options(&p), view)
+    });
+    let extrude = extrude_options(&p);
+    for (item, member, area, rule) in &parts {
+        let item: &AppearanceItem = item;
+        let mesh = match inflated.as_mut() {
+            Some(built) => built.next().unwrap_or_else(|| Ok(Mesh::default())),
+            None => vectorcraft_three_d::extrude_mesh(area, *rule, bounds, extrude, view),
+        };
+        match mesh {
+            Ok(mesh) => {
+                let (paint, opacity, _) = paint_of(item, *member);
+                keep(&mut out, mesh, mesh_color(&paint, opacity))?;
+            }
+            Err(_) if matches!(item, AppearanceItem::Stroke(_)) => {}
+            Err(e) => return Err(e),
+        }
+    }
+    Ok(out)
+}
+
+/// The solids `n`'s Extrude & Bevel, Inflate, Rotate or Revolve effect builds, as meshes with the
+/// colors they are painted ([`SolidMesh`]), faces turned away from the viewer included; meshes
+/// with no triangles are left out. On a group or layer, the effect's solids of its members
+/// ([`members`]). The object's opacity multiplies every color's. An error when `n` carries no
+/// such effect, its solids can't be built, or none has a triangle.
+pub fn three_d_meshes(n: &Node) -> Result<Vec<SolidMesh>, String> {
+    // Triangles of every solid together, against [`MAX_MESH_TRIANGLES`].
+    let mut total = 0usize;
+    let meshes = if crate::has_revolve(n) {
+        let mut out = vec![];
+        for m in crate::revolve::revolve_meshes(n)? {
+            keep_mesh(&mut out, &mut total, m, MAX_MESH_TRIANGLES)?;
+        }
+        out
+    } else if !has_solid(n) {
+        return Err("the object has no 3D effect (Extrude & Bevel, Revolve, Inflate or Rotate)".into());
+    } else if is_container(n) {
+        let (index, fx) = solid(&n.appearance.effects).ok_or("a 3D effect on a group's fill or stroke draws nothing to export")?;
+        let label = crate::effect_info(&fx.id).map_or("This effect", |e| e.label.trim_end_matches('…'));
+        let mut shapes = members(n, label)?;
+        reshape_members(n, n.appearance.effects.get(..index).unwrap_or_default(), &mut shapes);
+        meshes_for(fx, &shapes, &mut total)?
+    } else {
+        let (path, rule) = profile(n).ok_or("3D export needs a path, compound path, type or group")?;
+        let ctx = GeomContext::of(n);
+        let paints = solid_paints(n);
+        if let Some((index, fx)) = solid(&n.appearance.effects) {
+            let path = geometry(&path, n.appearance.effects.get(..index).unwrap_or_default(), &ctx);
+            meshes_for(fx, &[Profile { path, rule, items: paints, opacity: 1.0 }], &mut total)?
+        } else {
+            let path = geometry(&path, &n.appearance.effects, &ctx);
+            let mut out = vec![];
+            for item in &paints {
+                if let Some((index, fx)) = solid(item.effects()) {
+                    let p = geometry(&path, item.effects().get(..index).unwrap_or_default(), &ctx.item(item));
+                    out.extend(meshes_for(fx, &[Profile { path: p, rule, items: vec![item.clone()], opacity: 1.0 }], &mut total)?);
+                }
+            }
+            out
+        }
+    };
+    let meshes: Vec<SolidMesh> = meshes
+        .into_iter()
+        .filter(|m| !m.mesh.is_empty())
+        .map(|mut m| {
+            m.color[3] *= n.opacity.clamp(0.0, 1.0);
+            m
+        })
+        .collect();
+    if meshes.is_empty() {
+        return Err("its 3D effect builds no solid".into());
+    }
+    Ok(meshes)
+}
+
 #[cfg(test)]
 mod tests;
+
+#[cfg(test)]
+mod tests_mesh;
diff --git a/crates/effects/src/solids/tests_mesh.rs b/crates/effects/src/solids/tests_mesh.rs
new file mode 100644
index 000000000..9aca2ab8c
--- /dev/null
+++ b/crates/effects/src/solids/tests_mesh.rs
@@ -0,0 +1,140 @@
+use serde_json::json;
+use vectorcraft_doc::NodeId;
+use vectorcraft_doc::color::{Color, Gradient, GradientKind, GradientPaint, GradientStop};
+use vectorcraft_geom::BezPath;
+
+use super::*;
+
+const RED: Color = Color::Rgb { r: 0.8, g: 0.2, b: 0.1 };
+
+fn square_node(id: u64, x: f64) -> Node {
+    let mut b = BezPath::new();
+    b.move_to((x, 100.0));
+    b.line_to((x + 100.0, 100.0));
+    b.line_to((x + 100.0, 200.0));
+    b.line_to((x, 200.0));
+    b.close_path();
+    Node::path(NodeId(id), PathData::from_bezpath(&b), Appearance::basic(Paint::solid(RED), Paint::solid(Color::BLACK), 4.0))
+}
+
+fn fx(id: &str, params: Value) -> Effect {
+    crate::new_effect(id, &params).unwrap()
+}
+
+fn close(a: [f32; 4], b: [f32; 4]) -> bool {
+    a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-5)
+}
+
+#[test]
+fn every_3d_effect_gives_a_mesh_for_its_fill_and_its_stroke() {
+    for id in SOLIDS {
+        let mut n = square_node(1, 100.0);
+        n.appearance.effects.push(fx(id, json!({})));
+        let meshes = three_d_meshes(&n).unwrap_or_else(|e| panic!("{id}: {e}"));
+        assert_eq!(meshes.len(), 2, "{id}: the fill's solid and the stroke's");
+        assert!(close(meshes[0].color, [0.8, 0.2, 0.1, 1.0]), "{id}: {:?}", meshes[0].color);
+        assert!(close(meshes[1].color, [0.0, 0.0, 0.0, 1.0]), "{id}: {:?}", meshes[1].color);
+        assert!(meshes.iter().all(|m| !m.mesh.is_empty()), "{id}");
+    }
+}
+
+#[test]
+fn the_meshes_of_one_object_share_one_triangle_budget() {
+    let mut n = square_node(1, 100.0);
+    n.appearance.effects.push(fx(EXTRUDE, json!({})));
+    let meshes = three_d_meshes(&n).unwrap();
+    let first = meshes[0].mesh.triangles.len();
+    assert!(first > 0);
+    // Every mesh counts against what the ones before it used.
+    let (mut out, mut total) = (vec![], 0);
+    keep_mesh(&mut out, &mut total, meshes[0].clone(), first).unwrap();
+    assert!(keep_mesh(&mut out, &mut total, meshes[1].clone(), first).is_err());
+    assert_eq!(out.len(), 1);
+    // Building past the budget stops with an error instead of holding every mesh.
+    let shapes = [Profile { path: profile(&n).unwrap().0, rule: FillRule::NonZero, items: solid_paints(&n), opacity: 1.0 }];
+    let Some(effect) = n.appearance.effects.first() else { panic!("no effect") };
+    let mut total = 0;
+    assert!(meshes_for(effect, &shapes, &mut total).is_ok());
+    let mut total = MAX_MESH_TRIANGLES - first + 1;
+    assert!(meshes_for(effect, &shapes, &mut total).is_err_and(|e| e.contains("too complex")));
+}
+
+#[test]
+fn an_extruded_mesh_is_as_deep_as_the_effect() {
+    let mut n = square_node(1, 100.0);
+    n.appearance.items.truncate(1);
+    n.appearance.effects.push(fx(EXTRUDE, json!({ "depth": 30.0, "rotationX": 0.0, "rotationY": 0.0, "rotationZ": 0.0 })));
+    let meshes = three_d_meshes(&n).unwrap();
+    let (lo, hi) = meshes[0].mesh.bounds().unwrap();
+    assert!((hi[2] - lo[2] - 30.0).abs() < 1e-9 && (hi[0] - lo[0] - 100.0).abs() < 1e-9, "{lo:?} {hi:?}");
+}
+
+#[test]
+fn revolve_gives_a_mesh_in_the_top_fill() {
+    let mut b = BezPath::new();
+    b.move_to((100.0, 40.0));
+    b.line_to((130.0, 60.0));
+    b.line_to((130.0, 140.0));
+    b.line_to((100.0, 160.0));
+    let mut n = Node::path(NodeId(1), PathData::from_bezpath(&b), Appearance::basic(Paint::solid(RED), Paint::None, 0.0));
+    n.appearance.effects.push(fx(crate::REVOLVE, json!({})));
+    let meshes = three_d_meshes(&n).unwrap();
+    assert_eq!(meshes.len(), 1);
+    assert!(close(meshes[0].color, [0.8, 0.2, 0.1, 1.0]));
+    assert!(meshes[0].mesh.triangles.len() >= 64 * 3, "three profile edges swept in 64 steps");
+}
+
+#[test]
+fn an_object_without_a_3d_effect_has_no_mesh() {
+    let mut n = square_node(1, 100.0);
+    assert!(three_d_meshes(&n).is_err());
+    n.appearance.effects.push(fx(EXTRUDE, json!({})));
+    n.appearance.effects[0].visible = false;
+    assert!(three_d_meshes(&n).is_err(), "a hidden effect builds nothing");
+}
+
+#[test]
+fn the_object_and_the_paint_opacities_multiply() {
+    let mut n = square_node(1, 100.0);
+    n.appearance.items.truncate(1);
+    if let Some(AppearanceItem::Fill(f)) = n.appearance.items.first_mut() {
+        f.opacity = 0.5;
+    }
+    n.opacity = 0.5;
+    n.appearance.effects.push(fx(EXTRUDE, json!({})));
+    let meshes = three_d_meshes(&n).unwrap();
+    assert!((meshes[0].color[3] - 0.25).abs() < 1e-6, "{:?}", meshes[0].color);
+}
+
+#[test]
+fn an_effect_on_one_fill_gives_that_fills_mesh_alone() {
+    let mut n = square_node(1, 100.0);
+    if let Some(AppearanceItem::Stroke(s)) = n.appearance.items.get_mut(1) {
+        s.effects.push(fx(EXTRUDE, json!({})));
+    }
+    let meshes = three_d_meshes(&n).unwrap();
+    assert_eq!(meshes.len(), 1);
+    assert!(close(meshes[0].color, [0.0, 0.0, 0.0, 1.0]));
+}
+
+#[test]
+fn a_group_gives_a_mesh_for_each_member() {
+    let mut g = Node::group(NodeId(9), vec![Arc::new(square_node(1, 0.0)), Arc::new(square_node(2, 300.0))]);
+    g.appearance.effects.push(fx(EXTRUDE, json!({ "rotationX": 0.0, "rotationY": 0.0, "rotationZ": 0.0 })));
+    let meshes = three_d_meshes(&g).unwrap();
+    assert_eq!(meshes.len(), 4, "each member's fill and stroke");
+    // The members turn about their shared centre: the first is left of it, the second right.
+    let (lo, _) = meshes[0].mesh.bounds().unwrap();
+    let (_, hi) = meshes[2].mesh.bounds().unwrap();
+    assert!(lo[0] < -150.0 && hi[0] > 150.0, "{lo:?} {hi:?}");
+}
+
+#[test]
+fn a_gradient_takes_the_average_of_its_stops() {
+    let stops =
+        vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop { opacity: 0.5, ..GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0)) }];
+    let paint = Paint::Gradient(Box::new(GradientPaint::new(Gradient::new(GradientKind::Linear, stops))));
+    assert!(close(mesh_color(&paint, 1.0), [0.5, 0.0, 0.5, 0.75]));
+    let pattern = Paint::Pattern { pattern: "x".into(), xf: vectorcraft_geom::Affine::IDENTITY };
+    assert!(close(mesh_color(&pattern, 0.5), [0.5, 0.5, 0.5, 0.5]));
+}
diff --git a/crates/effects/src/svg_filter.rs b/crates/effects/src/svg_filter.rs
new file mode 100644
index 000000000..0c84cde69
--- /dev/null
+++ b/crates/effects/src/svg_filter.rs
@@ -0,0 +1,1444 @@
+//! Effect › SVG Filters (`svg.filter`): an SVG `<filter>` element applied as a live raster effect.
+//! The filter runs on the object's pixels as SVG 1.1 describes it
+//! (<https://www.w3.org/TR/SVG11/filters.html>), drawn by resvg. Its lengths are in points times
+//! the effect's `scale`, its user space starts at the effect's `origin`, its object bounding box is the box of the drawn pixels, and it runs at the
+//! Document Raster Effects resolution when the view shows the object at a finer one.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+
+use resvg::{tiny_skia, usvg};
+use serde_json::Value;
+use usvg::roxmltree;
+use vectorcraft_doc::SvgFilter;
+use vectorcraft_geom::{Affine, Rect, Vec2};
+
+use crate::pixel::PixelSpace;
+use crate::util::{num, text};
+
+#[cfg(test)]
+mod tests;
+
+/// Effect › SVG Filters' effect id.
+pub const SVG_FILTER: &str = "svg.filter";
+
+/// Most primitives a filter holds.
+pub const MAX_PRIMITIVES: usize = 64;
+
+/// Most octaves an `feTurbulence` adds up.
+pub const MAX_OCTAVES: f64 = 10.0;
+
+/// The largest `feConvolveMatrix` kernel, in cells along a side.
+pub const MAX_KERNEL: f64 = 9.0;
+
+/// Longest filter name, in characters.
+pub const MAX_NAME: usize = 255;
+
+/// The largest `feMorphology` radius, in user units.
+pub const MAX_RADIUS: f64 = 100.0;
+
+/// The largest `stdDeviation` of a blur or a drop shadow, in user units.
+pub const MAX_STD_DEVIATION: f64 = 500.0;
+
+/// The largest `kernelUnitLength` of a convolution or a lighting primitive, in user units.
+pub const MAX_KERNEL_UNIT: f64 = 100.0;
+
+/// The most pixels of the raster a filter runs on that an `feMorphology` radius or a
+/// `kernelUnitLength` may span, and that a `stdDeviation` may span: past them the filter runs on
+/// coarser pixels, whatever the effect's `scale`.
+const MAX_WINDOW_PX: f64 = 32.0;
+const MAX_BLUR_PX: f64 = 512.0;
+
+/// `v` as an SVG number list, `None` when it isn't one.
+fn numbers(v: &str) -> Option<Vec<f64>> {
+    svgtypes::NumberListParser::from(v).collect::<Result<Vec<f64>, _>>().ok()
+}
+
+/// Filter `xml` as it is drawn and written ([`rebuilt`]) when it passes [`check`], `None` when it
+/// doesn't. Remembered for the filters seen last, so drawing does not check a filter again each time.
+fn checked(xml: &str) -> Option<Arc<str>> {
+    use std::hash::BuildHasher;
+    type Seen = (std::collections::hash_map::RandomState, std::collections::HashMap<(u64, usize), Option<Arc<str>>>, usize);
+    static SEEN: std::sync::OnceLock<std::sync::Mutex<Seen>> = std::sync::OnceLock::new();
+    let seen = SEEN.get_or_init(Default::default);
+    // Keyed by a hash that a file can't aim at (randomly seeded) and the length.
+    let key = seen.lock().ok().map(|s| (s.0.hash_one(xml), xml.len()));
+    if let Some(hit) = key.and_then(|k| seen.lock().ok().and_then(|s| s.1.get(&k).cloned())) {
+        return hit;
+    }
+    let form: Option<Arc<str>> = checked_form(xml).ok().map(|(_, form)| Arc::from(form));
+    if let (Some(k), Ok(mut s)) = (key, seen.lock())
+        && !s.1.contains_key(&k)
+    {
+        let size = |f: &Option<Arc<str>>| f.as_ref().map_or(0, |f| f.len()) + 64;
+        // One result makes room for another, so a document with many filters keeps most of them.
+        while s.1.len() >= MAX_CHECKED || s.2 + size(&form) > MAX_CHECKED_BYTES {
+            let Some(old) = s.1.keys().next().copied() else { break };
+            let freed = s.1.remove(&old).map_or(0, |f| size(&f));
+            s.2 = s.2.saturating_sub(freed);
+        }
+        s.2 += size(&form);
+        s.1.insert(k, form.clone());
+    }
+    form
+}
+
+/// The most check results [`checked`] keeps, and the most bytes of filters it keeps.
+const MAX_CHECKED: usize = 65_536;
+const MAX_CHECKED_BYTES: usize = 32 << 20;
+
+/// The most pixels an image of a filter (`feImage`) may have, by its header, and the most all the
+/// images of one filter may have together.
+pub const MAX_IMAGE_PIXELS: u64 = 4096 * 4096;
+
+/// The most `<filter>` elements of one SVG file that Import SVG Filter reads ([`filters_of`]);
+/// the others are left out.
+pub const MAX_FILTERS_READ: usize = 256;
+
+/// The attributes a filter keeps when it is drawn and written ([`rebuilt`]): the filter's region
+/// and units, and its primitives' own attributes.
+const FILTER_ATTRIBUTES: &[&str] = &[
+    "id",
+    "x",
+    "y",
+    "width",
+    "height",
+    "filterUnits",
+    "primitiveUnits",
+    "color-interpolation-filters",
+    "in",
+    "in2",
+    "result",
+    "mode",
+    "type",
+    "values",
+    "operator",
+    "k1",
+    "k2",
+    "k3",
+    "k4",
+    "order",
+    "kernelMatrix",
+    "divisor",
+    "bias",
+    "targetX",
+    "targetY",
+    "edgeMode",
+    "kernelUnitLength",
+    "preserveAlpha",
+    "surfaceScale",
+    "diffuseConstant",
+    "specularConstant",
+    "specularExponent",
+    "lighting-color",
+    "scale",
+    "xChannelSelector",
+    "yChannelSelector",
+    "dx",
+    "dy",
+    "stdDeviation",
+    "flood-color",
+    "flood-opacity",
+    "preserveAspectRatio",
+    "radius",
+    "baseFrequency",
+    "numOctaves",
+    "seed",
+    "stitchTiles",
+    "tableValues",
+    "slope",
+    "intercept",
+    "amplitude",
+    "exponent",
+    "offset",
+    "azimuth",
+    "elevation",
+    "z",
+    "pointsAtX",
+    "pointsAtY",
+    "pointsAtZ",
+    "limitingConeAngle",
+    "href",
+    "color",
+];
+
+/// The style properties a filter keeps from a `style` attribute, written as attributes.
+const STYLE_PROPERTIES: [&str; 5] = ["color", "color-interpolation-filters", "flood-color", "flood-opacity", "lighting-color"];
+
+/// The `image-rendering` values a filter keeps.
+const IMAGE_RENDERING: [&str; 7] = ["auto", "optimizeQuality", "optimizeSpeed", "smooth", "high-quality", "crisp-edges", "pixelated"];
+
+/// The image types a filter's `data:` URLs may hold.
+const IMAGE_TYPES: [&str; 5] = ["image/png", "image/jpeg", "image/jpg", "image/gif", "image/webp"];
+
+/// Is `v` a `data:` URL of a PNG, JPEG, GIF or WebP image, by its media type?
+fn image_data_url(v: &str) -> bool {
+    let v = v.trim_start();
+    let Some(rest) = v.get(..5).filter(|s| s.eq_ignore_ascii_case("data:")).and_then(|_| v.get(5..)) else { return false };
+    let media = rest.split([';', ',']).next().unwrap_or_default().trim().to_ascii_lowercase();
+    IMAGE_TYPES.contains(&media.as_str())
+}
+
+/// `v` written as an XML attribute value.
+fn escaped(v: &str) -> String {
+    v.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;")
+}
+
+/// Filter element `f` (checked) rebuilt from what it holds that a filter draws with: its filter
+/// elements other than `desc` and `title`, without text, comments or processing instructions, and
+/// on each of them only the attributes in [`FILTER_ATTRIBUTES`] (with no prefix, from no namespace
+/// or the SVG namespace, and `href` from XLink too) and the [`STYLE_PROPERTIES`] of its `style`.
+fn rebuilt(f: roxmltree::Node) -> String {
+    let mut out = String::new();
+    write_rebuilt(f, &mut out);
+    out
+}
+
+fn write_rebuilt(n: roxmltree::Node, out: &mut String) {
+    let name = n.tag_name().name();
+    let mut attrs: Vec<(&str, String)> = vec![];
+    // An attribute without a prefix comes first, as usvg takes it.
+    for ns in [None, Some(SVG_NS), Some(XLINK_NS)] {
+        for a in n.attributes().filter(|a| a.namespace() == ns && (ns != Some(XLINK_NS) || a.name() == "href")) {
+            if FILTER_ATTRIBUTES.contains(&a.name()) && !attrs.iter().any(|(k, _)| *k == a.name()) {
+                attrs.push((a.name(), a.value().to_string()));
+            }
+        }
+    }
+    // Style declarations win over attributes.
+    let style = n.attributes().find(|a| a.name() == "style" && matches!(a.namespace(), None | Some(SVG_NS))).map(|a| a.value()).unwrap_or_default();
+    for (k, v) in style.split(';').filter_map(|d| d.split_once(':')) {
+        let v = v.trim().trim_end_matches("!important").trim();
+        if let Some(&k) = STYLE_PROPERTIES.iter().find(|p| p.eq_ignore_ascii_case(k.trim()))
+            && !v.to_ascii_lowercase().contains("url(")
+        {
+            attrs.retain(|(name, _)| *name != k);
+            attrs.push((k, v.to_string()));
+        }
+    }
+    // `image-rendering`, from its attribute or its style declaration, as a style declaration (usvg
+    // reads `pixelated` and `crisp-edges` only there), and only as one of its keywords.
+    let rendering = style
+        .split(';')
+        .filter_map(|d| d.split_once(':'))
+        .filter(|(k, _)| k.trim().eq_ignore_ascii_case("image-rendering"))
+        .map(|(_, v)| v.trim().trim_end_matches("!important").trim())
+        .next_back()
+        .or_else(|| n.attributes().find(|a| a.name() == "image-rendering" && matches!(a.namespace(), None | Some(SVG_NS))).map(|a| a.value().trim()))
+        .and_then(|v| IMAGE_RENDERING.iter().find(|k| k.eq_ignore_ascii_case(v)));
+    out.push('<');
+    out.push_str(name);
+    for (k, v) in &attrs {
+        out.push_str(&format!(" {k}=\"{}\"", escaped(v)));
+    }
+    if let Some(v) = rendering {
+        out.push_str(&format!(" style=\"image-rendering:{v}\""));
+    }
+    let children: Vec<roxmltree::Node> = n
+        .children()
+        .filter(|c| c.is_element() && c.tag_name().namespace() == Some(SVG_NS) && !matches!(c.tag_name().name(), "desc" | "title"))
+        .filter(|c| FILTER_ELEMENTS.contains(&c.tag_name().name()))
+        .collect();
+    if children.is_empty() {
+        out.push_str("/>");
+        return;
+    }
+    out.push('>');
+    for c in children {
+        write_rebuilt(c, out);
+    }
+    out.push_str(&format!("</{name}>"));
+}
+
+/// The primitives a filter runs, as usvg reads them: the first elements of [`FILTER_ELEMENTS`].
+const PRIMITIVES: [&str; 17] = [
+    "feBlend",
+    "feColorMatrix",
+    "feComponentTransfer",
+    "feComposite",
+    "feConvolveMatrix",
+    "feDiffuseLighting",
+    "feDisplacementMap",
+    "feDropShadow",
+    "feFlood",
+    "feGaussianBlur",
+    "feImage",
+    "feMerge",
+    "feMorphology",
+    "feOffset",
+    "feSpecularLighting",
+    "feTile",
+    "feTurbulence",
+];
+
+/// The `feBlend` modes of SVG 1.1, and the ones resvg also draws that SVG 1.1 lacks.
+const SVG11_BLEND_MODES: [&str; 5] = ["normal", "multiply", "screen", "darken", "lighten"];
+const LATER_BLEND_MODES: [&str; 11] =
+    ["overlay", "color-dodge", "color-burn", "hard-light", "soft-light", "difference", "exclusion", "hue", "saturation", "color", "luminosity"];
+
+/// The `feComposite` operators of SVG 1.1.
+const SVG11_OPERATORS: [&str; 6] = ["over", "in", "out", "atop", "xor", "arithmetic"];
+
+/// The longest form SVG output writes ([`svg11`]), leaving room within [`MAX_DRAWN_XML`] for the
+/// region and id written into it.
+const MAX_WRITTEN_XML: usize = MAX_DRAWN_XML - 1024;
+
+/// Filter `xml` (a rebuilt one, [`rebuilt`]) as SVG 1.1 output writes it, in the form an SVG 1.1
+/// viewer draws as resvg draws `xml`:
+/// - `feImage`'s `href` as `xlink:href`;
+/// - each `feDropShadow` (from Filter Effects Module Level 1,
+///   <https://www.w3.org/TR/filter-effects-1/#feDropShadowElement>) as the SVG 1.1 primitives that
+///   page gives as its equivalent: its input blurred by its `stdDeviation`, offset by its `dx` and
+///   `dy` (2, 2 and 2 when absent), a flood of its `flood-color` and `flood-opacity` composited
+///   `in` that, and a merge of the result over the input. The merge keeps its `result` and its
+///   subregion, and the results it adds take names no other primitive of the filter uses;
+/// - an `feComposite` operator SVG 1.1 lacks (`lighter`) and an `feBlend` mode resvg doesn't read
+///   left out, so the default that resvg draws (`over`, `normal`) applies;
+/// - colors in forms SVG 1.1 lacks (`rgba()`, `hsl()`, `transparent`, `#rgba` and the like) as
+///   `#rrggbb`, with a flood color's alpha multiplied into `flood-opacity` and a lighting color's
+///   alpha dropped, as resvg draws them, and `flood-opacity` as a number;
+/// - `image-rendering` as `optimizeSpeed` for `pixelated` and `crisp-edges`, and as
+///   `optimizeQuality` for `auto`, `smooth` and `high-quality`;
+/// - `edgeMode` only on `feConvolveMatrix`, the one SVG 1.1 primitive that has it;
+/// - each `in` and `in2` (also of `feMergeNode`) naming the primitive usvg reads: a result name
+///   only usvg gives (`result<n>` for a primitive without a `result`) as that primitive's written
+///   result, a name no earlier primitive has as the previous primitive's result (`SourceGraphic`
+///   for the first), and `BackgroundImage`, `BackgroundAlpha`, `FillPaint` and `StrokePaint`,
+///   which usvg draws as `SourceGraphic`, as `SourceGraphic`.
+///
+/// `None` when SVG 1.1 can't hold the filter: an `feBlend` mode SVG 1.1 lacks (`overlay` and the
+/// others in [`LATER_BLEND_MODES`]); an `feDropShadow` whose `flood-color` isn't a color, such as
+/// `currentColor` (resvg draws it black), or in a filter with `primitiveUnits="objectBoundingBox"`
+/// (where resvg fills an `feFlood` without a subregion over the object's box alone); more than
+/// [`MAX_PRIMITIVES`] primitives once the shadows are expanded; or more than [`MAX_WRITTEN_XML`]
+/// bytes. SVG output then leaves the filter out like other pixel effects, and exports that turn
+/// such effects into images draw the object as an image.
+fn svg11(xml: &str) -> Option<String> {
+    use std::collections::HashSet;
+    let (wrapped, _) = wrap(xml);
+    let doc = roxmltree::Document::parse(&wrapped).ok()?;
+    let f = filter_element(&doc).ok()?;
+    let primitives: Vec<roxmltree::Node> = f.children().filter(|c| c.is_element() && PRIMITIVES.contains(&c.tag_name().name())).collect();
+    let is_shadow = |n: &roxmltree::Node| n.tag_name().name() == "feDropShadow";
+    let shadows = primitives.iter().filter(|n| is_shadow(n)).count();
+    if primitives.len() + 4 * shadows > MAX_PRIMITIVES
+        || (shadows > 0 && f.attribute("primitiveUnits").is_some_and(|u| u.trim() == "objectBoundingBox"))
+        || primitives.iter().any(|n| is_shadow(n) && n.attribute("flood-color").is_some_and(|c| color(c).is_none()))
+    {
+        return None;
+    }
+    // Every name an input or a result uses, so the added results take others.
+    let taken: HashSet<String> =
+        f.descendants().flat_map(|n| ["result", "in", "in2"].into_iter().filter_map(move |a| n.attribute(a))).map(str::to_string).collect();
+    let named = |n: &roxmltree::Node| n.attribute("result").filter(|r| !r.trim().is_empty()).map(str::to_string);
+    let mut names = Names { taken, written: primitives.iter().map(named).collect() };
+    // The result names usvg gives the primitives: their own, or `result<n>` generated in order.
+    let mut drawn: Vec<String> = Vec::with_capacity(primitives.len());
+    let (mut own, mut next) = (HashSet::new(), 1usize);
+    for p in &primitives {
+        match p.attribute("result") {
+            Some(r) => {
+                own.insert(r.to_string());
+                next += 1;
+                drawn.push(r.to_string());
+            }
+            None => loop {
+                let name = format!("result{next}");
+                next += 1;
+                if !own.contains(&name) {
+                    drawn.push(name);
+                    break;
+                }
+            },
+        }
+    }
+    // Each input written as the primitive it reads when drawn: a result only usvg names (or one
+    // with no name) as that primitive's written result, an unknown result as the previous
+    // primitive's (`SourceGraphic` for the first), and an input usvg draws as `SourceGraphic` as
+    // that. A shadow names its input twice (the blur and the merge), so an implicit one is named.
+    let mut inputs = Inputs::new();
+    let mut shadow_inputs: Vec<Option<String>> = vec![None; primitives.len()];
+    for (i, p) in primitives.iter().enumerate() {
+        let previous = |names: &mut Names| i.checked_sub(1).map_or_else(|| "SourceGraphic".to_string(), |j| names.of(j));
+        let resolve = |v: &str, names: &mut Names| match v {
+            "SourceGraphic" | "SourceAlpha" => v.to_string(),
+            "BackgroundImage" | "BackgroundAlpha" | "FillPaint" | "StrokePaint" => "SourceGraphic".to_string(),
+            _ => match (0..i).rev().find(|&j| drawn.get(j).is_some_and(|d| d == v)) {
+                Some(j) if !v.trim().is_empty() && primitives.get(j).and_then(|q| q.attribute("result")) == Some(v) => v.to_string(),
+                Some(j) => names.of(j),
+                None => previous(names),
+            },
+        };
+        let mut elements = vec![*p];
+        if p.tag_name().name() == "feMerge" {
+            elements.extend(p.children().filter(|c| c.is_element() && c.tag_name().name() == "feMergeNode"));
+        }
+        for e in elements {
+            for a in ["in", "in2"] {
+                if let Some(v) = e.attribute(a) {
+                    let r = resolve(v, &mut names);
+                    inputs.insert((e.id(), a), r);
+                }
+            }
+        }
+        if is_shadow(p) {
+            shadow_inputs[i] = Some(match p.attribute("in") {
+                Some(v) => resolve(v, &mut names),
+                None => previous(&mut names),
+            });
+        }
+    }
+    let mut out = format!("<filter{}", svg11_attributes(f, None, &inputs)?);
+    let children: Vec<roxmltree::Node> = f.children().filter(roxmltree::Node::is_element).collect();
+    if children.is_empty() {
+        out.push_str("/>");
+    } else {
+        out.push('>');
+        let mut i = 0;
+        for c in children {
+            if !PRIMITIVES.contains(&c.tag_name().name()) {
+                write_svg11(c, None, &inputs, &mut out)?;
+                continue;
+            }
+            let result = names.written.get(i).cloned().flatten();
+            match shadow_inputs.get(i).cloned().flatten() {
+                Some(input) => {
+                    let added = (names.fresh(), names.fresh());
+                    write_drop_shadow(c, &input, result.as_deref(), added, &mut out);
+                }
+                // A result that differs from the element's own is one added for a later reference.
+                None => write_svg11(c, result.as_deref().filter(|r| Some(*r) != c.attribute("result")), &inputs, &mut out)?,
+            }
+            i += 1;
+        }
+        out.push_str("</filter>");
+    }
+    (out.len() <= MAX_WRITTEN_XML).then_some(out)
+}
+
+/// The result names of a filter's SVG 1.1 form ([`svg11`]): the names its elements use, and the
+/// result each primitive is written with.
+struct Names {
+    taken: std::collections::HashSet<String>,
+    written: Vec<Option<String>>,
+}
+
+impl Names {
+    /// A result name no element of the filter uses.
+    fn fresh(&mut self) -> String {
+        let name = (0..).map(|k| format!("vcShadow{k}")).find(|n| !self.taken.contains(n)).unwrap_or_default();
+        self.taken.insert(name.clone());
+        name
+    }
+
+    /// The result primitive `j` is written with, given a new name when it has none.
+    fn of(&mut self, j: usize) -> String {
+        if let Some(Some(r)) = self.written.get(j) {
+            return r.clone();
+        }
+        let r = self.fresh();
+        if let Some(w) = self.written.get_mut(j) {
+            *w = Some(r.clone());
+        }
+        r
+    }
+}
+
+/// `v` as a color, as usvg reads it: `None` for anything else, `currentColor` included.
+fn color(v: &str) -> Option<svgtypes::Color> {
+    <svgtypes::Color as std::str::FromStr>::from_str(v).ok()
+}
+
+/// `v` as an opacity, as usvg reads it: a number or a percentage, clamped to 0 to 1.
+fn opacity(v: &str) -> Option<f64> {
+    let l = <svgtypes::Length as std::str::FromStr>::from_str(v).ok()?;
+    let o = match l.unit {
+        svgtypes::LengthUnit::None => l.number,
+        svgtypes::LengthUnit::Percent => l.number / 100.0,
+        _ => return None,
+    };
+    o.is_finite().then(|| o.clamp(0.0, 1.0))
+}
+
+/// Number `v` written with at most six decimals.
+fn decimal(v: f64) -> String {
+    let s = format!("{v:.6}");
+    s.trim_end_matches('0').trim_end_matches('.').to_string()
+}
+
+/// Color `c` as `#rrggbb`, without its alpha.
+fn hex(c: svgtypes::Color) -> String {
+    format!("#{:02x}{:02x}{:02x}", c.red, c.green, c.blue)
+}
+
+/// The `flood-color` and `flood-opacity` of element `n` as SVG 1.1 writes them ([`svg11`]): a color
+/// as `#rrggbb` with its alpha multiplied into the opacity, and the opacity as a number. A
+/// `flood-color` that isn't a color is written as it is.
+fn flood_attributes(n: roxmltree::Node) -> String {
+    let mut out = String::new();
+    let flood = n.attribute("flood-color");
+    let parsed = flood.and_then(color);
+    match (flood, parsed) {
+        (_, Some(c)) => out.push_str(&format!(" flood-color=\"{}\"", hex(c))),
+        (Some(v), None) => out.push_str(&format!(" flood-color=\"{}\"", escaped(v))),
+        (None, None) => {}
+    }
+    let alpha = parsed.map_or(1.0, |c| f64::from(c.alpha) / 255.0);
+    let given = n.attribute("flood-opacity");
+    if given.is_some() || alpha < 1.0 {
+        let o = given.and_then(opacity).unwrap_or(1.0);
+        out.push_str(&format!(" flood-opacity=\"{}\"", decimal(alpha * o)));
+    }
+    out
+}
+
+/// Inputs written in place of an element's own `in` and `in2` ([`svg11`]).
+type Inputs<'a> = std::collections::HashMap<(roxmltree::NodeId, &'a str), String>;
+
+/// The attributes of element `n` of a rebuilt filter as SVG 1.1 writes them ([`svg11`]), with
+/// `result` in place of its own when given and its inputs as `inputs` gives them. `None` for an
+/// `feBlend` mode SVG 1.1 lacks.
+fn svg11_attributes(n: roxmltree::Node, result: Option<&str>, inputs: &Inputs) -> Option<String> {
+    let name = n.tag_name().name();
+    let mut out = String::new();
+    let mut push = |k: &str, v: &str| out.push_str(&format!(" {k}=\"{}\"", escaped(v)));
+    for a in n.attributes() {
+        let v = a.value();
+        match a.name() {
+            "href" => push("xlink:href", v),
+            k @ ("in" | "in2") => push(k, inputs.get(&(n.id(), k)).map_or(v, String::as_str)),
+            "result" if result.is_some() => {}
+            "flood-color" | "flood-opacity" => {}
+            "edgeMode" if name != "feConvolveMatrix" => {}
+            "mode" if name == "feBlend" => {
+                if LATER_BLEND_MODES.contains(&v) {
+                    return None;
+                }
+                if SVG11_BLEND_MODES.contains(&v) {
+                    push("mode", v);
+                }
+            }
+            "operator" if name == "feComposite" => {
+                if SVG11_OPERATORS.contains(&v) {
+                    push("operator", v);
+                }
+            }
+            k @ ("lighting-color" | "color") => match color(v) {
+                Some(c) => push(k, &hex(c)),
+                None => push(k, v),
+            },
+            "style" => {
+                let speed = v.ends_with(":pixelated") || v.ends_with(":crisp-edges") || v.ends_with(":optimizeSpeed");
+                push("style", if speed { "image-rendering:optimizeSpeed" } else { "image-rendering:optimizeQuality" });
+            }
+            k => push(k, v),
+        }
+    }
+    out.push_str(&flood_attributes(n));
+    if let Some(r) = result {
+        out.push_str(&format!(" result=\"{}\"", escaped(r)));
+    }
+    Some(out)
+}
+
+/// Element `n` of a rebuilt filter, and what it holds, as SVG 1.1 writes them ([`svg11`]), with
+/// `result` in place of its own when given and inputs as `inputs` gives them.
+fn write_svg11(n: roxmltree::Node, result: Option<&str>, inputs: &Inputs, out: &mut String) -> Option<()> {
+    let name = n.tag_name().name();
+    out.push_str(&format!("<{name}{}", svg11_attributes(n, result, inputs)?));
+    let children: Vec<roxmltree::Node> = n.children().filter(roxmltree::Node::is_element).collect();
+    if children.is_empty() {
+        out.push_str("/>");
+        return Some(());
+    }
+    out.push('>');
+    for c in children {
+        write_svg11(c, None, inputs, out)?;
+    }
+    out.push_str(&format!("</{name}>"));
+    Some(())
+}
+
+/// `feDropShadow` `n` as its SVG 1.1 equivalent ([`svg11`]) on `input`, giving `result` when set,
+/// with `names` (unused elsewhere in the filter) for the offset shadow and the colored one.
+fn write_drop_shadow(n: roxmltree::Node, input: &str, result: Option<&str>, names: (String, String), out: &mut String) {
+    let attr = |k: &str, default: &str| escaped(n.attribute(k).unwrap_or(default));
+    // An offset that isn't a number is the shadow's default 2, as usvg reads it (an `feOffset`'s is 0).
+    let offset_by = |k: &str| {
+        let v = n.attribute(k).filter(|v| <svgtypes::Number as std::str::FromStr>::from_str(v).is_ok()).unwrap_or("2");
+        escaped(v)
+    };
+    let space = n.attribute("color-interpolation-filters").map(|v| format!(" color-interpolation-filters=\"{}\"", escaped(v))).unwrap_or_default();
+    let (input, offset, shadow) = (escaped(input), escaped(&names.0), escaped(&names.1));
+    let mut region = String::new();
+    for k in ["x", "y", "width", "height"] {
+        if let Some(v) = n.attribute(k) {
+            region.push_str(&format!(" {k}=\"{}\"", escaped(v)));
+        }
+    }
+    let result = result.map(|r| format!(" result=\"{}\"", escaped(r))).unwrap_or_default();
+    out.push_str(&format!(
+        "<feGaussianBlur in=\"{input}\" stdDeviation=\"{}\"{space}/><feOffset dx=\"{}\" dy=\"{}\" result=\"{offset}\"{space}/><feFlood{}{space}/><feComposite in2=\"{offset}\" operator=\"in\" result=\"{shadow}\"{space}/><feMerge{region}{result}{space}><feMergeNode in=\"{shadow}\"/><feMergeNode in=\"{input}\"/></feMerge>",
+        attr("stdDeviation", "2"),
+        offset_by("dx"),
+        offset_by("dy"),
+        flood_attributes(n),
+    ));
+}
+
+/// `data` as an image a filter draws, with its pixel count: a PNG, JPEG, GIF or WebP, told by its
+/// first bytes whatever its `data:` URL says, of at most [`MAX_IMAGE_PIXELS`] pixels by its header.
+/// `None` for anything else, SVG and compressed SVG included.
+fn raster_image_sized(data: Arc<Vec<u8>>) -> Option<(usvg::ImageKind, u64)> {
+    let format = image::guess_format(&data).ok()?;
+    let (w, h) = image::ImageReader::with_format(std::io::Cursor::new(data.as_slice()), format).into_dimensions().ok()?;
+    let pixels = u64::from(w) * u64::from(h);
+    if pixels == 0 || pixels > MAX_IMAGE_PIXELS {
+        return None;
+    }
+    let kind = match format {
+        image::ImageFormat::Png => usvg::ImageKind::PNG(data),
+        image::ImageFormat::Jpeg => usvg::ImageKind::JPEG(data),
+        image::ImageFormat::Gif => usvg::ImageKind::GIF(data),
+        image::ImageFormat::WebP => usvg::ImageKind::WEBP(data),
+        _ => return None,
+    };
+    Some((kind, pixels))
+}
+
+/// The elements a filter may hold: its primitives, what they hold (transfer functions, merge
+/// nodes, light sources), and descriptions.
+const FILTER_ELEMENTS: [&str; 27] = [
+    "feBlend",
+    "feColorMatrix",
+    "feComponentTransfer",
+    "feComposite",
+    "feConvolveMatrix",
+    "feDiffuseLighting",
+    "feDisplacementMap",
+    "feDropShadow",
+    "feFlood",
+    "feGaussianBlur",
+    "feImage",
+    "feMerge",
+    "feMorphology",
+    "feOffset",
+    "feSpecularLighting",
+    "feTile",
+    "feTurbulence",
+    "feFuncR",
+    "feFuncG",
+    "feFuncB",
+    "feFuncA",
+    "feMergeNode",
+    "feDistantLight",
+    "fePointLight",
+    "feSpotLight",
+    "desc",
+    "title",
+];
+
+const SVG_NS: &str = "http://www.w3.org/2000/svg";
+const XLINK_NS: &str = "http://www.w3.org/1999/xlink";
+
+/// The id the filter takes while it is drawn.
+const DRAWN_ID: &str = "vcSvgFilter";
+
+/// `xml` inside an `<svg>` element that declares the SVG and XLink namespaces, and the length of
+/// what comes before it.
+fn wrap(xml: &str) -> (String, usize) {
+    let head = format!("<svg xmlns=\"{SVG_NS}\" xmlns:xlink=\"{XLINK_NS}\">");
+    (format!("{head}{xml}</svg>"), head.len())
+}
+
+/// The `<filter>` element of a wrapped filter ([`wrap`]): its only element, with no text beside it.
+fn filter_element<'a, 'i>(doc: &'a roxmltree::Document<'i>) -> Result<roxmltree::Node<'a, 'i>, String> {
+    let root = doc.root_element();
+    let stray = root.children().any(|n| n.is_text() && n.text().is_some_and(|t| !t.trim().is_empty()));
+    let mut elements = root.children().filter(roxmltree::Node::is_element);
+    match (elements.next(), elements.next()) {
+        (Some(f), None) if !stray && f.tag_name().name() == "filter" && f.tag_name().namespace() == Some(SVG_NS) => Ok(f),
+        _ => Err("give one <filter> element".into()),
+    }
+}
+
+/// Check filter `xml` and return its name (its `id`): one `<filter>` element with an `id`, up to
+/// [`SvgFilter::MAX_XML`] bytes, 1 to [`MAX_PRIMITIVES`] primitives, `feTurbulence` octaves up to
+/// [`MAX_OCTAVES`], `feConvolveMatrix` kernels up to [`MAX_KERNEL`] cells a side, morphology
+/// radii, standard deviations and kernel units up to [`MAX_RADIUS`], [`MAX_STD_DEVIATION`] and
+/// [`MAX_KERNEL_UNIT`], images only as PNG, JPEG, GIF or WebP `data:` URLs, that resvg can draw.
+pub fn check(xml: &str) -> Result<String, String> {
+    checked_form(xml).map(|(name, _)| name)
+}
+
+/// [`check`]: the filter's name and its form as it is drawn and written ([`rebuilt`]). The caps
+/// apply to that form, whose attributes are the ones usvg reads.
+fn checked_form(xml: &str) -> Result<(String, String), String> {
+    within_size(xml)?;
+    let (wrapped, _) = wrap(xml);
+    let doc = read(xml, &wrapped)?;
+    let f = filter_element(&doc)?;
+    let name = f.attribute("id").map(str::trim).filter(|n| !n.is_empty()).ok_or("the <filter> element needs an id, the filter's name")?;
+    if name.chars().count() > MAX_NAME {
+        return Err(format!("an SVG filter's id is at most {MAX_NAME} characters"));
+    }
+    for n in f.descendants().filter(roxmltree::Node::is_element) {
+        // Filter elements only, without scripts, event attributes or links out of the filter.
+        if n != f && !(n.tag_name().namespace() == Some(SVG_NS) && FILTER_ELEMENTS.contains(&n.tag_name().name())) {
+            return Err(format!("<{}> isn't an element of an SVG filter", n.tag_name().name()));
+        }
+        if let Some(a) = n.attributes().find(|a| a.name().get(..2).is_some_and(|on| on.eq_ignore_ascii_case("on"))) {
+            return Err(format!("an SVG filter has no event attributes such as {}", a.name()));
+        }
+        if n.attributes().any(|a| a.name() == "href" && !image_data_url(a.value())) {
+            return Err("an SVG filter's images are PNG, JPEG, GIF or WebP data: URLs".into());
+        }
+    }
+    let form = rebuilt(f);
+    let (wrapped, _) = wrap(&form);
+    let doc = roxmltree::Document::parse(&wrapped).map_err(|e| format!("the SVG filter isn't valid XML: {e}"))?;
+    let f = filter_element(&doc)?;
+    for n in f.descendants().filter(roxmltree::Node::is_element) {
+        if n.attribute("numOctaves").and_then(|v| v.trim().parse::<f64>().ok()).is_some_and(|v| v > MAX_OCTAVES) {
+            return Err(format!("feTurbulence's numOctaves is at most {MAX_OCTAVES}"));
+        }
+        // Read as usvg reads them: SVG number lists.
+        for (attr, max, what) in [
+            ("order", MAX_KERNEL, "feConvolveMatrix's order"),
+            ("radius", MAX_RADIUS, "feMorphology's radius"),
+            ("stdDeviation", MAX_STD_DEVIATION, "a blur's stdDeviation"),
+            ("kernelUnitLength", MAX_KERNEL_UNIT, "kernelUnitLength"),
+        ] {
+            if let Some(v) = n.attribute(attr)
+                && !numbers(v).is_some_and(|s| s.iter().all(|v| v.is_finite() && v.abs() <= max))
+            {
+                return Err(format!("{what} is at most {max}"));
+            }
+        }
+    }
+    // (Not its `desc` and `title`.)
+    let primitives = f.children().filter(|n| n.is_element() && n.tag_name().name().starts_with("fe")).count();
+    if primitives == 0 {
+        return Err("the SVG filter has no primitives".into());
+    }
+    if primitives > MAX_PRIMITIVES {
+        return Err(format!("an SVG filter has at most {MAX_PRIMITIVES} primitives"));
+    }
+    let drawn = with_id(&form, DRAWN_ID).ok_or("the SVG filter is too large once its attributes are written out")?;
+    let svg = format!(
+        "<svg xmlns=\"{SVG_NS}\" xmlns:xlink=\"{XLINK_NS}\" width=\"10\" height=\"10\"><defs>{drawn}</defs><rect width=\"10\" height=\"10\" filter=\"url(#{DRAWN_ID})\"/></svg>"
+    );
+    let over = Arc::new(AtomicBool::new(false));
+    let drawn = usvg::Tree::from_str(&svg, &options_with(None, Some(Arc::clone(&over))));
+    if over.load(Ordering::Relaxed) {
+        return Err(format!("an SVG filter's images have at most {MAX_IMAGE_PIXELS} pixels in all"));
+    }
+    match drawn {
+        Ok(tree) if has_filter(tree.root()) => Ok((name.to_string(), form)),
+        _ => Err("the SVG filter can't be drawn: check its primitives and their inputs".into()),
+    }
+}
+
+/// Can SVG output keep the SVG filter of `effects` (an object's own) as a filter: is it the last
+/// visible effect? When other effects follow it, SVG output draws it as an image.
+pub fn writes_live(effects: &[vectorcraft_doc::Effect]) -> bool {
+    effects.iter().rfind(|e| e.visible).is_some_and(|e| e.id == SVG_FILTER)
+}
+
+/// How deep a filter's elements may nest. A filter needs three levels: the filter, a primitive, and
+/// a primitive's transfer functions, merge nodes or lights.
+const MAX_DEPTH: usize = 16;
+
+/// How long the form of a filter that is drawn may be: a checked filter (at most
+/// [`SvgFilter::MAX_XML`] bytes) with the region attributes and id that drawing writes into it.
+const MAX_DRAWN_XML: usize = 2 * SvgFilter::MAX_XML;
+
+/// Filter `xml`, `wrapped` by [`wrap`], read as XML: refused past [`SvgFilter::MAX_XML`] bytes and,
+/// before the parser (which recurses) sees it, when its elements nest deeper than [`MAX_DEPTH`].
+fn read<'a>(xml: &str, wrapped: &'a str) -> Result<roxmltree::Document<'a>, String> {
+    within_size(xml)?;
+    read_unsized(xml, wrapped)
+}
+
+/// [`read`] without the size check, for a drawn form or a caller that checks its input separately.
+fn read_unsized<'a>(xml: &str, wrapped: &'a str) -> Result<roxmltree::Document<'a>, String> {
+    if nests_too_deep(xml) {
+        return Err(format!("an SVG filter's elements nest at most {MAX_DEPTH} deep"));
+    }
+    roxmltree::Document::parse(wrapped).map_err(|e| format!("the SVG filter isn't valid XML: {e}"))
+}
+
+/// Do the elements of `xml` nest deeper than [`MAX_DEPTH`]? Read from the text: comments, CDATA
+/// sections, declarations and processing instructions are skipped, and a `>` inside a quoted
+/// attribute value doesn't end a tag. Text that ends inside markup is left to the parser.
+fn nests_too_deep(xml: &str) -> bool {
+    let (mut i, mut depth) = (0usize, 0usize);
+    while let Some(rest) = xml.get(i..).and_then(|r| r.find('<').and_then(|at| r.get(at..))) {
+        let start = xml.len() - rest.len();
+        let past = |end: &str| rest.find(end).map(|e| e + end.len());
+        let step = if rest.starts_with("<!--") {
+            past("-->")
+        } else if rest.starts_with("<![CDATA[") {
+            past("]]>")
+        } else if rest.starts_with("<!") || rest.starts_with("<?") {
+            past(">")
+        } else if rest.starts_with("</") {
+            depth = depth.saturating_sub(1);
+            past(">")
+        } else {
+            let mut quote = None;
+            let end = rest.char_indices().skip(1).find_map(|(k, c)| match (quote, c) {
+                (Some(q), c) if c == q => {
+                    quote = None;
+                    None
+                }
+                (None, '"' | '\'') => {
+                    quote = Some(c);
+                    None
+                }
+                (None, '>') => Some(k),
+                _ => None,
+            });
+            let Some(end) = end else { return false };
+            if !rest.get(..end).is_some_and(|tag| tag.ends_with('/')) {
+                depth += 1;
+                if depth > MAX_DEPTH {
+                    return true;
+                }
+            }
+            Some(end + 1)
+        };
+        let Some(step) = step else { return false };
+        i = start + step;
+    }
+    false
+}
+
+/// What a document's style sheets can reach, read once for the whole document
+/// ([`depends_on_styles`]): whether a type selector names a `filter` or `fe…` element or they use
+/// `*`, or they set `color-interpolation-filters` (which a filter inherits), and the ids (`#id`)
+/// and attribute names (`[name]`) their selectors name. Other declarations (`filter: url(#a)` on a
+/// shape) don't count.
+#[derive(Clone, Debug, Default)]
+pub struct Styles {
+    reach_filters: bool,
+    ids: std::collections::HashSet<String>,
+    /// The attribute names their attribute selectors name (`[data-x]`, `[svg|x="1"]`), without a
+    /// namespace prefix: an element of a filter with one of them can be styled.
+    attrs: std::collections::HashSet<String>,
+}
+
+impl Styles {
+    /// The style sheets (`<style>` elements) of `doc`.
+    pub fn of(doc: &roxmltree::Document) -> Self {
+        let sheets: String = doc
+            .descendants()
+            .filter(|e| e.is_element() && e.tag_name().name() == "style")
+            .flat_map(|e| e.descendants().filter_map(|t| t.text()))
+            .collect();
+        let selectors = selectors_of(&sheets);
+        let ids = selectors
+            .split('#')
+            .skip(1)
+            .filter_map(|t| t.split(|c: char| !(c.is_alphanumeric() || matches!(c, '-' | '_'))).next())
+            .filter(|t| !t.is_empty())
+            .map(str::to_string)
+            .collect();
+        // A filter inherits `color-interpolation-filters` from whatever a sheet sets it on.
+        let inherited = sheets.contains("color-interpolation-filters");
+        let attrs = selectors
+            .split('[')
+            .skip(1)
+            .filter_map(|t| t.split(|c: char| matches!(c, ']' | '=' | '~' | '^' | '$' | '*') || c.is_whitespace()).next())
+            .map(|name| name.rsplit('|').next().unwrap_or(name).trim())
+            .filter(|t| !t.is_empty())
+            .map(str::to_string)
+            .collect();
+        Self { reach_filters: inherited || selects_filter_elements(&selectors), ids, attrs }
+    }
+}
+
+/// Can CSS `selectors` select a `filter` element or one of its elements ([`FILTER_ELEMENTS`]):
+/// a type selector naming one, in any case and with or without a namespace prefix, or the
+/// universal selector `*`. Class, id, attribute and pseudo-class names don't count; type
+/// selectors inside pseudo-class arguments (`:is(feFlood)`) do.
+fn selects_filter_elements(selectors: &str) -> bool {
+    let mut chars = selectors.char_indices().peekable();
+    let (mut prev, mut in_attr) = (' ', false);
+    while let Some((i, c)) = chars.next() {
+        if in_attr {
+            in_attr = c != ']';
+        } else if c == '[' {
+            in_attr = true;
+        } else if c == '*' {
+            return true;
+        } else if c.is_alphabetic() || c == '_' {
+            let mut end = i + c.len_utf8();
+            while let Some(&(j, d)) = chars.peek() {
+                if !(d.is_alphanumeric() || matches!(d, '-' | '_')) {
+                    break;
+                }
+                end = j + d.len_utf8();
+                chars.next();
+            }
+            let word = selectors.get(i..end).unwrap_or_default();
+            let names_filter = word.eq_ignore_ascii_case("filter") || FILTER_ELEMENTS.iter().any(|n| n.eq_ignore_ascii_case(word));
+            if names_filter && !matches!(prev, '.' | '#' | ':' | '-') {
+                return true;
+            }
+            prev = word.chars().last().unwrap_or(c);
+            continue;
+        }
+        prev = c;
+    }
+    false
+}
+
+/// The selectors of CSS `sheet`, outside comments: at any nesting depth, the text that opens a
+/// block (`… {`), at-rules' preludes (`@scope (#a) {`) included. Declarations, the text a `;` or
+/// `}` ends, aren't selectors.
+fn selectors_of(sheet: &str) -> String {
+    let (mut out, mut prelude, mut rest) = (String::new(), String::new(), sheet);
+    while let Some(c) = rest.chars().next() {
+        if rest.starts_with("/*") {
+            rest = rest.find("*/").and_then(|e| rest.get(e + 2..)).unwrap_or_default();
+            continue;
+        }
+        rest = rest.get(c.len_utf8()..).unwrap_or_default();
+        // A quoted string (backslash escapes included) as a whole: its braces and `/*` are text.
+        if c == '"' || c == '\'' {
+            let mut end = rest.len();
+            let mut escaped = false;
+            for (k, q) in rest.char_indices() {
+                match (escaped, q) {
+                    (true, _) => escaped = false,
+                    (false, '\\') => escaped = true,
+                    (false, q) if q == c => {
+                        end = k + q.len_utf8();
+                        break;
+                    }
+                    _ => {}
+                }
+            }
+            prelude.push(c);
+            prelude.push_str(rest.get(..end).unwrap_or_default());
+            rest = rest.get(end..).unwrap_or_default();
+            continue;
+        }
+        match c {
+            // An escaped character (`\;`) is text.
+            '\\' => {
+                prelude.push(c);
+                if let Some(next) = rest.chars().next() {
+                    prelude.push(next);
+                    rest = rest.get(next.len_utf8()..).unwrap_or_default();
+                }
+            }
+            '{' => {
+                out.push_str(&prelude);
+                out.push(',');
+                prelude.clear();
+            }
+            ';' | '}' => prelude.clear(),
+            _ => prelude.push(c),
+        }
+    }
+    out
+}
+
+/// The attributes of a filter's elements that can take `currentColor`.
+const COLOR_ATTRS: [&str; 7] = ["flood-color", "lighting-color", "fill", "stroke", "stop-color", "color", "style"];
+
+/// Does attribute `a` take its color from `currentColor`, in any case? Only attributes that carry
+/// a color are looked at (an `id` named "currentColor" doesn't), searched in place without a copy
+/// of the value.
+fn names_current_color(a: &roxmltree::Attribute) -> bool {
+    COLOR_ATTRS.contains(&a.name()) && a.value().as_bytes().windows(b"currentcolor".len()).any(|w| w.eq_ignore_ascii_case(b"currentcolor"))
+}
+
+/// Does filter element `n` look different outside its document: does an element of the filter
+/// have a `class` or use `currentColor`, can the document's style sheets (`styles`, [`Styles::of`]
+/// its document) reach it, or does an ancestor set `color-interpolation-filters` or a `style`?
+pub fn depends_on_styles(n: roxmltree::Node, styles: &Styles) -> bool {
+    styles.reach_filters
+        || n.descendants().filter_map(|e| e.attribute("id")).any(|id| styles.ids.contains(id))
+        || n.descendants().any(|e| e.attributes().any(|a| styles.attrs.contains(a.name())))
+        || n.descendants().any(|e| e.attribute("class").is_some() || e.attributes().any(|a| names_current_color(&a)))
+        || n.ancestors().skip(1).any(|a| a.attribute("color-interpolation-filters").is_some() || a.attribute("style").is_some())
+}
+
+/// The SVG filters of SVG document `doc` (read from `text`) that [`check`] takes, as (name, the
+/// `<filter>` element's XML from [`element_xml`]), in document order, up to `room` of them, and how
+/// many `<filter>` elements it didn't take. A filter named as `taken` says (a name the caller has),
+/// one past `room` or past the first [`MAX_FILTERS_READ`] filters, and one whose look depends on
+/// the document's styles ([`depends_on_styles`]) are not checked. The caller reads the document
+/// with its own limits on depth and entities.
+pub fn filters_of(doc: &roxmltree::Document, text: &str, room: usize, taken: impl Fn(&str) -> bool) -> (Vec<(String, String)>, usize) {
+    let (mut found, mut skipped): (Vec<(String, String)>, usize) = (vec![], 0);
+    let styles = Styles::of(doc);
+    let filters = doc.descendants().filter(|n| n.is_element() && n.tag_name().name() == "filter" && n.tag_name().namespace() == Some(SVG_NS));
+    for (k, n) in filters.enumerate() {
+        let id = n.attribute("id").map(str::trim).unwrap_or_default();
+        if k >= MAX_FILTERS_READ || found.len() >= room || taken(id) || found.iter().any(|(name, _)| name == id) || depends_on_styles(n, &styles) {
+            skipped += 1;
+            continue;
+        }
+        match element_xml(n, text).map(|xml| check(&xml).map(|name| (name, xml))) {
+            Some(Ok(f)) => found.push(f),
+            _ => skipped += 1,
+        }
+    }
+    (found, skipped)
+}
+
+/// The XML of element `n` of document `text`, as it is written there, with the namespace prefixes
+/// it uses that an ancestor declares (other than `xlink`, which [`check`] declares) declared on it.
+pub fn element_xml(n: roxmltree::Node, text: &str) -> Option<String> {
+    let xml = text.get(n.range())?;
+    let name_end = 1 + xml.get(1..)?.find(|c: char| c.is_whitespace() || c == '>' || c == '/')?;
+    let own = attribute_names(xml.get(name_end..)?);
+    let mut declared = String::new();
+    for ns in n.namespaces() {
+        let Some(prefix) = ns.name() else { continue };
+        let attr = format!("xmlns:{prefix}");
+        if prefix == "xml" || (prefix == "xlink" && ns.uri() == XLINK_NS) || !xml.contains(&format!("{prefix}:")) || own.contains(&attr.as_str()) {
+            continue;
+        }
+        let uri = ns.uri().replace('&', "&amp;").replace('<', "&lt;").replace('"', "&quot;");
+        declared.push_str(&format!(" {attr}=\"{uri}\""));
+    }
+    Some(format!("{}{declared}{}", xml.get(..name_end)?, xml.get(name_end..)?))
+}
+
+/// The attribute names of a start tag, `rest` the text after its element name: names, then `=`
+/// and a quoted value, with white space allowed around the `=`.
+fn attribute_names(rest: &str) -> Vec<&str> {
+    let mut names = vec![];
+    let mut s = rest;
+    loop {
+        s = s.trim_start();
+        if s.is_empty() || s.starts_with('>') || s.starts_with('/') {
+            return names;
+        }
+        let end = s.find(|c: char| c.is_whitespace() || c == '=' || c == '>' || c == '/').unwrap_or(s.len());
+        let (name, after) = s.split_at(end);
+        let Some(after) = after.trim_start().strip_prefix('=') else { return names };
+        let after = after.trim_start();
+        let Some(quote) = after.chars().next().filter(|c| *c == '"' || *c == '\'') else { return names };
+        let Some(close) = after.get(1..).and_then(|v| v.find(quote)) else { return names };
+        names.push(name);
+        s = after.get(close + 2..).unwrap_or_default();
+    }
+}
+
+/// The primitives of filter `xml` as usvg reads them (their `Debug` forms), to tell filters with
+/// the same primitives apart.
+pub fn primitive_forms(xml: &str) -> Option<Vec<String>> {
+    let drawn = with_id(xml, DRAWN_ID)?;
+    let svg = format!(
+        "<svg xmlns=\"{SVG_NS}\" xmlns:xlink=\"{XLINK_NS}\" width=\"10\" height=\"10\"><defs>{drawn}</defs><rect width=\"10\" height=\"10\" filter=\"url(#{DRAWN_ID})\"/></svg>"
+    );
+    let tree = usvg::Tree::from_str(&svg, &options()).ok()?;
+    fn first(g: &usvg::Group) -> Option<Arc<usvg::filter::Filter>> {
+        g.filters().first().cloned().or_else(|| {
+            g.children().iter().find_map(|n| match n {
+                usvg::Node::Group(g) => first(g),
+                _ => None,
+            })
+        })
+    }
+    Some(first(tree.root())?.primitives().iter().map(|p| format!("{:?}", p.kind())).collect())
+}
+
+/// Is filter `xml` at most [`SvgFilter::MAX_XML`] bytes? Checked before the text is copied.
+fn within_size(xml: &str) -> Result<(), String> {
+    if xml.len() > SvgFilter::MAX_XML {
+        return Err(format!("an SVG filter is at most {} KB", SvgFilter::MAX_XML / 1024));
+    }
+    Ok(())
+}
+
+/// Filter `xml` with its `id` changed to `id` (written escaped), up to [`MAX_DRAWN_XML`] bytes.
+/// Callers check user input with [`check`] before using the result as a filter.
+pub fn with_id(xml: &str, id: &str) -> Option<String> {
+    if xml.len() > MAX_DRAWN_XML {
+        return None;
+    }
+    let (wrapped, head) = wrap(xml);
+    let doc = read_unsized(xml, &wrapped).ok()?;
+    let f = filter_element(&doc).ok()?;
+    let at = f.attributes().find(|a| a.name() == "id" && a.namespace().is_none())?.range_value();
+    let (start, end) = (at.start.checked_sub(head)?, at.end.checked_sub(head)?);
+    // The value may sit in single quotes: those are escaped too.
+    let id = escaped(id).replace('\'', "&apos;");
+    Some(format!("{}{}{}", xml.get(..start)?, id, xml.get(end..)?))
+}
+
+/// usvg's options for drawing a filter: images only from `data:` URLs, and only the ones
+/// [`raster_image_sized`] takes.
+fn options() -> usvg::Options<'static> {
+    options_with(None, None)
+}
+
+/// Take `pixels` from the count `left`: false, leaving it as it is, when fewer are left.
+fn take(left: &AtomicU64, pixels: u64) -> bool {
+    let mut now = left.load(Ordering::Relaxed);
+    loop {
+        let Some(rest) = now.checked_sub(pixels) else { return false };
+        match left.compare_exchange_weak(now, rest, Ordering::Relaxed, Ordering::Relaxed) {
+            Ok(_) => return true,
+            Err(seen) => now = seen,
+        }
+    }
+}
+
+/// [`options`], also taking the PNG `source` (the object's pixels that [`SvgFilterFx::apply`]
+/// gives the filter) whatever its size. The filter's own images share [`MAX_IMAGE_PIXELS`]. An
+/// image that exceeds the remaining budget is left out and `over` is set.
+fn options_with(source: Option<Arc<Vec<u8>>>, over: Option<Arc<AtomicBool>>) -> usvg::Options<'static> {
+    let left = AtomicU64::new(MAX_IMAGE_PIXELS);
+    usvg::Options {
+        image_href_resolver: usvg::ImageHrefResolver {
+            resolve_data: Box::new(move |_, data, _| match &source {
+                Some(s) if **s == *data => Some(usvg::ImageKind::PNG(data)),
+                _ => {
+                    let (kind, pixels) = raster_image_sized(data)?;
+                    if !take(&left, pixels) {
+                        if let Some(o) = &over {
+                            o.store(true, Ordering::Relaxed);
+                        }
+                        return None;
+                    }
+                    Some(kind)
+                }
+            }),
+            resolve_string: Box::new(|_, _| None),
+        },
+        ..Default::default()
+    }
+}
+
+/// Filter `xml` (a rebuilt one, [`rebuilt`]) with attributes `set` on its `<filter>` element.
+fn with_attributes(xml: &str, set: &[(&str, f64)]) -> Option<String> {
+    let (wrapped, head) = wrap(xml);
+    let doc = roxmltree::Document::parse(&wrapped).ok()?;
+    let f = filter_element(&doc).ok()?;
+    let name_end = f.range().start.checked_sub(head)? + 1 + f.tag_name().name().len();
+    let mut edits: Vec<(usize, usize, String)> = vec![];
+    for (k, v) in set {
+        if !v.is_finite() {
+            return None;
+        }
+        match f.attributes().find(|a| a.name() == *k && a.namespace().is_none()) {
+            Some(a) => {
+                let r = a.range_value();
+                edits.push((r.start.checked_sub(head)?, r.end.checked_sub(head)?, format!("{v}")));
+            }
+            None => edits.push((name_end, name_end, format!(" {k}=\"{v}\""))),
+        }
+    }
+    edits.sort_by_key(|e| std::cmp::Reverse(e.0));
+    let mut out = xml.to_string();
+    for (start, end, text) in edits {
+        out = format!("{}{text}{}", out.get(..start)?, out.get(end..)?);
+    }
+    Some(out)
+}
+
+/// Does `g` or a group in it carry a filter?
+fn has_filter(g: &usvg::Group) -> bool {
+    !g.filters().is_empty() || g.children().iter().any(|n| matches!(n, usvg::Node::Group(g) if has_filter(g)))
+}
+
+/// A length of a filter region.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Length {
+    /// In user units.
+    User(f64),
+    /// A fraction of the object's box.
+    Box(f64),
+}
+
+/// A length of a filter region, whose default is the fraction `default`: in the object's bounding
+/// box (`user` false), a fraction or a percentage of the box, the default for anything else; in
+/// user space, a number or an absolute length (px, pt, pc, in, cm, mm) in user units. In user
+/// space a percentage, a length in em or ex, and a missing or unreadable length are measured
+/// against the object's box as well (the effect has no viewport or font of its own): a
+/// percentage as that share of the box, the others as the default.
+fn region_length(v: Option<&str>, default: f64, user: bool) -> Length {
+    let Some(v) = v.map(str::trim) else { return Length::Box(default) };
+    // Relative to the font (before the number is read: `e` also starts an exponent).
+    if v.ends_with("em") || v.ends_with("ex") {
+        return Length::Box(default);
+    }
+    let split = v.find(|c: char| !(c.is_ascii_digit() || matches!(c, '.' | '-' | '+' | 'e' | 'E'))).unwrap_or(v.len());
+    let (number, unit) = v.split_at(split);
+    let Some(number) = number.parse::<f64>().ok().filter(|n| n.is_finite()) else { return Length::Box(default) };
+    let per_unit = match (unit.trim(), user) {
+        ("", false) => return Length::Box(number),
+        ("%", _) => return Length::Box(number * 0.01),
+        (_, false) => return Length::Box(default),
+        ("" | "px", true) => 1.0,
+        ("pt", true) => 96.0 / 72.0,
+        ("pc", true) => 16.0,
+        ("in", true) => 96.0,
+        ("cm", true) => 96.0 / 2.54,
+        ("mm", true) => 96.0 / 25.4,
+        _ => return Length::Box(default),
+    };
+    Length::User(number * per_unit)
+}
+
+/// An SVG filter effect: the filter's XML, how many points one of its units is, where its user
+/// space's origin lies in the document, and its region.
+#[derive(Clone, Debug, PartialEq)]
+pub struct SvgFilterFx {
+    /// The filter as it is drawn and written ([`rebuilt`]).
+    xml: Arc<str>,
+    scale: f64,
+    origin: Vec2,
+    /// Its region (filter effects region): x, y, width, height.
+    region: [Length; 4],
+    /// Is the region in user space with a length measured against the object's box? It is then
+    /// written into the filter before it is drawn or written ([`Self::drawn_xml`]).
+    measured: bool,
+    /// The largest `feMorphology` radius or `kernelUnitLength`, and the largest `stdDeviation`, in
+    /// user units.
+    window: f64,
+    blur: f64,
+    /// `primitiveUnits="objectBoundingBox"`: those lengths are fractions of the object's box.
+    box_units: bool,
+}
+
+/// The `origin` of an SVG filter effect's parameters `p`: `[x, y]` in points, `[0, 0]` when absent.
+fn origin_param(p: &Value) -> Vec2 {
+    let at = |i: usize| p.get("origin").and_then(|o| o.get(i)).and_then(Value::as_f64).filter(|v| v.is_finite()).unwrap_or(0.0);
+    Vec2::new(at(0), at(1))
+}
+
+impl SvgFilterFx {
+    /// The effect's parameters `p` (defaults merged in): `xml`, the `<filter>` element, `scale`
+    /// and `origin`. `None` when `xml` isn't a filter [`check`] takes, however the effect came to
+    /// hold it (an opened file, a script): the object is then drawn, printed and exported without it.
+    pub(crate) fn parse(p: &Value) -> Option<Self> {
+        let xml = checked(text(p, "xml", ""))?;
+        let (wrapped, _) = wrap(&xml);
+        let doc = roxmltree::Document::parse(&wrapped).ok()?;
+        let f = filter_element(&doc).ok()?;
+        let user = f.attribute("filterUnits").is_some_and(|u| u.trim() == "userSpaceOnUse");
+        let region = [("x", -0.1), ("y", -0.1), ("width", 1.2), ("height", 1.2)].map(|(k, d)| region_length(f.attribute(k), d, user));
+        let measured = user && region.iter().any(|l| matches!(l, Length::Box(_)));
+        let largest = |attrs: &[&str]| {
+            f.descendants()
+                .flat_map(|n| attrs.iter().filter_map(move |a| n.attribute(*a)))
+                .filter_map(numbers)
+                .flatten()
+                .map(f64::abs)
+                .fold(0.0, f64::max)
+        };
+        let (window, blur) = (largest(&["radius", "kernelUnitLength"]), largest(&["stdDeviation"]));
+        let box_units = f.attribute("primitiveUnits").is_some_and(|u| u.trim() == "objectBoundingBox");
+        let scale = num(p, "scale", 1.0).clamp(1e-3, 1e3);
+        Some(Self { xml, scale, origin: origin_param(p), region, measured, window, blur, box_units })
+    }
+
+    /// The filter's region in its user space for an object whose box there is `b`: lengths in user
+    /// units as they are, the others as fractions of the box (x and y from its corner).
+    fn region_in(&self, b: Rect) -> Rect {
+        let [x, y, w, h] = self.region;
+        let at = |l: Length, from: f64, size: f64| match l {
+            Length::User(v) => v,
+            Length::Box(k) => from + k * size,
+        };
+        let len = |l: Length, size: f64| match l {
+            Length::User(v) => v,
+            Length::Box(k) => k * size,
+        };
+        let (x0, y0) = (at(x, b.x0, b.width()), at(y, b.y0, b.height()));
+        Rect::new(x0, y0, x0 + len(w, b.width()), y0 + len(h, b.height()))
+    }
+
+    /// The filter as it is drawn for an object whose box in its user space is `b`: a region
+    /// measured against the box is written into it in user units.
+    fn drawn_xml(&self, b: Rect) -> Option<String> {
+        self.with_region(&self.xml, b)
+    }
+
+    /// Filter `xml` (this one's, in a form) with a region measured against the box `b` written
+    /// into it in user units.
+    fn with_region(&self, xml: &str, b: Rect) -> Option<String> {
+        if !self.measured {
+            return Some(xml.to_string());
+        }
+        let r = self.region_in(b);
+        with_attributes(xml, &[("x", r.x0), ("y", r.y0), ("width", r.width()), ("height", r.height())])
+    }
+
+    /// The filter as SVG output writes it (one unit a point, [`Self::in_points`]) for an object
+    /// whose box in the document is `bounds`: in its SVG 1.1 form ([`svg11`]), `None` when SVG 1.1
+    /// can't hold it ([`Self::writes_as_svg11`]).
+    pub fn written_xml(&self, bounds: Rect) -> Option<String> {
+        self.with_region(&svg11(&self.xml)?, (bounds - self.origin).scale_from_origin(1.0 / self.scale))
+    }
+
+    /// Can SVG 1.1 output write the filter as a `<filter>` element ([`svg11`])? When it can't, SVG
+    /// output treats it as it treats the other pixel effects.
+    pub fn writes_as_svg11(&self) -> bool {
+        svg11(&self.xml).is_some()
+    }
+
+    /// How finely the filter runs on a raster whose pixels are `space.px` points wide, for an
+    /// object whose box is `box_px` raster pixels at its widest: the share of a raster pixel one of
+    /// its pixels is (at most 1). It is no finer than the Document Raster Effects resolution, and
+    /// coarse enough that a morphology radius or kernel unit spans at most 32 of its pixels and a
+    /// blur's standard deviation at most 512.
+    pub fn resolution(&self, space: &PixelSpace, box_px: f64) -> f64 {
+        if !(space.px.is_finite() && space.px > 0.0) {
+            return 1.0;
+        }
+        let mut s: f64 = if space.line.is_finite() && space.line > 0.0 { (space.px / space.line).min(1.0) } else { 1.0 };
+        // A length spans length × scale / px raster pixels, or a fraction of the box.
+        for (length, most) in [(self.window, MAX_WINDOW_PX), (self.blur, MAX_BLUR_PX)] {
+            let px = if self.box_units { length * box_px.max(0.0) } else { length * self.scale / space.px };
+            if px * s > most {
+                s = most / px;
+            }
+        }
+        // (However small: a coarser raster keeps the caps.)
+        if s.is_finite() { s.clamp(f64::MIN_POSITIVE, 1.0) } else { 1.0 }
+    }
+
+    /// Where the filter's user space has its origin in the document, in points.
+    pub fn origin(&self) -> Vec2 {
+        self.origin
+    }
+
+    /// The `<filter>` element's XML as it is drawn and written: rebuilt from its filter elements and
+    /// their filter attributes alone.
+    pub fn xml(&self) -> &str {
+        &self.xml
+    }
+
+    /// Is its region in user space measured against the object's box ([`region_length`])? SVG
+    /// output keeps such a filter as a filter only when no other raster effect comes before it.
+    pub fn measured(&self) -> bool {
+        self.measured
+    }
+
+    /// Does one unit of the filter's user space measure one point (its `scale` is 1)?
+    pub fn in_points(&self) -> bool {
+        self.scale == 1.0
+    }
+
+    /// How far beyond `bounds` (document units) the filter can draw: its region's reach past them.
+    pub fn outset(&self, bounds: Rect) -> f64 {
+        let b = (bounds - self.origin).scale_from_origin(1.0 / self.scale);
+        let region = self.region_in(b).scale_from_origin(self.scale) + self.origin;
+        let reach = [bounds.x0 - region.x0, bounds.y0 - region.y0, region.x1 - bounds.x1, region.y1 - bounds.y1].into_iter().fold(0.0, f64::max);
+        if reach.is_finite() { reach.min(MAX_OUTSET) } else { 0.0 }
+    }
+
+    /// Run the filter on `data`, `w` × `h` premultiplied RGBA8 pixels lying in the document as
+    /// `space` says, its source graphic, whose object bounding box is the box of the pixels that
+    /// aren't transparent (the whole raster when all are). Leaves them as they are when the sizes
+    /// don't match and when the filter can't be drawn.
+    pub fn apply(&self, data: &mut [u8], w: usize, h: usize, space: &PixelSpace) {
+        if w == 0 || h == 0 || w.checked_mul(h).and_then(|n| n.checked_mul(4)) != Some(data.len()) {
+            return;
+        }
+        // Art that draws no pixels still has a box: the whole raster stands for it.
+        let (x0, y0, x1, y1) = drawn_box(data, w, h).unwrap_or((0, 0, w, h));
+        let s = self.resolution(space, (x1 - x0).max(y1 - y0) as f64);
+        let (sw, sh) = ((w as f64 * s).ceil().max(1.0) as u32, (h as f64 * s).ceil().max(1.0) as u32);
+        let Some(png) = png_of(data, w, x0, y0, x1, y1).map(Arc::new) else { return };
+        let k = self.scale;
+        // Filter user space → the small canvas, and the image's pixels → filter user space.
+        let outer = Affine::scale(s) * space.to_doc.inverse() * Affine::translate(self.origin) * Affine::scale(k);
+        let place = Affine::scale(1.0 / k) * Affine::translate(-self.origin) * space.to_doc * Affine::translate(Vec2::new(x0 as f64, y0 as f64));
+        let b = place.transform_rect_bbox(Rect::new(0.0, 0.0, (x1 - x0) as f64, (y1 - y0) as f64));
+        let Some(drawn) = self.drawn_xml(b).and_then(|xml| with_id(&xml, DRAWN_ID)) else { return };
+        let svg = format!(
+            "<svg xmlns=\"{SVG_NS}\" xmlns:xlink=\"{XLINK_NS}\" width=\"{sw}\" height=\"{sh}\" viewBox=\"0 0 {sw} {sh}\"><defs>{drawn}</defs><g transform=\"{}\"><g filter=\"url(#{DRAWN_ID})\"><image width=\"{}\" height=\"{}\" preserveAspectRatio=\"none\" transform=\"{}\" xlink:href=\"data:image/png;base64,{}\"/></g></g></svg>",
+            matrix(outer),
+            x1 - x0,
+            y1 - y0,
+            matrix(place),
+            base64(&png)
+        );
+        let Ok(tree) = usvg::Tree::from_str(&svg, &options_with(Some(png), None)) else { return };
+        if !has_filter(tree.root()) {
+            return;
+        }
+        let Some(mut small) = tiny_skia::Pixmap::new(sw, sh) else { return };
+        resvg::render(&tree, tiny_skia::Transform::identity(), &mut small.as_mut());
+        let out = if s < 1.0 {
+            let Some(mut full) = tiny_skia::Pixmap::new(w as u32, h as u32) else { return };
+            let paint = tiny_skia::PixmapPaint { quality: tiny_skia::FilterQuality::Bilinear, ..Default::default() };
+            let up = (1.0 / s) as f32;
+            full.draw_pixmap(0, 0, small.as_ref(), &paint, tiny_skia::Transform::from_scale(up, up), None);
+            full
+        } else {
+            small
+        };
+        if out.data().len() == data.len() {
+            data.copy_from_slice(out.data());
+        }
+    }
+}
+
+/// The farthest a filter's region reaches beyond the object, in points.
+const MAX_OUTSET: f64 = 10_000.0;
+
+/// The box of the pixels of `data` (`w` wide) that aren't transparent: columns x0..x1, rows y0..y1.
+fn drawn_box(data: &[u8], w: usize, h: usize) -> Option<(usize, usize, usize, usize)> {
+    let (mut x0, mut y0, mut x1, mut y1) = (w, h, 0, 0);
+    for (i, p) in data.as_chunks::<4>().0.iter().enumerate() {
+        if p[3] > 0 {
+            let (x, y) = (i % w, i / w);
+            (x0, y0, x1, y1) = (x0.min(x), y0.min(y), x1.max(x + 1), y1.max(y + 1));
+        }
+    }
+    (x1 > x0 && y1 > y0).then_some((x0, y0, x1, y1))
+}
+
+/// The pixels of `data` (premultiplied RGBA8, `w` wide) in columns x0..x1 and rows y0..y1, as a PNG.
+fn png_of(data: &[u8], w: usize, x0: usize, y0: usize, x1: usize, y1: usize) -> Option<Vec<u8>> {
+    use image::ImageEncoder;
+    let px = data.as_chunks::<4>().0;
+    let mut straight = Vec::with_capacity((x1 - x0) * (y1 - y0) * 4);
+    for y in y0..y1 {
+        for p in px.get(y * w + x0..y * w + x1)? {
+            let a = u32::from(p[3]);
+            let un = |c: u8| (u32::from(c) * 255 + a / 2).checked_div(a).map_or(0, |v| v.min(255) as u8);
+            straight.extend_from_slice(&[un(p[0]), un(p[1]), un(p[2]), p[3]]);
+        }
+    }
+    let mut png = vec![];
+    let encoder = image::codecs::png::PngEncoder::new_with_quality(
+        &mut png,
+        image::codecs::png::CompressionType::Fast,
+        image::codecs::png::FilterType::NoFilter,
+    );
+    encoder.write_image(&straight, (x1 - x0) as u32, (y1 - y0) as u32, image::ExtendedColorType::Rgba8).ok()?;
+    Some(png)
+}
+
+/// `a` as an SVG `matrix(…)`.
+fn matrix(a: Affine) -> String {
+    let [a, b, c, d, e, f] = a.as_coeffs();
+    format!("matrix({a} {b} {c} {d} {e} {f})")
+}
+
+/// `bytes` in base64.
+fn base64(bytes: &[u8]) -> String {
+    const ABC: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
+    for chunk in bytes.chunks(3) {
+        let b = [0, 1, 2].map(|i| chunk.get(i).copied().unwrap_or(0));
+        let n = (u32::from(b[0]) << 16) | (u32::from(b[1]) << 8) | u32::from(b[2]);
+        for (i, shift) in [18, 12, 6, 0].into_iter().enumerate() {
+            out.push(if i <= chunk.len() { char::from(ABC[(n >> shift & 63) as usize]) } else { '=' });
+        }
+    }
+    out
+}
diff --git a/crates/effects/src/svg_filter/tests.rs b/crates/effects/src/svg_filter/tests.rs
new file mode 100644
index 000000000..4d0a60394
--- /dev/null
+++ b/crates/effects/src/svg_filter/tests.rs
@@ -0,0 +1,686 @@
+use serde_json::json;
+use vectorcraft_doc::Effect;
+use vectorcraft_geom::{Affine, Point, Rect};
+
+use super::*;
+use crate::pixel::Channels;
+use crate::{PixelFx, RasterFx, raster_effects};
+
+/// A `w` × `h` raster whose pixels are `px` points wide (origin top-left), at a raster effects
+/// resolution whose pixels are `line` points wide.
+fn space(w: usize, h: usize, px: f64, line: f64) -> PixelSpace {
+    let (wd, hd) = (w as f64 * px, h as f64 * px);
+    PixelSpace { to_doc: Affine::scale(px), px, center: Point::new(wd / 2.0, hd / 2.0), channels: Channels::Rgb, line, extent: 0.5 * wd.hypot(hd) }
+}
+
+/// `w` × `h` premultiplied pixels: `f(x, y)` each.
+fn image(w: usize, h: usize, f: impl Fn(usize, usize) -> [u8; 4]) -> Vec<u8> {
+    (0..h).flat_map(|y| (0..w).map(move |x| (x, y))).flat_map(|(x, y)| f(x, y)).collect()
+}
+
+fn at(d: &[u8], w: usize, x: usize, y: usize) -> [u8; 4] {
+    let i = (y * w + x) * 4;
+    [d[i], d[i + 1], d[i + 2], d[i + 3]]
+}
+
+/// The effect `svg.filter` with `params`, as the renderer reads it.
+fn filter(params: serde_json::Value) -> SvgFilterFx {
+    let e = Effect { id: SVG_FILTER.into(), params, visible: true };
+    match raster_effects(&[e]).first() {
+        Some(RasterFx::Pixel(PixelFx::Svg(f))) => f.clone(),
+        other => panic!("{other:?}"),
+    }
+}
+
+/// A blue square of `size` pixels inset by `inset` in a transparent raster `w` wide.
+fn blue_square(w: usize, inset: usize) -> Vec<u8> {
+    image(w, w, |x, y| if (inset..w - inset).contains(&x) && (inset..w - inset).contains(&y) { [0, 0, 255, 255] } else { [0; 4] })
+}
+
+const RED_FLOOD: &str = r##"<filter id="Red"><feFlood flood-color="#ff0000"/><feComposite in2="SourceGraphic" operator="in"/></filter>"##;
+
+#[test]
+fn check_names_a_filter_by_its_id() {
+    assert_eq!(check(RED_FLOOD), Ok("Red".into()));
+    assert_eq!(check(&format!("  {RED_FLOOD}\n")), Ok("Red".into()), "spaces around the element");
+    let linked = r#"<filter id=" Shadow 1 "><feImage xlink:href="data:image/png;base64,AAAA"/></filter>"#;
+    assert_eq!(check(linked), Ok("Shadow 1".into()), "the xlink prefix is declared for it");
+}
+
+#[test]
+fn check_refuses_what_is_not_one_drawable_filter() {
+    for (xml, why) in [
+        ("", "give one <filter> element"),
+        ("<filter id=\"a\">", "isn't valid XML"),
+        ("<g id=\"a\"><feFlood/></g>", "give one <filter> element"),
+        ("<filter id=\"a\"><feFlood/></filter><filter id=\"b\"><feFlood/></filter>", "give one <filter> element"),
+        ("text<filter id=\"a\"><feFlood/></filter>", "give one <filter> element"),
+        ("<filter><feFlood/></filter>", "needs an id"),
+        ("<filter id=\"  \"><feFlood/></filter>", "needs an id"),
+        ("<filter id=\"a\"></filter>", "no primitives"),
+        ("<filter id=\"a\"><feTurbulence numOctaves=\"11\"/></filter>", "numOctaves is at most 10"),
+        ("<filter id=\"a\"><feConvolveMatrix order=\"3 12\" kernelMatrix=\"1\"/></filter>", "order is at most 9"),
+        ("<filter id=\"a\"><feConvolveMatrix order=\"65536+65536\" kernelMatrix=\"1\"/></filter>", "order is at most 9"),
+        ("<filter id=\"a\"><feConvolveMatrix order=\"3 x\" kernelMatrix=\"1\"/></filter>", "order is at most 9"),
+        ("<filter id=\"a\"><notAPrimitive/></filter>", "<notAPrimitive> isn't an element of an SVG filter"),
+        ("<filter id=\"a\"><feOffset/><script>alert(1)</script></filter>", "<script> isn't an element"),
+        ("<filter id=\"a\"><feMerge><feMergeNode/><a/></feMerge></filter>", "<a> isn't an element"),
+        ("<filter id=\"a\" onload=\"x()\"><feOffset/></filter>", "no event attributes such as onload"),
+        ("<filter id=\"a\"><feOffset ONCLICK=\"x()\"/></filter>", "no event attributes such as ONCLICK"),
+        ("<filter id=\"a\"><feImage xlink:href=\"javascript:x()\"/></filter>", "WebP data: URLs"),
+        ("<filter id=\"a\"><feImage href=\"photo.png\"/></filter>", "WebP data: URLs"),
+        ("<filter id=\"a\"><feImage href=\"data:image/svg+xml;base64,PHN2Zy8+\"/></filter>", "WebP data: URLs"),
+        ("<filter id=\"a\"><feImage href=\"data:application/gzip;base64,H4sI\"/></filter>", "WebP data: URLs"),
+        ("<filter id=\"a\"><feImage href=\"data:;base64,AAAA\"/></filter>", "WebP data: URLs"),
+        ("<filter id=\"a\" width=\"0\"><feOffset/></filter>", "can't be drawn"),
+    ] {
+        let e = check(xml).expect_err(xml);
+        assert!(e.contains(why), "{xml}: {e}");
+    }
+    let many = format!("<filter id=\"a\">{}</filter>", "<feOffset/>".repeat(MAX_PRIMITIVES + 1));
+    assert!(check(&many).is_err_and(|e| e.contains("at most 64 primitives")));
+    let titled = format!("<filter id=\"a\"><title>T</title><desc>D</desc>{}</filter>", "<feOffset/>".repeat(MAX_PRIMITIVES));
+    assert_eq!(check(&titled), Ok("a".into()), "a title and a description aren't primitives");
+    assert!(check("<filter id=\"a\"><title>T</title></filter>").is_err_and(|e| e.contains("no primitives")));
+    let long = format!("<filter id=\"{}\"><feOffset/></filter>", "x".repeat(MAX_NAME + 1));
+    assert!(check(&long).is_err_and(|e| e.contains("at most 255 characters")));
+    let big = format!("<filter id=\"a\"><feOffset/><!--{}--></filter>", " ".repeat(SvgFilter::MAX_XML));
+    assert!(check(&big).is_err_and(|e| e.contains("at most 64 KB")));
+}
+
+#[test]
+fn with_id_renames_only_the_filter() {
+    let xml = r#"<filter id="Old" x="0"><feOffset result="Old"/></filter>"#;
+    assert_eq!(with_id(xml, "New").as_deref(), Some(r#"<filter id="New" x="0"><feOffset result="Old"/></filter>"#));
+    assert_eq!(with_id("<filter><feOffset/></filter>", "New"), None);
+}
+
+#[test]
+fn filters_in_lists_the_documents_filters_it_takes() {
+    let svg = format!(
+        "<?xml version=\"1.0\"?><!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"><svg xmlns=\"http://www.w3.org/2000/svg\"><defs>{RED_FLOOD}<filter id=\"Empty\"/><filter id=\"Off\"><feOffset dx=\"2\"/></filter></defs></svg>"
+    );
+    let (found, skipped) = filters_in(&svg);
+    assert_eq!(found.iter().map(|(n, _)| n.as_str()).collect::<Vec<_>>(), ["Red", "Off"]);
+    assert_eq!(found[0].1, RED_FLOOD, "each filter's XML as it is written");
+    assert_eq!(skipped, 1, "the filter without primitives");
+}
+
+/// [`filters_of`] on `svg` read as SVG import reads it (with DTDs).
+fn filters_in(svg: &str) -> (Vec<(String, String)>, usize) {
+    let doc = roxmltree::Document::parse_with_options(svg, roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() }).unwrap();
+    filters_of(&doc, svg, usize::MAX, |_| false)
+}
+
+#[test]
+fn filters_of_stops_at_the_room_left_and_skips_taken_and_styled_filters() {
+    let many = format!(
+        "<svg xmlns=\"http://www.w3.org/2000/svg\">{}</svg>",
+        (0..200).map(|i| format!("<filter id=\"f{i}\"><feOffset/></filter>")).collect::<String>()
+    );
+    let doc = roxmltree::Document::parse(&many).unwrap();
+    let (found, skipped) = filters_of(&doc, &many, 3, |name| name == "f1");
+    assert_eq!(found.iter().map(|(n, _)| n.as_str()).collect::<Vec<_>>(), ["f0", "f2", "f3"]);
+    assert_eq!(skipped, 197);
+    // A filter whose look comes from the document's styles isn't taken.
+    for styled in [
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>.r{flood-color:red}</style><filter id=\"a\"><feFlood class=\"r\"/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><filter id=\"a\"><feFlood flood-color=\"currentColor\"/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><filter id=\"a\"><feFlood flood-color=\"CURRENTcolor\"/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><defs color-interpolation-filters=\"sRGB\"><filter id=\"a\"><feGaussianBlur stdDeviation=\"2\"/></filter></defs></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>@media screen { feFlood { flood-color: red } }</style><filter id=\"a\"><feFlood/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>#a feOffset{dx:2}</style><filter id=\"a\"><feOffset/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>.s { content: \"{ /*\" } feFlood { flood-color: red }</style><filter id=\"a\"><feFlood/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>.outer { fill: blue; &amp; #a { color: red } }</style><filter id=\"a\"><feFlood/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>@scope (#a) { :scope { color: red } }</style><filter id=\"a\"><feFlood/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>svg { color-interpolation-filters: sRGB }</style><filter id=\"a\"><feGaussianBlur stdDeviation=\"2\"/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>feFlood[data-t=\\;] { flood-color: red }</style><filter id=\"a\"><feFlood/></filter></svg>",
+    ] {
+        let doc = roxmltree::Document::parse(styled).unwrap();
+        assert_eq!(filters_of(&doc, styled, usize::MAX, |_| false), (vec![], 1), "{styled}");
+    }
+    // A style sheet for the shapes alone (as CSS export writes), applying the filter to them
+    // included, doesn't reach the filter.
+    for shapes in [
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>.cls-1{fill:#f00}</style><filter id=\"a\"><feOffset/></filter></svg>",
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><style>/* #a */ .shape { filter: url(#a) }</style><filter id=\"a\"><feOffset/></filter></svg>",
+        // An identifier named currentColor takes no color.
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><filter id=\"currentColor\"><feOffset result=\"currentColor\"/></filter></svg>",
+    ] {
+        let doc = roxmltree::Document::parse(shapes).unwrap();
+        assert_eq!(filters_of(&doc, shapes, usize::MAX, |_| false).0.len(), 1, "{shapes}");
+    }
+}
+
+#[test]
+fn deeply_nested_filters_are_refused_before_they_are_parsed() {
+    let deep = format!("<filter id=\"a\"><feMerge>{}<feMergeNode/>{}</feMerge></filter>", "<g>".repeat(20), "</g>".repeat(20));
+    assert!(check(&deep).is_err_and(|e| e.contains("nest at most 16 deep")));
+    assert_eq!(with_id(&deep, "b"), None);
+    let e = Effect { id: SVG_FILTER.into(), params: json!({ "xml": deep }), visible: true };
+    assert!(raster_effects(&[e]).is_empty(), "drawn without it");
+    // Markup in comments, CDATA and attribute values doesn't count.
+    let quoted =
+        format!("<filter id=\"a\" x=\"{}\"><!--{}--><feOffset/><![CDATA[{}]]></filter>", "&lt;g>".repeat(20), "<g>".repeat(20), "<g>".repeat(20));
+    assert_eq!(check(&quoted), Ok("a".into()));
+    let gt = format!("<filter id=\"a\" title='{}'>{}<feOffset/></filter>", "x>".repeat(20), "<!-- > -->".repeat(3));
+    assert_eq!(check(&gt), Ok("a".into()));
+}
+
+#[test]
+fn a_filter_replaces_the_pixels_with_its_result() {
+    let w = 20;
+    let mut data = blue_square(w, 5);
+    filter(json!({ "xml": RED_FLOOD })).apply(&mut data, w, w, &space(w, w, 1.0, 1.0));
+    assert_eq!(at(&data, w, 10, 10), [255, 0, 0, 255], "inside: the flood, cut to the source");
+    assert_eq!(at(&data, w, 1, 1), [0; 4], "outside the source");
+}
+
+#[test]
+fn lengths_are_in_points_times_scale() {
+    let w = 40;
+    let shift = r#"<filter id="Shift" x="-1" y="-1" width="3" height="3"><feOffset dx="4"/></filter>"#;
+    let run = |px: f64, scale: f64| {
+        let n = (w as f64 / px) as usize;
+        let mut data = image(n, n, |x, y| {
+            let (x, y) = (x as f64 * px, y as f64 * px);
+            if (10.0..20.0).contains(&x) && (10.0..20.0).contains(&y) { [0, 0, 255, 255] } else { [0; 4] }
+        });
+        filter(json!({ "xml": shift, "scale": scale })).apply(&mut data, n, n, &space(n, n, px, px));
+        let column = |x: f64| at(&data, n, (x / px) as usize, (15.0 / px) as usize)[3];
+        (column(9.5), column(21.0), column(23.5), column(25.0))
+    };
+    // The square spans 10..20 pt: moved by 4 pt, 14..24.
+    assert_eq!(run(1.0, 1.0), (0, 255, 255, 0));
+    assert_eq!(run(0.5, 1.0), (0, 255, 255, 0), "the same in points at another zoom");
+    // One unit of the filter is half a point: moved by 2 pt, 12..22.
+    assert_eq!(run(1.0, 0.5), (0, 255, 0, 0));
+}
+
+/// A user-space region is placed from the effect's origin.
+#[test]
+fn user_space_starts_at_the_origin() {
+    let w = 40;
+    // Flood the square, cut to the region x 0..20 of the filter's user space.
+    let half = r##"<filter id="Half" filterUnits="userSpaceOnUse" x="0" y="0" width="20" height="40"><feFlood flood-color="#ff0000"/><feComposite in2="SourceGraphic" operator="in"/></filter>"##;
+    let run = |origin: [f64; 2]| {
+        let mut data = image(w, w, |_, _| [0, 0, 255, 255]);
+        filter(json!({ "xml": half, "origin": origin })).apply(&mut data, w, w, &space(w, w, 1.0, 1.0));
+        (at(&data, w, 5, 20)[3], at(&data, w, 25, 20)[3])
+    };
+    assert_eq!(run([0.0, 0.0]), (255, 0));
+    assert_eq!(run([20.0, 0.0]), (0, 255), "the region 20 pt to the right");
+    let b = Rect::new(0.0, 0.0, 40.0, 40.0);
+    assert!((filter(json!({ "xml": half, "origin": [-10.0, 0.0] })).outset(b) - 10.0).abs() < 1e-9);
+}
+
+#[test]
+fn runs_no_finer_than_the_raster_effects_resolution() {
+    let w = 16;
+    // Columns one view pixel wide, alternately opaque and clear.
+    let stripes = image(w, w, |x, _| if x % 2 == 0 { [0, 0, 255, 255] } else { [0; 4] });
+    let keep = r#"<filter id="Keep" x="0" y="0" width="1" height="1"><feOffset/></filter>"#;
+    let mut fine = stripes.clone();
+    filter(json!({ "xml": keep })).apply(&mut fine, w, w, &space(w, w, 0.25, 0.25));
+    assert_eq!(at(&fine, w, 4, 4)[3], 255);
+    assert_eq!(at(&fine, w, 5, 4)[3], 0, "at the view's resolution the stripes stay");
+    let mut coarse = stripes.clone();
+    filter(json!({ "xml": keep })).apply(&mut coarse, w, w, &space(w, w, 0.25, 1.0));
+    let (a, b) = (at(&coarse, w, 4, 4)[3], at(&coarse, w, 5, 4)[3]);
+    assert!(a < 255 && b > 0, "four view pixels to a raster pixel: the stripes blend ({a}, {b})");
+}
+
+#[test]
+fn draws_nothing_new_without_content_or_a_readable_filter() {
+    let w = 8;
+    let mut empty = vec![0; w * w * 4];
+    filter(json!({ "xml": RED_FLOOD })).apply(&mut empty, w, w, &space(w, w, 1.0, 1.0));
+    assert!(empty.iter().all(|v| *v == 0), "a flood cut to a source that draws nothing");
+    // A filter that doesn't read the source draws on art that draws no pixels: the raster is its box.
+    let mut clear = vec![0; w * w * 4];
+    filter(json!({ "xml": "<filter id=\"G\"><feFlood flood-color=\"#00ff00\"/></filter>" })).apply(&mut clear, w, w, &space(w, w, 1.0, 1.0));
+    assert_eq!(at(&clear, w, 4, 4), [0, 255, 0, 255]);
+    let e = Effect { id: SVG_FILTER.into(), params: json!({ "xml": "<g/>" }), visible: true };
+    assert!(raster_effects(&[e]).is_empty(), "not a filter: the object is drawn without it");
+    let e = Effect { id: SVG_FILTER.into(), params: json!({ "xml": "<filter id=\"x\" width=\"0\"><feOffset/></filter>" }), visible: true };
+    assert!(raster_effects(&[e]).is_empty(), "a filter resvg can't draw: the object is drawn without it");
+}
+
+#[test]
+fn outset_is_how_far_the_region_reaches() {
+    let b = Rect::new(0.0, 0.0, 100.0, 50.0);
+    assert!((filter(json!({ "xml": RED_FLOOD })).outset(b) - 10.0).abs() < 1e-9, "the default region: 10% of the width");
+    let wide = r#"<filter id="w" x="-50%" y="0" width="200%" height="100%"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": wide })).outset(b) - 50.0).abs() < 1e-9);
+    let user = r#"<filter id="u" filterUnits="userSpaceOnUse" x="-10" y="0" width="60" height="25"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": user, "scale": 2.0 })).outset(b) - 20.0).abs() < 1e-9, "user units times scale");
+    let inside = r#"<filter id="i" x="0" y="0" width="1" height="1"><feOffset/></filter>"#;
+    assert_eq!(filter(json!({ "xml": inside })).outset(b), 0.0);
+    // User-space lengths in points: -30 pt is -40 user units.
+    let points = r#"<filter id="p" filterUnits="userSpaceOnUse" x="-30pt" y="0" width="100" height="50"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": points })).outset(b) - 40.0).abs() < 1e-9);
+    // In user space, a percentage is a share of the object's box; em, ex and a missing length
+    // take the default region's share of it.
+    let viewport = r#"<filter id="v" filterUnits="userSpaceOnUse" x="-50%" y="0" width="10" height="10"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": viewport })).outset(b) - 50.0).abs() < 1e-9);
+    let far = r#"<filter id="r" filterUnits="userSpaceOnUse" x="-1000%" y="0" width="3000%" height="10"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": far })).outset(b) - 1900.0).abs() < 1e-9, "however far it reaches");
+    let font = r#"<filter id="f" filterUnits="userSpaceOnUse" x="-100em" y="0" width="10" height="10"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": font })).outset(b) - 10.0).abs() < 1e-9, "relative to the font");
+    let default = r#"<filter id="d" filterUnits="userSpaceOnUse"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": default })).outset(b) - 10.0).abs() < 1e-9);
+    // In the bounding box, a length with a unit is invalid: the default.
+    let unit = r#"<filter id="u" x="-5mm"><feOffset/></filter>"#;
+    assert!((filter(json!({ "xml": unit })).outset(b) - 10.0).abs() < 1e-9);
+}
+
+#[test]
+fn a_filter_keeps_the_prefixes_an_ancestor_declares() {
+    let svg = r#"<svg:svg xmlns:svg="http://www.w3.org/2000/svg" xmlns:x="urn:other"><svg:defs><svg:filter id="Pre"><svg:feOffset dx="1"/></svg:filter></svg:defs></svg:svg>"#;
+    let (found, skipped) = filters_in(svg);
+    assert_eq!((found.len(), skipped), (1, 0));
+    assert_eq!(
+        found[0].1, r#"<svg:filter xmlns:svg="http://www.w3.org/2000/svg" id="Pre"><svg:feOffset dx="1"/></svg:filter>"#,
+        "only the prefix it uses"
+    );
+    // A declaration on the filter itself, with spaces around its `=`, is kept as it is.
+    let own = r#"<svg xmlns="http://www.w3.org/2000/svg"><defs><s:filter xmlns:s = "http://www.w3.org/2000/svg" id="Own"><s:feOffset/></s:filter></defs></svg>"#;
+    let (found, skipped) = filters_in(own);
+    assert_eq!((found.len(), skipped), (1, 0));
+    assert_eq!(found[0].1, r#"<s:filter xmlns:s = "http://www.w3.org/2000/svg" id="Own"><s:feOffset/></s:filter>"#);
+    // The same declaration again on the filter, and text like one inside an attribute's value.
+    let again = r#"<s:svg xmlns:s="http://www.w3.org/2000/svg"><s:filter xmlns:s="http://www.w3.org/2000/svg" id="A"><s:feOffset/></s:filter><s:filter id="B" color-profile=" xmlns:s = x"><s:feOffset/></s:filter></s:svg>"#;
+    let (found, skipped) = filters_in(again);
+    assert_eq!((found.len(), skipped), (2, 0), "{found:?}");
+    assert!(found[1].1.starts_with(r#"<s:filter xmlns:s="http://www.w3.org/2000/svg" id="B""#), "{found:?}");
+}
+
+#[test]
+fn primitive_forms_tell_filters_with_the_same_primitives_apart() {
+    let a = primitive_forms(r#"<filter id="a"><feOffset dx="1"/></filter>"#).unwrap();
+    let b = primitive_forms(r#"<filter id="b"><feOffset dx="2"/></filter>"#).unwrap();
+    assert_eq!(a.len(), 1);
+    assert_ne!(a, b);
+    assert_eq!(primitive_forms(r#"<filter id="c"><feOffset dx="1"/></filter>"#), Some(a), "the id doesn't count");
+}
+
+#[test]
+fn costly_parameters_are_capped() {
+    for (xml, why) in [
+        ("<filter id=\"a\"><feMorphology radius=\"101\"/></filter>", "radius is at most 100"),
+        ("<filter id=\"a\"><feMorphology radius=\"2 1e9\"/></filter>", "radius is at most 100"),
+        ("<filter id=\"a\"><feMorphology radius=\"50+500\"/></filter>", "radius is at most 100"),
+        ("<filter id=\"a\"><feGaussianBlur stdDeviation=\"501\"/></filter>", "stdDeviation is at most 500"),
+        ("<filter id=\"a\"><feDropShadow stdDeviation=\"1 9e9\"/></filter>", "stdDeviation is at most 500"),
+        (
+            "<filter id=\"a\"><feDiffuseLighting kernelUnitLength=\"101\"><feDistantLight/></feDiffuseLighting></filter>",
+            "kernelUnitLength is at most 100",
+        ),
+    ] {
+        let e = check(xml).expect_err(xml);
+        assert!(e.contains(why), "{xml}: {e}");
+    }
+    assert_eq!(check("<filter id=\"a\"><feMorphology radius=\"100\"/></filter>"), Ok("a".into()));
+    // usvg also reads attributes in the SVG, XLink and XML namespaces by their local names.
+    for prefixed in [
+        "<filter id=\"a\" xmlns:s=\"http://www.w3.org/2000/svg\"><feMorphology s:radius=\"1000\"/></filter>",
+        "<filter id=\"a\" xmlns:s=\"http://www.w3.org/2000/svg\"><feGaussianBlur s:stdDeviation=\"1e6\"/></filter>",
+    ] {
+        assert!(check(prefixed).is_err(), "{prefixed}");
+    }
+}
+
+/// A filter is drawn and written rebuilt from its filter elements and their filter attributes:
+/// no comments, text, descriptions, other attributes or prefixes.
+#[test]
+fn the_filter_is_drawn_and_written_from_its_filter_parts_alone() {
+    let xml = concat!(
+        "<filter id=\"a\" xmlns:s=\"http://www.w3.org/2000/svg\" data-x=\"1\"><!-- note --><desc>&lt;script&gt;</desc><title>T</title>",
+        "<feFlood flood-color=\"blue\" style=\"flood-color: red; fill: url(#x); flood-opacity: url(#y)\" foo=\"&quot;\"/>",
+        "<feMorphology s:radius=\"2\"/><feImage xlink:href=\"data:image/png;base64,AAAA\"/></filter>",
+    );
+    let f = filter(json!({ "xml": xml }));
+    assert_eq!(
+        f.xml(),
+        "<filter id=\"a\"><feFlood flood-color=\"red\"/><feMorphology radius=\"2\"/><feImage href=\"data:image/png;base64,AAAA\"/></filter>"
+    );
+    // An image keeps how it is scaled, as a style declaration.
+    for image in [
+        "<filter id=\"i\"><feImage image-rendering=\"pixelated\" href=\"data:image/png;base64,AAAA\"/></filter>",
+        "<filter id=\"i\"><feImage style=\"image-rendering: pixelated; fill: red\" href=\"data:image/png;base64,AAAA\"/></filter>",
+    ] {
+        assert_eq!(
+            filter(json!({ "xml": image })).xml(),
+            "<filter id=\"i\"><feImage href=\"data:image/png;base64,AAAA\" style=\"image-rendering:pixelated\"/></filter>",
+            "{image}"
+        );
+    }
+    // `currentColor` keeps the color it names.
+    let colored = filter(json!({ "xml": "<filter id=\"c\" color=\"red\"><feFlood flood-color=\"currentColor\" style=\"color: blue\"/></filter>" }));
+    assert_eq!(colored.xml(), "<filter id=\"c\" color=\"red\"><feFlood flood-color=\"currentColor\" color=\"blue\"/></filter>");
+}
+
+/// An image of a filter is a PNG, JPEG, GIF or WebP, by its bytes, within the pixel cap by its header.
+#[test]
+fn filter_images_are_small_raster_images() {
+    fn png(w: u32, h: u32) -> Vec<u8> {
+        let mut out = vec![];
+        image::ImageEncoder::write_image(
+            image::codecs::png::PngEncoder::new(&mut out),
+            &vec![0; (w * h * 4) as usize],
+            w,
+            h,
+            image::ExtendedColorType::Rgba8,
+        )
+        .unwrap();
+        out
+    }
+    let raster_image = |data| raster_image_sized(data).map(|(kind, _)| kind);
+    assert!(matches!(raster_image(Arc::new(png(2, 2))), Some(usvg::ImageKind::PNG(_))));
+    assert_eq!(raster_image_sized(Arc::new(png(3, 2))).map(|(_, n)| n), Some(6), "its pixel count");
+    // A header that claims more pixels than the cap: the IHDR's width, with its CRC fixed.
+    let mut big = png(2, 2);
+    big[16..20].copy_from_slice(&5000u32.to_be_bytes());
+    big[20..24].copy_from_slice(&5000u32.to_be_bytes());
+    let crc = crc32(&big[12..29]);
+    big[29..33].copy_from_slice(&crc.to_be_bytes());
+    assert!(raster_image(Arc::new(big)).is_none(), "past the pixel cap");
+    assert!(raster_image(Arc::new(b"<svg xmlns=\"http://www.w3.org/2000/svg\"/>".to_vec())).is_none(), "SVG");
+    assert!(raster_image(Arc::new(vec![0x1f, 0x8b, 8, 0, 0, 0, 0, 0])).is_none(), "compressed SVG");
+}
+
+/// A 2 × 2 PNG whose header claims `w` × `h` pixels (its IHDR rewritten, with the CRC fixed).
+fn png_claiming(w: u32, h: u32) -> Vec<u8> {
+    let mut out = vec![];
+    image::ImageEncoder::write_image(image::codecs::png::PngEncoder::new(&mut out), &[0; 16], 2, 2, image::ExtendedColorType::Rgba8).unwrap();
+    out[16..20].copy_from_slice(&w.to_be_bytes());
+    out[20..24].copy_from_slice(&h.to_be_bytes());
+    let crc = crc32(&out[12..29]);
+    out[29..33].copy_from_slice(&crc.to_be_bytes());
+    out
+}
+
+/// A filter's images share the pixel cap: images that are each within it but pass it together
+/// are refused.
+#[test]
+fn a_filters_images_share_the_pixel_cap() {
+    let img = |w: u32, h: u32| format!("<feImage href=\"data:image/png;base64,{}\"/>", base64(&png_claiming(w, h)));
+    let half = img(4096, 2048);
+    let err = check(&format!("<filter id=\"a\">{half}{}</filter>", img(4096, 2049))).unwrap_err();
+    assert!(err.contains("pixels in all"), "{err}");
+    let err = check(&format!("<filter id=\"a\">{half}{half}{}</filter>", img(1, 1))).unwrap_err();
+    assert!(err.contains("pixels in all"), "{err}");
+    assert!(check(&format!("<filter id=\"a\">{half}{half}</filter>")).is_ok(), "two halves fill the cap exactly");
+}
+
+/// The image limit is for a filter's own images: the object it runs on is its source graphic
+/// whatever its size.
+#[test]
+fn a_large_object_is_still_the_source_graphic() {
+    let w = 4097;
+    let mut d = blue_square(w, 0);
+    filter(json!({ "xml": RED_FLOOD })).apply(&mut d, w, w, &space(w, w, 1.0, 1.0));
+    assert_eq!(at(&d, w, w / 2, w / 2), [255, 0, 0, 255]);
+}
+
+fn crc32(bytes: &[u8]) -> u32 {
+    let mut c = !0u32;
+    for b in bytes {
+        c ^= u32::from(*b);
+        for _ in 0..8 {
+            c = if c & 1 == 1 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
+        }
+    }
+    !c
+}
+
+/// A user-space region in percentages is written in user units, measured against the object's box.
+#[test]
+fn a_region_measured_against_the_box_is_written_out() {
+    let far = r#"<filter id="r" filterUnits="userSpaceOnUse" x="-50%" y="0" width="200%" height="10"><feOffset/></filter>"#;
+    let f = filter(json!({ "xml": far, "origin": [10.0, 0.0] }));
+    assert_eq!(
+        f.written_xml(Rect::new(10.0, 0.0, 30.0, 10.0)).as_deref(),
+        Some(r#"<filter id="r" filterUnits="userSpaceOnUse" x="-10" y="0" width="40" height="10"><feOffset/></filter>"#)
+    );
+    let plain = filter(json!({ "xml": RED_FLOOD }));
+    assert_eq!(plain.written_xml(Rect::new(0.0, 0.0, 1.0, 1.0)).as_deref(), Some(plain.xml()));
+}
+
+/// A filter at the size limit whose region is measured against the box still draws: written in
+/// user units, the region can make the drawn form longer than the limit.
+#[test]
+fn a_filter_at_the_size_limit_draws_with_its_measured_region() {
+    let open = r#"<filter id="r" filterUnits="userSpaceOnUse" x="-1%" y="-1%" width="1%" height="1%"><feOffset result=""#;
+    let close = r#""/><feOffset/></filter>"#;
+    let xml = format!("{open}{}{close}", "a".repeat(SvgFilter::MAX_XML - open.len() - close.len()));
+    assert_eq!(xml.len(), SvgFilter::MAX_XML);
+    assert_eq!(check(&xml), Ok("r".into()));
+    let f = filter(json!({ "xml": xml }));
+    let written = f.written_xml(Rect::new(0.123456789, 0.123456789, 1000.987654321, 1000.987654321)).unwrap();
+    assert!(written.len() > SvgFilter::MAX_XML, "the region written out is longer: {} bytes", written.len());
+    assert!(with_id(&written, DRAWN_ID).is_some(), "the drawn form is read");
+}
+
+/// Only a type selector naming a filter or one of its elements, or `*`, lets a style sheet reach
+/// filters: class, id, attribute and pseudo-class names that contain "filter" or "fe" don't.
+#[test]
+fn style_sheets_reach_filters_only_through_their_type_selectors() {
+    let reaches = |sheet: &str| {
+        let svg = format!("<svg xmlns=\"http://www.w3.org/2000/svg\"><style>{sheet}</style></svg>");
+        Styles::of(&roxmltree::Document::parse(&svg).unwrap()).reach_filters
+    };
+    for sheet in
+        [".filter-button { color: red }", "#feature, .fe-icon { fill: blue }", "[data-filter] { fill: red }", "a:hover, rect.filter { stroke: red }"]
+    {
+        assert!(!reaches(sheet), "{sheet}");
+    }
+    for sheet in
+        ["filter { x: 0 }", "FeFlood { flood-color: red }", "svg|feBlend { mode: multiply }", "* { color: red }", "g :is(feGaussianBlur) { x: 0 }"]
+    {
+        assert!(reaches(sheet), "{sheet}");
+    }
+}
+
+/// An attribute selector styles a filter whose elements carry that attribute, whatever its value
+/// or namespace prefix; a filter without it is not affected.
+#[test]
+fn an_attribute_selector_styles_a_filter_with_that_attribute() {
+    let depends = |sheet: &str, filter: &str| {
+        let svg = format!("<svg xmlns=\"http://www.w3.org/2000/svg\"><style>{sheet}</style><defs>{filter}</defs></svg>");
+        let doc = roxmltree::Document::parse(&svg).unwrap();
+        let f = doc.descendants().find(|n| n.tag_name().name() == "filter").unwrap();
+        depends_on_styles(f, &Styles::of(&doc))
+    };
+    let tagged = r#"<filter id="a"><feFlood data-tone="warm"/></filter>"#;
+    let plain = r#"<filter id="a"><feFlood/></filter>"#;
+    for sheet in ["[data-tone] { flood-color: red }", "[data-tone=\"warm\"] { flood-color: red }", "[svg|data-tone ~= warm] { x: 0 }"] {
+        assert!(depends(sheet, tagged), "{sheet}");
+        assert!(!depends(sheet, plain), "{sheet}");
+    }
+}
+
+#[test]
+fn filters_of_reads_at_most_256_filters() {
+    let many = format!(
+        "<svg xmlns=\"http://www.w3.org/2000/svg\">{}</svg>",
+        (0..300).map(|i| format!("<filter id=\"f{i}\"><feOffset/></filter>")).collect::<String>()
+    );
+    let doc = roxmltree::Document::parse(&many).unwrap();
+    let (found, skipped) = filters_of(&doc, &many, usize::MAX, |_| false);
+    assert_eq!((found.len(), skipped), (MAX_FILTERS_READ, 300 - MAX_FILTERS_READ));
+}
+
+/// However large `scale` makes them, a morphology radius spans at most 32 pixels of the raster the
+/// filter runs on, and a standard deviation at most 512.
+#[test]
+fn costly_lengths_are_clamped_in_pixels() {
+    let sp = space(10, 10, 0.5, 0.5);
+    let morph = filter(json!({ "xml": "<filter id=\"m\"><feMorphology radius=\"100\"/></filter>", "scale": 1000.0 }));
+    let s = morph.resolution(&sp, 10.0);
+    assert!(100.0 * 1000.0 / 0.5 * s <= 32.0 + 1e-6, "{s}");
+    let blur = filter(json!({ "xml": "<filter id=\"b\"><feGaussianBlur stdDeviation=\"500\"/></filter>", "scale": 1000.0 }));
+    let s = blur.resolution(&sp, 10.0);
+    assert!(500.0 * 1000.0 / 0.5 * s <= 512.0 + 1e-6, "{s}");
+    // At a fine raster too (1200 ppi): the cap holds.
+    let fine = space(10, 10, 0.06, 0.06);
+    let s = morph.resolution(&fine, 10.0);
+    assert!(100.0 * 1000.0 / 0.06 * s <= 32.0 + 1e-6, "{s}");
+    let small = filter(json!({ "xml": "<filter id=\"s\"><feMorphology radius=\"1\"/></filter>" }));
+    assert_eq!(small.resolution(&sp, 10.0), 1.0, "a small radius runs at the raster's own pixels");
+    // In the object's bounding box, a radius is a fraction of its box: half a 4096-pixel box.
+    let boxed = filter(json!({ "xml": "<filter id=\"o\" primitiveUnits=\"objectBoundingBox\"><feMorphology radius=\"0.5\"/></filter>" }));
+    let s = boxed.resolution(&sp, 4096.0);
+    assert!(0.5 * 4096.0 * s <= 32.0 + 1e-6, "{s}");
+}
+
+/// A filter that `check` refuses is never drawn, whatever path put it in an effect.
+#[test]
+fn an_unchecked_filter_is_not_drawn() {
+    for xml in [
+        "<filter id=\"a\"><feOffset/><script>alert(1)</script></filter>",
+        "<filter id=\"a\"><feMorphology radius=\"1e6\"/></filter>",
+        "<filter id=\"a\" onload=\"x()\"><feOffset/></filter>",
+    ] {
+        let e = Effect { id: SVG_FILTER.into(), params: json!({ "xml": xml }), visible: true };
+        assert!(raster_effects(&[e]).is_empty(), "{xml}");
+    }
+}
+
+/// Scale Strokes & Effects scales the filter's lengths with the art: the points a unit measures.
+#[test]
+fn scaling_the_effect_scales_its_units() {
+    let mut e = Effect { id: SVG_FILTER.into(), params: json!({ "xml": RED_FLOOD }), visible: true };
+    crate::scale_effect(&mut e, 2.0);
+    assert_eq!(e.params["scale"], json!(2.0));
+    crate::scale_effect(&mut e, 0.25);
+    assert_eq!(e.params["scale"], json!(0.5));
+}
+
+/// The form SVG output writes, for a filter that fills a 10 × 10 point box.
+fn written(xml: &str) -> Option<String> {
+    filter(json!({ "xml": xml })).written_xml(Rect::new(0.0, 0.0, 10.0, 10.0))
+}
+
+/// SVG 1.1 output writes an image's reference as `xlink:href`; the filter as it is drawn and
+/// listed keeps `href`.
+#[test]
+fn an_image_is_written_with_an_xlink_reference() {
+    let data = format!("data:image/png;base64,{}", base64(&png_claiming(2, 2)));
+    let f = filter(json!({ "xml": format!(r#"<filter id="i"><feImage href="{data}"/></filter>"#) }));
+    assert_eq!(f.xml(), format!(r#"<filter id="i"><feImage href="{data}"/></filter>"#));
+    let out = f.written_xml(Rect::new(0.0, 0.0, 10.0, 10.0)).unwrap();
+    assert_eq!(out, format!(r#"<filter id="i"><feImage xlink:href="{data}"/></filter>"#));
+    assert!(f.writes_as_svg11());
+    assert_eq!(check(&out), Ok("i".into()), "the written form reads back");
+}
+
+/// SVG 1.1 has no `feDropShadow`: it is written as the primitives Filter Effects gives as its
+/// equivalent, with its defaults, input, result and subregion, and results no other primitive uses.
+#[test]
+fn a_drop_shadow_is_written_as_svg_1_1_primitives() {
+    assert_eq!(
+        written(r#"<filter id="s"><feDropShadow/></filter>"#).as_deref(),
+        Some(concat!(
+            r#"<filter id="s"><feGaussianBlur in="SourceGraphic" stdDeviation="2"/><feOffset dx="2" dy="2" result="vcShadow0"/><feFlood/>"#,
+            r#"<feComposite in2="vcShadow0" operator="in" result="vcShadow1"/><feMerge><feMergeNode in="vcShadow1"/><feMergeNode in="SourceGraphic"/></feMerge></filter>"#,
+        ))
+    );
+    // Its input, result, subregion, color space and flood; a name the filter uses is not taken.
+    let given = r#"<filter id="s"><feOffset dx="1" result="vcShadow0"/><feDropShadow in="vcShadow0" result="r" x="1" width="5" dx="3" dy="-1" stdDeviation="1 2" flood-color="rgba(255,0,0,0.5)" flood-opacity="50%" color-interpolation-filters="sRGB"/></filter>"#;
+    assert_eq!(
+        written(given).as_deref(),
+        Some(concat!(
+            r#"<filter id="s"><feOffset dx="1" result="vcShadow0"/>"#,
+            r#"<feGaussianBlur in="vcShadow0" stdDeviation="1 2" color-interpolation-filters="sRGB"/><feOffset dx="3" dy="-1" result="vcShadow1" color-interpolation-filters="sRGB"/>"#,
+            r##"<feFlood flood-color="#ff0000" flood-opacity="0.25098" color-interpolation-filters="sRGB"/>"##,
+            r#"<feComposite in2="vcShadow1" operator="in" result="vcShadow2" color-interpolation-filters="sRGB"/>"#,
+            r#"<feMerge x="1" width="5" result="r" color-interpolation-filters="sRGB"><feMergeNode in="vcShadow2"/><feMergeNode in="vcShadow0"/></feMerge></filter>"#,
+        ))
+    );
+    // An implicit input, or a result no earlier primitive has, is the previous result, named.
+    for shadow in [r#"<feDropShadow dx="1"/>"#, r#"<feDropShadow in="nowhere" dx="1"/>"#] {
+        let out = written(&format!(r#"<filter id="s"><feFlood flood-color="blue"/>{shadow}</filter>"#)).unwrap();
+        assert!(out.starts_with(r##"<filter id="s"><feFlood flood-color="#0000ff" result="vcShadow0"/><feGaussianBlur in="vcShadow0""##), "{out}");
+        assert!(out.ends_with(r#"<feMergeNode in="vcShadow0"/></feMerge></filter>"#), "{out}");
+        assert_eq!(check(&out), Ok("s".into()), "the written form reads back");
+    }
+    // What SVG 1.1 can't hold leaves the filter to be written as other pixel effects are.
+    for xml in [
+        r#"<filter id="s"><feDropShadow flood-color="currentColor"/></filter>"#,
+        r#"<filter id="s" primitiveUnits="objectBoundingBox"><feDropShadow/></filter>"#,
+    ] {
+        let f = filter(json!({ "xml": xml }));
+        assert!(!f.writes_as_svg11() && f.written_xml(Rect::new(0.0, 0.0, 10.0, 10.0)).is_none(), "{xml}");
+    }
+    // An offset that isn't a number is the shadow's default, which an `feOffset` doesn't share.
+    let out = written(r#"<filter id="s"><feDropShadow dx="bad" dy="-3"/></filter>"#).unwrap();
+    assert!(out.contains(r#"<feOffset dx="2" dy="-3""#), "{out}");
+    // Expanded shadows past the primitive cap.
+    let many = format!(r#"<filter id="s">{}</filter>"#, "<feDropShadow/>".repeat(13));
+    assert!(!filter(json!({ "xml": many })).writes_as_svg11());
+}
+
+/// Each input is written as the primitive it reads when drawn: a result name only usvg gives (to
+/// a primitive without a `result`, here the shadow), and the inputs usvg draws as `SourceGraphic`.
+#[test]
+fn inputs_are_written_as_the_primitives_they_read() {
+    let xml = r#"<filter id="s"><feOffset dx="1"/><feDropShadow in="BackgroundImage"/><feOffset dx="2"/><feMerge><feMergeNode in="result2"/><feMergeNode in="FillPaint"/></feMerge><feComposite in="result1" in2="StrokePaint"/></filter>"#;
+    let out = written(xml).unwrap();
+    assert_eq!(
+        out,
+        concat!(
+            r#"<filter id="s"><feOffset dx="1" result="vcShadow1"/>"#,
+            r#"<feGaussianBlur in="SourceGraphic" stdDeviation="2"/><feOffset dx="2" dy="2" result="vcShadow2"/><feFlood/>"#,
+            r#"<feComposite in2="vcShadow2" operator="in" result="vcShadow3"/><feMerge result="vcShadow0"><feMergeNode in="vcShadow3"/><feMergeNode in="SourceGraphic"/></feMerge>"#,
+            r#"<feOffset dx="2"/><feMerge><feMergeNode in="vcShadow0"/><feMergeNode in="SourceGraphic"/></feMerge>"#,
+            r#"<feComposite in="vcShadow1" in2="SourceGraphic"/></filter>"#,
+        )
+    );
+    assert_eq!(check(&out), Ok("s".into()), "the written form reads back");
+}
+
+/// Other values SVG 1.1 lacks: SVG 1.1 values that draw alike, or no SVG 1.1 form.
+#[test]
+fn values_svg_1_1_lacks_are_written_as_resvg_draws_them() {
+    // `lighter` (Filter Effects) is drawn as the default `over`, and a blur has no `edgeMode`.
+    assert_eq!(
+        written(r#"<filter id="c"><feComposite in2="SourceAlpha" operator="lighter"/><feGaussianBlur stdDeviation="1" edgeMode="wrap"/></filter>"#)
+            .as_deref(),
+        Some(r#"<filter id="c"><feComposite in2="SourceAlpha"/><feGaussianBlur stdDeviation="1"/></filter>"#)
+    );
+    assert_eq!(
+        written(r#"<filter id="c"><feBlend in2="SourceAlpha" mode="multiply"/></filter>"#).as_deref(),
+        Some(r#"<filter id="c"><feBlend in2="SourceAlpha" mode="multiply"/></filter>"#)
+    );
+    // CSS colors as `#rrggbb`, a flood color's alpha in its opacity, a lighting color's dropped.
+    assert_eq!(
+        written(r#"<filter id="c" color="hsl(120, 100%, 50%)"><feFlood flood-color="transparent"/><feDiffuseLighting lighting-color="rgba(0,0,255,0.5)"><feDistantLight/></feDiffuseLighting></filter>"#)
+            .as_deref(),
+        Some(
+            r##"<filter id="c" color="#00ff00"><feFlood flood-color="#000000" flood-opacity="0"/><feDiffuseLighting lighting-color="#0000ff"><feDistantLight/></feDiffuseLighting></filter>"##
+        )
+    );
+    // Image scaling as an SVG 1.1 keyword.
+    let data = format!("data:image/png;base64,{}", base64(&png_claiming(2, 2)));
+    for (given, kept) in
+        [("pixelated", "optimizeSpeed"), ("crisp-edges", "optimizeSpeed"), ("smooth", "optimizeQuality"), ("auto", "optimizeQuality")]
+    {
+        let out = written(&format!(r#"<filter id="i"><feImage style="image-rendering:{given}" href="{data}"/></filter>"#)).unwrap();
+        assert!(out.contains(&format!(r#"style="image-rendering:{kept}""#)), "{given}: {out}");
+    }
+    // The blend modes SVG 1.1 lacks have no SVG 1.1 form.
+    for mode in LATER_BLEND_MODES {
+        let f = filter(json!({ "xml": format!(r#"<filter id="b"><feBlend in2="SourceAlpha" mode="{mode}"/></filter>"#) }));
+        assert!(!f.writes_as_svg11(), "{mode}");
+    }
+}
+
+#[test]
+fn base64_pads_as_rfc_4648_does() {
+    assert_eq!(base64(b""), "");
+    assert_eq!(base64(b"f"), "Zg==");
+    assert_eq!(base64(b"fo"), "Zm8=");
+    assert_eq!(base64(b"foo"), "Zm9v");
+    assert_eq!(base64(b"foobar"), "Zm9vYmFy");
+}
diff --git a/crates/effects/src/tests.rs b/crates/effects/src/tests.rs
index ea3843f0e..0b3fc0b1c 100644
--- a/crates/effects/src/tests.rs
+++ b/crates/effects/src/tests.rs
@@ -407,6 +407,54 @@ fn stacked_effects_on_art_stay_within_the_anchor_budget() {
     assert_eq!(reshaped, 10);
 }
 
+/// A path that keeps its shape because its Transform effect would pass the budget keeps the
+/// gradients that paint the art as a whole in place too, also with Scale Strokes & Effects on.
+#[test]
+fn art_past_the_budget_keeps_its_own_gradients_in_place() {
+    use std::sync::Arc;
+
+    use vectorcraft_color::{Gradient, GradientGeom, GradientKind, GradientPaint, GradientStop};
+    use vectorcraft_doc::{AppearanceItem, FillLayer, NodeId, color::Paint};
+    let id = NodeId(9);
+    let stops = vec![GradientStop::new(0.0, vectorcraft_color::Color::BLACK), GradientStop::new(1.0, vectorcraft_color::Color::WHITE)];
+    let geom = GradientGeom { start: (0.0, 50.0).into(), end: (100.0, 50.0).into(), aspect: 1.0, focal: None };
+    let placed = Paint::Gradient(Box::new(GradientPaint { geom: Some(geom), ..GradientPaint::new(Gradient::new(GradientKind::Linear, stops)) }));
+    let circle = || Arc::new(Node::path(id, shapes::ellipse(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default()));
+    // The group's own fill, a gradient placed across the circle, after `carry` moves it.
+    let own_end = |carry: &crate::Carry| {
+        let mut ap = Appearance::default();
+        ap.items.push(AppearanceItem::Fill(FillLayer::new(placed.clone())));
+        carry.apply(&mut ap);
+        match ap.fill_paint() {
+            Paint::Gradient(g) => g.geom.map(|g| g.end.x),
+            _ => None,
+        }
+    };
+    for params in [json!({"scaleH": 1000, "scaleV": 1000}), json!({"scaleH": 1000, "scaleV": 1000, "strokes": true})] {
+        let grow = fx("distort.transform", params.clone());
+        let mut art = Node::group(id, vec![circle()]);
+        let carry = crate::reshape::reshape_leaves_within(&mut art, &[&grow], Budget::EFFECTS);
+        let end = own_end(&carry).unwrap();
+        assert!((end - 550.0).abs() < 1e-6, "{params}: within the budget the group's gradient grows with the circle: {end}");
+        // No room beyond what the circle costs: scaled up, it would be drawn with more lines.
+        let mut art = Node::group(id, vec![circle()]);
+        let carry = crate::reshape::reshape_leaves_within(&mut art, &[&grow], Budget { anchors: usize::MAX, lines: 0 });
+        let b = art.geometric_bounds().unwrap();
+        assert!(b.width() < 101.0 && b.height() < 101.0, "{params}: the circle keeps its shape: {b:?}");
+        assert_eq!(own_end(&carry), Some(100.0), "{params}: the group's gradient stays where it was placed");
+        // A group inside the art whose square took the effect moves its own gradient all the same.
+        let square = Arc::new(Node::path(NodeId(3), shapes::rectangle(Rect::new(0.0, 0.0, 100.0, 100.0)), Appearance::default()));
+        let mut inner = Node::group(NodeId(2), vec![square]);
+        inner.appearance.items.push(AppearanceItem::Fill(FillLayer::new(placed.clone())));
+        let mut art = Node::group(id, vec![circle(), Arc::new(inner)]);
+        let carry = crate::reshape::reshape_leaves_within(&mut art, &[&grow], Budget { anchors: usize::MAX, lines: 0 });
+        assert_eq!(own_end(&carry), Some(100.0), "{params}: the art's own gradient stays");
+        let inner = &art.children().unwrap()[1];
+        let Paint::Gradient(g) = inner.appearance.fill_paint() else { panic!("a gradient") };
+        assert!((g.geom.unwrap().end.x - 550.0).abs() < 1e-6, "{params}: the inner group's gradient: {:?}", g.geom);
+    }
+}
+
 /// #3578: a large Roughen draws each of its points as many lines; they stay within the budget,
 /// the Roughen built again with fewer points where they wouldn't.
 #[test]
diff --git a/crates/engine/src/cmd.rs b/crates/engine/src/cmd.rs
index a26c75da2..eb61b5126 100644
--- a/crates/engine/src/cmd.rs
+++ b/crates/engine/src/cmd.rs
@@ -1,5 +1,6 @@
 //! The command registry. Ids follow Illustrator's menu structure.
 
+pub mod actionset;
 mod addons;
 pub(crate) mod appearance;
 mod assets;
@@ -83,6 +84,7 @@ pub(crate) mod slices;
 mod stroke;
 mod style;
 pub mod stylelib;
+mod svgfilter;
 mod swatch;
 pub mod swatchlib;
 pub(crate) mod symboledit;
@@ -317,6 +319,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(expand::specs());
         v.extend(attributes::specs());
         v.extend(interactivity::specs());
+        v.extend(svgfilter::specs());
         v.extend(newart::specs());
         v.extend(colortheme::specs());
         v.extend(fileio::pdf::specs());
@@ -344,6 +347,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(halftone::specs());
         v.extend(perspgrid::specs());
         v.extend(shortcutset::specs());
+        v.extend(actionset::specs());
         v.extend(importmatches::specs());
         v.extend(addons::specs());
         v
@@ -590,11 +594,16 @@ pub(crate) fn object_param(p: &Value, key: &str, cmd: &str) -> Result<Option<Nod
 }
 
 /// Objects a command targets: its `ids`, else its `id` as `ids` of one ([`named_ids`]), else the
-/// selection. An `ids` or `id` that isn't an object id is an error, never the selection.
+/// selection. An `ids` or `id` that isn't an object id is an error, never the selection. The
+/// selection is refused while an object of a dynamic symbol instance's art is selected, as by
+/// [`edit::selected_roots`].
 pub(crate) fn targets(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
     match named_ids(p)? {
         Some(ids) => Ok(ids),
-        None => Ok(s.doc()?.selection.objects.clone()),
+        None => {
+            edit::refuse_symbol_part(s)?;
+            Ok(s.doc()?.selection.objects.clone())
+        }
     }
 }
 
@@ -667,6 +676,7 @@ pub(crate) const MAX_IMPORTED_PRESETS: usize = 1000;
 
 pub(crate) use edit::{settle_interaction, typing_in_progress};
 pub(crate) use object::bounds_rewrite;
+pub(crate) use object::{keep_aligned_in, refresh_pixel_aligned};
 pub(crate) use vectorcraft_doc::range::parse_range;
 
 /// A date param in Unix seconds that defaults to the clock: `None` when absent (now, see
diff --git a/crates/engine/src/cmd/actionset.rs b/crates/engine/src/cmd/actionset.rs
new file mode 100644
index 000000000..b6a911838
--- /dev/null
+++ b/crates/engine/src/cmd/actionset.rs
@@ -0,0 +1,560 @@
+//! Action sets another app saves as text (`.aia` files that start `/version`), read into their
+//! actions and steps without changing anything (`actionSet.read`).
+//!
+//! The text is a set of fields and blocks. A slash name followed by a value sets a field, and a
+//! slash name followed by `{` opens a block that `}` closes. A value is a decimal number, text in
+//! parentheses, a byte count and hexadecimal bytes in square brackets (`[ 5 48656c6c6f ]`, UTF-8
+//! text, which can run over several words), or a byte count and hexadecimal bytes in angle brackets
+//! (`< 3 0a0b0c >`, raw bytes). The set's `/version` comes first, and its `/name` is hexadecimal
+//! text. Each action is an `/action-N` block with a hexadecimal `/name`; each step is an `/event-N`
+//! block inside one, with its `/internalName` in parentheses, the `/localizedName` it is shown with
+//! as hexadecimal text, and `/isOn` 0 when it is left out of playback; each value a step was
+//! recorded with is a `/parameter-N` block inside it, which is counted, and whose hexadecimal
+//! `/value` is checked against its byte count. The set's `/actionCount`, an action's `/eventCount`
+//! and a step's `/parameterCount` give how many actions, steps and recorded values follow.
+//! The layout follows the README of Inventsable's Redesigning-Illustrator-Actions-in-Scripting
+//! (https://github.com/Inventsable/Redesigning-Illustrator-Actions-in-Scripting), the forum post
+//! "Made a two-way aia to json converter"
+//! (https://community.adobe.com/t5/illustrator-discussions/made-a-two-way-aia-to-json-converter/m-p/13751909),
+//! sttk3's article on names as UTF-8 hexadecimal
+//! (https://sttk3.com/blog/tips/illustrator/dynamic-generate-action.html), and the MIT-licensed
+//! reader in zachshallbetter/adobe-mcp (https://github.com/zachshallbetter/adobe-mcp). The raw form
+//! follows the forum thread "Creating a dynamic action"
+//! (https://community.adobe.com/questions-652/creating-a-dynamic-action-to-use-with-app-doscript-method-814406).
+
+use serde_json::{Value, json};
+
+use super::{CommandSpec, EngineError, Result, Session, always, bad, cmd, text_param};
+
+/// The most bytes of a file read.
+const MAX_BYTES: usize = 8 << 20;
+/// The most bytes taken in: [`MAX_BYTES`] after a byte order mark, and one more that shows the text
+/// goes on.
+const READ_LIMIT: usize = MAX_BYTES + 4;
+/// The most blocks open at once.
+const MAX_DEPTH: usize = 16;
+/// The most actions read.
+const MAX_ACTIONS: usize = 1000;
+/// The most steps read in one action.
+const MAX_STEPS: usize = 10_000;
+/// The most steps read in the set: a small text can hold hundreds of thousands of empty steps, and
+/// the answer holds an object for each.
+const MAX_SET_STEPS: usize = 100_000;
+/// The longest name kept (bytes).
+const MAX_NAME: usize = 1024;
+/// The most tokens listed as unread.
+const MAX_UNREAD: usize = 1000;
+/// The longest unread token shown (characters).
+const UNREAD_SHOWN: usize = 80;
+
+/// The extensions of action sets other apps save.
+pub const EXTS: &[&str] = &["aia"];
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![cmd!(
+        query "actionSet.read",
+        "Read Action Set File",
+        [],
+        None,
+        "{path? | data?: the file's text | dataBase64?, name?: the file's name (default: the path's)} read an action set another app saved as text (.aia, starting \"/version\") without changing anything → {set: the set's /name (else the file's name without its extension, else empty), version, actions: [{name, steps: [{name: the step's /internalName, label: its /localizedName, or null when it has none or it is blank, on: false when /isOn is 0, params: how many /parameter blocks it has, line}]}], unread: [{line, text}] (tokens that aren't read, at most 1000), truncated: true when a cap stopped the reading (8 MiB, 16 open blocks, 1,000 actions, 10,000 steps in an action, 100,000 steps in the set; names past 1,024 bytes are cut), when the text ends inside a block or a value or after a field's name, when /actionCount, /eventCount or a step's /parameterCount differs from the actions, steps or recorded values read (a negative count, one too large for a number and one that isn't a number always differ), or when a hexadecimal name, label or recorded /value isn't as many bytes as its count says}. Give exactly one of path, data and dataBase64. Text that doesn't start with /version and a number is an error",
+        always,
+        read
+    )]
+}
+
+/// A step of an action: an `/event-N` block.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AiaStep {
+    /// Its `/internalName`.
+    pub name: String,
+    /// Its `/localizedName`, if it has one.
+    pub label: Option<String>,
+    /// Its `/isOn`, if it has one.
+    pub on: Option<i64>,
+    /// How many `/parameter-N` blocks it has.
+    pub params: usize,
+    /// Its `/parameterCount`, if it has one.
+    pub declared: Option<i64>,
+    /// The line its block opens on (from 1).
+    pub line: usize,
+}
+
+/// An action: an `/action-N` block.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AiaAction {
+    pub name: String,
+    pub steps: Vec<AiaStep>,
+    /// Its `/eventCount`, if it has one.
+    pub declared: Option<i64>,
+}
+
+/// An action set read from text.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AiaSet {
+    pub version: i64,
+    /// The set's `/name`, if it has one.
+    pub name: Option<String>,
+    pub actions: Vec<AiaAction>,
+    /// Its `/actionCount`, if it has one.
+    pub declared: Option<i64>,
+    /// The tokens that weren't read, with their lines.
+    pub unread: Vec<(usize, String)>,
+    /// A cap stopped the reading or cut a name, the text ends inside a block or a value or after a
+    /// field's name, its counts differ from the actions, steps and recorded values read (a negative
+    /// count, one too large for an `i64` and one that isn't a number always differ), or a hexadecimal
+    /// name, label or recorded `/value` isn't as many bytes as its count says.
+    pub truncated: bool,
+    /// How many steps were read in all the actions.
+    steps: usize,
+}
+
+/// A token of the text.
+enum Token {
+    /// A slash name.
+    Name(Vec<u8>),
+    /// An integer; `None` when it doesn't fit an `i64`.
+    Int(Option<i64>),
+    /// Text in parentheses, a backslash taking the next byte as it is.
+    Text(Vec<u8>),
+    /// The bytes of `[ count hex… ]`; `None` when the hexadecimal digits don't make whole bytes or
+    /// as many bytes as the count says.
+    Hex(Option<Vec<u8>>),
+    /// `< count hex… >`.
+    Raw,
+    Open,
+    Close,
+    /// Anything else, as written.
+    Other(Vec<u8>),
+}
+
+/// The tokens of `text`, each with its line.
+struct Tokens<'a> {
+    text: &'a [u8],
+    at: usize,
+    line: usize,
+    /// The text ended inside a value in parentheses, square brackets or angle brackets.
+    unclosed: bool,
+}
+
+impl<'a> Tokens<'a> {
+    /// Past one byte, counting a line at LF, at CR alone, and once for CRLF.
+    fn step(&mut self) -> Option<u8> {
+        let b = *self.text.get(self.at)?;
+        if b == b'\n' || b == b'\r' && self.text.get(self.at + 1) != Some(&b'\n') {
+            self.line += 1;
+        }
+        self.at += 1;
+        Some(b)
+    }
+
+    /// The bytes up to `end` (not taken in); `None` when the text ends first.
+    fn until(&mut self, end: u8) -> Option<&'a [u8]> {
+        let (text, start) = (self.text, self.at);
+        while text.get(self.at).is_some_and(|&b| b != end) {
+            self.step();
+        }
+        let inside = text.get(start..self.at)?;
+        text.get(self.at)?;
+        self.at += 1;
+        Some(inside)
+    }
+
+    fn next_token(&mut self) -> Option<(usize, Token)> {
+        while self.text.get(self.at).is_some_and(|&b| b.is_ascii_whitespace() || b == 0) {
+            self.step();
+        }
+        let line = self.line;
+        let b = *self.text.get(self.at)?;
+        let ends = |b: u8| b.is_ascii_whitespace() || b == 0 || b"{}[]()<>/".contains(&b);
+        let token = match b {
+            b'{' | b'}' => {
+                self.at += 1;
+                if b == b'{' { Token::Open } else { Token::Close }
+            }
+            b'(' => {
+                self.at += 1;
+                let (mut text, mut depth) = (vec![], 0usize);
+                self.unclosed = true;
+                while let Some(c) = self.step() {
+                    match c {
+                        b'\\' => text.extend(self.step()),
+                        b'(' => {
+                            depth += 1;
+                            text.push(c);
+                        }
+                        b')' if depth == 0 => {
+                            self.unclosed = false;
+                            break;
+                        }
+                        b')' => {
+                            depth -= 1;
+                            text.push(c);
+                        }
+                        _ => text.push(c),
+                    }
+                }
+                Token::Text(text)
+            }
+            b'[' | b'<' => {
+                self.at += 1;
+                let close = if b == b'[' { b']' } else { b'>' };
+                let inside = self.until(close);
+                self.unclosed = inside.is_none();
+                let inside = inside.unwrap_or_default().to_vec();
+                if b == b'<' {
+                    Token::Raw
+                } else {
+                    // The first word is the byte count; the bytes follow in one or more words.
+                    let mut words = inside.split(|c| c.is_ascii_whitespace()).filter(|w| !w.is_empty());
+                    let count = words.next().and_then(|w| std::str::from_utf8(w).ok()).and_then(|w| w.parse::<usize>().ok());
+                    let digits: Vec<u8> = words.flatten().copied().collect();
+                    Token::Hex(hex_bytes(&digits).filter(|b| Some(b.len()) == count))
+                }
+            }
+            b'/' => {
+                self.at += 1;
+                let start = self.at;
+                while self.text.get(self.at).is_some_and(|&c| !ends(c)) {
+                    self.at += 1;
+                }
+                Token::Name(self.text.get(start..self.at).unwrap_or_default().to_vec())
+            }
+            _ => {
+                let start = self.at;
+                while self.text.get(self.at).is_some_and(|&c| !ends(c)) {
+                    self.at += 1;
+                }
+                // Always past at least one byte.
+                self.at = self.at.max(start + 1);
+                let word = self.text.get(start..self.at).unwrap_or_default();
+                let number = word.strip_prefix(b"-").or_else(|| word.strip_prefix(b"+")).unwrap_or(word);
+                if !number.is_empty() && number.iter().all(u8::is_ascii_digit) {
+                    Token::Int(std::str::from_utf8(word).ok().and_then(|s| s.parse().ok()))
+                } else {
+                    Token::Other(word.to_vec())
+                }
+            }
+        };
+        Some((line, token))
+    }
+}
+
+/// The bytes hexadecimal `digits` stand for, two digits a byte.
+fn hex_bytes(digits: &[u8]) -> Option<Vec<u8>> {
+    let nibble = |c: u8| (c as char).to_digit(16).and_then(|d| u8::try_from(d).ok());
+    if !digits.len().is_multiple_of(2) {
+        return None;
+    }
+    digits.chunks(2).map(|pair| Some((nibble(*pair.first()?)? << 4) | nibble(*pair.get(1)?)?)).collect()
+}
+
+/// What a block is.
+enum Kind {
+    Action,
+    Step,
+    Param,
+    /// A block that isn't read, or one past a cap.
+    Other,
+}
+
+/// `name` ends with `-` and a number after `prefix`, as `/action-1` does.
+fn numbered(name: &[u8], prefix: &[u8]) -> bool {
+    name.strip_prefix(prefix).is_some_and(|n| !n.is_empty() && n.iter().all(u8::is_ascii_digit))
+}
+
+/// A name as text: at most [`MAX_NAME`] bytes, read as UTF-8 with replacement characters.
+fn name_text(name: &[u8], set: &mut AiaSet) -> String {
+    if name.len() > MAX_NAME {
+        set.truncated = true;
+    }
+    let mut s = String::from_utf8_lossy(name.get(..MAX_NAME).unwrap_or(name)).into_owned();
+    // A character cut at the limit reads as one replacement character.
+    if name.len() > MAX_NAME && s.ends_with('\u{FFFD}') {
+        s.pop();
+    }
+    s
+}
+
+/// How the unread list shows a value in square brackets that isn't as many bytes as its count says.
+const BAD_HEX: &str = "[ … ] (not the hexadecimal bytes its count says)";
+
+/// List a token that isn't read.
+fn unread(set: &mut AiaSet, line: usize, text: impl AsRef<[u8]>) {
+    if set.unread.len() < MAX_UNREAD {
+        let text: String = String::from_utf8_lossy(text.as_ref()).chars().take(UNREAD_SHOWN).collect();
+        set.unread.push((line, text));
+    }
+}
+
+/// What the block `name` that opens on `line` inside the blocks `stack` is: a new action, step or
+/// recorded value of `set`, or a block that isn't read (listed when it is out of place).
+fn open_block(set: &mut AiaSet, stack: &[Kind], name: &[u8], line: usize) -> Kind {
+    match stack.last() {
+        _ if stack.len() >= MAX_DEPTH => {
+            set.truncated = true;
+            Kind::Other
+        }
+        None if numbered(name, b"action-") => {
+            if set.actions.len() < MAX_ACTIONS {
+                set.actions.push(AiaAction::default());
+                Kind::Action
+            } else {
+                set.truncated = true;
+                Kind::Other
+            }
+        }
+        Some(Kind::Action) if numbered(name, b"event-") => match set.actions.last_mut() {
+            Some(a) if a.steps.len() < MAX_STEPS && set.steps < MAX_SET_STEPS => {
+                a.steps.push(AiaStep { line, ..AiaStep::default() });
+                set.steps += 1;
+                Kind::Step
+            }
+            _ => {
+                set.truncated = true;
+                Kind::Other
+            }
+        },
+        Some(Kind::Step) if numbered(name, b"parameter-") => {
+            if let Some(s) = set.actions.last_mut().and_then(|a| a.steps.last_mut()) {
+                s.params += 1;
+            }
+            Kind::Param
+        }
+        Some(Kind::Param | Kind::Other) => Kind::Other,
+        _ => {
+            unread(set, line, format!("/{} {{", String::from_utf8_lossy(name)));
+            Kind::Other
+        }
+    }
+}
+
+/// Set the field `name` of the block `kind` (the set when `None`) to the hexadecimal text `bytes`
+/// on `line`: the set's or an action's `/name`, or a step's `/localizedName`.
+fn set_hex(set: &mut AiaSet, kind: Option<&Kind>, name: Option<&[u8]>, bytes: Option<Vec<u8>>, line: usize) {
+    let Some(bytes) = bytes else {
+        set.truncated = true;
+        unread(set, line, BAD_HEX);
+        return;
+    };
+    match (kind, name) {
+        (None, Some(b"name")) => set.name = Some(name_text(&bytes, set)),
+        (Some(Kind::Action), Some(b"name")) => {
+            let text = name_text(&bytes, set);
+            if let Some(a) = set.actions.last_mut() {
+                a.name = text;
+            }
+        }
+        (Some(Kind::Step), Some(b"localizedName")) => {
+            let text = name_text(&bytes, set);
+            if let Some(s) = set.actions.last_mut().and_then(|a| a.steps.last_mut()) {
+                s.label = Some(text);
+            }
+        }
+        (_, Some(_)) => {}
+        (_, None) => unread(set, line, "[ … ]"),
+    }
+}
+
+/// Mark `set` truncated when the hexadecimal `/value` on `line` isn't as many bytes as its count
+/// says.
+fn check_value(set: &mut AiaSet, bytes: Option<Vec<u8>>, line: usize) {
+    if bytes.is_none() {
+        set.truncated = true;
+        unread(set, line, BAD_HEX);
+    }
+}
+
+/// Mark `set` truncated when the field `name` of the block `kind` (the set when `None`) is a count
+/// (the set's `/actionCount`, an action's `/eventCount` or a step's `/parameterCount`) whose value is
+/// not a number that fits an `i64`.
+fn bad_count(set: &mut AiaSet, kind: Option<&Kind>, name: Option<&[u8]>) {
+    if matches!((kind, name), (None, Some(b"actionCount")) | (Some(Kind::Action), Some(b"eventCount")) | (Some(Kind::Step), Some(b"parameterCount")))
+    {
+        set.truncated = true;
+    }
+}
+
+/// Set the field `name` of the block `kind` (the set when `None`) to the integer `value` on `line`:
+/// the set's `/actionCount`, an action's `/eventCount`, a step's `/parameterCount`, or a step's
+/// `/isOn`. A count too large for an `i64` marks the set truncated.
+fn set_int(set: &mut AiaSet, kind: Option<&Kind>, name: Option<&[u8]>, value: Option<i64>, line: usize) {
+    if value.is_none() {
+        bad_count(set, kind, name);
+    }
+    match (kind, name) {
+        (None, Some(b"actionCount")) => set.declared = value,
+        (Some(Kind::Action), Some(b"eventCount")) => {
+            if let Some(a) = set.actions.last_mut() {
+                a.declared = value;
+            }
+        }
+        (Some(Kind::Step), Some(b"parameterCount")) => {
+            if let Some(s) = set.actions.last_mut().and_then(|a| a.steps.last_mut()) {
+                s.declared = value;
+            }
+        }
+        (Some(Kind::Step), Some(b"isOn")) => {
+            if let Some(s) = set.actions.last_mut().and_then(|a| a.steps.last_mut()) {
+                s.on = value;
+            }
+        }
+        (_, Some(_)) => {}
+        (_, None) => unread(set, line, value.map_or_else(|| "(a number too large)".to_string(), |v| v.to_string())),
+    }
+}
+
+/// Read an action set saved as text. An error when the text isn't one: it doesn't start with
+/// `/version` and an integer.
+pub fn read_aia(bytes: &[u8]) -> std::result::Result<AiaSet, String> {
+    let mut set = AiaSet::default();
+    let text = bytes.strip_prefix(b"\xEF\xBB\xBF").unwrap_or(bytes);
+    let text = match text.get(..MAX_BYTES) {
+        Some(head) if text.len() > MAX_BYTES => {
+            set.truncated = true;
+            head
+        }
+        _ => text,
+    };
+    let mut tokens = Tokens { text, at: 0, line: 1, unclosed: false };
+    match (tokens.next_token(), tokens.next_token()) {
+        (Some((_, Token::Name(n))), Some((_, Token::Int(Some(v))))) if n == b"version" => set.version = v,
+        _ => return Err("not an action set: the text doesn't start with /version and a number".into()),
+    }
+    let mut stack: Vec<Kind> = vec![];
+    // A slash name waiting for its value or its `{`: (line, name).
+    let mut pending: Option<(usize, Vec<u8>)> = None;
+    while let Some((line, token)) = tokens.next_token() {
+        let in_step = matches!(stack.last(), Some(Kind::Step));
+        let field = |pending: &mut Option<(usize, Vec<u8>)>| pending.take().map(|(_, n)| n);
+        match token {
+            Token::Name(name) => {
+                if let Some((l, n)) = pending.replace((line, name)) {
+                    bad_count(&mut set, stack.last(), Some(&n));
+                    unread(&mut set, l, [b"/".as_slice(), &n].concat());
+                }
+            }
+            Token::Open => {
+                let (l, name) = pending.take().unwrap_or((line, vec![]));
+                bad_count(&mut set, stack.last(), Some(&name));
+                let kind = open_block(&mut set, &stack, &name, l);
+                stack.push(kind);
+            }
+            Token::Close => {
+                if let Some((l, n)) = pending.take() {
+                    bad_count(&mut set, stack.last(), Some(&n));
+                    unread(&mut set, l, [b"/".as_slice(), &n].concat());
+                }
+                if stack.pop().is_none() {
+                    unread(&mut set, line, "}");
+                }
+            }
+            Token::Hex(bytes) if matches!(stack.last(), Some(Kind::Param)) => {
+                if field(&mut pending).as_deref() == Some(b"value".as_slice()) {
+                    check_value(&mut set, bytes, line);
+                }
+            }
+            // The other values inside a recorded value, or a block that isn't read.
+            _ if matches!(stack.last(), Some(Kind::Param | Kind::Other)) => {
+                pending = None;
+            }
+            Token::Hex(bytes) => {
+                let name = field(&mut pending);
+                bad_count(&mut set, stack.last(), name.as_deref());
+                set_hex(&mut set, stack.last(), name.as_deref(), bytes, line);
+            }
+            Token::Text(t) => {
+                let name = field(&mut pending);
+                bad_count(&mut set, stack.last(), name.as_deref());
+                match name {
+                    Some(n) if in_step && n == b"internalName" => {
+                        let name = name_text(&t, &mut set);
+                        if let Some(s) = set.actions.last_mut().and_then(|a| a.steps.last_mut()) {
+                            s.name = name;
+                        }
+                    }
+                    Some(_) => {}
+                    None => unread(&mut set, line, [b"(".as_slice(), &t, b")"].concat()),
+                }
+            }
+            Token::Int(v) => {
+                let name = field(&mut pending);
+                set_int(&mut set, stack.last(), name.as_deref(), v, line);
+            }
+            Token::Raw => {
+                let name = field(&mut pending);
+                bad_count(&mut set, stack.last(), name.as_deref());
+                if name.is_none() {
+                    unread(&mut set, line, "< … >");
+                }
+            }
+            Token::Other(word) => {
+                // A real number, or another word as a field's value.
+                let name = field(&mut pending);
+                bad_count(&mut set, stack.last(), name.as_deref());
+                if name.is_none() {
+                    unread(&mut set, line, word);
+                }
+            }
+        }
+    }
+    // The text ends after a field's name, before its value.
+    if let Some((l, n)) = pending {
+        set.truncated = true;
+        unread(&mut set, l, [b"/".as_slice(), &n].concat());
+    }
+    // An unclosed value is the last token: it takes the rest of the text.
+    if tokens.unclosed {
+        set.truncated = true;
+        unread(&mut set, tokens.line, "a value not closed at the end");
+    }
+    if !stack.is_empty() {
+        set.truncated = true;
+        unread(&mut set, tokens.line, format!("blocks left open at the end: {}", stack.len()));
+    }
+    // Not as many actions, steps or recorded values as the counts give; a negative count never matches.
+    let differs = |declared: Option<i64>, read: usize| declared.is_some_and(|d| !usize::try_from(d).is_ok_and(|d| d == read));
+    let step_differs = |a: &AiaAction| a.steps.iter().any(|s| differs(s.declared, s.params));
+    if differs(set.declared, set.actions.len()) || set.actions.iter().any(|a| differs(a.declared, a.steps.len()) || step_differs(a)) {
+        set.truncated = true;
+        unread(&mut set, tokens.line, "not as many actions, steps or recorded values as the counts give");
+    }
+    Ok(set)
+}
+
+fn read(_: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "actionSet.read";
+    let (path, data, b64) = (text_param(p, "path", C)?, text_param(p, "data", C)?, text_param(p, "dataBase64", C)?);
+    let name = text_param(p, "name", C)?;
+    let bytes: std::borrow::Cow<[u8]> = match (path, data, b64) {
+        (Some(path), None, None) => super::fileio::read_file_head(path, READ_LIMIT)?.into(),
+        (None, Some(text), None) => text.as_bytes().get(..READ_LIMIT).unwrap_or(text.as_bytes()).into(),
+        (None, None, Some(b64)) => super::scripts::decode_head(b64, READ_LIMIT).ok_or_else(|| bad(C, "bad dataBase64"))?.into(),
+        _ => return Err(bad(C, "give exactly one of `path`, `data` and `dataBase64`")),
+    };
+    let set = read_aia(&bytes).map_err(EngineError::Other)?;
+    let file = name.or(path).unwrap_or_default();
+    let stem = std::path::Path::new(file).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default();
+    let name = set.name.clone().filter(|n| !n.trim().is_empty()).unwrap_or(stem);
+    let actions: Vec<Value> = set
+        .actions
+        .iter()
+        .map(|a| {
+            let steps: Vec<Value> = a
+                .steps
+                .iter()
+                .map(|s| {
+                    let label = s.label.clone().filter(|l| !l.trim().is_empty());
+                    json!({ "name": s.name, "label": label, "on": s.on != Some(0), "params": s.params, "line": s.line })
+                })
+                .collect();
+            json!({ "name": a.name, "steps": steps })
+        })
+        .collect();
+    Ok(json!({
+        "set": name,
+        "version": set.version,
+        "actions": actions,
+        "unread": set.unread.iter().map(|(line, text)| json!({ "line": line, "text": text })).collect::<Vec<_>>(),
+        "truncated": set.truncated,
+    }))
+}
diff --git a/crates/engine/src/cmd/appearance.rs b/crates/engine/src/cmd/appearance.rs
index 30e48d4fc..7f7b34352 100644
--- a/crates/engine/src/cmd/appearance.rs
+++ b/crates/engine/src/cmd/appearance.rs
@@ -126,7 +126,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Eyedropper",
             [],
             None,
-            "{source: id, ids?, pickUp?, apply? (trees as eyedropper.setOptions, merged over the Eyedropper Options for this call), reverse?: bool, append?: bool, defaultsOnly?: bool} copy the attributes both picked up and applied (by default the whole appearance stack, opacity and blend mode, and from type to type the character and paragraph attributes) from `source` to ids (default: highlighted characters while editing type, after Select All in a frame of threaded text the text of the story's frames, leaving out `source`, otherwise the object selection; highlighted characters reject enabled non-neutral object transparency), the fill, stroke and weight also to the paint defaults; `defaultsOnly` updates only paint defaults and cannot be combined with ids, reverse or append; `reverse` (Alt-click) copies from the first selected object (or ids) onto `source` instead, or with nothing selected what the Eyedropper picked up last (a click without Alt); `append` (Shift+Alt-click) adds the source's fills, strokes and effects on top of each target's stack; placed gradients land at the same place relative to each target's bounds (defaults: fitted to new art). On a path directly in a graph series, the graph also stores the paint, weight and opacity of the topmost visible fill and stroke (exceptions: docs/mcp.md) → {ids}",
+            "{source: id, ids?, pickUp?, apply? (trees as eyedropper.setOptions, merged over the Eyedropper Options for this call), reverse?: bool, append?: bool, defaultsOnly?: bool} copy the attributes both picked up and applied (by default the whole appearance stack, opacity and blend mode, and from type to type the character and paragraph attributes) from `source` to ids (default: highlighted characters while editing type, after Select All in a frame of threaded text the text of the story's frames, leaving out `source`, otherwise the object selection; highlighted characters reject enabled non-neutral object transparency), the fill, stroke and weight also to the paint defaults; `defaultsOnly` updates only paint defaults and cannot be combined with ids, reverse or append; `reverse` (Alt-click) copies from the first selected object (or ids) onto `source` instead, or with nothing selected what the Eyedropper picked up last (a click without Alt); `append` (Shift+Alt-click) adds the source's fills, strokes and effects on top of each target's stack; placed gradients land at the same place relative to each target's bounds (defaults: fitted to new art); with an object of a dynamic symbol instance selected by Direct Selection and no ids, reverse, append or defaultsOnly, that object takes the source's solid fill and stroke for this instance only, as the Eyedropper Options allow, and a sampled gradient or pattern, a source that is not a path, compound path or type, or options that pick up neither color, are refused. On a path directly in a graph series, the graph also stores the paint, weight and opacity of the topmost visible fill and stroke (exceptions: docs/mcp.md) → {ids}",
             has_doc,
             copy_from
         ),
@@ -598,6 +598,9 @@ fn add_item(s: &mut Session, p: &Value, fill: bool) -> Result<Value> {
                     n.appearance.items.push(item);
                     added.push((*id, fill));
                 }
+                if !fill {
+                    super::object::snap_if_aligned(n);
+                }
             }
         }
         super::graph::capture_series_opacity(d, &top_opacity_changed(&before, d, &ids));
@@ -620,6 +623,7 @@ fn clear_appearance(s: &mut Session, p: &Value) -> Result<Value> {
         for id in &ids {
             if let Some(n) = d.node_mut(*id) {
                 clear(n);
+                super::object::snap_if_aligned(n);
             }
         }
         let kept = super::graph::capture_series_opacity(d, &both_kinds(&ids));
@@ -661,6 +665,35 @@ fn painted_rows(d: &vectorcraft_doc::Document, rows: impl IntoIterator<Item = (N
     rows.into_iter().filter(|(id, fill)| d.node(*id).is_some_and(|n| !super::graph::shown_paint(n, *fill).0.is_none())).collect()
 }
 
+/// Store on the graph what an edit of `ids` (from `before` to `d`) leaves on the topmost visible fill and stroke of the
+/// series marks among them: a paint, weight or opacity that changed, and the paint (`paints`) and opacity (`opacities`) of
+/// the kinds of row the edit wrote, as (fill, stroke). With `top_only` the edit wrote the topmost row of each kind, which
+/// counts only when it is visible. Returns whether the stored paint changed.
+pub(super) fn capture_series_writes(
+    before: &vectorcraft_doc::Document,
+    d: &mut vectorcraft_doc::Document,
+    ids: &[NodeId],
+    paints: (bool, bool),
+    opacities: (bool, bool),
+    top_only: bool,
+) -> bool {
+    let top_shows = |d: &vectorcraft_doc::Document, id: NodeId, kind: bool| {
+        let items = d.node(id).map_or(&[][..], |n| &n.appearance.items[..]);
+        items.iter().rev().find(|it| it.is_fill() == kind).is_some_and(AppearanceItem::visible)
+    };
+    let written = |d: &vectorcraft_doc::Document, (fill, stroke): (bool, bool)| -> Vec<(NodeId, bool)> {
+        let rows = ids.iter().flat_map(|id| [fill.then_some((*id, true)), stroke.then_some((*id, false))]).flatten();
+        painted_rows(d, rows.filter(|(id, kind)| !top_only || top_shows(d, *id, *kind)))
+    };
+    let mut opacity_rows = top_opacity_changed(before, d, ids);
+    opacity_rows.extend(written(d, opacities));
+    let mut rows = top_paint_changed(before, d, ids);
+    rows.extend(written(d, paints));
+    let kept = super::graph::capture_series_opacity(d, &opacity_rows);
+    let painted = super::graph::capture_series_top_paints(d, &rows);
+    kept || painted
+}
+
 /// The kind of the row at `at` (fill `true`, stroke `false`) when it is the topmost visible row of that kind in `ap`.
 fn top_row_kind(ap: &Appearance, at: usize) -> Option<bool> {
     let fill = ap.items.get(at)?.is_fill();
@@ -698,9 +731,11 @@ fn transfer(s: &mut Session, p: &Value) -> Result<Value> {
         }
         to.appearance = ap;
         (to.opacity, to.blend, to.isolate, to.knockout, to.knockout_shape) = (src.opacity, src.blend, src.isolate, src.knockout, src.knockout_shape);
+        super::object::snap_if_aligned(to);
         if !copy && let Some(n) = d.node_mut(source) {
             clear(n);
             (n.isolate, n.knockout, n.knockout_shape) = (false, Default::default(), false);
+            super::object::snap_if_aligned(n);
         }
         let changed = if copy { vec![target] } else { vec![source, target] };
         let kept = super::graph::capture_series_opacity(d, &both_kinds(&changed));
@@ -759,6 +794,7 @@ fn reduce_basic(s: &mut Session, p: &Value) -> Result<Value> {
                     st.blend = BlendMode::Normal;
                     n.appearance.items.push(AppearanceItem::Stroke(st));
                 }
+                super::object::snap_if_aligned(n);
             }
         }
         let kept = super::graph::capture_series_opacity(d, &both_kinds(&ids));
@@ -818,6 +854,7 @@ fn set_item(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(v) = p.get("visible").and_then(Value::as_bool) {
                 *vis = v;
             }
+            super::object::snap_if_aligned(n);
             let items = &n.appearance.items;
             if let Some(fill) =
                 items.get(idx).map(AppearanceItem::is_fill).filter(|f| items.iter().rposition(|it| it.is_fill() == *f && it.visible()) == Some(idx))
@@ -878,6 +915,7 @@ fn remove_item(s: &mut Session, p: &Value) -> Result<Value> {
                 for &i in idx.iter().rev() {
                     n.appearance.remove_item(i);
                 }
+                super::object::snap_if_aligned(n);
             }
         }
         let kept = super::graph::capture_series_opacity(d, &top_opacity_changed(&before, d, &ids));
@@ -982,7 +1020,19 @@ fn show_all_hidden(s: &mut Session, p: &Value) -> Result<Value> {
     let roots = require_targets(s, p, "appearance.showAllHidden")?;
     let before = s.doc()?.doc.clone();
     let ids = s.edit("Show All Hidden Attributes", |d, _| {
-        let shown: Vec<NodeId> = roots.iter().copied().filter(|id| d.node_mut(*id).is_some_and(|n| n.appearance.show_all())).collect();
+        let shown: Vec<NodeId> = roots
+            .iter()
+            .copied()
+            .filter(|id| {
+                d.node_mut(*id).is_some_and(|n| {
+                    let shown = n.appearance.show_all();
+                    if shown {
+                        super::object::snap_if_aligned(n);
+                    }
+                    shown
+                })
+            })
+            .collect();
         if shown.is_empty() {
             return Err(EngineError::Other("Show All Hidden Attributes: nothing is hidden".into()));
         }
@@ -1136,6 +1186,42 @@ fn copy_from(s: &mut Session, p: &Value) -> Result<Value> {
         return Err(bad(C, "`defaultsOnly` cannot be combined with `ids`, `reverse` or `append`"));
     }
     let attrs = s.prefs.eyedropper.attrs(p).map_err(|e| bad(C, e))?;
+    // An object of a dynamic symbol instance's art selected with Direct Selection takes the clicked
+    // object's solid fill and stroke, as the Eyedropper Options allow, for this instance only. A
+    // gradient or pattern sampled for it, a source that is not a path, compound path or type (a
+    // symbol instance's own appearance is empty), and options that pick up neither color are
+    // refused, and the paint defaults stay as they are. A path of a compound path stands for the
+    // compound path, which holds the paint.
+    if !reverse
+        && !append
+        && !defaults_only
+        && p.get("ids").is_none()
+        && let Some((id, path)) = super::brushsym::selected_part(s)?
+    {
+        let d = &s.doc()?.doc;
+        let src = Arc::new(d.node(super::path::compound_or_self(d, clicked)).ok_or(EngineError::NoNode(clicked))?.clone());
+        let (fill, stroke) = (super::paint::proxy_paint(&src, false, None), super::paint::proxy_paint(&src, true, None));
+        let a = attrs.appearance;
+        if !vectorcraft_doc::symbol_overrides::takes_part_paint(&src)
+            || !(a.fill.color || a.stroke.color)
+            || (a.fill.color && !super::paint::part_takes(&fill))
+            || (a.stroke.color && !super::paint::part_takes(&stroke))
+        {
+            return Err(super::brushsym::part_only());
+        }
+        super::brushsym::edit_part(s, id, &path, "Eyedropper", |o| {
+            if a.fill.color {
+                o.fill = Some(fill);
+            }
+            if a.stroke.color {
+                o.stroke = Some(stroke);
+            }
+        })?;
+        // The clicked object becomes the Eyedropper's sample, and new art takes its paint.
+        Picked::of(&src).to_defaults(s, &attrs.appearance);
+        s.eyedropper_sample = Some(src);
+        return Ok(json!({ "ids": [id.0] }));
+    }
     let range = if !defaults_only && !reverse && !append && p.get("ids").is_none() {
         super::textedit::editing_range(s)?.filter(|(_, a, b)| a != b)
     } else {
@@ -1343,6 +1429,7 @@ impl Picked {
             let placed = self.placed(n.geometric_bounds());
             n.appearance.items.extend(placed.items.into_iter().filter(|it| if it.is_fill() { ap.fill.color } else { ap.stroke.color }));
             n.appearance.effects.extend(placed.effects);
+            super::object::snap_if_aligned(n);
             return;
         }
         if let NodeKind::Text(t) = &mut n.kind {
@@ -1366,6 +1453,7 @@ impl Picked {
         } else {
             focal_attrs(&mut n.appearance, &placed, ap);
         }
+        super::object::snap_if_aligned(n);
     }
 }
 
diff --git a/crates/engine/src/cmd/assets.rs b/crates/engine/src/cmd/assets.rs
index 133fb1fce..fd273e067 100644
--- a/crates/engine/src/cmd/assets.rs
+++ b/crates/engine/src/cmd/assets.rs
@@ -3,12 +3,17 @@
 //! settings Export for Screens shares (`document.exportSettings`). File → Export Selection collects
 //! the selection this way and opens Export for Screens on its Assets tab (a UI command).
 
+use std::collections::HashSet;
+
 use serde_json::{Map, Value, json};
 use vectorcraft_doc::{ExportAsset, NodeId};
 
 use super::edit::{roots_of, selected_roots};
-use super::fileio::{SCREEN_SETTINGS_KEYS, check_screen_settings, export_crop, export_screens, store_screen_settings, with_screen_export_preset};
-use super::{CommandSpec, EngineError, Result, Session, bad, bool_or, checked_ids_param, cmd, has_doc, ok, str_param};
+use super::fileio::{
+    DEFAULT_FORMAT_3D, FORMATS_3D, SCREEN_SETTINGS_KEYS, check_screen_settings, create_dir, export_crop, export_screens, mesh_file_names, mesh_files,
+    safe_file_name, store_screen_settings, with_screen_export_preset, write_file,
+};
+use super::{CommandSpec, EngineError, Result, Session, bad, bool_or, checked_ids_param, cmd, has_doc, ok, str_param, switch_or, text_param};
 
 /// The longest asset name kept (characters).
 const MAX_NAME: usize = 255;
@@ -39,7 +44,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Assets",
             [],
             None,
-            "{} → {assets: [{id, name, nodes: [id…], bounds: [x, y, width, height] | null (the crop: the bounds the renderer measures for what its art draws, effects included)}]} the Asset Export panel's assets, in order",
+            "{} → {assets: [{id, name, nodes: [id…], bounds: [x, y, width, height] | null (the crop: the bounds the renderer measures for what its art draws, effects included), format3D: usda|usdz|gltf|obj | null (a 3D asset's mesh format; null for art exported as pictures)}]} the Asset Export panel's assets, in order",
             has_doc,
             list
         ),
@@ -48,10 +53,37 @@ pub fn specs() -> Vec<CommandSpec> {
             "Export Assets",
             [],
             None,
-            "{assets?: [asset id…] (default all), folder?, zip?, openLocation?, formats?, preset?, settings?, prefix?, subfolders?, antiAlias?} each asset's art alone, cropped to it, in every format row: document.exportForScreens {assets} at the document's export settings (document.exportSettings) under the ones given; with subfolders false every file goes into the folder itself, mobile and density rows too → what document.exportForScreens returns (no folder: the files, or one zip, as dataBase64). Leaves the remembered settings as they are (assets.settings.set changes them)",
+            "{assets?: [asset id…] (default all but the 3D assets, which assets.export3D writes), folder?, zip?, openLocation?, formats?, preset?, settings?, prefix?, subfolders?, antiAlias?} each asset's art alone, cropped to it, in every format row: document.exportForScreens {assets} at the document's export settings (document.exportSettings) under the ones given; with subfolders false every file goes into the folder itself, mobile and density rows too → what document.exportForScreens returns (no folder: the files, or one zip, as dataBase64). Leaves the remembered settings as they are (assets.settings.set changes them)",
             has_doc,
             export
         ),
+        cmd!(
+            "assets.add3D",
+            "Export 3D Object",
+            [],
+            None,
+            "{ids?: [id…] (default: the selected objects), format?: usda|usdz|gltf|obj (default usda)} collect each object with an Extrude & Bevel, Revolve, Inflate or Rotate effect as a 3D asset of Window › Asset Export, named after the object (else Asset 1, Asset 2…): assets.export3D writes it as a mesh file. An object already collected as a 3D asset keeps it; an object without such an effect is refused → {assets: [asset id…] (in order), added: n}",
+            has_doc,
+            add_3d
+        ),
+        cmd!(
+            "assets.set3DFormat",
+            "3D Export Format",
+            [],
+            None,
+            "{assets: [asset id…], format: usda|usdz|gltf|obj} the mesh format 3D assets export to (Asset Export's Format for a 3D asset) → {changed: n}",
+            has_doc,
+            set_3d_format
+        ),
+        cmd!(
+            "assets.export3D",
+            "Export 3D Assets",
+            [],
+            None,
+            "{assets?: [asset id…] (default every 3D asset), folder?, zip?} each 3D asset's object as a mesh file in its format (assets.set3DFormat), named after the asset: USDA or USDZ, glTF 2.0 (one .gltf, its buffer embedded) or OBJ with its .mtl (whitespace and # in an OBJ's name become _). Every solid of the object (the fill's, each stroke's, a group's members') is a mesh with a material in the color it is painted; faces turned away from the viewer are included, at the object's 3D rotation, y up, about the point it turns about, in points (glTF: meters). Files that would share a name get -2, -3…; an object with a hole that crosses its face's outline or another hole, or with more than 2,000,000 triangles, is refused → {files: [path…]} (no folder: {files: [{name, dataBase64}]}, or with zip one zip as {name, dataBase64, files})",
+            has_doc,
+            export_3d
+        ),
         cmd!(
             "assets.settings.set",
             "Asset Export Settings",
@@ -115,7 +147,9 @@ fn add(s: &mut Session, p: &Value) -> Result<Value> {
     if name.is_some() && sets.len() > 1 {
         return Err(bad(C, "a name names one asset: give multiple: false, or one object"));
     }
-    let existing = |d: &vectorcraft_doc::Document, nodes: &[NodeId]| d.assets.iter().find(|a| a.nodes == nodes).map(|a| a.id);
+    // A 3D asset of the same art is another asset.
+    let existing =
+        |d: &vectorcraft_doc::Document, nodes: &[NodeId]| d.assets.iter().find(|a| a.nodes == nodes && a.format_3d.is_none()).map(|a| a.id);
     let d = &s.doc()?.doc;
     // Nothing new: no undo step.
     if sets.iter().all(|set| existing(d, set).is_some()) {
@@ -134,7 +168,7 @@ fn add(s: &mut Session, p: &Value) -> Result<Value> {
             };
             let name = name.clone().or(own).unwrap_or_else(|| d.next_asset_name());
             let id = d.alloc_id().0;
-            d.assets.push(ExportAsset { id, name, nodes });
+            d.assets.push(ExportAsset { id, name, nodes, format_3d: None });
             out.push(id);
             added += 1;
         }
@@ -142,6 +176,162 @@ fn add(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
+/// The format of param `format` of command `cmd` ([`FORMATS_3D`]), `default` when it is not given.
+fn format_3d_param(p: &Value, cmd: &str, default: Option<&str>) -> Result<String> {
+    match (p.get("format"), default) {
+        (None, Some(d)) => Ok(d.to_string()),
+        (Some(Value::String(f)), _) if FORMATS_3D.contains(&f.as_str()) => Ok(f.clone()),
+        _ => {
+            let key = "format";
+            Err(bad(cmd, format!("`{key}` must be one of {}", FORMATS_3D.join(", "))))
+        }
+    }
+}
+
+/// The asset ids of param `key` of command `cmd`, each a 3D asset of `d`.
+fn three_d_asset_ids(d: &vectorcraft_doc::Document, p: &Value, key: &str, cmd: &str) -> Result<Vec<u64>> {
+    let ids = asset_ids(p, key, cmd)?;
+    for id in &ids {
+        match d.asset(*id) {
+            None => return Err(bad(cmd, "no such assets (see assets.list)")),
+            Some(a) if a.format_3d.is_none() => return Err(bad(cmd, format!("asset {id} isn't a 3D asset"))),
+            _ => {}
+        }
+    }
+    Ok(ids)
+}
+
+fn add_3d(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "assets.add3D";
+    let format = format_3d_param(p, C, Some(DEFAULT_FORMAT_3D))?;
+    let ids = if p.get("ids").is_some_and(|v| !v.is_null()) { checked_ids_param(s, p, "ids", C)? } else { selected_roots(s)? };
+    if ids.is_empty() {
+        return Err(bad(C, "select an object with a 3D effect (or give its ids)"));
+    }
+    let d = &s.doc()?.doc;
+    let mut ids = d.paint_order(ids);
+    ids.dedup();
+    for id in &ids {
+        let n = d.node(*id).ok_or_else(|| bad(C, format!("no such object {0}", id.0)))?;
+        if let Err(e) = vectorcraft_render::effects::three_d_meshes(n) {
+            let what = n.name.clone().unwrap_or_else(|| format!("#{}", id.0));
+            return Err(bad(C, format!("{what} can't be exported in 3D: {e}")));
+        }
+    }
+    let existing = |d: &vectorcraft_doc::Document, id: NodeId| d.assets.iter().find(|a| a.nodes == [id] && a.format_3d.is_some()).map(|a| a.id);
+    // Nothing new: no undo step.
+    if ids.iter().all(|id| existing(d, *id).is_some()) {
+        return Ok(json!({ "assets": ids.iter().filter_map(|id| existing(d, *id)).collect::<Vec<_>>(), "added": 0 }));
+    }
+    s.edit("Export 3D Object", |d, _| {
+        let (mut out, mut added) = (vec![], 0);
+        for node in ids {
+            if let Some(id) = existing(d, node) {
+                out.push(id);
+                continue;
+            }
+            let name = d.node(node).and_then(|n| n.name.as_deref()).and_then(clean_name).unwrap_or_else(|| d.next_asset_name());
+            let id = d.alloc_id().0;
+            d.assets.push(ExportAsset { id, name, nodes: vec![node], format_3d: Some(format.clone()) });
+            out.push(id);
+            added += 1;
+        }
+        Ok(json!({ "assets": out, "added": added }))
+    })
+}
+
+fn set_3d_format(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "assets.set3DFormat";
+    let d = &s.doc()?.doc;
+    let ids = three_d_asset_ids(d, p, "assets", C)?;
+    let format = format_3d_param(p, C, None)?;
+    let changed = d.assets.iter().filter(|a| ids.contains(&a.id) && a.format_3d.as_deref() != Some(format.as_str())).count();
+    // Nothing changes: no undo step.
+    if changed == 0 {
+        return Ok(json!({ "changed": 0 }));
+    }
+    s.edit("3D Export Format", |d, _| {
+        for a in d.assets.iter_mut().filter(|a| ids.contains(&a.id)) {
+            a.format_3d = Some(format.clone());
+        }
+        Ok(json!({ "changed": changed }))
+    })
+}
+
+fn export_3d(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "assets.export3D";
+    let d = &s.doc()?.doc;
+    let ids = if p.get("assets").is_some_and(|v| !v.is_null()) {
+        three_d_asset_ids(d, p, "assets", C)?
+    } else {
+        d.assets.iter().filter(|a| a.format_3d.is_some()).map(|a| a.id).collect()
+    };
+    if ids.is_empty() {
+        return Err(bad(C, "no 3D assets yet: collect an object with a 3D effect first (assets.add3D)"));
+    }
+    let folder = text_param(p, "folder", C)?.filter(|f| !f.is_empty());
+    let zip = switch_or(p, "zip", false, C)?;
+    // Every file's name, compared without case: a later file that would take one gets -2, -3…
+    let mut taken: HashSet<String> = HashSet::new();
+    let mut files: Vec<(String, Vec<u8>)> = vec![];
+    for id in ids {
+        let Some(a) = d.asset(id) else { continue };
+        let format = a.format_3d.as_deref().unwrap_or(DEFAULT_FORMAT_3D);
+        let mut parts = vec![];
+        for node in &a.nodes {
+            let n = d.node(*node).ok_or_else(|| bad(C, format!("no such object {0}", node.0)))?;
+            let what = &a.name;
+            parts.extend(vectorcraft_render::effects::three_d_meshes(n).map_err(|e| bad(C, format!("{what} can't be exported in 3D: {e}")))?);
+        }
+        let base = Some(safe_file_name(&a.name)).filter(|b| !b.is_empty()).unwrap_or_else(|| "Asset".into());
+        let mut stem = base.clone();
+        let mut k = 1;
+        loop {
+            let names = mesh_file_names(&stem, format).map_err(|e| bad(C, e))?;
+            if names.iter().all(|n| !taken.contains(&n.to_lowercase())) {
+                break;
+            }
+            k += 1;
+            stem = format!("{base}-{k}");
+        }
+        let made = mesh_files(&stem, format, &parts).map_err(|e| bad(C, e))?;
+        taken.extend(made.iter().map(|(n, _)| n.to_lowercase()));
+        files.extend(made);
+    }
+    let names: Vec<&str> = files.iter().map(|(n, _)| n.as_str()).collect();
+    if zip {
+        let archive = super::fileio::zip::store(&files).map_err(|e| bad(C, e))?;
+        // "-3D" keeps it apart from the picture assets' ZIP, which is named after the document.
+        let name = Some(safe_file_name(&d.title)).filter(|t| !t.is_empty()).map_or_else(|| "3D Assets.zip".into(), |t| format!("{t}-3D.zip"));
+        return match folder {
+            Some(dir) => {
+                create_dir(dir)?;
+                let path = format!("{dir}/{name}");
+                write_file(&path, &archive)?;
+                Ok(json!({ "path": path, "bytes": archive.len(), "files": names }))
+            }
+            None => Ok(json!({ "name": name, "dataBase64": vectorcraft_format::base64_encode(&archive), "bytes": archive.len(), "files": names })),
+        };
+    }
+    match folder {
+        Some(dir) => {
+            create_dir(dir)?;
+            let mut written = vec![];
+            for (name, bytes) in &files {
+                let path = format!("{dir}/{name}");
+                write_file(&path, bytes)?;
+                written.push(path);
+            }
+            Ok(json!({ "files": written }))
+        }
+        None => {
+            let files: Vec<Value> =
+                files.iter().map(|(name, bytes)| json!({ "name": name, "dataBase64": vectorcraft_format::base64_encode(bytes) })).collect();
+            Ok(json!({ "files": files }))
+        }
+    }
+}
+
 /// The asset ids of param `key`.
 fn asset_ids(p: &Value, key: &str, cmd: &str) -> Result<Vec<u64>> {
     let ids = p.get(key).and_then(Value::as_array).ok_or_else(|| bad(cmd, format!("`{key}` must be an array of asset ids (see assets.list)")))?;
@@ -186,6 +376,7 @@ fn list(s: &mut Session, _: &Value) -> Result<Value> {
                 "name": a.name,
                 "nodes": a.nodes.iter().map(|n| n.0).collect::<Vec<_>>(),
                 "bounds": bounds.map(|b| [b.x0, b.y0, b.width(), b.height()]),
+                "format3D": a.format_3d,
             })
         })
         .collect();
@@ -227,8 +418,10 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
     if q.get("subfolders").and_then(Value::as_bool) == Some(false) && p.get("folders").is_none() {
         q.insert("folders".into(), json!("none"));
     }
+    let d = &s.doc()?.doc;
+    // 3D assets are written as mesh files, by assets.export3D: the export refuses one it is given.
     if !q.contains_key("assets") {
-        let all: Vec<u64> = s.doc()?.doc.assets.iter().map(|a| a.id).collect();
+        let all: Vec<u64> = d.assets.iter().filter(|a| a.format_3d.is_none()).map(|a| a.id).collect();
         if all.is_empty() {
             return Err(bad(C, "no assets yet: collect art for export first (assets.add)"));
         }
diff --git a/crates/engine/src/cmd/brushsym.rs b/crates/engine/src/cmd/brushsym.rs
index 8cf3a2195..5dcb82136 100644
--- a/crates/engine/src/cmd/brushsym.rs
+++ b/crates/engine/src/cmd/brushsym.rs
@@ -36,7 +36,8 @@ use brushes::{
     brush_apply, brush_delete, brush_duplicate, brush_freehand, brush_get, brush_list, brush_move, brush_new, brush_options, brush_remove,
     brush_selection_art, brush_set_current, brush_unused, expand_brush,
 };
-use dynamic::{symbol_instance_reset, symbol_instance_set_appearance};
+pub(crate) use dynamic::{edit_part, part_only, selected_part};
+use dynamic::{symbol_instance_reset, symbol_instance_select_part, symbol_instance_set_appearance};
 use symbols::selected_instances;
 pub(crate) use symbols::{
     expand_instances_under, expandable_instances, instance_in_place, natural_size, normalize, place_xf, set_natural_size, store_symbol,
@@ -266,6 +267,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection,
             symbol_instance_set_appearance
         ),
+        cmd!(
+            "symbol.instance.selectPart",
+            "Select Symbol Instance Part",
+            [],
+            None,
+            "{id, path: [i…] (as symbol.instance.setAppearance)} select one path, compound path or type object of a dynamic symbol instance's art, as a Direct Selection click on it does: the instance is selected alone, and until the selection changes paint.setFill and paint.setStroke with a solid color or none, paint.invert and paint.complement on a solid color (without ids, id or item; type whose characters differ in color is refused) and appearance.copyFrom with a solid fill and stroke (the Eyedropper, without ids, reverse or append; options that pick up neither color are refused) change that object's fill or stroke for this instance only; gradients and patterns are refused, and so are the commands that change the selected objects without ids (transparency.set, the gradient commands, object.group, edit.cut and edit.clear among them); edit.copy copies the instance whole, and selection exports, artboard.fitToSelection, object.liquify, object.isolate, library.add and select.save use the instance (docs/mcp.md); selectPart itself is refused for a static symbol, a path naming no object, a group, image or other kind of object, a hidden, locked or template object or one inside such a group, and a hidden or locked instance → {id, path}",
+            has_doc,
+            symbol_instance_select_part
+        ),
         cmd!(
             "symbol.instance.reset",
             "Reset Symbol Instance",
diff --git a/crates/engine/src/cmd/brushsym/dynamic.rs b/crates/engine/src/cmd/brushsym/dynamic.rs
index baa721c45..6197e57be 100644
--- a/crates/engine/src/cmd/brushsym/dynamic.rs
+++ b/crates/engine/src/cmd/brushsym/dynamic.rs
@@ -61,6 +61,62 @@ fn dynamic_instance(s: &Session, p: &Value, cmd: &str) -> Result<(NodeId, Arc<No
     Ok((id, sym.art.clone()))
 }
 
+/// The selected object of a dynamic symbol instance's art (Direct Selection): the instance and the
+/// object's path in the symbol's art.
+pub(crate) fn selected_part(s: &Session) -> Result<Option<(NodeId, Vec<u32>)>> {
+    Ok(s.doc()?.selection.symbol_part.as_ref().map(|sp| (sp.instance, sp.path.clone())))
+}
+
+/// Change instance `id`'s own appearance for the object at `path` of its art by `f`, as one undo
+/// step named `label`; nothing is recorded when the change leaves it as it was. Replies how many
+/// objects the instance changes.
+pub(crate) fn edit_part(s: &mut Session, id: NodeId, path: &[u32], label: &str, f: impl FnOnce(&mut SymbolOverride)) -> Result<usize> {
+    let list = s.doc()?.doc.node(id).ok_or(EngineError::NoNode(id))?.extras().symbol_overrides.clone();
+    let old = list.iter().find(|o| o.path == path).cloned().unwrap_or_else(|| SymbolOverride { path: path.to_vec(), ..Default::default() });
+    let mut new = old.clone();
+    f(&mut new);
+    if new == old {
+        return Ok(list.len());
+    }
+    s.edit(label, |d, _| {
+        let n = d.node_mut(id).ok_or(EngineError::NoNode(id))?;
+        let mut e = n.extras_mut();
+        let list = &mut e.symbol_overrides;
+        list.retain(|o| o.path != path);
+        if !new.is_empty() {
+            list.push(new);
+        }
+        Ok(list.len())
+    })
+}
+
+/// The refusal of anything but a solid color fill or stroke change while an object of a symbol
+/// instance's art is selected ([`selected_part`]), and of selecting any other object of the art.
+pub(crate) fn part_only() -> EngineError {
+    EngineError::Other("Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change".into())
+}
+
+pub(super) fn symbol_instance_select_part(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "symbol.instance.selectPart";
+    if p.get("id").is_none() {
+        return Err(bad(C, "missing id"));
+    }
+    let (id, art) = dynamic_instance(s, p, C)?;
+    let path = path_param(p, &art, C)?;
+    // Direct Selection passes over hidden, locked and template objects, and over everything in a
+    // group or layer that is: the instance in the document, and the object in the symbol's art.
+    let editable = |n: &Node| n.visible && !n.locked && !n.is_template();
+    if !s.doc()?.doc.is_editable(id) || !(0..=path.len()).all(|k| symbol_overrides::part(&art, &path[..k]).is_some_and(editable)) {
+        return Err(bad(C, "the object is hidden or locked"));
+    }
+    if !symbol_overrides::part(&art, &path).is_some_and(symbol_overrides::takes_part_paint) {
+        return Err(part_only());
+    }
+    let shown = json!(path);
+    s.select(|_, sel| sel.set_symbol_part(id, path))?;
+    Ok(json!({ "id": id.0, "path": shown }))
+}
+
 /// The `path` param: child indices from the art's root, naming an object of `art`.
 fn path_param(p: &Value, art: &Node, cmd: &str) -> Result<Vec<u32>> {
     let path: Option<Vec<u32>> =
@@ -117,16 +173,7 @@ pub(super) fn symbol_instance_set_appearance(s: &mut Session, p: &Value) -> Resu
     let d = &s.doc()?.doc;
     let old = d.node(id).and_then(|n| n.extras().symbol_overrides.iter().find(|o| o.path == path).cloned());
     let new = changed(s, p, old.unwrap_or_else(|| SymbolOverride { path: path.clone(), ..Default::default() }), C)?;
-    let count = s.edit("Symbol Instance Appearance", |d, _| {
-        let n = d.node_mut(id).ok_or(EngineError::NoNode(id))?;
-        let mut e = n.extras_mut();
-        let list = &mut e.symbol_overrides;
-        list.retain(|o| o.path != path);
-        if !new.is_empty() {
-            list.push(new);
-        }
-        Ok(list.len())
-    })?;
+    let count = edit_part(s, id, &path, "Symbol Instance Appearance", |o| *o = new)?;
     Ok(json!({ "id": id.0, "overrides": count }))
 }
 
diff --git a/crates/engine/src/cmd/brushsym/symbols.rs b/crates/engine/src/cmd/brushsym/symbols.rs
index 69bfcb66e..60353921e 100644
--- a/crates/engine/src/cmd/brushsym/symbols.rs
+++ b/crates/engine/src/cmd/brushsym/symbols.rs
@@ -888,6 +888,8 @@ pub(super) fn symbol_adjust(s: &mut Session, p: &Value) -> Result<Value> {
     let radius = number_or(p, "radius", 40.0, C)?.clamp(1.0, 2000.0);
     let intensity = number_or(p, "intensity", 5.0, C)?.clamp(1.0, 10.0) / 10.0;
     let alt = switch_or(p, "alt", false, C)?;
+    // Refused while an object of a dynamic instance's art is selected: the instance stays as it is.
+    crate::cmd::edit::refuse_symbol_part(s)?;
     let st = s.doc()?;
     let color = match color_param(p, "color", C)? {
         Some(c) => crate::cmd::paint::new_color(s, p, c),
diff --git a/crates/engine/src/cmd/distortcmds.rs b/crates/engine/src/cmd/distortcmds.rs
index d54238925..bcaa59426 100644
--- a/crates/engine/src/cmd/distortcmds.rs
+++ b/crates/engine/src/cmd/distortcmds.rs
@@ -13,7 +13,7 @@ use vectorcraft_tools::distort::liquify::{Dabber, LiquifyParams, PathStroke, Sam
 use vectorcraft_tools::distort::perspective::{self as persp, PerspectiveGrid, Plane};
 use vectorcraft_tools::distort::{PinSet, arap, collect_points, mesh_for, project_node, stroke_owner, warp_from_rest, warp_node_with};
 
-use super::edit::{duplicate_in, outermost, selected_roots};
+use super::edit::{duplicate_in, outermost, refuse_symbol_part, selected_roots};
 use super::{
     CommandSpec, Result, Session, bad, check_numbers, check_switches, cmd, f64_or, f64_req, finite_numbers, has_doc, has_selection, id_param,
     matrix_param, named_id, named_ids, number_or, ok, point_indices, point_param, str_param, switch_or, targets,
@@ -730,8 +730,13 @@ fn puppet_warp(s: &mut Session, p: &Value) -> Result<Value> {
     if pins.iter().chain(&moved).any(|q| !q.x.is_finite() || !q.y.is_finite()) {
         return Err(bad(C, "pins must be finite"));
     }
-    let ids =
-        if rest { puppet_ids(p, || Ok(s.doc()?.selection.objects.clone()))? } else { outermost(&s.doc()?.doc, puppet_ids(p, || selected_roots(s))?) };
+    // While an object of a dynamic symbol instance's art is selected, the selection is refused, as
+    // `selected_roots` refuses it.
+    let selected = || {
+        refuse_symbol_part(s)?;
+        Ok(s.doc()?.selection.objects.clone())
+    };
+    let ids = if rest { puppet_ids(p, selected)? } else { outermost(&s.doc()?.doc, puppet_ids(p, || selected_roots(s))?) };
     let expand = f64_or(p, "expand", 3.0).clamp(0.0, 1000.0);
     let angles: Vec<Option<f64>> = match p.get("angles") {
         None | Some(Value::Null) => vec![None; pins.len()],
diff --git a/crates/engine/src/cmd/edit.rs b/crates/engine/src/cmd/edit.rs
index 21bd4f9bc..f6491d757 100644
--- a/crates/engine/src/cmd/edit.rs
+++ b/crates/engine/src/cmd/edit.rs
@@ -157,7 +157,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Cut",
             ["Edit"],
             Some("Cmd+X"),
-            "{lockedAndHidden?: bool (the Artboard tool chosen, as artboard.cut)} (selected ruler guides go too; the Artboard tool chosen: artboard.cut)",
+            "{lockedAndHidden?: bool (the Artboard tool chosen, as artboard.cut)} (selected ruler guides go too; the Artboard tool chosen: artboard.cut); refused while an object of a symbol instance's art is selected",
             has_selection_guides_or_artboard_tool,
             cut
         ),
@@ -166,7 +166,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Copy",
             ["Edit"],
             Some("Cmd+C"),
-            "{lockedAndHidden?: bool (the Artboard tool chosen, as artboard.copy)} the selection with what it uses, and the selected ruler guides (pasted on the layer new art goes to, moved as the objects are; alone, where they were); the Artboard tool chosen: artboard.copy → {copied, guides}",
+            "{lockedAndHidden?: bool (the Artboard tool chosen, as artboard.copy)} the selection with what it uses, and the selected ruler guides (pasted on the layer new art goes to, moved as the objects are; alone, where they were); the Artboard tool chosen: artboard.copy; with an object of a symbol instance's art selected, the instance is copied whole → {copied, guides}",
             has_selection_guides_or_artboard_tool,
             copy
         ),
@@ -220,7 +220,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Clear",
             ["Edit"],
             Some("Delete"),
-            "{ids?, guides?: bool (with ids: also delete the selected ruler guides)} delete the objects `ids`, else the selection (fully selected objects and direct-selected anchors together, else ruler guides)",
+            "{ids?, guides?: bool (with ids: also delete the selected ruler guides)} delete the objects `ids`, else the selection (fully selected objects and direct-selected anchors together, else ruler guides); without ids, refused while an object of a symbol instance's art is selected",
             has_selection_or_guides,
             clear
         ),
@@ -829,16 +829,38 @@ fn shared_selection(selection: vectorcraft_doc::Selection, like: Option<&crate::
 }
 
 /// Selected top-level objects in paint order, dropping any whose ancestor is also selected.
+///
+/// Refused with [`super::brushsym::part_only`] while an object of a dynamic symbol instance's art
+/// is selected ([`super::brushsym::selected_part`]): only the paint commands change that object,
+/// and only its solid fill and stroke, so a command that gathers the selection here leaves the
+/// instance as it is. Copy copies the instance whole ([`copy_cut_targets`]).
 pub(crate) fn selected_roots(s: &Session) -> Result<Vec<NodeId>> {
+    refuse_symbol_part(s)?;
     let st = s.doc()?;
     Ok(roots_of(&st.doc, st.selection.in_paint_order(&st.doc)))
 }
 
+/// [`super::brushsym::part_only`] while an object of a dynamic symbol instance's art is selected:
+/// for the commands that read the selected objects without [`selected_roots`]. A command that
+/// changes nothing in the document ([`Session::reading`]) reads the instance instead.
+pub(crate) fn refuse_symbol_part(s: &Session) -> Result<()> {
+    if !s.reading && s.doc()?.selection.symbol_part.is_some() { Err(super::brushsym::part_only()) } else { Ok(()) }
+}
+
+/// [`refuse_symbol_part`] as a command's `enabled` check: the command is dimmed, and refused with
+/// [`super::brushsym::part_only`]'s message, while an object of a dynamic symbol instance's art is
+/// selected.
+pub(crate) fn no_symbol_part(s: &Session) -> std::result::Result<(), String> {
+    if !s.reading && s.active().is_some_and(|st| st.selection.symbol_part.is_some()) { Err(super::brushsym::part_only().to_string()) } else { Ok(()) }
+}
+
 /// [`selected_roots`] for the commands that move or reshape the art (Move, Transform, Rotate…): a
 /// path of a compound path selected on its own (Group Selection, or in the isolated compound path)
 /// is an object of its own, so the hole of a ring moves without the ring (#2441). Paint and the
-/// rest still go to the compound path, which holds the paint.
+/// rest still go to the compound path, which holds the paint. Refused while an object of a symbol
+/// instance's art is selected, as [`selected_roots`] is: it moves with its instance only.
 pub(crate) fn selected_roots_to_transform(s: &Session) -> Result<Vec<NodeId>> {
+    refuse_symbol_part(s)?;
     let st = s.doc()?;
     Ok(roots_within(&st.doc, st.selection.in_paint_order(&st.doc), |_, _| true))
 }
@@ -847,8 +869,10 @@ pub(crate) fn selected_roots_to_transform(s: &Session) -> Result<Vec<NodeId>> {
 /// ([`super::inside_isolation`]): `root` itself and objects outside it are left out before the
 /// objects held by another selected object are dropped. A selected path of a compound path stands
 /// for its compound unless the compound is `root` or `members` is set (as in
-/// [`selected_roots_to_transform`]).
+/// [`selected_roots_to_transform`]). Refused while an object of a symbol instance's art is
+/// selected, as [`selected_roots`] is.
 pub(crate) fn selected_roots_inside(s: &Session, root: NodeId, members: bool) -> Result<Vec<NodeId>> {
+    refuse_symbol_part(s)?;
     let st = s.doc()?;
     let ids = st.selection.in_paint_order(&st.doc).into_iter().filter(|id| super::inside_isolation(&st.doc, root, *id)).collect();
     Ok(roots_within(&st.doc, ids, |compound, _| members || compound == root))
@@ -925,6 +949,7 @@ fn copy(s: &mut Session, p: &Value) -> Result<Value> {
     if s.tool_id() == "artboard" {
         return super::panelcmds::artboard_copy(s, &artboard_clipboard_params(p), false);
     }
+    // With an object of a dynamic symbol instance's art selected, the instance is copied.
     let (direct, targets) = copy_cut_targets(s)?;
     let st = s.doc()?;
     // Selected ruler guides come along (#3226), as canvas guides: their layer and artboard stay
@@ -965,6 +990,7 @@ fn cut(s: &mut Session, p: &Value) -> Result<Value> {
     if s.tool_id() == "artboard" {
         return super::panelcmds::artboard_copy(s, &artboard_clipboard_params(p), true);
     }
+    refuse_symbol_part(s)?;
     // Ruler guides selected on their own: Copy takes them, Clear removes them.
     if s.doc()?.selection.is_empty() {
         copy(s, p)?;
@@ -1038,6 +1064,10 @@ fn cut_direct_selection(s: &mut Session, roots: &[NodeId]) -> Result<Value> {
 fn clear(s: &mut Session, p: &Value) -> Result<Value> {
     let guides = switch_or(p, "guides", false, "edit.clear")?;
     let explicit = if p.get("ids").is_some() { Some(checked_ids_param(s, p, "ids", "edit.clear")?) } else { None };
+    // An object of a symbol instance's art can't be removed from the instance alone.
+    if explicit.is_none() && s.doc()?.selection.symbol_part.is_some() {
+        return Err(super::brushsym::part_only());
+    }
     // Direct-selected anchors or segments: remove those, and any objects selected whole with them.
     if explicit.is_none() && (!s.doc()?.selection.anchors.is_empty() || !s.doc()?.selection.segments.is_empty()) {
         return super::path::delete_anchors(s, p);
@@ -1269,10 +1299,11 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
             for (k, n) in clip.nodes.iter().enumerate() {
                 let mut c = d.reid(n);
                 imported.apply(&mut c);
+                let sc = vectorcraft_doc::Scaling { patterns: mode == PasteMode::Drag, ..Default::default() };
                 if xf != Affine::IDENTITY {
                     // A cross-document drag carries the graphic's appearance with it,
                     // including the pattern phase, independently of transform-tool settings.
-                    c.transform(xf, vectorcraft_doc::Scaling { patterns: mode == PasteMode::Drag, ..Default::default() });
+                    c.transform(xf, sc);
                 }
                 let layer = match clip.source_layers.get(k) {
                     Some(Some(name)) if remember => Some(*layers.entry(name).or_insert_with(|| layer_named(d, name))),
@@ -1308,6 +1339,9 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
                                 if let NodeKind::Path { live, .. } = &mut child_node.kind {
                                     *live = None;
                                 }
+                                if child_node.extras().pixel_aligned {
+                                    child_node.extras_mut().pixel_aligned = false;
+                                }
                                 let insert_idx = if idx == usize::MAX { usize::MAX } else { idx.saturating_add(offset) };
                                 new_ids.push(d.insert(par, insert_idx, child_node)?);
                             }
@@ -1320,6 +1354,10 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
                             if let NodeKind::Path { live, .. } = &mut c.kind {
                                 *live = None;
                             }
+                            // A path inside a compound path snaps with the compound path, whose property it takes.
+                            if c.extras().pixel_aligned {
+                                c.extras_mut().pixel_aligned = false;
+                            }
                             new_ids.push(d.insert(par, idx, c)?);
                         }
                         _ => {
@@ -1328,14 +1366,19 @@ fn paste_clip(s: &mut Session, p: &Value, mode: PasteMode, clip: &Clipboard, cho
                             let offset = *placed.entry(outer_par).or_default();
                             *placed.entry(outer_par).or_default() += 1;
                             let insert_idx = if beside_idx == usize::MAX { usize::MAX } else { beside_idx.saturating_add(offset) };
+                            super::object::keep_pixel_aligned(&mut c, sc);
                             new_ids.push(d.insert(outer_par, insert_idx, c)?);
                         }
                     }
                 } else {
+                    super::object::keep_pixel_aligned(&mut c, sc);
                     new_ids.push(d.insert(par, idx, c)?);
                 }
             }
         }
+        for id in &new_ids {
+            super::object::keep_compound_aligned(d, *id, vectorcraft_doc::Scaling::default());
+        }
         sel.set(new_ids.iter().copied());
         // Copied ruler guides (#3226): on the layer new art goes to, moved as the objects are (a
         // paste of guides alone keeps them where they were, but onto another artboard or every
@@ -1407,7 +1450,10 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
 /// Duplicate `roots` directly above each original, transform the copies, select them
 /// ([`copy_above`]).
 pub(crate) fn duplicate_in(d: &mut Document, sel: &mut vectorcraft_doc::Selection, roots: &[NodeId], xf: Affine) -> Result<Vec<NodeId>> {
-    let out = copy_above(d, roots, |_, _, c| c.transform(xf, true))?;
+    let out = copy_above(d, roots, |_, _, c| {
+        c.transform(xf, true);
+        super::object::keep_pixel_aligned(c, true.into());
+    })?;
     sel.set(out.iter().copied());
     Ok(out)
 }
diff --git a/crates/engine/src/cmd/effectcmd.rs b/crates/engine/src/cmd/effectcmd.rs
index 21f43e0ee..c7bee5400 100644
--- a/crates/engine/src/cmd/effectcmd.rs
+++ b/crates/engine/src/cmd/effectcmd.rs
@@ -18,6 +18,22 @@ use super::expand::has_seeded;
 use super::rasterfx;
 use super::{CommandSpec, EngineError, NodeId, Result, Session, always, bad, cmd, fileio, has_doc, str_param, switch_or};
 
+/// The name of the `svg.filter` effect drawing `xml`: its `<filter>` id. An effect names the
+/// document's filter of that name, so `xml` that differs from the document's filter of the same
+/// name is refused.
+fn svg_filter_name(s: &Session, xml: &str, cmd: &str) -> Result<String> {
+    let name = effects::svg_filter::check(xml).map_err(|e| bad(cmd, e))?;
+    if let Some(held) = s.doc()?.doc.svg_filters.iter().find(|f| f.name == name)
+        && held.xml != xml.trim()
+    {
+        return Err(bad(
+            cmd,
+            format!("the document has another SVG filter named {name:?}: use svgFilter.apply, or svgFilter.define with `replace` to edit it"),
+        ));
+    }
+    Ok(name)
+}
+
 /// The effect commands of the Effect menu and the Appearance panel.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
@@ -35,7 +51,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Effects",
             [],
             None,
-            "{ids?|id?: object ids (default: the selection), target?: \"object\"|\"contents\"} → {catalog: [{id, label, menu, params, defaults, raster, lengths: {always, absolute (while relative is false)} (distance params Scale Strokes & Effects scales)}] (installed effect plug-ins last: id plugin.<plug-in id>, menu Effect › Plug-ins), applied: [{id, effects, items: [{index, kind: fill|stroke, effects}]}], activeItem} for the selection",
+            "{ids?|id?: object ids (default: the selection), target?: \"object\"|\"contents\"} → {catalog: [{id, label, menu, params, defaults, raster, lengths: {always, absolute (while relative is false)} (distance params Scale Strokes & Effects scales)}] (installed effect plug-ins last: id plugin.<plug-in id>, menu Effect › Plug-ins), applied: [{id, effects, items: [{index, kind: fill|stroke, effects}]}] (an effect has skipped: true while Safe Mode skips it: a plug-in effect, which the object keeps and draws without), activeItem} for the selection",
             always,
             list
         ),
@@ -71,7 +87,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Expand Appearance",
             ["Object"],
             None,
-            "{ids?|id?: [..], target?} turn each object's appearance into objects: every fill and stroke becomes an object of its own (a stroke stays a stroke, with its weight, dashes, arrowheads and width profile, on its own copy of the path, which object.expand or object.path.outlineStroke outline; brushed strokes become their brush art) grouped in paint order under the object's id and transparency, geometry effects are baked, raster effects become an embedded image (shadows and outer glows below the art; blur, feather and inner glow replace it; an object whose only raster effect is its own Rasterize becomes the image object.rasterize makes with the effect's options), type with effects or fills of its own is outlined; Crop Marks become a group of the object and its marks; Vector Halftone (addon.color.halftone) becomes a group of its dot paths, one per ink; a group's or layer's own fills and strokes become objects among its members, which are expanded too. An outlined frame of threaded text leaves its thread with the text it shows, and a frame kept as type in a group stays in its thread. A dimension whose art it changes, or one selected with the art it measures when that art is replaced, becomes a plain group of its art. Hidden fills, strokes and effects are dropped. Enabled when a selected or targeted object's appearance isn't basic (`ids` then pick which objects) → {ids, warning? (an image in the art couldn't be decoded, as object.rasterize says)}",
+            "{ids?|id?: [..], target?} turn each object's appearance into objects: every fill and stroke becomes an object of its own (a stroke stays a stroke, with its weight, dashes, arrowheads and width profile, on its own copy of the path, which object.expand or object.path.outlineStroke outline; brushed strokes become their brush art) grouped in paint order under the object's id and transparency, geometry effects are baked, raster effects become an embedded image (shadows and outer glows below the art; blur, feather and inner glow replace it; an object whose only raster effect is its own Rasterize becomes the image object.rasterize makes with the effect's options), type with effects or fills of its own is outlined; Crop Marks become a group of the object and its marks; Vector Halftone (addon.color.halftone) becomes a group of its dot paths, one per ink; a group's or layer's own fills and strokes become objects among its members, which are expanded too. An outlined frame of threaded text leaves its thread with the text it shows, and a frame kept as type in a group stays in its thread. A dimension whose art it changes, or one selected with the art it measures when that art is replaced, becomes a plain group of its art. Hidden fills, strokes and effects are dropped. In Safe Mode, an object with a visible plug-in effect (in it, or in a symbol it places) is an error and nothing changes. Enabled when a selected or targeted object's appearance isn't basic (`ids` then pick which objects) → {ids, warning? (an image in the art couldn't be decoded, as object.rasterize says)}",
             can_expand,
             expand_appearance
         ),
@@ -245,6 +261,11 @@ pub(crate) fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     if texture_load_effect(id) {
         load_texture(&mut params, C)?;
     }
+    // An SVG filter needs its <filter> element, and is named by its id.
+    if id == effects::SVG_FILTER {
+        let xml = params.get("xml").and_then(Value::as_str).ok_or_else(|| bad(C, "give `xml`, one SVG <filter> element"))?;
+        params["name"] = json!(svg_filter_name(s, xml, C)?);
+    }
     let effect = effects::new_effect(id, &params).ok_or_else(|| bad(C, format!("unknown effect `{id}`")))?;
     let label = effects::effect_info(id).map(|e| e.label.trim_end_matches('…').to_string()).unwrap_or_default();
     aligned(p, C)?;
@@ -307,7 +328,22 @@ fn list(s: &mut Session, p: &Value) -> Result<Value> {
         .collect();
     let mut applied = vec![];
     if s.active().is_some() {
-        let fx = |e: &[Effect]| serde_json::to_value(e).unwrap_or(Value::Null);
+        // A plug-in effect Safe Mode skips says so (`skipped`): the object keeps it.
+        let fx = |e: &[Effect]| {
+            Value::Array(
+                e.iter()
+                    .map(|e| {
+                        let mut v = serde_json::to_value(e).unwrap_or(Value::Null);
+                        if vectorcraft_plugins::effect::skipped(&e.id)
+                            && let Some(o) = v.as_object_mut()
+                        {
+                            o.insert("skipped".into(), json!(true));
+                        }
+                        v
+                    })
+                    .collect(),
+            )
+        };
         for id in appearance_targets(s, p)? {
             if let Some(n) = s.doc()?.doc.node(id) {
                 let items: Vec<Value> = n
@@ -521,6 +557,12 @@ fn set_params(s: &mut Session, p: &Value) -> Result<Value> {
             return Ok(json!({ "ids": [] }));
         }
     }
+    // An SVG filter is named by its id: another filter renames the effect.
+    if edited.iter().any(|e| e == effects::SVG_FILTER)
+        && let Some(xml) = params.get("xml").and_then(Value::as_str)
+    {
+        params["name"] = json!(svg_filter_name(s, xml, C)?);
+    }
     for &(id, target, index) in &targets {
         let n = s.doc()?.doc.node(id).ok_or(EngineError::NoNode(id))?;
         let effect = n.appearance.effects_at(target).and_then(|fx| fx.get(index));
@@ -879,8 +921,40 @@ fn expanded_node(d: &mut Document, mut n: Node, brushes: &[vectorcraft_brush::Br
     changed.then_some(n)
 }
 
+/// Does `n`, an object in it, or the art of a symbol placed in it hold a plug-in effect that
+/// expanding it draws: a visible one, the object's own or a visible fill's or stroke's, on an
+/// object that expands ([`expandable`]; in a symbol's art, `in_art`, every object does). A symbol's
+/// art counts where an instance of it expands. `seen` holds the symbols already looked into.
+fn holds_plugin_effect(d: &Document, n: &Node, in_art: bool, seen: &mut std::collections::HashSet<String>) -> bool {
+    let plugin = |e: &Effect| e.visible && vectorcraft_plugins::effect::plugin_id(&e.id).is_some();
+    let mut symbols = vec![];
+    let mut holds = false;
+    n.walk(&mut |c| {
+        if !in_art && !expandable(c) {
+            return;
+        }
+        holds |= c.appearance.effects.iter().any(plugin) || c.appearance.items.iter().any(|i| i.visible() && i.effects().iter().any(plugin));
+        if let NodeKind::SymbolInstance { symbol, .. } = &c.kind {
+            symbols.push(symbol.clone());
+        }
+    });
+    holds
+        || symbols.into_iter().any(|name| {
+            seen.insert(name.clone()) && d.symbols.iter().find(|s| s.name == name).is_some_and(|s| holds_plugin_effect(d, &s.art, true, seen))
+        })
+}
+
 fn expand_appearance(s: &mut Session, p: &Value) -> Result<Value> {
     let roots = appearance_targets(s, p)?;
+    // In Safe Mode a plug-in effect draws nothing: expanding it would drop the effect and keep the
+    // geometry it hasn't changed.
+    if vectorcraft_plugins::safe_mode::active() {
+        let d = &s.doc()?.doc;
+        let mut seen = std::collections::HashSet::new();
+        if roots.iter().filter_map(|id| d.node(*id)).any(|n| holds_plugin_effect(d, n, false, &mut seen)) {
+            return Err(EngineError::Other("Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode".into()));
+        }
+    }
     let failed = vectorcraft_render::decode_failures();
     let colorized_ok = super::paint::check_colorized(&s.doc()?.doc).is_ok();
     let ids = s.edit("Expand Appearance", |d, _| {
diff --git a/crates/engine/src/cmd/expand.rs b/crates/engine/src/cmd/expand.rs
index d67b89a97..de056e4ec 100644
--- a/crates/engine/src/cmd/expand.rs
+++ b/crates/engine/src/cmd/expand.rs
@@ -407,8 +407,9 @@ fn expand_fills(d: &mut Document, l: &Node, to: GradientTo) -> Option<Node> {
     let mut expanded = false;
     for item in &l.appearance.items {
         // Items that paint nothing go; a gradient that can't be expanded stays.
-        let art = gradient_fill(item).and_then(|(f, g)| {
-            let (fl, path, bounds) = fill_shape(l, item, &path, bounds)?;
+        let art = gradient_fill(item).and_then(|_| {
+            let (fl, path, bounds, moved) = fill_shape(l, item, &path, bounds)?;
+            let (f, g) = gradient_fill(&moved)?;
             gradient_art(d, &fl, &path, bounds, f, g, to)
         });
         let Some(art) = art else {
@@ -470,29 +471,39 @@ fn gradient_art(d: &mut Document, l: &Node, path: &PathData, bounds: Rect, f: &F
 /// path (a plain path then), and every geometry effect of its own removed. `None` when it has no
 /// visible geometry effect.
 fn reshaped(l: &Node) -> Option<Node> {
-    use vectorcraft_render::effects::{GeomContext, apply_geometry_with, has_geometry, is_geometry};
+    use vectorcraft_render::effects::{GeomContext, apply_geometry_carrying, has_geometry, is_geometry};
     if !has_geometry(&l.appearance.effects) {
         return None;
     }
     let (path, _) = node_path(l)?;
-    let g = apply_geometry_with(&l.appearance.effects, &path, path.bounds()?, &GeomContext::of(l));
+    let (g, carry) = apply_geometry_carrying(&l.appearance.effects, &path, path.bounds()?, &GeomContext::of(l));
     let mut m = with_path(l, g);
+    // Its gradients move with the outline, as the canvas paints them.
+    if carry.moves(&m.appearance) {
+        carry.apply(&mut m.appearance);
+    }
     m.appearance.effects.retain(|e| !is_geometry(&e.id));
     Some(m)
 }
 
 /// Path `l` (outline `path`, box `bounds`) as its fill `item` paints it on the canvas, with its
-/// outline and box: when the fill has visible geometry effects, `l` with the outline they make of
-/// `path` as a plain path, and that outline's box.
-fn fill_shape(l: &Node, item: &AppearanceItem, path: &PathData, bounds: Rect) -> Option<(Node, PathData, Rect)> {
-    use vectorcraft_render::effects::{GeomContext, apply_geometry_with, has_geometry};
+/// outline, box and fill: when the fill has visible geometry effects, `l` with the outline they
+/// make of `path` as a plain path, that outline's box, and the fill with its gradient moved along
+/// with the outline.
+fn fill_shape(l: &Node, item: &AppearanceItem, path: &PathData, bounds: Rect) -> Option<(Node, PathData, Rect, AppearanceItem)> {
+    use vectorcraft_render::effects::{GeomContext, apply_geometry_carrying, has_geometry};
     if !has_geometry(item.effects()) {
-        return Some((l.clone(), path.clone(), bounds));
+        return Some((l.clone(), path.clone(), bounds, item.clone()));
     }
     // In the fill's context, as drawing runs them: a plug-in effect is told which fill it is on.
-    let outline = apply_geometry_with(item.effects(), path, bounds, &GeomContext::of(l).item(item));
+    let (outline, carry) = apply_geometry_carrying(item.effects(), path, bounds, &GeomContext::of(l).item(item));
     let b = outline.bounds()?;
-    Some((with_path(l, outline.clone()), outline, b))
+    let mut one = Appearance { items: vec![item.clone()], ..Default::default() };
+    if carry.moves(&one) {
+        carry.apply(&mut one);
+    }
+    let moved = one.items.pop().unwrap_or_else(|| item.clone());
+    Some((with_path(l, outline.clone()), outline, b, moved))
 }
 
 /// Path or compound path `l` with `path` as its path, a plain path.
@@ -809,7 +820,7 @@ fn expand_patterns_where(d: &mut Document, l: &Node, which: impl Fn(&Document, &
         later -= usize::from(fill.is_some());
         let room = if later > 0 { left.saturating_sub(l.count() + 1) } else { left };
         let tiles = fill.filter(|_| !full).and_then(|(f, def, xf)| {
-            let (fl, _, bounds) = fill_shape(l, item, &path, bounds)?;
+            let (fl, _, bounds, _) = fill_shape(l, item, &path, bounds)?;
             let Some(t) = pattern_tiles(d, &def, xf, bounds, room) else {
                 full = true;
                 return None;
diff --git a/crates/engine/src/cmd/fileio.rs b/crates/engine/src/cmd/fileio.rs
index 3f881b8e4..c453fecd7 100644
--- a/crates/engine/src/cmd/fileio.rs
+++ b/crates/engine/src/cmd/fileio.rs
@@ -17,6 +17,7 @@
 //! - `eps`: EPS export options (flattened transparency, previews, the embedded document), `document.exportEps`.
 //! - `dxfimport`: the DXF options `document.open` and Place read, `document.dxfInfo`.
 //! - `metafile`: EMF and WMF export, open and place.
+//! - `mesh3d`: 3D assets as OBJ, glTF, USDA and USDZ mesh files (`assets.export3D`).
 //!
 //! [`FORMATS`] is the single list of formats (append-only); open dialogs use [`open_filters`],
 //! agents query `document.formats`.
@@ -32,6 +33,7 @@ mod export;
 pub(crate) mod imagemap;
 mod legacy_ai;
 mod load;
+mod mesh3d;
 pub(crate) use load::{MAX_RASTER_ALLOC, size_note};
 mod heifread;
 mod jp2read;
@@ -74,6 +76,8 @@ pub use load::{
     read_for_open, texture_image,
 };
 pub use load::{losses_summary, overwrite_losses};
+pub use mesh3d::{DEFAULT_FORMAT_3D, FORMATS_3D, format_3d_label};
+pub(crate) use mesh3d::{mesh_file_names, mesh_files};
 pub use naming::{NameParts as FileNameParts, parse_date as parse_file_date, render as render_file_name};
 pub(crate) use native::preview_png;
 pub use native::with_compression_pref;
diff --git a/crates/engine/src/cmd/fileio/dxf.rs b/crates/engine/src/cmd/fileio/dxf.rs
index 4320cbb9c..32b87d80d 100644
--- a/crates/engine/src/cmd/fileio/dxf.rs
+++ b/crates/engine/src/cmd/fileio/dxf.rs
@@ -6,7 +6,7 @@ use std::sync::Arc;
 
 use serde::Deserialize;
 use serde_json::{Value, json};
-use vectorcraft_cad::{ColorDepth, DxfOptions, DxfVersion, Preserve, RasterFormat};
+use vectorcraft_cad::{ColorDepth, DxfOptions, DxfPreset, DxfVersion, Preserve, RasterFormat};
 use vectorcraft_doc::{Document, Unit};
 use vectorcraft_geom::Rect;
 
@@ -21,7 +21,7 @@ pub fn specs() -> Vec<CommandSpec> {
         "Export DXF",
         [],
         None,
-        "{path?, version?: R12|R13|R14|2000|2004|2007|2010|2013|2018 (default), unit?: mm (default; any unit name: pt, in, cm…), scale?: 1 (drawing units per unit), scaleLineweights?: false, colors?: 8|16|256|true (default; true colour needs 2004+, else 256), rasterFormat?: png (default)|jpeg (placed images, written next to the file), preserve?: appearance (default: type as outlines; strokes a CAD line can't draw as filled outlines; brush art)|editability (type as text; every stroke a line with its lineweight and dashes), alterPaths?: false (strokes a CAD line can't draw as their filled outlines, with editability too; also strokes wider than 2.11 mm, and every stroke in R13 and R14), outlineText?: false, selectedOnly?: false (the selected objects, in their layers), artboard?: 0 (the origin is its bottom-left corner), useArtboards?: true (one drawing per chosen artboard, artboards?/range?, holding the art over it: {stem}-{artboard}.dxf) | false (the origin at the art's bounds)} → {path, bytes, warnings, files?, linked?: [image files]}; no path → {dataBase64, …, linked?: [{name, dataBase64}]}. Layers become DXF layers (hidden: off; locked; non-printing: not plotted); paths become polylines and splines, fills their outlines (which laser and cutter software reads) and solid hatches. Same as document.export {format: dxf}",
+        "{path?, dxfPreset?: custom (default)|cnc (CNC / CAM: version 2000, the oldest version that has both lightweight polylines and lineweights; unit mm, scale 1; colors 256, all 2000 holds; preserve editability and alterPaths false, so strokes stay center lines; outlineText true, so type is paths; rasterFormat png; the options given override it), version?: R12|R13|R14|2000|2004|2007|2010|2013|2018 (default), unit?: mm (default; any unit name: pt, in, cm…), scale?: 1 (drawing units per unit), scaleLineweights?: false, colors?: 8|16|256|true (default; true colour needs 2004+, else 256), rasterFormat?: png (default)|jpeg (placed images, written next to the file), preserve?: appearance (default: type as outlines; strokes a CAD line can't draw as filled outlines; brush art)|editability (type as text; every stroke a line with its lineweight and dashes), alterPaths?: false (strokes a CAD line can't draw as their filled outlines, with editability too; also strokes wider than 2.11 mm, and every stroke in R13 and R14), outlineText?: false, selectedOnly?: false (the selected objects, in their layers), artboard?: 0 (the origin is its bottom-left corner), useArtboards?: true (one drawing per chosen artboard, artboards?/range?, holding the art over it: {stem}-{artboard}.dxf) | false (the origin at the art's bounds)} → {path, bytes, warnings, files?, linked?: [image files]}; no path → {dataBase64, …, linked?: [{name, dataBase64}]}. Layers become DXF layers (hidden: off; locked; non-printing: not plotted); paths become polylines and splines, fills their outlines (which laser and cutter software reads) and solid hatches. Same as document.export {format: dxf}",
         has_doc,
         export_dxf
     )]
@@ -33,6 +33,12 @@ pub(super) const OPTIONS: &[FormatOption] = &[
     super::ARTBOARDS,
     super::RANGE,
     super::USE_ARTBOARDS,
+    FormatOption {
+        name: "dxfPreset",
+        ty: "string",
+        default: "\"custom\"",
+        description: "custom, or cnc (CNC / CAM: version 2000, mm, 256 colors, editability, type as outlines, PNG images); the options given override it",
+    },
     FormatOption { name: "version", ty: "string", default: "\"2018\"", description: "R12, R13, R14, 2000, 2004, 2007, 2010, 2013 or 2018" },
     FormatOption {
         name: "unit",
@@ -120,6 +126,7 @@ impl Unsupported {
 struct Params {
     #[serde(flatten)]
     boards: ArtboardPick,
+    dxf_preset: Option<String>,
     version: Option<Value>,
     unit: Option<String>,
     scale: Option<f64>,
@@ -150,7 +157,8 @@ fn choice<T>(field: &str, v: Option<String>, read: impl Fn(&str) -> Option<T>, d
 /// The DXF options in `p` (the region and crop are set per drawing) and the artboard choice.
 fn parse(p: &Value) -> Result<(DxfOptions, ArtboardPick)> {
     let q: Params = if p.is_object() { Params::deserialize(p).map_err(|e| bad(C, format!("DXF options: {e}")))? } else { Params::default() };
-    let d = DxfOptions::default();
+    // The options a preset sets are the defaults of those `p` leaves out.
+    let d = choice("dxfPreset", q.dxf_preset, DxfPreset::from_id, DxfPreset::Custom, "custom or cnc")?.options();
     let scale = q.scale.unwrap_or(d.scale);
     if !(scale.is_finite() && vectorcraft_cad::SCALE_RANGE.contains(&scale)) {
         return Err(bad(C, format!("DXF scale must be a positive number up to {}, not {scale}", vectorcraft_cad::SCALE_RANGE.end())));
@@ -181,6 +189,11 @@ pub fn check(p: &Value) -> std::result::Result<(), String> {
     parse(p).map(|_| ()).map_err(|e| e.to_string())
 }
 
+/// The DXF options in `p` (the region and crop left at their defaults).
+pub fn options(p: &Value) -> std::result::Result<DxfOptions, String> {
+    parse(p).map(|(o, _)| o).map_err(|e| e.to_string())
+}
+
 /// Encode `doc` as DXF: one drawing whose origin is the chosen artboard's bottom-left corner
 /// (default the first), or with `use_artboards` one drawing per chosen artboard (default all)
 /// holding the art over it.
diff --git a/crates/engine/src/cmd/fileio/export.rs b/crates/engine/src/cmd/fileio/export.rs
index 13564614b..0869ad850 100644
--- a/crates/engine/src/cmd/fileio/export.rs
+++ b/crates/engine/src/cmd/fileio/export.rs
@@ -214,10 +214,11 @@ fn selection(s: &mut Session, cmd: &str) -> Result<(Document, vectorcraft_geom::
 }
 
 /// The selected objects (their top-most selected ancestors) that are artwork: those on template
-/// layers are guides and are left out.
+/// layers are guides and are left out. With an object of a dynamic symbol instance's art selected,
+/// the instance is exported whole.
 pub(crate) fn selected_artwork(s: &Session) -> Result<Vec<NodeId>> {
-    let ids = edit::selected_roots(s)?;
     let st = s.doc()?;
+    let ids = edit::roots_of(&st.doc, st.selection.in_paint_order(&st.doc));
     let is_template = |id| st.doc.node(id).is_some_and(|l| matches!(l.kind, NodeKind::Layer { template: true, .. }));
     // On a template layer or sublayer, at any depth.
     let on_template = |id| st.doc.ancestry(id).is_some_and(|a| a.into_iter().any(is_template));
diff --git a/crates/engine/src/cmd/fileio/load.rs b/crates/engine/src/cmd/fileio/load.rs
index 03bfde85b..7ff22689c 100644
--- a/crates/engine/src/cmd/fileio/load.rs
+++ b/crates/engine/src/cmd/fileio/load.rs
@@ -29,6 +29,8 @@ pub struct Loaded {
     /// A PDF, or a `.ai` or `.ait` that holds a PDF, read through the editor's own copy of its art
     /// that it carries (its layers), not from its PDF part alone.
     pub editing_data: bool,
+    /// Whether the native source declared a PDF; other formats carry no native save preference.
+    pub native_pdf_compatible: Option<bool>,
 }
 
 impl Loaded {
@@ -341,6 +343,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
     let mut converted = false;
     let mut preview_only = false;
     let mut editing_data = false;
+    let mut native_pdf_compatible = None;
     let (mut doc, mut warnings, restored) = match format.id {
         // EPS, .ps and PostScript .ai: the document our EPS files carry, else the PostScript read.
         _ if matches!(format.id, "eps" | "ps") || vectorcraft_pdf::is_postscript(bytes) => {
@@ -353,6 +356,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
         }
         "vectorcraft" | "template" => {
             let (d, info, warnings) = native_file(bytes)?;
+            native_pdf_compatible = Some(info.pdf_compatible);
             converted = info.is_old() || super::extension(name) == vectorcraft_format::LEGACY_EXTENSION;
             (d, warnings, false)
         }
@@ -500,7 +504,7 @@ pub fn load_with(name: &str, bytes: &[u8], opts: &LoadOptions) -> Result<Loaded>
         doc.title = title;
     }
     warnings.extend(doc.images.values().filter_map(|b| size_note(&b.bytes)));
-    Ok(Loaded { doc, format, warnings, restored, converted, preview_only, editing_data })
+    Ok(Loaded { doc, format, warnings, restored, converted, preview_only, editing_data, native_pdf_compatible })
 }
 
 /// Import SVG text, reading the files its images link to (relative links from `folder`, the SVG's
@@ -593,7 +597,7 @@ pub fn open_template(s: &mut Session, name: &str, bytes: &[u8], path: Option<&st
 /// Make a loaded file the new active document; `links` is what became of its linked files, and
 /// `opts` are the options it was read with.
 fn open_loaded(s: &mut Session, loaded: Loaded, links: Resolved, path: Option<String>, opts: &LoadOptions, as_template: bool) -> Result<Value> {
-    let Loaded { mut doc, format, warnings, restored, converted, .. } = loaded.with_grid_prefs(&s.prefs);
+    let Loaded { mut doc, format, warnings, restored, converted, native_pdf_compatible, .. } = loaded.with_grid_prefs(&s.prefs);
     // EPS now has an ordinary Save path. Its preview, partial-program and damaged-editing
     // fallbacks must ask before overwriting the richer source they could not fully read.
     let losses: Vec<String> = warnings
@@ -630,6 +634,9 @@ fn open_loaded(s: &mut Session, loaded: Loaded, links: Resolved, path: Option<St
     let converted = saves_back && converted && s.prefs.append_converted;
     let index = s.add_document(doc, path);
     let st = s.doc_mut()?;
+    if let Some(pdf) = native_pdf_compatible {
+        st.save_options.insert("pdfCompatible".into(), json!(pdf));
+    }
     if saves_back {
         st.format = format.id;
         // An SVG that reopened as the full document saves as one again: Save keeps Preserve
diff --git a/crates/engine/src/cmd/fileio/mesh3d.rs b/crates/engine/src/cmd/fileio/mesh3d.rs
new file mode 100644
index 000000000..50a919d83
--- /dev/null
+++ b/crates/engine/src/cmd/fileio/mesh3d.rs
@@ -0,0 +1,260 @@
+//! 3D objects as mesh files, for a 3D asset of Window › Asset Export (`assets.export3D`): OBJ with
+//! its MTL materials, glTF 2.0 (one `.gltf` file, its buffer embedded as a data URI), USDA and
+//! USDZ (the USDA layer in an uncompressed ZIP, its data on a 64-byte boundary).
+//!
+//! Each solid of the object ([`vectorcraft_render::effects::three_d_meshes`]) is its own mesh, with a
+//! material in the color it is painted (solids of one color share it). Positions are y up and
+//! about the point the object turns about: in points in OBJ and USD (whose layer says how many
+//! meters a unit is), in meters in glTF, as its specification asks. glTF and USD colors are linear,
+//! as their specifications ask; MTL colors are the display colors. Materials are two-sided, since
+//! an open solid or a turned plane is seen from both sides.
+//!
+//! Formats: glTF 2.0 <https://registry.khronos.org/glTF/specs/2.0/glTF-2.0.html>, USD
+//! <https://openusd.org/release/index.html> (USDZ: <https://openusd.org/release/spec_usdz.html>).
+
+use std::fmt::Write as _;
+
+use serde_json::{Value, json};
+use vectorcraft_render::effects::SolidMesh;
+
+/// The formats a 3D asset exports to, as `assets.set3DFormat` names them: USDA first, the default.
+pub const FORMATS_3D: [&str; 4] = ["usda", "usdz", "gltf", "obj"];
+/// The format a new 3D asset exports to.
+pub const DEFAULT_FORMAT_3D: &str = "usda";
+/// The meters in a point (1/72 inch).
+const METERS_PER_POINT: f64 = 0.0254 / 72.0;
+
+/// The label of `format` for menus: `USDA`, `USDZ`, `glTF`, `OBJ`.
+pub fn format_3d_label(format: &str) -> &'static str {
+    match format {
+        "usdz" => "USDZ",
+        "gltf" => "glTF",
+        "obj" => "OBJ",
+        _ => "USDA",
+    }
+}
+
+/// `stem` as an OBJ file name: whitespace and `#` become `_`, so the `mtllib` line names the MTL
+/// file as one word.
+fn obj_stem(stem: &str) -> String {
+    stem.chars().map(|c| if c.is_whitespace() || c == '#' { '_' } else { c }).collect()
+}
+
+/// The names of the files [`mesh_files`] writes for `stem` in `format`.
+pub(crate) fn mesh_file_names(stem: &str, format: &str) -> Result<Vec<String>, String> {
+    match format {
+        "obj" => {
+            let stem = obj_stem(stem);
+            Ok(vec![format!("{stem}.obj"), format!("{stem}.mtl")])
+        }
+        "gltf" | "usda" | "usdz" => Ok(vec![format!("{stem}.{format}")]),
+        _ => {
+            let key = "format";
+            Err(format!("`{key}` must be one of {}", FORMATS_3D.join(", ")))
+        }
+    }
+}
+
+/// The files of a 3D object named `stem` in `format` ([`FORMATS_3D`]): `(file name, bytes)`, the
+/// OBJ with its MTL after it.
+pub(crate) fn mesh_files(stem: &str, format: &str, parts: &[SolidMesh]) -> Result<Vec<(String, Vec<u8>)>, String> {
+    let names = mesh_file_names(stem, format)?;
+    let bytes = match format {
+        "obj" => {
+            let (obj, mtl) = obj(&obj_stem(stem), parts);
+            vec![obj.into_bytes(), mtl.into_bytes()]
+        }
+        "gltf" => vec![gltf(stem, parts).into_bytes()],
+        "usda" => vec![usda(stem, parts).into_bytes()],
+        _ => vec![super::zip::store_aligned(&[(format!("{stem}.usda"), usda(stem, parts).into_bytes())], 64)?],
+    };
+    Ok(names.into_iter().zip(bytes).collect())
+}
+
+/// The distinct colors of `parts` in order, and each part's index among them.
+fn materials(parts: &[SolidMesh]) -> (Vec<[f32; 4]>, Vec<usize>) {
+    let mut colors: Vec<[f32; 4]> = vec![];
+    let index = parts
+        .iter()
+        .map(|p| {
+            colors.iter().position(|c| *c == p.color).unwrap_or_else(|| {
+                colors.push(p.color);
+                colors.len() - 1
+            })
+        })
+        .collect();
+    (colors, index)
+}
+
+/// An sRGB channel (0..1) as linear light.
+fn linear(c: f32) -> f32 {
+    if c <= 0.04045 { c / 12.92 } else { ((c + 0.055) / 1.055).powf(2.4) }
+}
+
+/// A number as text: the shortest decimal that reads back as the same value.
+fn num(v: f64) -> String {
+    format!("{v}")
+}
+
+fn obj(stem: &str, parts: &[SolidMesh]) -> (String, String) {
+    let (colors, material) = materials(parts);
+    let mut o = String::new();
+    let _ = writeln!(o, "mtllib {stem}.mtl");
+    let _ = writeln!(o, "o {stem}");
+    for p in parts {
+        for v in &p.mesh.positions {
+            let _ = writeln!(o, "v {} {} {}", num(v[0]), num(v[1]), num(v[2]));
+        }
+    }
+    for p in parts {
+        for n in &p.mesh.normals {
+            let _ = writeln!(o, "vn {} {} {}", num(n[0]), num(n[1]), num(n[2]));
+        }
+    }
+    let mut base = 1usize;
+    for (k, p) in parts.iter().enumerate() {
+        let _ = writeln!(o, "g Solid_{}", k + 1);
+        let _ = writeln!(o, "usemtl Material_{}", material.get(k).copied().unwrap_or(0) + 1);
+        for t in &p.mesh.triangles {
+            let [a, b, c] = t.map(|i| i as usize + base);
+            let _ = writeln!(o, "f {a}//{a} {b}//{b} {c}//{c}");
+        }
+        base += p.mesh.positions.len();
+    }
+    let mut m = String::new();
+    for (k, c) in colors.iter().enumerate() {
+        let _ = writeln!(m, "newmtl Material_{}", k + 1);
+        let _ = writeln!(m, "Kd {} {} {}", num(f64::from(c[0])), num(f64::from(c[1])), num(f64::from(c[2])));
+        let _ = writeln!(m, "d {}", num(f64::from(c[3])));
+        let _ = writeln!(m, "illum 1");
+    }
+    (o, m)
+}
+
+fn gltf(stem: &str, parts: &[SolidMesh]) -> String {
+    let (colors, material) = materials(parts);
+    let mut buffer: Vec<u8> = vec![];
+    let (mut views, mut accessors, mut primitives) = (vec![], vec![], vec![]);
+    let mut view = |buffer: &mut Vec<u8>, bytes: Vec<u8>, target: u32| -> usize {
+        views.push(json!({ "buffer": 0, "byteOffset": buffer.len(), "byteLength": bytes.len(), "target": target }));
+        buffer.extend(bytes);
+        views.len() - 1
+    };
+    for (k, p) in parts.iter().enumerate() {
+        let floats = |v: &[[f64; 3]], scale: f64| v.iter().flatten().flat_map(|x| ((x * scale) as f32).to_le_bytes()).collect::<Vec<u8>>();
+        let (lo, hi) = p.mesh.bounds().unwrap_or_default();
+        let positions = view(&mut buffer, floats(&p.mesh.positions, METERS_PER_POINT), 34962);
+        let normals = view(&mut buffer, floats(&p.mesh.normals, 1.0), 34962);
+        let indices = view(&mut buffer, p.mesh.triangles.iter().flatten().flat_map(|i| i.to_le_bytes()).collect(), 34963);
+        let count = p.mesh.positions.len();
+        let at = accessors.len();
+        accessors.push(json!({
+            "bufferView": positions, "componentType": 5126, "count": count, "type": "VEC3",
+            "min": lo.map(|v| (v * METERS_PER_POINT) as f32), "max": hi.map(|v| (v * METERS_PER_POINT) as f32),
+        }));
+        accessors.push(json!({ "bufferView": normals, "componentType": 5126, "count": count, "type": "VEC3" }));
+        accessors.push(json!({ "bufferView": indices, "componentType": 5125, "count": p.mesh.triangles.len() * 3, "type": "SCALAR" }));
+        primitives.push(json!({
+            "attributes": { "POSITION": at, "NORMAL": at + 1 },
+            "indices": at + 2,
+            "material": material.get(k).copied().unwrap_or(0),
+        }));
+    }
+    let materials: Vec<Value> = colors
+        .iter()
+        .enumerate()
+        .map(|(k, c)| {
+            let mut m = json!({
+                "name": format!("Material_{}", k + 1),
+                "pbrMetallicRoughness": {
+                    "baseColorFactor": [linear(c[0]), linear(c[1]), linear(c[2]), c[3]],
+                    "metallicFactor": 0.0,
+                    "roughnessFactor": 1.0,
+                },
+                "doubleSided": true,
+            });
+            if c[3] < 1.0 {
+                m["alphaMode"] = json!("BLEND");
+            }
+            m
+        })
+        .collect();
+    let doc = json!({
+        "asset": { "version": "2.0", "generator": "VectorCraft" },
+        "scene": 0,
+        "scenes": [{ "nodes": [0] }],
+        "nodes": [{ "name": stem, "mesh": 0 }],
+        "meshes": [{ "name": stem, "primitives": primitives }],
+        "materials": materials,
+        "buffers": [{
+            "byteLength": buffer.len(),
+            "uri": format!("data:application/octet-stream;base64,{}", vectorcraft_format::base64_encode(&buffer)),
+        }],
+        "bufferViews": views,
+        "accessors": accessors,
+    });
+    serde_json::to_string_pretty(&doc).unwrap_or_default()
+}
+
+/// `name` as a USD prim name: letters, digits and `_`, not starting with a digit.
+fn prim_name(name: &str) -> String {
+    let mut out: String = name.chars().map(|c| if c.is_ascii_alphanumeric() { c } else { '_' }).collect();
+    if out.is_empty() || out.starts_with(|c: char| c.is_ascii_digit()) {
+        out.insert(0, '_');
+    }
+    out
+}
+
+fn usda(stem: &str, parts: &[SolidMesh]) -> String {
+    let (colors, material) = materials(parts);
+    let root = prim_name(stem);
+    let triple = |v: [f64; 3]| format!("({}, {}, {})", num(v[0]), num(v[1]), num(v[2]));
+    let list = |items: Vec<String>| items.join(", ");
+    let mut u = String::new();
+    let _ = writeln!(u, "#usda 1.0");
+    let _ = writeln!(u, "(\n    defaultPrim = \"{root}\"\n    metersPerUnit = {}\n    upAxis = \"Y\"\n)\n", METERS_PER_POINT);
+    let _ = writeln!(u, "def Xform \"{root}\"\n{{");
+    for (k, p) in parts.iter().enumerate() {
+        let (lo, hi) = p.mesh.bounds().unwrap_or_default();
+        let m = material.get(k).copied().unwrap_or(0) + 1;
+        let _ = writeln!(u, "    def Mesh \"Solid_{}\" (\n        prepend apiSchemas = [\"MaterialBindingAPI\"]\n    )\n    {{", k + 1);
+        let _ = writeln!(u, "        uniform bool doubleSided = 1");
+        let _ = writeln!(u, "        float3[] extent = [{}, {}]", triple(lo), triple(hi));
+        let _ = writeln!(u, "        int[] faceVertexCounts = [{}]", list(vec!["3".to_string(); p.mesh.triangles.len()]));
+        let _ = writeln!(u, "        int[] faceVertexIndices = [{}]", list(p.mesh.triangles.iter().flatten().map(u32::to_string).collect()));
+        let _ = writeln!(u, "        rel material:binding = </{root}/Materials/Material_{m}>");
+        let _ = writeln!(
+            u,
+            "        normal3f[] normals = [{}] (\n            interpolation = \"vertex\"\n        )",
+            list(p.mesh.normals.iter().map(|n| triple(*n)).collect())
+        );
+        let _ = writeln!(u, "        point3f[] points = [{}]", list(p.mesh.positions.iter().map(|v| triple(*v)).collect()));
+        let c = p.color;
+        let _ = writeln!(
+            u,
+            "        color3f[] primvars:displayColor = [({}, {}, {})] (\n            interpolation = \"constant\"\n        )",
+            linear(c[0]),
+            linear(c[1]),
+            linear(c[2])
+        );
+        let _ = writeln!(u, "        float[] primvars:displayOpacity = [{}] (\n            interpolation = \"constant\"\n        )", c[3]);
+        let _ = writeln!(u, "        uniform token subdivisionScheme = \"none\"\n    }}\n");
+    }
+    let _ = writeln!(u, "    def Scope \"Materials\"\n    {{");
+    for (k, c) in colors.iter().enumerate() {
+        let m = k + 1;
+        let _ = writeln!(u, "        def Material \"Material_{m}\"\n        {{");
+        let _ = writeln!(u, "            token outputs:surface.connect = </{root}/Materials/Material_{m}/Surface.outputs:surface>\n");
+        let _ = writeln!(u, "            def Shader \"Surface\"\n            {{");
+        let _ = writeln!(u, "                uniform token info:id = \"UsdPreviewSurface\"");
+        let _ = writeln!(u, "                color3f inputs:diffuseColor = ({}, {}, {})", linear(c[0]), linear(c[1]), linear(c[2]));
+        let _ = writeln!(u, "                float inputs:opacity = {}", c[3]);
+        let _ = writeln!(u, "                float inputs:roughness = 1");
+        let _ = writeln!(u, "                token outputs:surface\n            }}\n        }}");
+    }
+    let _ = writeln!(u, "    }}\n}}");
+    u
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/engine/src/cmd/fileio/mesh3d/tests.rs b/crates/engine/src/cmd/fileio/mesh3d/tests.rs
new file mode 100644
index 000000000..7c467fafa
--- /dev/null
+++ b/crates/engine/src/cmd/fileio/mesh3d/tests.rs
@@ -0,0 +1,130 @@
+use serde_json::Value;
+use vectorcraft_render::effects::{Mesh, SolidMesh};
+
+use super::*;
+
+/// A 10 × 10 square facing the viewer: two triangles, each with corners of its own.
+fn square(color: [f32; 4]) -> SolidMesh {
+    let [a, b, c, d] = [[-5.0, -5.0, 0.0], [5.0, -5.0, 0.0], [5.0, 5.0, 0.0], [-5.0, 5.0, 0.0]];
+    let mesh = Mesh { positions: vec![a, b, c, a, c, d], normals: vec![[0.0, 0.0, 1.0]; 6], triangles: vec![[0, 1, 2], [3, 4, 5]] };
+    SolidMesh { mesh, color }
+}
+
+const RED: [f32; 4] = [1.0, 0.0, 0.0, 1.0];
+const BLUE: [f32; 4] = [0.0, 0.0, 1.0, 0.5];
+
+fn text(files: &[(String, Vec<u8>)], name: &str) -> String {
+    let (_, bytes) = files.iter().find(|(n, _)| n == name).unwrap_or_else(|| panic!("no {name}"));
+    String::from_utf8(bytes.clone()).unwrap()
+}
+
+#[test]
+fn obj_numbers_corners_across_solids_and_names_its_materials() {
+    let files = mesh_files("Box", "obj", &[square(RED), square(BLUE), square(RED)]).unwrap();
+    assert_eq!(files.iter().map(|(n, _)| n.as_str()).collect::<Vec<_>>(), ["Box.obj", "Box.mtl"]);
+    let obj = text(&files, "Box.obj");
+    assert!(obj.starts_with("mtllib Box.mtl\no Box\n"));
+    assert_eq!(obj.lines().filter(|l| l.starts_with("v ")).count(), 18);
+    assert_eq!(obj.lines().filter(|l| l.starts_with("vn ")).count(), 18);
+    // The third solid's last triangle uses corners 13 to 18; red solids share Material_1.
+    assert_eq!(obj.lines().rfind(|l| l.starts_with("f ")), Some("f 16//16 17//17 18//18"));
+    assert_eq!(obj.lines().filter(|l| l.starts_with("usemtl ")).collect::<Vec<_>>(), ["usemtl Material_1", "usemtl Material_2", "usemtl Material_1"]);
+    let mtl = text(&files, "Box.mtl");
+    assert_eq!(mtl.matches("newmtl").count(), 2);
+    assert!(mtl.contains("newmtl Material_2\nKd 0 0 1\nd 0.5\n"), "{mtl}");
+}
+
+#[test]
+fn gltf_holds_its_buffer_and_every_accessor_fits_it() {
+    let files = mesh_files("Box", "gltf", &[square(RED), square(BLUE)]).unwrap();
+    let g: Value = serde_json::from_str(&text(&files, "Box.gltf")).unwrap();
+    assert_eq!(g["asset"]["version"], "2.0");
+    let uri = g["buffers"][0]["uri"].as_str().unwrap();
+    let data = vectorcraft_format::base64_decode(uri.strip_prefix("data:application/octet-stream;base64,").unwrap()).unwrap();
+    assert_eq!(g["buffers"][0]["byteLength"].as_u64(), Some(data.len() as u64));
+    for v in g["bufferViews"].as_array().unwrap() {
+        assert!(v["byteOffset"].as_u64().unwrap() + v["byteLength"].as_u64().unwrap() <= data.len() as u64);
+        assert_eq!(v["byteOffset"].as_u64().unwrap() % 4, 0);
+    }
+    let prims = g["meshes"][0]["primitives"].as_array().unwrap();
+    assert_eq!(prims.len(), 2);
+    assert_eq!((prims[0]["material"].as_u64(), prims[1]["material"].as_u64()), (Some(0), Some(1)));
+    // Positions are meters: the 10 pt square is 10/72 inch across.
+    let pos = &g["accessors"][prims[0]["attributes"]["POSITION"].as_u64().unwrap() as usize];
+    let width = pos["max"][0].as_f64().unwrap() - pos["min"][0].as_f64().unwrap();
+    assert!((width - 10.0 * 0.0254 / 72.0).abs() < 1e-7, "{width}");
+    let index = &g["accessors"][prims[0]["indices"].as_u64().unwrap() as usize];
+    assert_eq!((index["componentType"].as_u64(), index["count"].as_u64()), (Some(5125), Some(6)));
+    // Translucent paint blends; colors are linear.
+    assert_eq!(g["materials"][1]["alphaMode"], "BLEND");
+    assert!(g["materials"][0].get("alphaMode").is_none());
+    assert_eq!(g["materials"][0]["doubleSided"], true);
+}
+
+#[test]
+fn usda_is_y_up_in_points_with_a_material_for_each_color() {
+    let files = mesh_files("My Box", "usda", &[square(RED), square([0.5, 0.5, 0.5, 1.0])]).unwrap();
+    let u = text(&files, "My Box.usda");
+    assert!(u.starts_with("#usda 1.0\n"));
+    assert!(u.contains("defaultPrim = \"My_Box\"") && u.contains("upAxis = \"Y\"") && u.contains("def Xform \"My_Box\""), "{u}");
+    assert!(u.contains(&format!("metersPerUnit = {}", 0.0254 / 72.0)));
+    assert_eq!(u.matches("def Mesh").count(), 2);
+    assert_eq!(u.matches("def Material").count(), 2);
+    assert!(u.contains("int[] faceVertexCounts = [3, 3]"));
+    assert!(u.contains("rel material:binding = </My_Box/Materials/Material_2>"));
+    // sRGB 0.5 is about 0.214 linear.
+    assert!(u.contains("color3f inputs:diffuseColor = (0.21404"), "{u}");
+    assert_eq!(u.matches('{').count(), u.matches('}').count());
+}
+
+#[test]
+fn usdz_stores_the_layer_uncompressed_on_a_64_byte_boundary() {
+    let files = mesh_files("Box", "usdz", &[square(RED)]).unwrap();
+    let (name, zip) = &files[0];
+    assert_eq!(name, "Box.usdz");
+    // The local header: 30 bytes, the name, then the extra field.
+    let u16_at = |at: usize| u16::from_le_bytes([zip[at], zip[at + 1]]) as usize;
+    assert_eq!(&zip[..4], &[0x50, 0x4b, 0x03, 0x04]);
+    assert_eq!(u16_at(8), 0, "stored, not deflated");
+    let start = 30 + u16_at(26) + u16_at(28);
+    assert_eq!(start % 64, 0);
+    let layer = mesh_files("Box", "usda", &[square(RED)]).unwrap().remove(0).1;
+    assert_eq!(&zip[start..start + layer.len()], layer.as_slice());
+    let archive = super::super::zip::Archive::open(zip, 8).unwrap();
+    assert_eq!(archive.read("Box.usda", usize::MAX).unwrap(), Some(layer));
+}
+
+#[test]
+fn an_obj_names_its_mtl_file_without_spaces_or_comment_marks() {
+    let files = mesh_files("Box #1", "obj", &[square(RED)]).unwrap();
+    assert_eq!(files.iter().map(|(n, _)| n.as_str()).collect::<Vec<_>>(), ["Box__1.obj", "Box__1.mtl"]);
+    assert!(text(&files, "Box__1.obj").starts_with("mtllib Box__1.mtl\n"));
+    assert_eq!(mesh_file_names("Box #1", "obj").unwrap(), ["Box__1.obj", "Box__1.mtl"]);
+    assert_eq!(mesh_file_names("Box #1", "usda").unwrap(), ["Box #1.usda"]);
+}
+
+#[test]
+fn obj_and_usda_keep_coordinates_a_32_bit_float_would_merge() {
+    let mut part = square(RED);
+    part.mesh.positions[0] = [20_000_000.0, 0.0, 0.0];
+    part.mesh.positions[1] = [20_000_001.0, 0.0, 0.0];
+    let obj = text(&mesh_files("Box", "obj", std::slice::from_ref(&part)).unwrap(), "Box.obj");
+    assert!(obj.contains("v 20000000 0 0\nv 20000001 0 0\n"), "{obj}");
+    let usda = text(&mesh_files("Box", "usda", &[part]).unwrap(), "Box.usda");
+    assert!(usda.contains("(20000001, 0, 0)"));
+}
+
+#[test]
+fn an_unknown_format_is_refused() {
+    assert!(mesh_files("Box", "fbx", &[square(RED)]).is_err());
+    assert!(mesh_file_names("Box", "").is_err());
+    assert_eq!(mesh_file_names("Box", "obj").unwrap(), ["Box.obj", "Box.mtl"]);
+}
+
+#[test]
+fn prim_names_are_usd_identifiers() {
+    assert_eq!(prim_name("Logo 2"), "Logo_2");
+    assert_eq!(prim_name("3D"), "_3D");
+    assert_eq!(prim_name(""), "_");
+    assert_eq!(prim_name("é/x"), "__x");
+}
diff --git a/crates/engine/src/cmd/fileio/native.rs b/crates/engine/src/cmd/fileio/native.rs
index 74cfced2b..4e2e9a85f 100644
--- a/crates/engine/src/cmd/fileio/native.rs
+++ b/crates/engine/src/cmd/fileio/native.rs
@@ -48,7 +48,7 @@ pub const OPTIONS: &[FormatOption] = &[
     FormatOption {
         name: "pdfCompatible",
         ty: "boolean",
-        default: "false",
+        default: "true",
         description: "also carry a PDF of every artboard, for apps that read PDF (a larger file)",
     },
 ];
@@ -146,7 +146,7 @@ struct NativeOptions {
     precision: Option<Value>,
     include_linked: bool,
     embed_profiles: Option<bool>,
-    pdf_compatible: bool,
+    pdf_compatible: Option<bool>,
 }
 
 /// What [`save_options`] leaves to [`encode`] (rendering and encoding take time).
@@ -171,7 +171,9 @@ pub(super) fn save_options(cmd: &str, f: &Format, doc: &Document, p: &Value) ->
         so.profiles = embedded_profiles(doc);
     }
     so.check().map_err(|e| bad(cmd, e.to_string()))?;
-    Ok((so, Extras { preview: o.preview, pdf: o.pdf_compatible }))
+    let pdf = o.pdf_compatible.unwrap_or(true);
+    so.pdf_compatible = Some(pdf);
+    Ok((so, Extras { preview: o.preview, pdf }))
 }
 
 /// The `precision` option `v`: a whole number of decimal places, 0 to
@@ -213,9 +215,11 @@ pub(super) fn encode_to(cmd: &str, f: &Format, doc: &Document, p: &Value, w: imp
     if extras.preview {
         so.preview = preview_png(&drawn)?;
     }
-    if extras.pdf {
-        // Every artboard as PDF pages (no editing data: the file is the native document).
-        so.pdf = Some(super::pdf::encode(cmd, &drawn, &json!({ "range": "all", "preserveEditing": false }))?.0);
+    if extras.pdf && !drawn.artboards.is_empty() {
+        // Every artboard as PDF pages (no editing data: the file is the native document), dated by
+        // the document's File Info, so the same document and dates give the same bytes.
+        let at = drawn.metadata.modified.or(drawn.metadata.created);
+        so.pdf = Some(super::pdf::encode_at(cmd, &drawn, &json!({ "range": "all", "preserveEditing": false }), at)?.0);
     }
     drop(drawn);
     let native = match full {
diff --git a/crates/engine/src/cmd/fileio/pdf.rs b/crates/engine/src/cmd/fileio/pdf.rs
index 785764db9..52e7489dd 100644
--- a/crates/engine/src/cmd/fileio/pdf.rs
+++ b/crates/engine/src/cmd/fileio/pdf.rs
@@ -240,9 +240,13 @@ pub fn expand_preset<'a>(s: &Session, cmd: &str, p: &'a Value) -> Result<Cow<'a,
 /// time of writing. On the web, which has no clock, the creation date is the modification date too,
 /// and a document without one gets neither.
 pub fn options(cmd: &str, doc: &Document, p: &Value) -> Result<PdfOptions> {
+    options_at(cmd, doc, p, vectorcraft_doc::metadata::output_time())
+}
+
+/// [`options`] modified at `now` (Unix seconds) instead of the time of writing.
+fn options_at(cmd: &str, doc: &Document, p: &Value, now: Option<i64>) -> Result<PdfOptions> {
     let pick = if p.is_object() { ArtboardPick::deserialize(p).map_err(|e| bad(cmd, format!("PDF options: {e}")))? } else { ArtboardPick::default() };
     let artboards = pick.resolve(doc.artboards.len()).map_err(|e| bad(cmd, e))?;
-    let now = vectorcraft_doc::metadata::output_time();
     Ok(PdfOptions {
         settings: settings(cmd, p)?,
         artboards,
@@ -265,9 +269,14 @@ pub const BLEED_LEFT_OUT: &str = "the document sets a bleed that this PDF/X file
 /// to images at the document's raster effects resolution. Preserve Editing embeds `doc` itself
 /// when the PDF has every artboard (a PDF of some reopens as just those).
 pub fn encode(cmd: &str, doc: &Document, p: &Value) -> Result<(Vec<u8>, Vec<String>)> {
+    encode_at(cmd, doc, p, None)
+}
+
+/// [`encode`] modified at `modified` (Unix seconds) when given, instead of the time of writing.
+pub(super) fn encode_at(cmd: &str, doc: &Document, p: &Value, modified: Option<i64>) -> Result<(Vec<u8>, Vec<String>)> {
     // Keep the editable object tree independent of preview fallbacks used by the drawn pages.
     let (full, mut warnings) = crate::cmd::place::document::full_documents(doc);
-    let (bytes, drawn_warnings) = encode_carrying(cmd, &full, p, || Ok(vectorcraft_format::save(doc, false)), || Ok(None))?;
+    let (bytes, drawn_warnings) = encode_carrying_at(cmd, &full, p, modified, || Ok(vectorcraft_format::save(doc, false)), || Ok(None))?;
     warnings.extend(drawn_warnings);
     warnings.extend(overflow_warning(cmd, &full, p)?);
     Ok((bytes, warnings))
@@ -294,7 +303,20 @@ pub(super) fn encode_carrying(
     native: impl FnOnce() -> Result<Vec<u8>>,
     private: impl FnOnce() -> Result<Option<(vectorcraft_pdf::PrivateData, Vec<String>)>>,
 ) -> Result<(Vec<u8>, Vec<String>)> {
-    let mut opts = options(cmd, doc, p)?;
+    encode_carrying_at(cmd, doc, p, None, native, private)
+}
+
+/// [`encode_carrying`] modified at `modified` (Unix seconds) when given, instead of the time of
+/// writing.
+fn encode_carrying_at(
+    cmd: &str,
+    doc: &Document,
+    p: &Value,
+    modified: Option<i64>,
+    native: impl FnOnce() -> Result<Vec<u8>>,
+    private: impl FnOnce() -> Result<Option<(vectorcraft_pdf::PrivateData, Vec<String>)>>,
+) -> Result<(Vec<u8>, Vec<String>)> {
+    let mut opts = options_at(cmd, doc, p, modified.or_else(vectorcraft_doc::metadata::output_time))?;
     // The pages' background colors, behind the art (the editing data keeps them as colors).
     let pages = opts.artboards.clone().unwrap_or_else(|| (0..doc.artboards.len()).collect());
     let filled = super::export::with_artboard_fills(doc, p, pages).map_err(|e| bad(cmd, e))?;
diff --git a/crates/engine/src/cmd/fileio/save.rs b/crates/engine/src/cmd/fileio/save.rs
index 0eefa45c0..893b783bf 100644
--- a/crates/engine/src/cmd/fileio/save.rs
+++ b/crates/engine/src/cmd/fileio/save.rs
@@ -270,7 +270,18 @@ pub fn save_plan(s: &Session, mode: SaveMode, p: &Value) -> Result<SavePlan> {
         }
     }
     // None given: the ones the document was last saved with in this format.
-    let options = if given.is_empty() && format.id == st.format { remembered_save_options(st) } else { given };
+    let mut options = if given.is_empty() && format.id == st.format { remembered_save_options(st) } else { given };
+    // Remember the effective choice, including the encoder's default, so another document's
+    // later save cannot change what this one writes. Invalid non-null values still reach validation.
+    if matches!(format.id, "vectorcraft" | "template") {
+        let pdf = match options.get("pdfCompatible") {
+            None | Some(Value::Null) => Some(native_pdf_preference(s, Some(st)).unwrap_or(true)),
+            _ => None,
+        };
+        if let Some(pdf) = pdf {
+            options.insert("pdfCompatible".into(), json!(pdf));
+        }
+    }
     // Save writes the document's own file; the other modes only where they are told to.
     let path =
         path.or_else(|| (mode == SaveMode::Save && !st.converted && !st.recovered && format.id == st.format).then(|| st.path.clone()).flatten());
@@ -336,6 +347,15 @@ fn same_value(a: &Value, b: &Value) -> bool {
     }
 }
 
+/// Native documents and templates share only their PDF choice. Other source formats use the
+/// application's last native choice, keeping an AI file's separate PDF option out of it.
+fn native_pdf_preference(s: &Session, st: Option<&DocState>) -> Option<bool> {
+    st.filter(|d| matches!(d.format, "vectorcraft" | "template"))
+        .and_then(|d| d.save_options.get("pdfCompatible"))
+        .and_then(Value::as_bool)
+        .or_else(|| s.prefs.native_save_options.get("pdfCompatible").and_then(Value::as_bool))
+}
+
 /// The options `st` was last saved with, their artboards (`artboard`, `artboards` and `range`)
 /// following the artboards they named ([`DocState::save_artboards`]): an artboard deleted since is
 /// left out, and one that moved is named by its new number. When none of the artboards the save
@@ -1028,12 +1048,15 @@ fn can_revert(s: &Session) -> std::result::Result<(), String> {
 fn revert(s: &mut Session, _: &Value) -> Result<Value> {
     let index = s.active_index().ok_or(crate::EngineError::NoDocument)?;
     let path = s.doc()?.path.clone().ok_or_else(|| bad("file.revert", "the document has never been saved"))?;
-    let Loaded { mut doc, .. } = load(&path, &read_file(&path)?)?.with_grid_prefs(&s.prefs);
+    let Loaded { mut doc, native_pdf_compatible, .. } = load(&path, &read_file(&path)?)?.with_grid_prefs(&s.prefs);
     doc.template = false;
     // Back to the saved file: its recovery copy has nothing left to recover.
     let uid = s.doc()?.uid;
     crate::cmd::recovery::forget(s, uid);
     s.replace_document(index, doc);
+    if let Some(pdf) = native_pdf_compatible {
+        s.doc_mut()?.save_options.insert("pdfCompatible".into(), json!(pdf));
+    }
     Ok(json!({ "path": path }))
 }
 
@@ -1053,11 +1076,17 @@ fn format_options(s: &mut Session, p: &Value) -> Result<Value> {
         .or_else(|| (f.id == "vectorcraft" && !s.prefs.native_save_options.is_empty()).then(|| s.prefs.native_save_options.clone()));
     // A native save compresses as Use Compression says, unless told otherwise.
     let prefs = with_compression_pref(&s.prefs, &json!({}));
+    let native_pdf = matches!(f.id, "vectorcraft" | "template").then(|| native_pdf_preference(s, st)).flatten();
     let mut v = f.to_json();
     if let Some(options) = v["options"].as_object_mut() {
         for (name, o) in options.iter_mut() {
             let default = prefs.get(name).filter(|_| matches!(f.id, "vectorcraft" | "template")).unwrap_or(&o["default"]);
             o["value"] = saved.as_ref().and_then(|m| m.get(name)).unwrap_or(default).clone();
+            if name == "pdfCompatible"
+                && let Some(pdf) = native_pdf
+            {
+                o["value"] = json!(pdf);
+            }
         }
     }
     v["saveFormats"] =
@@ -1072,7 +1101,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             "Save Document",
             [],
             None,
-            "{path?, format?: vectorcraft|template|pdf|svg|svgz|ai|eps (default: the path's extension, else the document's own format), options?: {…the format's options, see file.formatOptions; default: as last saved}, svg?: {…SVG options} (an SVG save keeps hidden layers, display:none, unless hiddenLayers is false), …the SVG and PDF options given flat instead (an option given flat or in svg and in options with different values is an error), compress?: bool (native, also in options: gzip; default: the useCompression preference; warnings say when the format doesn't read compress, version, preview or precision given flat, or a key given in options), version?: 4 (3, 2 or 1: for older VectorCraft versions; 1 and 2 are never compressed), preview?: false (embed a PNG of the first artboard, at most 256 px), precision?: 0..9 (native: round path anchors and handles to this many decimal places, a smaller file; colors, transforms and type stay exact; default: exact, and a later save without it writes exactly again), separateArtboards?: false (native and .ai: also save each artboard of `range` to <name>-<artboard>.<ext> beside the file, holding that artboard and the art touching it; the result's files lists every file written), range?: \"1-3, 5\"|\"all\" (default; with separateArtboards), includeLinked?: false (keep linked files' own pixels, not just their previews; they stay linked), embedProfiles?: true (carry the ICC profiles loaded from files that the document is tagged with; opening the file installs them where missing), pdfCompatible?: false for native (also carry a PDF of every artboard) | true for .ai (false: blank pages, only the native document; a .ai file's compress, default true, is its compression.compressText), modified?: Unix seconds|null (the File Info modified date, and created date when there is none, a save to a file stamps; default now, recorded in the journal so a replay matches; null: leave the dates)} → {path, format, bytes, warnings, files?: [path…] (the file and its artboards' files), linked?: [path…] (images an SVG links to)}. Save writes one artboard, except a .ai file: a PDF-compatible file of every artboard carrying the native document (preserveEditing always on; PDF options flat or in options), which document.open restores exactly, on the active artboard (the app's, else the one the document opened on; with editingData: false, the first); separateArtboards writes more files, one per artboard. EPS saves the chosen artboard (first by default), retaining its page margins and the whole editable document; its PostScript appearance flattens transparency, as EPS requires. Without a path it writes the document's own file in its own format: a document opened from or saved as SVG/PDF/EPS saves as that again (warnings name what the format loses). No path known (never saved, converted from an older version, restored by Data Recovery, or another format) → {dataBase64, format, name, folder?, warnings} and the document stays modified",
+            "{path?, format?: vectorcraft|template|pdf|svg|svgz|ai|eps (default: the path's extension, else the document's own format), options?: {…the format's options, see file.formatOptions; default: as last saved}, svg?: {…SVG options} (an SVG save keeps hidden layers, display:none, unless hiddenLayers is false), …the SVG and PDF options given flat instead (an option given flat or in svg and in options with different values is an error), compress?: bool (native, also in options: gzip; default: the useCompression preference; warnings say when the format doesn't read compress, version, preview or precision given flat, or a key given in options), version?: 4 (3, 2 or 1: for older VectorCraft versions; 1 and 2 are never compressed), preview?: false (embed a PNG of the first artboard, at most 256 px), precision?: 0..9 (native: round path anchors and handles to this many decimal places, a smaller file; colors, transforms and type stay exact; default: exact, and a later save without it writes exactly again), separateArtboards?: false (native and .ai: also save each artboard of `range` to <name>-<artboard>.<ext> beside the file, holding that artboard and the art touching it; the result's files lists every file written), range?: \"1-3, 5\"|\"all\" (default; with separateArtboards), includeLinked?: false (keep linked files' own pixels, not just their previews; they stay linked), embedProfiles?: true (carry the ICC profiles loaded from files that the document is tagged with; opening the file installs them where missing), pdfCompatible?: true (native: also carry a PDF of every artboard; false omits it) | true for .ai (false: blank pages, only the native document; a .ai file's compress, default true, is its compression.compressText), modified?: Unix seconds|null (the File Info modified date, and created date when there is none, a save to a file stamps; default now, recorded in the journal so a replay matches; null: leave the dates)} → {path, format, bytes, warnings, files?: [path…] (the file and its artboards' files), linked?: [path…] (images an SVG links to)}. Save writes one artboard, except a .ai file: a PDF-compatible file of every artboard carrying the native document (preserveEditing always on; PDF options flat or in options), which document.open restores exactly, on the active artboard (the app's, else the one the document opened on; with editingData: false, the first); separateArtboards writes more files, one per artboard. EPS saves the chosen artboard (first by default), retaining its page margins and the whole editable document; its PostScript appearance flattens transparency, as EPS requires. Without a path it writes the document's own file in its own format: a document opened from or saved as SVG/PDF/EPS saves as that again (warnings name what the format loses). No path known (never saved, converted from an older version, restored by Data Recovery, or another format) → {dataBase64, format, name, folder?, warnings} and the document stays modified",
             has_doc,
             |s, p| save(s, SaveMode::Save, p)
         ),
diff --git a/crates/engine/src/cmd/fileio/screens.rs b/crates/engine/src/cmd/fileio/screens.rs
index 11e878bc1..b69cfd177 100644
--- a/crates/engine/src/cmd/fileio/screens.rs
+++ b/crates/engine/src/cmd/fileio/screens.rs
@@ -1210,6 +1210,9 @@ fn items(
         let mut pieces = vec![];
         for id in ids {
             let a = doc.asset(*id).ok_or_else(|| bad(C, format!("no asset {id} (see assets.list)")))?;
+            if a.format_3d.is_some() {
+                return Err(bad(C, format!("asset {id} is a 3D asset: assets.export3D writes it")));
+            }
             let (d, r) = alone(&a.nodes, &a.name).ok_or_else(|| bad(C, format!("asset `{}` has no art to export", a.name)))?;
             pieces.push((a.name.clone(), d, Some(0), r));
         }
diff --git a/crates/engine/src/cmd/fileio/svg.rs b/crates/engine/src/cmd/fileio/svg.rs
index a11e4a4e8..56bfd0f7b 100644
--- a/crates/engine/src/cmd/fileio/svg.rs
+++ b/crates/engine/src/cmd/fileio/svg.rs
@@ -177,7 +177,7 @@ pub(super) fn encode(doc: &Document, p: &Value, compressed: bool) -> Result<Enco
         chosen.then(|| boards.iter().flatten().filter_map(|b| doc.artboards.get(*b)).map(|a| a.rect).collect());
     let overflow = crate::cmd::fonts::export_overflow_warning(doc, &doc.layers, regions.as_deref());
     // Render effects SVG cannot represent faithfully, including source-model Darkness shadows.
-    let flat = crate::cmd::rasterfx::flatten_pixel_effects(doc);
+    let flat = crate::cmd::rasterfx::flatten_pixel_effects_for(doc, opts.profile != vectorcraft_svg::Profile::Tiny12);
     let doc = flat.as_ref().unwrap_or(doc);
     let mut enc = Encoded { warnings, ..Encoded::default() };
     for artboard in boards {
diff --git a/crates/engine/src/cmd/fileio/tests.rs b/crates/engine/src/cmd/fileio/tests.rs
index fca92d73f..84513cd2c 100644
--- a/crates/engine/src/cmd/fileio/tests.rs
+++ b/crates/engine/src/cmd/fileio/tests.rs
@@ -680,7 +680,9 @@ fn a_native_save_streams_the_bytes_the_encoder_makes() {
     s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 20})).unwrap();
     for (name, compress) in [("a.vectorcraft", false), ("b.vectorcraft", true), ("c.vctemplate", true)] {
         let path = d.join(name).to_string_lossy().to_string();
-        let p = json!({"path": path, "compress": compress});
+        // A PDF-compatible file's PDF is dated to the second it is written, so the byte comparison
+        // uses files without one.
+        let p = json!({"path": path, "compress": compress, "pdfCompatible": false});
         let r = s.execute("file.saveCopy", &p).unwrap();
         let written = std::fs::read(&path).unwrap();
         assert_eq!(r["bytes"], written.len(), "{r}");
@@ -690,6 +692,17 @@ fn a_native_save_streams_the_bytes_the_encoder_makes() {
         assert_eq!(written, job.encode().unwrap().files[0].1, "{name}");
         assert_eq!(vectorcraft_format::load(&written).unwrap().template, name.ends_with("vctemplate"));
     }
+    // A save with the default options streams a file that carries its PDF.
+    let path = d.join("d.vectorcraft").to_string_lossy().to_string();
+    let p = json!({"path": path});
+    let r = s.execute("file.saveCopy", &p).unwrap();
+    let written = std::fs::read(&path).unwrap();
+    assert_eq!(r["bytes"], written.len(), "{r}");
+    assert!(vectorcraft_format::pdf_content(&written).is_some());
+    let plan = save_plan(&s, SaveMode::Copy, &p).unwrap();
+    let job = save_job(&mut s, plan).unwrap();
+    assert!(job.streams());
+    assert!(vectorcraft_format::pdf_content(&job.encode().unwrap().files[0].1).is_some());
     // A writer that fails: the save fails with its error.
     let plan = save_plan(&s, SaveMode::Copy, &json!({"path": "/x/y.vectorcraft"})).unwrap();
     let job = save_job(&mut s, plan).unwrap();
diff --git a/crates/engine/src/cmd/fileio/tests_dxf.rs b/crates/engine/src/cmd/fileio/tests_dxf.rs
index 298adeb11..849767683 100644
--- a/crates/engine/src/cmd/fileio/tests_dxf.rs
+++ b/crates/engine/src/cmd/fileio/tests_dxf.rs
@@ -63,6 +63,32 @@ fn export_writes_dxf_of_the_chosen_version() {
     assert_eq!(header(&text(&ser), "$INSUNITS").as_deref(), Some("1"));
 }
 
+#[test]
+fn the_cnc_preset_sets_the_options_that_are_not_given() {
+    let mut s = two_boards();
+    let cnc = text(&s.execute("document.exportDxf", &json!({"dxfPreset": "cnc"})).unwrap());
+    assert_eq!(header(&cnc, "$ACADVER").as_deref(), Some("AC1015"));
+    assert_eq!(header(&cnc, "$INSUNITS").as_deref(), Some("4"));
+    // document.export takes it too, beside a PDF preset's name.
+    let r = s.execute("document.export", &json!({"format": "dxf", "dxfPreset": "cnc"})).unwrap();
+    assert_eq!(header(&text(&r), "$ACADVER").as_deref(), Some("AC1015"));
+    let o = dxf::options(&json!({"dxfPreset": "CNC", "unit": "in"})).unwrap();
+    assert_eq!(
+        (o.version, o.unit, o.colors, o.preserve, o.alter_paths, o.outline_text),
+        (
+            vectorcraft_cad::DxfVersion::R2000,
+            vectorcraft_doc::Unit::Inches,
+            vectorcraft_cad::ColorDepth::Aci256,
+            vectorcraft_cad::Preserve::Editability,
+            false,
+            true
+        )
+    );
+    assert_eq!(dxf::options(&json!({})).unwrap().version, vectorcraft_cad::DxfVersion::R2018, "custom by default");
+    let e = s.execute("document.exportDxf", &json!({"dxfPreset": "laser"})).unwrap_err().to_string();
+    assert!(e.contains("custom or cnc"), "{e}");
+}
+
 #[test]
 fn use_artboards_writes_one_drawing_per_artboard() {
     let mut s = two_boards();
diff --git a/crates/engine/src/cmd/fileio/tests_svg.rs b/crates/engine/src/cmd/fileio/tests_svg.rs
index 73ee604a9..eb3989597 100644
--- a/crates/engine/src/cmd/fileio/tests_svg.rs
+++ b/crates/engine/src/cmd/fileio/tests_svg.rs
@@ -224,7 +224,11 @@ fn save_writes_svg_and_remembers_its_options() {
     let native = dir.join("doc.vectorcraft").to_string_lossy().to_string();
     s.execute("document.save", &json!({"path": native})).unwrap();
     assert!(vectorcraft_format::sniff(&std::fs::read(&native).unwrap()));
-    assert!(s.doc().unwrap().save_options.is_empty(), "a native save remembers no options");
+    assert_eq!(
+        Value::Object(s.doc().unwrap().save_options.clone()),
+        json!({"pdfCompatible":true}),
+        "a native save retains its PDF choice without SVG options"
+    );
     let _ = std::fs::remove_dir_all(dir);
 }
 
diff --git a/crates/engine/src/cmd/fileio/zip.rs b/crates/engine/src/cmd/fileio/zip.rs
index 8279b368f..047fcb56e 100644
--- a/crates/engine/src/cmd/fileio/zip.rs
+++ b/crates/engine/src/cmd/fileio/zip.rs
@@ -23,6 +23,13 @@ pub const DEFLATE_CHUNK: usize = 1 << 20;
 /// The archive of `files` (`(name, bytes)`; `/` separates folders in a name), stored without
 /// compression. Fails past the limits of a ZIP without its 64-bit extension (65534 files, 4 GB; 65535 is the ZIP64 marker).
 pub fn store<N: AsRef<str>, B: AsRef<[u8]>>(files: &[(N, B)]) -> Result<Vec<u8>, String> {
+    store_aligned(files, 1)
+}
+
+/// [`store`], with each file's data starting at a multiple of `align` bytes from the start of the
+/// archive (USDZ asks for 64): a padding block in the local header's extra field (header id
+/// 0x1986) moves it there.
+pub fn store_aligned<N: AsRef<str>, B: AsRef<[u8]>>(files: &[(N, B)], align: usize) -> Result<Vec<u8>, String> {
     let too_big = || "too much to zip: at most 65534 files and 4 GB".to_string();
     let count = u16::try_from(files.len()).ok().filter(|&c| c != u16::MAX).ok_or_else(too_big)?;
     let mut out = Vec::with_capacity(files.iter().map(|(n, b)| 76 + 2 * n.as_ref().len() + b.as_ref().len()).sum::<usize>() + 22);
@@ -47,8 +54,21 @@ pub fn store<N: AsRef<str>, B: AsRef<[u8]>>(files: &[(N, B)]) -> Result<Vec<u8>,
         out.extend_from_slice(&0x0403_4b50u32.to_le_bytes());
         out.extend_from_slice(&VERSION.to_le_bytes());
         out.extend_from_slice(&shared);
-        out.extend_from_slice(&0u16.to_le_bytes()); // extra field length
+        // The data would start after the header (30 bytes) and the name; a padding block of at
+        // least its own 4-byte header moves it to the boundary.
+        let start = out.len() + 2 + name.len();
+        let mut pad = if align > 1 { (align - start % align) % align } else { 0 };
+        if pad > 0 && pad < 4 {
+            pad += align;
+        }
+        let pad_len = u16::try_from(pad).map_err(|_| format!("cannot align zip entries to {align} bytes"))?;
+        out.extend_from_slice(&pad_len.to_le_bytes()); // extra field length
         out.extend_from_slice(name);
+        if pad > 0 {
+            out.extend_from_slice(&0x1986u16.to_le_bytes());
+            out.extend_from_slice(&(pad_len - 4).to_le_bytes());
+            out.resize(out.len() + pad - 4, 0);
+        }
         out.extend_from_slice(bytes);
         // Central directory record.
         central.extend_from_slice(&0x0201_4b50u32.to_le_bytes());
diff --git a/crates/engine/src/cmd/freeform.rs b/crates/engine/src/cmd/freeform.rs
index 21b5245ae..0f72b066a 100644
--- a/crates/engine/src/cmd/freeform.rs
+++ b/crates/engine/src/cmd/freeform.rs
@@ -92,8 +92,12 @@ impl Session {
 
     /// The freeform gradient behind the Fill (`stroke` false) or Stroke proxy, its points in
     /// document coordinates, and the length its spreads are fractions of there (see
-    /// [`Node::proxy_freeform`]).
+    /// [`Node::proxy_freeform`]). `None` while an object of a symbol instance is selected
+    /// ([`vectorcraft_doc::Selection::symbol_part`]): its points are in the symbol's coordinates.
     pub fn proxy_freeform(&self, stroke: bool) -> Option<(Freeform, f64)> {
+        if self.active()?.selection.symbol_part.is_some() {
+            return None;
+        }
         let (n, item) = self.proxy_source(stroke)?;
         n.proxy_freeform(stroke, item)
     }
diff --git a/crates/engine/src/cmd/globaledit.rs b/crates/engine/src/cmd/globaledit.rs
index 2b0e214cc..4a42f03d4 100644
--- a/crates/engine/src/cmd/globaledit.rs
+++ b/crates/engine/src/cmd/globaledit.rs
@@ -354,8 +354,10 @@ fn close(a: f64, b: f64) -> bool {
 }
 
 /// The members a Global Edit started on the one selected object would take, with `o`: that
-/// object first, then the others in paint order.
+/// object first, then the others in paint order. Refused while an object of a dynamic symbol
+/// instance's art is selected.
 fn matches(s: &Session, o: &Options) -> Result<Vec<(NodeId, Affine)>> {
+    super::edit::refuse_symbol_part(s)?;
     let st = s.doc()?;
     let d = &st.doc;
     let [id] = st.selection.objects.as_slice() else { return Err(bad(C, "select one object")) };
@@ -423,6 +425,7 @@ fn can_toggle(s: &Session) -> std::result::Result<(), String> {
     if st.global_edit.is_some() {
         return Ok(());
     }
+    super::edit::no_symbol_part(s)?;
     let [id] = st.selection.objects.as_slice() else {
         return Err(if st.selection.is_empty() { "nothing selected" } else { "select one object" }.into());
     };
@@ -765,10 +768,12 @@ pub(crate) fn propagate(before: &Document, d: &mut Document, ge: &GlobalEdit, se
         let mut placed = model.clone();
         placed.transform(*xf * back, Scaling::default());
         give(was, &model, placed, &mut n, d);
+        super::object::keep_pixel_aligned(&mut n, Scaling::default());
         if let Some(slot) = d.node_mut(*id) {
             *slot = n;
             edited.push(*id);
         }
+        super::object::keep_compound_aligned(d, *id, Scaling::default());
     }
     edited
 }
diff --git a/crates/engine/src/cmd/gradient.rs b/crates/engine/src/cmd/gradient.rs
index 47989a29c..c73a23d6c 100644
--- a/crates/engine/src/cmd/gradient.rs
+++ b/crates/engine/src/cmd/gradient.rs
@@ -41,7 +41,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Select Gradient Stop",
             [],
             None,
-            "{index: stop index (0 = the start) | null to clear} select a stop of the gradient behind the active proxy (the first selected object's, else the default paint): the stop the Gradient tool's annotator, the Gradient and Color panels and Delete/arrow keys act on → {index}",
+            "{index: stop index (0 = the start) | null to clear} select a stop of the gradient behind the active proxy (the first selected object's, else the default paint): the stop the Gradient tool's annotator, the Gradient and Color panels and Delete/arrow keys act on; refused while an object of a symbol instance's art is selected → {index}",
             always,
             select_stop
         ),
@@ -59,6 +59,10 @@ pub(crate) fn active_gradient(s: &Session) -> Option<GradientPaint> {
 
 fn select_stop(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "gradient.selectStop";
+    // No document is needed for the default paint's gradient, so this does not use `refuse_symbol_part`.
+    if s.active().is_some_and(|st| st.selection.symbol_part.is_some()) {
+        return Err(super::brushsym::part_only());
+    }
     let index = match p.get("index") {
         None => return Err(bad(C, "missing `index` (a stop index, or null to clear)")),
         Some(Value::Null) => None,
diff --git a/crates/engine/src/cmd/graph/edit.rs b/crates/engine/src/cmd/graph/edit.rs
index 1ea621c63..c33be78d5 100644
--- a/crates/engine/src/cmd/graph/edit.rs
+++ b/crates/engine/src/cmd/graph/edit.rs
@@ -58,12 +58,16 @@ pub(super) fn create(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 /// The graph `id` names (or the graph containing it), else the selected graph (or the graph
-/// containing the selection).
+/// containing the selection). Refused while an object of a dynamic symbol instance's art is
+/// selected.
 pub(super) fn target(s: &Session, p: &Value, cmd: &str) -> Result<NodeId> {
     let st = s.doc()?;
     let start = match named_id(p)? {
         Some(id) => vec![id],
-        None => st.selection.objects.clone(),
+        None => {
+            crate::cmd::edit::refuse_symbol_part(s)?;
+            st.selection.objects.clone()
+        }
     };
     for id in start {
         let mut cur = Some(id);
diff --git a/crates/engine/src/cmd/graph/tests.rs b/crates/engine/src/cmd/graph/tests.rs
index 8b059c111..5825c5fc0 100644
--- a/crates/engine/src/cmd/graph/tests.rs
+++ b/crates/engine/src/cmd/graph/tests.rs
@@ -1316,6 +1316,195 @@ fn a_paint_on_a_design_copy_or_the_other_kind_of_row_is_not_kept() {
     assert_eq!(spec(&s, id), kept);
 }
 
+/// A graphic style `name` made from a new rectangle with a blue fill at 50% opacity, and without a stroke row unless
+/// `stroke`: the rectangle and the blue paint.
+fn blue_style(s: &mut Session, name: &str, stroke: bool) -> (NodeId, Paint) {
+    let r = NodeId(s.execute("shape.rectangle", &json!({"x": 600, "y": 600, "width": 10, "height": 10})).unwrap()["id"].as_u64().unwrap());
+    s.execute("appearance.setItem", &json!({"ids": [r.0], "index": top_row(s, r, true), "color": "#0000ff", "opacity": 50})).unwrap();
+    if !stroke {
+        s.execute("appearance.removeItem", &json!({"ids": [r.0], "index": top_row(s, r, false)})).unwrap();
+    }
+    s.execute("graphicStyle.new", &json!({"id": r.0, "name": name})).unwrap();
+    let blue = s.doc().unwrap().doc.node(r).unwrap().appearance.fill_paint();
+    (r, blue)
+}
+
+/// Series 0's marks with a red 2 pt stroke stored from `marks[1]` and a 40% fill opacity stored from `marks[2]`.
+fn stored_red_stroke() -> (Session, NodeId, Vec<NodeId>) {
+    let (mut s, id, _, marks) = column_marks();
+    let stroke = top_row(&s, marks[1], false);
+    s.execute("appearance.setItem", &json!({"ids": [marks[1].0], "index": stroke, "color": "#ff0000", "weight": 2})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[2].0], "index": top_row(&s, marks[2], true), "opacity": 40})).unwrap();
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.stroke_width, kept.fill_opacity), (Some(2.0), Some(0.4)));
+    (s, id, marks)
+}
+
+/// After the graph is drawn again, every mark of series 0 has `fill` at `opacity` and `stroke` at `weight`; two undos (the
+/// data edit, then the command) bring back the paints the graph stored in `was`.
+fn series_0_is(s: &mut Session, id: NodeId, (fill, opacity, stroke, weight): (&Paint, f32, &Paint, f64), was: &[vectorcraft_doc::SeriesPaint]) {
+    s.execute("graph.setData", &json!({"id": id.0, "rows": [[1, 2], [3, 4]]})).unwrap();
+    let n = s.doc().unwrap().doc.node(id).unwrap().clone();
+    for m in series(&n, 0).children().unwrap() {
+        let f = m.appearance.fill().unwrap();
+        assert_eq!((&f.paint, f.opacity), (fill, opacity));
+        assert_eq!((&m.appearance.stroke_paint(), m.appearance.stroke_width()), (stroke, weight));
+    }
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(spec(s, id).series_paints, was);
+}
+
+/// A graphic style applied to a series mark is stored on the graph, its fill opacity included. A style without a stroke,
+/// applied to a mark that shows one, leaves the series without a stroke.
+#[test]
+fn a_graphic_style_applied_to_a_series_mark_is_kept() {
+    let (mut s, id, marks) = stored_red_stroke();
+    let (_, blue) = blue_style(&mut s, "Blue", false);
+    let was = spec(&s, id).series_paints;
+    s.execute("graphicStyle.apply", &json!({"name": "Blue", "ids": [marks[1].0]})).unwrap();
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.fill, kept.fill_opacity, kept.stroke), (Some(blue.clone()), Some(0.5), Some(Paint::None)));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(spec(&s, id).series_paints, was, "one undo takes back the style and what the graph stored");
+    s.execute("edit.redo", &json!({})).unwrap();
+    series_0_is(&mut s, id, (&blue, 0.5, &Paint::None, 0.0), &was);
+}
+
+/// A graphic style added on top of a series mark's appearance (Alt-click) stores the kinds of row the style shows: a style
+/// with only a fill leaves the stroke the series stores.
+#[test]
+fn a_graphic_style_added_to_a_series_mark_keeps_only_its_own_kinds() {
+    let (mut s, id, marks) = stored_red_stroke();
+    let stroke = top_row(&s, marks[0], false);
+    let red = spec(&s, id).series_paints[0].stroke.clone().unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[0].0], "index": stroke, "color": "#00ff00", "weight": 3})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[1].0], "index": stroke, "color": "#ff0000", "weight": 2})).unwrap();
+    let (_, blue) = blue_style(&mut s, "Blue", false);
+    let was = spec(&s, id).series_paints;
+    s.execute("graphicStyle.apply", &json!({"name": "Blue", "ids": [marks[0].0], "add": true})).unwrap();
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.fill, kept.fill_opacity), (Some(blue.clone()), Some(0.5)));
+    assert_eq!((kept.stroke.clone(), kept.stroke_width), (Some(red.clone()), Some(2.0)));
+    series_0_is(&mut s, id, (&blue, 0.5, &red, 2.0), &was);
+}
+
+/// A graphic style whose stroke row is hidden, added on top of a series mark (Alt-click), stores its fill and leaves the
+/// stroke the series stores, although the mark shows a stroke of its own.
+#[test]
+fn a_graphic_style_with_a_hidden_stroke_added_to_a_series_mark_keeps_the_stored_stroke() {
+    let (mut s, id, marks) = stored_red_stroke();
+    let stroke = top_row(&s, marks[0], false);
+    let red = spec(&s, id).series_paints[0].stroke.clone().unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[0].0], "index": stroke, "color": "#00ff00", "weight": 3})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[1].0], "index": stroke, "color": "#ff0000", "weight": 2})).unwrap();
+    let (rect, blue) = blue_style(&mut s, "Blue", true);
+    s.execute("appearance.setItem", &json!({"ids": [rect.0], "index": top_row(&s, rect, false), "visible": false})).unwrap();
+    s.execute("graphicStyle.new", &json!({"id": rect.0, "name": "Hidden stroke"})).unwrap();
+    let was = spec(&s, id).series_paints;
+    s.execute("graphicStyle.apply", &json!({"name": "Hidden stroke", "ids": [marks[0].0], "add": true})).unwrap();
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.fill, kept.fill_opacity), (Some(blue.clone()), Some(0.5)));
+    assert_eq!((kept.stroke.clone(), kept.stroke_width), (Some(red.clone()), Some(2.0)));
+    series_0_is(&mut s, id, (&blue, 0.5, &red, 2.0), &was);
+}
+
+/// Redefine Graphic Style restyles the series marks still linked to the style, and the graph stores the new look.
+#[test]
+fn redefining_a_graphic_style_updates_a_linked_series_mark() {
+    let (mut s, id, _, marks) = column_marks();
+    let (rect, _) = blue_style(&mut s, "Blue", true);
+    s.execute("graphicStyle.apply", &json!({"name": "Blue", "ids": [marks[0].0]})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [rect.0], "index": top_row(&s, rect, true), "color": "#00ff00", "opacity": 100})).unwrap();
+    let green = s.doc().unwrap().doc.node(rect).unwrap().appearance.fill_paint();
+    let was = spec(&s, id).series_paints;
+    s.execute("graphicStyle.redefine", &json!({"name": "Blue", "id": rect.0})).unwrap();
+    assert_eq!(s.doc().unwrap().doc.node(marks[0]).unwrap().appearance.fill_paint(), green, "the mark follows the style");
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.fill, kept.fill_opacity), (Some(green.clone()), None));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(spec(&s, id).series_paints, was, "one undo takes back the redefinition and what the graph stored");
+    s.execute("edit.redo", &json!({})).unwrap();
+    let (stroke, weight) = {
+        let r = s.doc().unwrap().doc.node(rect).unwrap().clone();
+        (r.appearance.stroke_paint(), r.appearance.stroke_width())
+    };
+    series_0_is(&mut s, id, (&green, 1.0, &stroke, weight), &was);
+}
+
+/// Redefine Graphic Style made from a series mark does not edit that mark, so the graph keeps the paint another mark of the
+/// series stored after it: the graph drawn again shows the same marks with or without the redefinition, and undo brings
+/// back the stored paint.
+#[test]
+fn redefining_a_graphic_style_from_a_series_mark_keeps_the_paint_another_mark_stored() {
+    let (mut s, id, _, marks) = column_marks();
+    blue_style(&mut s, "Blue", true);
+    s.execute("graphicStyle.apply", &json!({"name": "Blue", "ids": [marks[1].0]})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[1].0], "index": top_row(&s, marks[1], true), "color": "#00ff00"})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[0].0], "index": top_row(&s, marks[0], true), "color": "#ff0000"})).unwrap();
+    let red = s.doc().unwrap().doc.node(marks[0]).unwrap().appearance.fill_paint();
+    let was = spec(&s, id).series_paints;
+    assert_eq!(was[0].fill, Some(red.clone()));
+    s.execute("graph.setData", &json!({"id": id.0, "rows": [[1, 2], [3, 4]]})).unwrap();
+    let without = marks_of(&s, id, 0);
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("graphicStyle.redefine", &json!({"name": "Blue", "id": marks[1].0})).unwrap();
+    assert_eq!(spec(&s, id).series_paints, was, "the source mark was not edited");
+    s.execute("graph.setData", &json!({"id": id.0, "rows": [[1, 2], [3, 4]]})).unwrap();
+    assert_eq!(marks_of(&s, id, 0), without);
+    assert!(without.iter().all(|m| m.0 == red));
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(spec(&s, id).series_paints, was);
+}
+
+/// Default Fill and Stroke on a series mark stores a white fill and a 1 pt black stroke, both opaque, on the graph.
+#[test]
+fn default_fill_and_stroke_on_a_series_mark_is_kept() {
+    let (mut s, id, marks) = stored_red_stroke();
+    let was = spec(&s, id).series_paints;
+    s.execute("paint.default", &json!({"ids": [marks[0].0]})).unwrap();
+    let (white, black) = (Paint::solid(vectorcraft_color::Color::WHITE), Paint::solid(vectorcraft_color::Color::BLACK));
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.fill.clone(), kept.fill_opacity), (Some(white.clone()), None));
+    assert_eq!((kept.stroke.clone(), kept.stroke_width), (Some(black.clone()), Some(1.0)));
+    series_0_is(&mut s, id, (&white, 1.0, &black, 1.0), &was);
+}
+
+/// Swap Fill and Stroke on a series mark stores the swapped paints and the stroke weight, and leaves the opacity the series
+/// stores.
+#[test]
+fn swapping_a_series_marks_fill_and_stroke_is_kept() {
+    let (mut s, id, marks) = stored_red_stroke();
+    let stroke = top_row(&s, marks[0], false);
+    s.execute("appearance.setItem", &json!({"ids": [marks[0].0], "index": stroke, "color": "#00ff00", "weight": 3})).unwrap();
+    let mark = s.doc().unwrap().doc.node(marks[0]).unwrap().clone();
+    let (gray, green) = (mark.appearance.fill_paint(), mark.appearance.stroke_paint());
+    let was = spec(&s, id).series_paints;
+    s.execute("paint.swap", &json!({"ids": [marks[0].0]})).unwrap();
+    let kept = spec(&s, id).series_paints[0].clone();
+    assert_eq!((kept.fill.clone(), kept.fill_opacity), (Some(green.clone()), Some(0.4)));
+    assert_eq!((kept.stroke.clone(), kept.stroke_width), (Some(gray.clone()), Some(3.0)));
+    series_0_is(&mut s, id, (&green, 0.4, &gray, 3.0), &was);
+}
+
+/// Swap Fill and Stroke writes the topmost fill even when it is hidden: the visible fill under it does not replace the
+/// fill the series stores.
+#[test]
+fn swapping_onto_a_hidden_top_fill_leaves_the_stored_fill() {
+    let (mut s, id, _, marks) = column_marks();
+    s.execute("appearance.addFill", &json!({"ids": [marks[0].0]})).unwrap();
+    let (_, upper) = fill_rows(&s, marks[0]);
+    s.execute("appearance.setItem", &json!({"ids": [marks[0].0], "index": upper, "visible": false})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [marks[1].0], "index": top_row(&s, marks[1], true), "color": "#ff0000"})).unwrap();
+    let red = spec(&s, id).series_paints[0].fill.clone();
+    assert_eq!(red, Some(s.doc().unwrap().doc.node(marks[1]).unwrap().appearance.fill_paint()));
+    let stroke = top_row(&s, marks[0], false);
+    s.execute("appearance.setItem", &json!({"ids": [marks[0].0], "index": stroke, "color": "#00ff00", "weight": 3})).unwrap();
+    s.execute("paint.swap", &json!({"ids": [marks[0].0]})).unwrap();
+    assert_eq!(spec(&s, id).series_paints[0].fill, red);
+}
+
 /// A kept opacity read from a file outside 0..1 is held to that range, and one that is not a number is left out.
 #[test]
 fn a_kept_series_opacity_from_a_file_is_held_to_its_range() {
diff --git a/crates/engine/src/cmd/intertwine.rs b/crates/engine/src/cmd/intertwine.rs
index b19206c39..9841d2abb 100644
--- a/crates/engine/src/cmd/intertwine.rs
+++ b/crates/engine/src/cmd/intertwine.rs
@@ -76,8 +76,9 @@ pub fn specs() -> Vec<CommandSpec> {
 // ---------- predicates ----------
 
 /// The Intertwine groups of the selection: selected ones, and those around a selected object.
+/// None while an object of a dynamic symbol instance's art is selected.
 fn selected_groups(s: &Session) -> Vec<NodeId> {
-    let Some(st) = s.active() else { return vec![] };
+    let Some(st) = s.active().filter(|st| st.selection.symbol_part.is_none()) else { return vec![] };
     let mut out = vec![];
     for id in &st.selection.objects {
         let group = st.doc.ancestry(*id).unwrap_or_default().into_iter().rev().find(|a| st.doc.node(*a).is_some_and(is_intertwine));
@@ -92,6 +93,7 @@ fn selected_groups(s: &Session) -> Vec<NodeId> {
 
 fn has_intertwine(s: &Session) -> std::result::Result<(), String> {
     has_selection(s)?;
+    super::edit::no_symbol_part(s)?;
     if selected_groups(s).is_empty() { Err("select an Intertwine group".into()) } else { Ok(()) }
 }
 
@@ -378,11 +380,14 @@ fn arrange(s: &mut Session, p: &Value) -> Result<Value> {
             }
             id
         }
-        None => match selected_groups(s).as_slice() {
-            [g] => *g,
-            [] => return Err(bad(C, "select an Intertwine group")),
-            _ => return Err(bad(C, "select one Intertwine group")),
-        },
+        None => {
+            super::edit::refuse_symbol_part(s)?;
+            match selected_groups(s).as_slice() {
+                [g] => *g,
+                [] => return Err(bad(C, "select an Intertwine group")),
+                _ => return Err(bad(C, "select one Intertwine group")),
+            }
+        }
     };
     let at = match p.get("at") {
         Some(_) => Some(point_param(p, "at").filter(|q| q.x.is_finite() && q.y.is_finite()).ok_or_else(|| bad(C, "at must be [x, y]"))?),
diff --git a/crates/engine/src/cmd/layer.rs b/crates/engine/src/cmd/layer.rs
index d4adaf2fd..6fe0746ac 100644
--- a/crates/engine/src/cmd/layer.rs
+++ b/crates/engine/src/cmd/layer.rs
@@ -10,7 +10,7 @@ use std::collections::HashSet;
 use std::sync::Arc;
 
 use serde_json::{Value, json};
-use vectorcraft_doc::{Artboard, Document, LAYER_COLORS, LayerColor, Node, NodeId, NodeKind, Scaling};
+use vectorcraft_doc::{Artboard, ArtboardSide, Document, LAYER_COLORS, LayerColor, Node, NodeId, NodeKind, Scaling};
 use vectorcraft_geom::{Affine, Rect};
 
 use super::{
@@ -128,7 +128,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "New Artboard",
             ["Window", "Artboards"],
             None,
-            "{x?, y?, width?, height?, name?, color?: color (its background color, as artboard.setProps takes it, #rrggbbaa and #rgba refused; default: none), showCenterMark?: bool, showCrossHairs?: bool, showVideoSafeAreas?: bool (as artboard.setProps takes them; default false), videoRulerPixelAspectRatio?: number 0.1–10 (as artboard.setProps takes it; default 1)} (default place: right of the last)",
+            "{x?, y?, width?, height?, name?, color?: color (its background color, as artboard.setProps takes it, #rrggbbaa and #rgba refused; default: none), showCenterMark?: bool, showCrossHairs?: bool, showVideoSafeAreas?: bool (as artboard.setProps takes them; default false), videoRulerPixelAspectRatio?: number 0.1–10 (as artboard.setProps takes it; default 1), side?: \"left\"|\"right\"|\"top\"|\"bottom\" (the size of artboard `beside`, 20 pt from that side of it; refused with x, y, width or height), beside?: n (the artboard `side` places it by; default the last)} (default place: right of the last)",
             has_doc,
             artboard_new
         ),
@@ -869,6 +869,17 @@ fn artboard_str<'a>(p: &'a Value, key: &str, cmd: &str) -> Result<Option<&'a str
     }
 }
 
+/// An artboard command's `side` param: None when absent or null, else the side it names. Any other
+/// value is an error that names the four sides.
+pub(crate) fn artboard_side(p: &Value, cmd: &str) -> Result<Option<ArtboardSide>> {
+    let bad_side = || bad(cmd, "`side` must be \"left\", \"right\", \"top\" or \"bottom\"");
+    match p.get("side") {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(v)) => ArtboardSide::parse(v).map(Some).ok_or_else(bad_side),
+        Some(_) => Err(bad_side()),
+    }
+}
+
 /// An artboard command's `videoRulerPixelAspectRatio` param: None when absent, else a number within
 /// [`vectorcraft_doc::VIDEO_PIXEL_ASPECT_RANGE`].
 fn video_pixel_aspect(p: &Value, cmd: &str) -> Result<Option<f64>> {
@@ -886,10 +897,24 @@ fn artboard_new(s: &mut Session, p: &Value) -> Result<Value> {
     let d0 = &s.doc()?.doc;
     let last = d0.artboards.last().map(|a| a.rect).unwrap_or(Rect::new(0.0, 0.0, 612.0, 792.0));
     let def = Rect::new(last.x1 + 20.0, last.y0, last.x1 + 20.0 + last.width(), last.y1);
-    let r = rect_from(p, def);
     let color = artboard_color(p, "artboard.new")?.flatten();
     check_switches(p, &["showCenterMark", "showCrossHairs", "showVideoSafeAreas"], "artboard.new")?;
     check_numbers(p, &["x", "y", "width", "height"], "artboard.new")?;
+    let r = match artboard_side(p, "artboard.new")? {
+        Some(side) => {
+            if ["x", "y", "width", "height"].iter().any(|k| p.get(*k).is_some_and(|v| !v.is_null())) {
+                return Err(bad("artboard.new", "`side` places the artboard: leave out x, y, width and height"));
+            }
+            let beside = match p.get("beside") {
+                None | Some(Value::Null) => d0.artboards.len().saturating_sub(1),
+                Some(_) => super::appearance::index_param(p, "beside", "artboard.new")?,
+            };
+            let src = d0.artboards.get(beside).map(|a| a.rect).ok_or_else(|| EngineError::Other("no such artboard".into()))?;
+            src + side.offset(src)
+        }
+        None if p.get("beside").is_some_and(|v| !v.is_null()) => return Err(bad("artboard.new", "`beside` needs `side`")),
+        None => rect_from(p, def),
+    };
     let given = artboard_str(p, "name", "artboard.new")?.map(str::trim).filter(|n| !n.is_empty());
     let (show_center_mark, show_cross_hairs) = (bool_or(p, "showCenterMark", false), bool_or(p, "showCrossHairs", false));
     let show_video_safe_areas = bool_or(p, "showVideoSafeAreas", false);
@@ -1100,6 +1125,7 @@ fn artboard_set(s: &mut Session, p: &Value) -> Result<Value> {
                 for id in &e.art {
                     if let Some(n) = d.node_mut(*id) {
                         n.transform(xf, sc);
+                        super::object::keep_pixel_aligned(n, sc);
                     }
                 }
             } else if !e.resized {
diff --git a/crates/engine/src/cmd/links.rs b/crates/engine/src/cmd/links.rs
index 89492ad01..28d8be2ee 100644
--- a/crates/engine/src/cmd/links.rs
+++ b/crates/engine/src/cmd/links.rs
@@ -849,9 +849,10 @@ impl Resolved {
 
 /// The linked files of document `d`, just read from `doc_path`: those found unchanged are read
 /// again (their images had the preview), modified ones are read again when `update`, links found
-/// away from their path take the new path. A link nothing is known of whose image shows a preview
-/// (a file another app wrote kept only that) was never read: its file is read now, into the
-/// image's bounds, which isn't a change to report. Nothing here is an undo step.
+/// away from their path take the new path. A link nothing is known of whose image, or placed
+/// document, shows a preview (a file another app wrote kept only that) was never read: its file is
+/// read now, into the object's bounds, which isn't a change to report. A placed document whose
+/// file's bytes are gone isn't showing a preview. Nothing here is an undo step.
 pub fn resolve(d: &mut Document, doc_path: Option<&str>, update: bool, low_res_proxy_eps: bool) -> Resolved {
     let mut out = Resolved::default();
     // The image (with its preview) and hash of each file read for a preview here, by path: images
@@ -863,7 +864,11 @@ pub fn resolve(d: &mut Document, doc_path: Option<&str>, update: bool, low_res_p
     let mut moved: Vec<(String, String, bool, LinkInfo)> = vec![];
     for g in groups(d, None) {
         let row = rows(std::iter::once(&g), doc_path);
-        let unread = g.document.is_none() && g.link.hash.is_none() && g.link.size.is_none() && previewing(d, &g.key);
+        let shows_preview = match g.document {
+            None => previewing(d, &g.key),
+            Some(_) => d.images.get(&g.key).is_some_and(ImageBlob::is_proxy),
+        };
+        let unread = g.link.hash.is_none() && g.link.size.is_none() && shows_preview;
         let eps_preview = keep_eps_preview(low_res_proxy_eps, &g, d);
         match probe(&g, doc_path) {
             (Status::Missing, _) => out.missing.extend(row),
diff --git a/crates/engine/src/cmd/live/commands.rs b/crates/engine/src/cmd/live/commands.rs
index 54c65b0c7..b69b4e869 100644
--- a/crates/engine/src/cmd/live/commands.rs
+++ b/crates/engine/src/cmd/live/commands.rs
@@ -154,7 +154,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Make with Top Object",
             ["Object", "Envelope Distort"],
             Some("Cmd+Alt+C"),
-            "{ids?} the topmost selected path becomes the envelope of the others (type maps from its glyph outline bounds) → {id}",
+            "{ids?} the topmost selected path becomes the envelope of the others: its outline splits into four sides at its corners, and each piece of a side takes a share of the content in proportion to its control polygon's length (type maps from its glyph outline bounds) → {id}",
             has_multi,
             env_make_top
         ),
diff --git a/crates/engine/src/cmd/live/common.rs b/crates/engine/src/cmd/live/common.rs
index 226a57a0d..80c9d714a 100644
--- a/crates/engine/src/cmd/live/common.rs
+++ b/crates/engine/src/cmd/live/common.rs
@@ -33,9 +33,10 @@ pub(super) fn roots_param(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
     selected_roots(s)
 }
 
-/// Selected nodes of a kind (the selection itself or an ancestor).
+/// Selected nodes of a kind (the selection itself or an ancestor). None while an object of a
+/// dynamic symbol instance's art is selected.
 pub(super) fn selected_of(s: &Session, pred: fn(&Node) -> bool) -> Vec<NodeId> {
-    let Some(st) = s.active() else { return vec![] };
+    let Some(st) = s.active().filter(|st| st.selection.symbol_part.is_none()) else { return vec![] };
     let mut out = vec![];
     for id in &st.selection.objects {
         for a in st.doc.ancestry(*id).unwrap_or_default().into_iter().rev() {
@@ -64,16 +65,19 @@ pub(super) fn is_mesh(n: &Node) -> bool {
 
 pub(super) fn has_blend(s: &Session) -> std::result::Result<(), String> {
     has_selection(s)?;
+    crate::cmd::edit::no_symbol_part(s)?;
     if selected_of(s, is_blend).is_empty() { Err("select a blend".into()) } else { Ok(()) }
 }
 
 pub(super) fn has_envelope(s: &Session) -> std::result::Result<(), String> {
     has_selection(s)?;
+    crate::cmd::edit::no_symbol_part(s)?;
     if selected_of(s, is_envelope).is_empty() { Err("select an envelope".into()) } else { Ok(()) }
 }
 
 pub(super) fn has_mesh(s: &Session) -> std::result::Result<(), String> {
     has_selection(s)?;
+    crate::cmd::edit::no_symbol_part(s)?;
     if selected_of(s, is_mesh).is_empty() { Err("select a gradient mesh".into()) } else { Ok(()) }
 }
 
diff --git a/crates/engine/src/cmd/live/envelope.rs b/crates/engine/src/cmd/live/envelope.rs
index 521f092b0..1aceb49b5 100644
--- a/crates/engine/src/cmd/live/envelope.rs
+++ b/crates/engine/src/cmd/live/envelope.rs
@@ -113,7 +113,7 @@ pub(super) fn env_make_top(s: &mut Session, p: &Value) -> Result<Value> {
     let path = s.doc()?.doc.node(top).and_then(outline_of).filter(|p| p.bounds().is_some()).ok_or_else(|| bad(C, "the top object must be a path"))?;
     let defaults = envelope_defaults(s);
     let id = s.edit("Make Envelope", |d, sel| {
-        let id = wrap(d, sel, &content, |id, content| envelope(id, content, EnvelopeKind::TopObject { path }, defaults))?;
+        let id = wrap(d, sel, &content, |id, content| envelope(id, content, EnvelopeKind::TopObject { path, corners: None }, defaults))?;
         d.remove(top)?;
         Ok(id)
     })?;
@@ -223,7 +223,7 @@ pub(super) fn env_info(s: &mut Session, _: &Value) -> Result<Value> {
 fn envelope_shape(env: &Node, kind: &EnvelopeKind) -> Option<Node> {
     let grey = Color::gray(0.25);
     let (rows, cols) = match kind {
-        EnvelopeKind::TopObject { path } => {
+        EnvelopeKind::TopObject { path, .. } => {
             return Some(Node::path(NodeId(0), path.clone(), Appearance::basic(Paint::solid(grey), Paint::None, 0.0)));
         }
         // The mesh itself, handles and all.
diff --git a/crates/engine/src/cmd/maskedit.rs b/crates/engine/src/cmd/maskedit.rs
index 01721471c..f2d322a39 100644
--- a/crates/engine/src/cmd/maskedit.rs
+++ b/crates/engine/src/cmd/maskedit.rs
@@ -30,7 +30,7 @@ pub fn specs() -> Vec<CommandSpec> {
             ["Window", "Transparency"],
             None,
             "{id?} edit the mask art of `id` (default: the first selected object with a mask) in place, as clicking the mask thumbnail in the Transparency panel does; refused in isolation mode and in pattern editing mode → {layer}",
-            can_edit_mask,
+            can_enter,
             enter
         ),
         cmd!(
@@ -79,6 +79,13 @@ pub(crate) fn can_edit_mask(s: &Session) -> std::result::Result<(), String> {
     mask_editing_refused(st).map_or(Ok(()), |why| Err(why.into()))
 }
 
+/// Edit Opacity Mask: mask editing can be entered ([`can_edit_mask`]), and outside it no object of a
+/// dynamic symbol instance's art is selected, since its instance's mask is not edited from it.
+fn can_enter(s: &Session) -> std::result::Result<(), String> {
+    can_edit_mask(s)?;
+    if s.active().is_some_and(|st| st.doc.mask_edit.is_some()) { Ok(()) } else { super::edit::no_symbol_part(s) }
+}
+
 /// A document is open and no opacity mask is being edited: isolation mode and pattern editing mode
 /// are not entered while an opacity mask is edited.
 pub(crate) fn outside_mask_editing(s: &Session) -> std::result::Result<(), String> {
@@ -117,12 +124,17 @@ fn enter(s: &mut Session, p: &Value) -> Result<Value> {
     if st.doc.mask_edit.is_some() {
         return Err(bad(C, "already editing an opacity mask"));
     }
-    let id = object_param(p, "id", C)?.or_else(|| first_masked(st)).ok_or_else(|| bad(C, "select an object with an opacity mask"))?;
+    let given = object_param(p, "id", C)?;
+    if given.is_none() {
+        super::edit::refuse_symbol_part(s)?;
+    }
+    let id = given.or_else(|| first_masked(st)).ok_or_else(|| bad(C, "select an object with an opacity mask"))?;
     let layer = start(s, id)?;
     Ok(json!({ "layer": layer.0 }))
 }
 
-/// The first selected object with an opacity mask.
+/// The first selected object with an opacity mask. Callers refuse first while an object of a
+/// dynamic symbol instance's art is selected ([`super::edit::refuse_symbol_part`]).
 fn first_masked(st: &crate::DocState) -> Option<NodeId> {
     st.selection.subjects().iter().copied().find(|i| st.doc.node(*i).is_some_and(|n| n.extras().mask.is_some()))
 }
@@ -145,6 +157,9 @@ fn view_mask(s: &mut Session, p: &Value) -> Result<Value> {
         st.revision += 1;
         return Ok(json!({ "on": false, "id": id.map(|i| i.0) }));
     }
+    if given.is_none() && editing.is_none() {
+        super::edit::refuse_symbol_part(s)?;
+    }
     let id = given.or(editing).or_else(|| first_masked(st)).ok_or_else(|| bad(C, "select an object with an opacity mask"))?;
     match editing {
         Some(e) if e != id => return Err(bad(C, "already editing another object's opacity mask")),
diff --git a/crates/engine/src/cmd/menucmds.rs b/crates/engine/src/cmd/menucmds.rs
index 6992f42ab..4a48319f3 100644
--- a/crates/engine/src/cmd/menucmds.rs
+++ b/crates/engine/src/cmd/menucmds.rs
@@ -620,6 +620,9 @@ fn transform_each_as(s: &mut Session, p: &Value, label: &str) -> Result<Value> {
             if let Some(n) = d.node_mut(*id) {
                 super::object::transform_node(n, m, sc, objects);
             }
+            if objects {
+                super::object::keep_compound_aligned(d, *id, sc);
+            }
         }
         Ok(targets)
     })?;
@@ -1363,6 +1366,7 @@ fn rearrange_artboards(s: &mut Session, p: &Value) -> Result<Value> {
         for (id, dl) in &art {
             if let Some(n) = d.node_mut(*id) {
                 n.transform(Affine::translate(*dl), sc);
+                super::object::keep_pixel_aligned(n, sc);
             }
         }
         let mut moved = vec![];
diff --git a/crates/engine/src/cmd/object.rs b/crates/engine/src/cmd/object.rs
index ade05bd95..c467f06e5 100644
--- a/crates/engine/src/cmd/object.rs
+++ b/crates/engine/src/cmd/object.rs
@@ -25,6 +25,7 @@ mod arrange;
 mod bounds;
 mod commands;
 mod compound;
+mod pixelgrid;
 mod props;
 mod shape;
 mod spans;
@@ -35,5 +36,6 @@ pub(crate) use arrange::group_nodes;
 pub(crate) use bounds::{bounds_rewrite, object_bounds_transform};
 pub use commands::specs;
 pub(super) use compound::{as_clipping_path, make_clipping_path, release_clip};
+pub(crate) use pixelgrid::{keep_aligned_in, keep_compound_aligned, keep_pixel_aligned, refresh as refresh_pixel_aligned, resnap, snap_if_aligned};
 pub(super) use shape::recut;
 pub(crate) use transform::{apply_transform, preview_copies, scaling, transform_node, transform_patterns, transforms_objects};
diff --git a/crates/engine/src/cmd/object/align.rs b/crates/engine/src/cmd/object/align.rs
index 156b35824..82a61b02a 100644
--- a/crates/engine/src/cmd/object/align.rs
+++ b/crates/engine/src/cmd/object/align.rs
@@ -112,7 +112,9 @@ fn apply_moves(s: &mut Session, label: &str, p: &Value, ids: &[NodeId], moves: &
         for (id, dv) in moves {
             if let Some(n) = d.node_mut(*id) {
                 n.transform(Affine::translate(*dv), sc);
+                super::pixelgrid::keep_pixel_aligned(n, sc);
             }
+            super::pixelgrid::keep_compound_aligned(d, *id, sc);
         }
         for &(i, pos) in &guides {
             if let Some(g) = d.guides.get_mut(i) {
@@ -330,6 +332,7 @@ fn align_anchors(s: &mut Session, p: &Value, ids: &[NodeId], (h, v): (Option<&st
                     a.translate(target(a.p) - a.p);
                 }
             }
+            snap_anchor_path(d, *id);
         }
         Ok(())
     })?;
@@ -434,11 +437,23 @@ fn distribute_anchors(s: &mut Session, label: &str, horiz: bool, gap: Option<f64
                 a.translate(if horiz { Vec2::new(delta, 0.0) } else { Vec2::new(0.0, delta) });
             }
         }
+        for (id, _) in &targets {
+            snap_anchor_path(d, *id);
+        }
         Ok(())
     })?;
     ok()
 }
 
+/// After anchors of path `id` moved: snap the path, or the compound path that holds it, to the
+/// pixel grid again when it is pixel-aligned.
+fn snap_anchor_path(d: &mut Document, id: NodeId) {
+    let top = crate::cmd::path::compound_or_self(d, id);
+    if let Some(n) = d.node_mut(top) {
+        super::pixelgrid::snap_if_aligned(n);
+    }
+}
+
 pub(super) fn distribute(s: &mut Session, p: &Value) -> Result<Value> {
     check_switches(p, &["patterns"], "object.distribute")?;
     check_numbers(p, &["artboard"], "object.distribute")?;
diff --git a/crates/engine/src/cmd/object/commands.rs b/crates/engine/src/cmd/object/commands.rs
index 69f464edb..f248294f2 100644
--- a/crates/engine/src/cmd/object/commands.rs
+++ b/crates/engine/src/cmd/object/commands.rs
@@ -2,6 +2,7 @@ use super::align::{align, can_distribute, distribute, distribute_spacing};
 use super::arrange::{Arrange, arrange, exit_isolation, group, hide, isolate, lock, send_to_current_layer, show_all, ungroup, unlock_all};
 use super::bounds::set_bounds;
 use super::compound::{clip_edit, clip_make, clip_release, compound_make, compound_release};
+use super::pixelgrid::set_pixel_aligned;
 use super::props::set_props;
 use super::shape::{expand_shape, set_live_shape};
 use super::transform::{move_cmd, nudge, reflect, rotate, scale, shear, transform, transform_again};
@@ -300,5 +301,14 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection,
             set_live_shape
         ),
+        cmd!(
+            "object.setPixelAligned",
+            "Align to Pixel Grid",
+            [],
+            None,
+            "{ids?|id?, on?: bool (default true)} → {ids (the objects whose property changed)} (Transform panel › Align to Pixel Grid: on, each object's horizontal and vertical straight segments move to whole points, or half points when a visible, painted centered stroke has an odd weight, its stroke weights become whole points (at least 1), and every later move, scale, rotation, reflection, Transform Each, Align move, Transform panel change, move of direct-selected anchors or of one anchor (path.moveAnchor), path.setAnchors, object.setLiveShape, move of a compound path's path on its own, artboard move or resize that carries the art (artboard.move, artboard.setProps) or copies it (artboard.move with copy, Duplicate Artboards), every copy that edit.duplicate or a paste moves and object.slice.move of an object slice snaps them again, as does every stroke.set, stroke.weightUp or stroke.weightDown edit (which also rounds the new weight) and every appearance.setItem, appearance.addStroke, appearance.removeItem, appearance.clear, appearance.reduceToBasic, appearance.showAllHidden, appearance.transfer, appearance.copyFrom, paint.setStroke or graphicStyle.apply edit, and every other command that changes the object; diagonal segments and curves keep their shape apart from the anchors they share with those segments, and coordinates that differ stay at least 1 point apart; a live rectangle, polygon, line or pie moves and scales as a whole to the snapped bounds (a full ellipse, all curves, stays as it is), and a path with Live Corners snaps the outline its corners are cut from; a compound path snaps its paths with its own stroke, Make Compound Path from an aligned path or compound path gives an aligned compound path whose paths drop the property, and Release Compound Path gives each path the compound path's property; off, the object keeps its geometry and stops snapping. Only paths and compound paths can be aligned: type, images, groups, guides, paths inside a compound path and other objects are an error and nothing changes. One undo step; nothing changes and no undo step is made when every object already has the value. Saved in the native file)",
+            has_selection,
+            set_pixel_aligned
+        ),
     ]
 }
diff --git a/crates/engine/src/cmd/object/compound.rs b/crates/engine/src/cmd/object/compound.rs
index 1dabc76db..54e4d6f88 100644
--- a/crates/engine/src/cmd/object/compound.rs
+++ b/crates/engine/src/cmd/object/compound.rs
@@ -13,11 +13,15 @@ pub(super) fn compound_make(s: &mut Session, _: &Value) -> Result<Value> {
         d.node(backmost).ok_or(EngineError::NoNode(backmost))?;
         let mut units: Vec<Vec<Arc<Node>>> = vec![];
         let mut appearance = None;
+        // The compound path is pixel-aligned when any of its paths was, or any compound path whose
+        // paths it takes; its paths snap with its stroke, so they do not keep the property themselves.
+        let mut aligned = false;
         for id in &ids {
             let n = d.node(*id).ok_or(EngineError::NoNode(*id))?;
             if !matches!(n.kind, NodeKind::Path { .. } | NodeKind::Compound { .. } | NodeKind::Group { .. }) {
                 return Err(EngineError::Other("compound paths can only contain paths".into()));
             }
+            n.walk(&mut |c| aligned |= c.extras().pixel_aligned);
             compound_members(n, &mut appearance, &mut units);
         }
         let cid = d.alloc_id();
@@ -40,6 +44,7 @@ pub(super) fn compound_make(s: &mut Session, _: &Value) -> Result<Value> {
             for mut p in unit {
                 let pn = Arc::make_mut(&mut p);
                 pn.appearance = Appearance::default().into();
+                pn.extras_mut().pixel_aligned = false;
                 if let NodeKind::Path { path, live, .. } = &mut pn.kind {
                     *live = None;
                     if flip {
@@ -49,6 +54,10 @@ pub(super) fn compound_make(s: &mut Session, _: &Value) -> Result<Value> {
                 ch.push(p);
             }
         }
+        if aligned {
+            c.extras_mut().pixel_aligned = true;
+            super::pixelgrid::snap_if_aligned(&mut c);
+        }
         d.wrap(&ids, |_| c)?;
         sel.set([cid]);
         Ok(cid)
@@ -99,6 +108,10 @@ pub(super) fn compound_release(s: &mut Session, _: &Value) -> Result<Value> {
                     for c in children {
                         let mut c = (**c).clone();
                         c.appearance = n.appearance.clone();
+                        // Each path keeps the compound path's pixel-aligned property.
+                        if n.extras().pixel_aligned {
+                            c.extras_mut().pixel_aligned = true;
+                        }
                         out.push(c.id);
                         parts.push(c);
                     }
diff --git a/crates/engine/src/cmd/object/pixelgrid.rs b/crates/engine/src/cmd/object/pixelgrid.rs
new file mode 100644
index 000000000..6441fda0c
--- /dev/null
+++ b/crates/engine/src/cmd/object/pixelgrid.rs
@@ -0,0 +1,407 @@
+//! Transform panel › Align to Pixel Grid: an object's pixel-aligned property, and the snapping that
+//! keeps the horizontal and vertical segments of a pixel-aligned object on the pixel grid
+//! (<https://helpx.adobe.com/illustrator/desktop/get-started/learn-the-basics/pixel-preview-mode-for-web-graphics.html>).
+
+use vectorcraft_doc::{AppearanceItem, LiveShape, StrokeAlign};
+
+use super::{
+    Affine, Arc, Document, EngineError, Node, NodeId, NodeKind, Paint, PathData, Rect, Result, Scaling, Session, Value, Vec2, bad, json,
+    selected_roots,
+};
+use crate::cmd::{given_objects, switch_or};
+
+const C: &str = "object.setPixelAligned";
+
+/// How far apart two coordinates may be and still count as one, in points: segments this close to
+/// horizontal or vertical count as horizontal or vertical.
+const EPS: f64 = 1e-6;
+
+/// Whether `n` can be aligned to the pixel grid: a path that is not a guide, or a compound path.
+/// Type, images, groups and other objects cannot.
+pub(crate) fn can_align(n: &Node) -> bool {
+    matches!(n.kind, NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. })
+}
+
+/// `object.setPixelAligned`: turn the pixel-aligned property of the objects given (or the selected
+/// objects) on or off. Turning it on snaps them to the pixel grid at once. Every object must be
+/// one [`can_align`] accepts, else nothing changes. When every object already has the value, the
+/// document and its undo history stay as they are.
+pub(super) fn set_pixel_aligned(s: &mut Session, p: &Value) -> Result<Value> {
+    let on = switch_or(p, "on", true, C)?;
+    let ids = match given_objects(s, p, C)? {
+        Some(ids) => ids,
+        None => selected_roots(s)?,
+    };
+    let d = &s.doc()?.doc;
+    let mut changed: Vec<NodeId> = vec![];
+    for id in &ids {
+        let n = d.node(*id).ok_or(EngineError::NoNode(*id))?;
+        // A path inside a compound path snaps with the compound path, whose property it takes.
+        let in_compound = d.parent_of(*id).and_then(|p| d.node(p)).is_some_and(|p| matches!(p.kind, NodeKind::Compound { .. }));
+        if !can_align(n) || in_compound {
+            return Err(bad(C, "only paths and compound paths can be aligned to the pixel grid"));
+        }
+        if n.extras().pixel_aligned != on && !changed.contains(id) {
+            changed.push(*id);
+        }
+    }
+    if changed.is_empty() {
+        return Ok(json!({ "ids": [] }));
+    }
+    s.edit("Align to Pixel Grid", |d, _| {
+        for id in &changed {
+            let n = d.node_mut(*id).ok_or(EngineError::NoNode(*id))?;
+            n.extras_mut().pixel_aligned = on;
+            if on {
+                snap_object(n, Scaling::default());
+            }
+        }
+        Ok(())
+    })?;
+    Ok(json!({ "ids": changed.iter().map(|i| i.0).collect::<Vec<_>>() }))
+}
+
+/// After a transform of `n` with `sc`: snap `n` and every object in it that is pixel-aligned to the
+/// pixel grid, the art of linked opacity masks included. Objects that are not pixel-aligned stay as
+/// they are.
+pub(crate) fn keep_pixel_aligned(n: &mut Node, sc: Scaling) {
+    let mut found = vec![];
+    aligned_within(n, &mut vec![], &mut found);
+    for at in found {
+        if let Some(a) = node_at(n, &at) {
+            snap_object(a, sc);
+        }
+    }
+}
+
+/// One step from an object down to an object it holds: its child at an index, or the art of its
+/// linked opacity mask.
+#[derive(Clone, Copy)]
+enum Step {
+    Child(usize),
+    Mask,
+}
+
+/// Add to `out` the steps from the object [`keep_pixel_aligned`] started at to `n` (`at`) and to
+/// every pixel-aligned object in `n`, in the art of linked opacity masks included, `n` first. One
+/// walk visits each object once, so nothing is copied that does not snap.
+fn aligned_within(n: &Node, at: &mut Vec<Step>, out: &mut Vec<Vec<Step>>) {
+    if n.extras().pixel_aligned {
+        out.push(at.clone());
+    }
+    // The paths of a pixel-aligned compound path snap with it, but their opacity masks still need a visit.
+    for (i, c) in n.children().map_or(&[][..], Vec::as_slice).iter().enumerate() {
+        at.push(Step::Child(i));
+        aligned_within(c, at, out);
+        at.pop();
+    }
+    if let Some(m) = n.extras().mask.as_ref()
+        && m.linked
+    {
+        at.push(Step::Mask);
+        aligned_within(&m.art, at, out);
+        at.pop();
+    }
+}
+
+/// The object that `steps` lead to from `n`, made unique for editing.
+fn node_at<'a>(n: &'a mut Node, steps: &[Step]) -> Option<&'a mut Node> {
+    let mut cur = n;
+    for s in steps {
+        cur = match s {
+            Step::Child(i) => Arc::make_mut(cur.children_mut()?.get_mut(*i)?),
+            Step::Mask => Arc::make_mut(&mut cur.extras_if_any()?.mask.as_mut()?.art),
+        };
+    }
+    Some(cur)
+}
+
+/// After a transform of object `id` with `sc`: when `id` is a path of a pixel-aligned compound path
+/// (moved on its own, as with Group Selection), snap that compound path to the pixel grid again.
+/// The compound path holds the property, so [`keep_pixel_aligned`] on the path alone does nothing.
+pub(crate) fn keep_compound_aligned(d: &mut Document, id: NodeId, sc: Scaling) {
+    let Some(parent) = d.parent_of(id) else { return };
+    if let Some(n) = d.node_mut(parent)
+        && matches!(n.kind, NodeKind::Compound { .. })
+        && n.extras().pixel_aligned
+    {
+        snap_object(n, sc);
+    }
+}
+
+/// After any edit ([`Session::edit`]): snap each pixel-aligned object that the edit changed or added
+/// (its node in `doc` is not the one in `before`), with the pixel-aligned art of its linked opacity
+/// mask, to the pixel grid. Objects the edit did not touch are not visited.
+pub(crate) fn refresh(before: &Document, doc: &mut Document) {
+    let mut ids = vec![];
+    changed_aligned(&before.layers, &doc.layers, &mut ids);
+    for id in ids {
+        if let Some(n) = doc.node_mut(id) {
+            keep_pixel_aligned(n, Scaling::default());
+        }
+    }
+}
+
+/// After a pass that moved what objects `ids` hold (Objects on Path placing its members): snap the
+/// pixel-aligned objects in them to the pixel grid again.
+pub(crate) fn keep_aligned_in(doc: &mut Document, ids: &[NodeId]) {
+    for id in ids {
+        if doc.node(*id).is_some_and(holds_aligned)
+            && let Some(n) = doc.node_mut(*id)
+        {
+            keep_pixel_aligned(n, Scaling::default());
+        }
+    }
+}
+
+/// The objects of `after` that differ from their counterparts in `before` (or are new) and are
+/// pixel-aligned or hold pixel-aligned art in a linked opacity mask. Inside such an object the
+/// walk stops: [`keep_pixel_aligned`] visits what it holds.
+fn changed_aligned(before: &[Arc<Node>], after: &[Arc<Node>], out: &mut Vec<NodeId>) {
+    let mut by_id: Option<std::collections::HashMap<NodeId, &Arc<Node>>> = None;
+    for (i, a) in after.iter().enumerate() {
+        let b = match before.get(i) {
+            Some(b) if b.id == a.id => Some(b),
+            _ => by_id.get_or_insert_with(|| before.iter().map(|b| (b.id, b)).collect()).get(&a.id).copied(),
+        };
+        if b.is_some_and(|b| Arc::ptr_eq(b, a)) {
+            continue;
+        }
+        if a.extras().pixel_aligned || a.extras().mask.as_ref().is_some_and(|m| m.linked && holds_aligned(&m.art)) {
+            out.push(a.id);
+        } else if let Some(children) = a.children() {
+            changed_aligned(b.and_then(|b| b.children()).map_or(&[], Vec::as_slice), children, out);
+        }
+    }
+}
+
+/// After an edit that replaces object `id`'s geometry: snap it, or the pixel-aligned compound path
+/// that holds it, to the pixel grid again when it is pixel-aligned.
+pub(crate) fn resnap(d: &mut Document, id: NodeId) {
+    if let Some(n) = d.node_mut(id) {
+        snap_if_aligned(n);
+    }
+    keep_compound_aligned(d, id, Scaling::default());
+}
+
+/// After an edit of `n`'s strokes: when `n` is pixel-aligned, round its stroke weights and snap it to
+/// the pixel grid again, since a new weight or alignment can move where the stroke's edges fall.
+pub(crate) fn snap_if_aligned(n: &mut Node) {
+    if n.extras().pixel_aligned {
+        snap_object(n, Scaling::default());
+    }
+}
+
+/// Whether `n` or an object in it, or in the art of a linked opacity mask in it, is pixel-aligned.
+/// It goes only where a transform of `n` goes: not into unlinked masks.
+fn holds_aligned(n: &Node) -> bool {
+    n.extras().pixel_aligned
+        || n.extras().mask.as_ref().is_some_and(|m| m.linked && holds_aligned(&m.art))
+        || n.children().is_some_and(|ch| ch.iter().any(|c| holds_aligned(c)))
+}
+
+/// Snap pixel-aligned object `n` to the pixel grid: its stroke weights become whole points (at
+/// least 1), and its horizontal and vertical straight segments move to whole points, or to half
+/// points when a centered stroke has an odd weight, so that the stroke's edges fall on the grid.
+/// A compound path snaps each of its paths. Placed gradients and linked opacity masks of an object
+/// whose anchors moved follow it ([`follow_snap`]).
+fn snap_object(n: &mut Node, sc: Scaling) {
+    let half = round_strokes(n);
+    let before = n.geometric_bounds();
+    let mut moved = false;
+    if let NodeKind::Compound { children, .. } = &mut n.kind {
+        // A path is copied for editing only when the snap moves it.
+        for c in children.iter_mut() {
+            if path_snaps(c, half) {
+                let was = c.geometric_bounds();
+                let anchors = snaps_anchors(c);
+                let snapped = Arc::make_mut(c);
+                snap_path_node(snapped, half, sc);
+                if anchors {
+                    follow_snap(snapped, was, sc);
+                }
+                moved = true;
+            }
+        }
+    } else if snaps_anchors(n) {
+        moved = snap_path_node(n, half, sc);
+    } else {
+        // A live shape is moved with `Node::transform`, which carries its gradients and mask along.
+        snap_path_node(n, half, sc);
+    }
+    if moved {
+        follow_snap(n, before, sc);
+    }
+}
+
+/// Whether a snap moves the anchors of path `n` itself (a plain path, or one with Live Corners)
+/// rather than transforming it as a whole (another live shape).
+fn snaps_anchors(n: &Node) -> bool {
+    matches!(&n.kind, NodeKind::Path { live, .. } if live.as_deref().is_none_or(|l| matches!(l, LiveShape::Path { .. })))
+}
+
+/// After the anchors of `n` moved in a snap, from bounds `before`: its placed gradients are fitted
+/// to its new bounds, its patterns move and scale with those bounds when `sc` transforms patterns,
+/// and the art of its linked opacity mask moves and scales with them (and snaps when it is
+/// pixel-aligned itself).
+fn follow_snap(n: &mut Node, before: Option<Rect>, sc: Scaling) {
+    let (Some(f), Some(t)) = (before, n.geometric_bounds()) else { return };
+    if f == t {
+        return;
+    }
+    n.appearance.rebase_gradients(f, t);
+    if sc.patterns {
+        vectorcraft_doc::pattern::transform_pattern_paints(n, rect_to_rect(f, t));
+    }
+    if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut())
+        && m.linked
+    {
+        let art = Arc::make_mut(&mut m.art);
+        art.transform(rect_to_rect(f, t), sc);
+        keep_pixel_aligned(art, sc);
+    }
+}
+
+/// Round the stroke weights of `n` to whole points, at least 1 (strokes without weight stay
+/// without). Returns whether a visible, painted centered stroke has an odd weight.
+fn round_strokes(n: &mut Node) -> bool {
+    let rounds = |w: f64| if w > 0.0 { w.round().max(1.0) } else { w };
+    let needs = n.appearance.items.iter().any(|i| matches!(i, AppearanceItem::Stroke(st) if rounds(st.width) != st.width));
+    if needs {
+        for item in &mut n.appearance.items {
+            if let AppearanceItem::Stroke(st) = item {
+                st.width = rounds(st.width);
+            }
+        }
+    }
+    n.appearance.items.iter().any(|i| {
+        matches!(i, AppearanceItem::Stroke(st) if st.visible
+            && !matches!(st.paint, Paint::None)
+            && st.width > 0.0
+            && st.width % 2.0 == 1.0
+            && st.align == StrokeAlign::Center)
+    })
+}
+
+/// Snap path object `n`'s horizontal and vertical straight segments ([`snap_segments`]). A path
+/// with Live Corners snaps the outline its corners are cut from. Another live shape is moved and
+/// scaled as a whole instead, from its path's bounds to the bounds of the snapped path, so that it
+/// stays a live shape. Returns whether it changed.
+fn snap_path_node(n: &mut Node, half: bool, sc: Scaling) -> bool {
+    let NodeKind::Path { path, live, .. } = &mut n.kind else { return false };
+    let Some(shape) = live.as_deref_mut() else { return snap_segments(path, half) };
+    if let LiveShape::Path { base, .. } = shape {
+        if !snap_segments(base, half) {
+            return false;
+        }
+        *path = shape.to_path();
+        return true;
+    }
+    let mut snapped = path.clone();
+    if !snap_segments(&mut snapped, half) {
+        return false;
+    }
+    let (Some(from), Some(to)) = (path.bounds(), snapped.bounds()) else { return false };
+    n.transform(rect_to_rect(from, to), Scaling { keep_corners: true, patterns: sc.patterns, ..Scaling::default() });
+    true
+}
+
+/// Whether [`snap_path_node`] would change path object `n`: whether an anchor of the path it snaps
+/// moves. Another kind of object is not changed.
+fn path_snaps(n: &Node, half: bool) -> bool {
+    let NodeKind::Path { path, live, .. } = &n.kind else { return false };
+    match live.as_deref() {
+        Some(LiveShape::Path { base, .. }) => segment_moves(base, half).is_some(),
+        _ => segment_moves(path, half).is_some(),
+    }
+}
+
+/// The move and scale that takes `from` onto `to` (a side without size is only moved).
+fn rect_to_rect(from: Rect, to: Rect) -> Affine {
+    let sx = if from.width() > EPS { to.width() / from.width() } else { 1.0 };
+    let sy = if from.height() > EPS { to.height() / from.height() } else { 1.0 };
+    Affine::translate((to.x0, to.y0)) * Affine::scale_non_uniform(sx, sy) * Affine::translate((-from.x0, -from.y0))
+}
+
+/// Move the anchors of `path`'s horizontal straight segments to whole points vertically and the
+/// anchors of its vertical ones to whole points horizontally (`half`: to half points), each anchor
+/// with its handles, so curves and diagonal segments keep their shape apart from the anchors they
+/// share with those segments. Coordinates that differ stay at least 1 point apart within a subpath,
+/// so no side collapses. Returns whether an anchor moved.
+pub(crate) fn snap_segments(path: &mut PathData, half: bool) -> bool {
+    let Some(moves) = segment_moves(path, half) else { return false };
+    for (sp, m) in path.subpaths.iter_mut().zip(moves) {
+        for (a, d) in sp.anchors.iter_mut().zip(m) {
+            if d.x != 0.0 || d.y != 0.0 {
+                a.translate(d);
+            }
+        }
+    }
+    true
+}
+
+/// How far [`snap_segments`] moves each anchor of each subpath of `path`, or `None` when it moves
+/// no anchor.
+fn segment_moves(path: &PathData, half: bool) -> Option<Vec<Vec<Vec2>>> {
+    let mut changed = false;
+    let mut moves = Vec::with_capacity(path.subpaths.len());
+    for sp in &path.subpaths {
+        let n = sp.anchors.len();
+        let (mut snap_x, mut snap_y) = (vec![false; n], vec![false; n]);
+        for i in 0..sp.segment_count() {
+            if !sp.segment_is_line(i) {
+                continue;
+            }
+            let (a, b) = (i % n, (i + 1) % n);
+            let (p, q) = (sp.anchors[a].p, sp.anchors[b].p);
+            let (dx, dy) = ((q.x - p.x).abs(), (q.y - p.y).abs());
+            if dy <= EPS && dx > EPS {
+                (snap_y[a], snap_y[b]) = (true, true);
+            } else if dx <= EPS && dy > EPS {
+                (snap_x[a], snap_x[b]) = (true, true);
+            }
+        }
+        let xs = snapped_values(sp.anchors.iter().zip(&snap_x).filter(|(_, s)| **s).map(|(a, _)| a.p.x), half);
+        let ys = snapped_values(sp.anchors.iter().zip(&snap_y).filter(|(_, s)| **s).map(|(a, _)| a.p.y), half);
+        let mut m = Vec::with_capacity(n);
+        for (i, a) in sp.anchors.iter().enumerate() {
+            let dx = if snap_x[i] { snapped(&xs, a.p.x) - a.p.x } else { 0.0 };
+            let dy = if snap_y[i] { snapped(&ys, a.p.y) - a.p.y } else { 0.0 };
+            changed |= dx != 0.0 || dy != 0.0;
+            m.push(Vec2::new(dx, dy));
+        }
+        moves.push(m);
+    }
+    changed.then_some(moves)
+}
+
+/// The coordinates `values` and where each snaps to, in increasing order: the nearest whole point
+/// (`half`: half point), and at least 1 point past where the coordinate before it snaps when the
+/// two differ.
+fn snapped_values(values: impl Iterator<Item = f64>, half: bool) -> Vec<(f64, f64)> {
+    let mut sorted: Vec<f64> = values.filter(|v| v.is_finite()).collect();
+    sorted.sort_by(f64::total_cmp);
+    let mut out: Vec<(f64, f64)> = vec![];
+    for v in sorted {
+        match out.last() {
+            Some(&(last, _)) if v - last <= EPS => {}
+            Some(&(_, at)) => out.push((v, nearest(v, half).max(at + 1.0))),
+            None => out.push((v, nearest(v, half))),
+        }
+    }
+    out
+}
+
+/// The whole point (`half`: half point) nearest `v`. A whole point halfway between two half points
+/// goes to the half point above it, and a half point halfway between two whole points goes to the
+/// whole point below it, so that switching between the two returns a coordinate to where it was.
+fn nearest(v: f64, half: bool) -> f64 {
+    if half { (v + EPS).floor() + 0.5 } else { (v - 0.5 - EPS).ceil() }
+}
+
+/// Where coordinate `v` snaps to, from [`snapped_values`] (`v` itself when it is not listed). A
+/// coordinate merged into one listed is at most [`EPS`] past it.
+fn snapped(values: &[(f64, f64)], v: f64) -> f64 {
+    let i = values.partition_point(|(x, _)| *x < v - EPS);
+    values.get(i).filter(|(x, _)| (x - v).abs() <= EPS).map_or(v, |(_, to)| *to)
+}
diff --git a/crates/engine/src/cmd/object/shape.rs b/crates/engine/src/cmd/object/shape.rs
index eddc05763..2b32c5998 100644
--- a/crates/engine/src/cmd/object/shape.rs
+++ b/crates/engine/src/cmd/object/shape.rs
@@ -254,6 +254,9 @@ pub(super) fn set_live_shape(s: &mut Session, p: &Value) -> Result<Value> {
             };
             recut(path, live, partial, &picked, radius, kind);
         }
+        for id in &ids {
+            super::pixelgrid::resnap(d, *id);
+        }
         Ok(())
     })?;
     ok()
diff --git a/crates/engine/src/cmd/object/transform.rs b/crates/engine/src/cmd/object/transform.rs
index b400f637a..7940fc879 100644
--- a/crates/engine/src/cmd/object/transform.rs
+++ b/crates/engine/src/cmd/object/transform.rs
@@ -70,10 +70,12 @@ pub(crate) fn transforms_objects(p: &Value) -> bool {
 /// check them with [`check_switches`] before they change anything.
 pub(super) const TRANSFORM_SWITCHES: [&str; 6] = ["copy", "strokes", "corners", "patterns", "objects", "typeAreas"];
 
-/// `xf` on `n` with Transform Objects (`objects`, see [`transforms_objects`]) on or off.
+/// `xf` on `n` with Transform Objects (`objects`, see [`transforms_objects`]) on or off. The objects
+/// in `n` that are aligned to the pixel grid snap to it again ([`super::pixelgrid::keep_pixel_aligned`]).
 pub(crate) fn transform_node(n: &mut Node, xf: Affine, sc: Scaling, objects: bool) {
     if objects {
         n.transform(xf, sc);
+        super::pixelgrid::keep_pixel_aligned(n, sc);
     } else if sc.patterns {
         vectorcraft_doc::pattern::transform_patterns_only(n, xf);
     }
@@ -168,6 +170,11 @@ fn apply_transform_moving_guides(
                     transform_node(n, xf, sc, objects);
                 }
             }
+            if objects {
+                for id in &targets {
+                    super::pixelgrid::keep_compound_aligned(d, *id, sc);
+                }
+            }
             if with_guides && (delta.x != 0.0 || delta.y != 0.0) {
                 for i in sel.guides.clone() {
                     if let Some(g) = d.guides.get_mut(i) {
@@ -242,6 +249,11 @@ pub(super) fn transform(s: &mut Session, p: &Value) -> Result<Value> {
     check_switches(p, &TRANSFORM_SWITCHES, "object.transform")?;
     check_switches(p, &["anchors", "releaseOutside"], "object.transform")?;
     let m = matrix_param(p, "matrix").ok_or_else(|| bad("object.transform", "missing matrix [a,b,c,d,e,f]"))?;
+    // An object selected in a symbol instance's art stays where the symbol puts it: the selection
+    // is left as it is, and the reply's warning goes to the status bar.
+    if p.get("ids").is_none() && crate::cmd::brushsym::selected_part(s)?.is_some() {
+        return Ok(json!({ "warning": crate::cmd::brushsym::part_only().to_string() }));
+    }
     let (ids, anchors) = match ids_param(p, "ids") {
         Some(v) => (outermost(&s.doc()?.doc, v), false),
         None => (selected_roots_to_transform(s)?, bool_or(p, "anchors", false)),
diff --git a/crates/engine/src/cmd/objects_on_path.rs b/crates/engine/src/cmd/objects_on_path.rs
index e2bd0957d..1a36a4e29 100644
--- a/crates/engine/src/cmd/objects_on_path.rs
+++ b/crates/engine/src/cmd/objects_on_path.rs
@@ -82,9 +82,10 @@ fn groups_of(d: &Document, ids: &[NodeId]) -> Vec<NodeId> {
     out
 }
 
-/// The Objects on Path groups of the selection ([`groups_of`]).
+/// The Objects on Path groups of the selection ([`groups_of`]). None while an object of a dynamic
+/// symbol instance's art is selected.
 fn selected_groups(s: &Session) -> Vec<NodeId> {
-    s.active().map(|st| groups_of(&st.doc, &st.selection.objects)).unwrap_or_default()
+    s.active().filter(|st| st.selection.symbol_part.is_none()).map(|st| groups_of(&st.doc, &st.selection.objects)).unwrap_or_default()
 }
 
 /// The groups a command acts on: those of `ids` when given, otherwise those of the selection.
@@ -102,6 +103,7 @@ fn target_groups(s: &Session, p: &Value, cmd: &str) -> Result<Vec<NodeId>> {
 
 fn has_objects_on_path(s: &Session) -> std::result::Result<(), String> {
     has_selection(s)?;
+    super::edit::no_symbol_part(s)?;
     if selected_groups(s).is_empty() { Err("select an Objects on Path group".into()) } else { Ok(()) }
 }
 
@@ -312,13 +314,18 @@ fn expand(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// After an edit: put the objects of every Objects on Path group that changed back on its path
 /// ([`place`]), inner groups first. Only the parts of the tree that the edit changed are searched.
-pub(crate) fn refresh(before: &Document, doc: &mut Document) {
+/// Returns the groups that placing changed.
+pub(crate) fn refresh(before: &Document, doc: &mut Document) -> Vec<NodeId> {
     let mut groups = vec![];
     changed_groups(&before.layers, &doc.layers, &mut groups);
+    let mut placed = vec![];
     for id in groups.iter().rev() {
         follow_replacements(before, doc, *id);
-        place_in(doc, *id);
+        if place_in(doc, *id) {
+            placed.push(*id);
+        }
     }
+    placed
 }
 
 /// Members of the group `id` that the edit replaced with new art at the same index keep their
@@ -337,14 +344,17 @@ fn follow_replacements(before: &Document, doc: &mut Document, id: NodeId) {
 }
 
 /// [`place`] the Objects on Path group `id` of `doc`, measuring symbol instances by their art.
-fn place_in(doc: &mut Document, id: NodeId) {
-    let Some(n) = doc.node(id) else { return };
+/// Returns whether the group changed.
+fn place_in(doc: &mut Document, id: NodeId) -> bool {
+    let Some(n) = doc.node(id) else { return false };
     let mut g = n.clone();
     if place(&mut g, &doc.symbol_boxes())
         && let Some(slot) = doc.node_mut(id)
     {
         *slot = g;
+        return true;
     }
+    false
 }
 
 /// The Objects on Path groups among `after` and inside them that are not the same nodes as before
diff --git a/crates/engine/src/cmd/opacitymask.rs b/crates/engine/src/cmd/opacitymask.rs
index 7089770e4..b8b0138c5 100644
--- a/crates/engine/src/cmd/opacitymask.rs
+++ b/crates/engine/src/cmd/opacitymask.rs
@@ -34,7 +34,7 @@ pub fn specs() -> Vec<CommandSpec> {
             ["Window", "Transparency"],
             None,
             "{id?|ids?} put the mask art back above each masked object (default: the selection, or the object whose mask is being edited, which leaves mask editing)",
-            has_doc,
+            can_change_mask,
             release
         ),
         cmd!(
@@ -43,25 +43,22 @@ pub fn specs() -> Vec<CommandSpec> {
             ["Window", "Transparency"],
             None,
             "{id?|ids?} keep the mask but stop applying it",
-            has_doc,
+            can_change_mask,
             |s, p| set_flags(s, p, "Disable Opacity Mask", &json!({ "disabled": true }))
         ),
-        cmd!("transparency.enableOpacityMask", "Enable Opacity Mask", ["Window", "Transparency"], None, "{id?|ids?}", has_doc, |s, p| set_flags(
-            s,
-            p,
-            "Enable Opacity Mask",
-            &json!({ "disabled": false })
-        )),
+        cmd!("transparency.enableOpacityMask", "Enable Opacity Mask", ["Window", "Transparency"], None, "{id?|ids?}", can_change_mask, |s, p| {
+            set_flags(s, p, "Enable Opacity Mask", &json!({ "disabled": false }))
+        }),
         cmd!(
             "transparency.unlinkOpacityMask",
             "Unlink Opacity Mask",
             ["Window", "Transparency"],
             None,
             "{id?|ids?} the object moves without its mask",
-            has_doc,
+            can_change_mask,
             |s, p| set_flags(s, p, "Unlink Opacity Mask", &json!({ "linked": false }))
         ),
-        cmd!("transparency.linkOpacityMask", "Link Opacity Mask", ["Window", "Transparency"], None, "{id?|ids?}", has_doc, |s, p| set_flags(
+        cmd!("transparency.linkOpacityMask", "Link Opacity Mask", ["Window", "Transparency"], None, "{id?|ids?}", can_change_mask, |s, p| set_flags(
             s,
             p,
             "Link Opacity Mask",
@@ -73,7 +70,7 @@ pub fn specs() -> Vec<CommandSpec> {
             [],
             None,
             "{id?|ids?, clip?, invert?, disabled?, linked?} change the opacity masks of `ids`, the selection, or the object whose mask is being edited",
-            has_doc,
+            can_change_mask,
             |s, p| set_flags(s, p, "Opacity Mask Options", p)
         ),
         cmd!(
@@ -152,9 +149,21 @@ pub(crate) fn percent(o: f64) -> f32 {
     (o / 100.0).clamp(0.0, 1.0) as f32
 }
 
-/// The [`transparency_targets`] that have an opacity mask.
+/// Refuses a command that would change [`transparency_targets`] when they are the selection, without
+/// `id` or `ids` and outside mask editing, while an object of a dynamic symbol instance's art is
+/// selected: the instance's transparency and mask change only when the instance is selected.
+pub(crate) fn refuse_symbol_part_unnamed(s: &Session, p: &Value) -> Result<()> {
+    if p.get("ids").is_none() && p.get("id").is_none() && s.doc()?.doc.mask_edit.is_none() {
+        super::edit::refuse_symbol_part(s)?;
+    }
+    Ok(())
+}
+
+/// The [`transparency_targets`] that have an opacity mask, refused as
+/// [`refuse_symbol_part_unnamed`] says.
 fn masked_targets(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
     let d = &s.doc()?.doc;
+    refuse_symbol_part_unnamed(s, p)?;
     let ids: Vec<NodeId> = transparency_targets(s, p)?.into_iter().filter(|id| d.node(*id).is_some_and(|n| n.extras().mask.is_some())).collect();
     if ids.is_empty() {
         return Err(EngineError::Other("no target object has an opacity mask: select one or give `id`".into()));
@@ -162,6 +171,13 @@ fn masked_targets(s: &Session, p: &Value) -> Result<Vec<NodeId>> {
     Ok(ids)
 }
 
+/// The commands that change an existing opacity mask: a document is open, and outside mask editing
+/// no object of a dynamic symbol instance's art is selected ([`masked_targets`]).
+fn can_change_mask(s: &Session) -> std::result::Result<(), String> {
+    has_doc(s)?;
+    if s.active().is_some_and(|st| st.doc.mask_edit.is_some()) { Ok(()) } else { super::edit::no_symbol_part(s) }
+}
+
 /// Make Opacity Mask: a document is open, and one selected object, which [`make`] gives an empty
 /// mask and takes into mask editing, is where mask editing can be entered
 /// ([`super::maskedit::can_edit_mask`]: not in isolation mode or pattern editing mode). The
diff --git a/crates/engine/src/cmd/paint.rs b/crates/engine/src/cmd/paint.rs
index bbb5f35d3..19cdcfbbd 100644
--- a/crates/engine/src/cmd/paint.rs
+++ b/crates/engine/src/cmd/paint.rs
@@ -1,5 +1,7 @@
 //! Fill and stroke paint (the toolbar proxies and their defaults) and the Transparency panel.
 
+use std::borrow::Cow;
+
 use serde_json::{Value, json};
 use vectorcraft_color::{BlendMode, Color, GradientPaint, Paint};
 use vectorcraft_doc::{Appearance, CharStyle, Document, Node, NodeId, NodeKind};
@@ -19,7 +21,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Fill",
             [],
             None,
-            "{color?: \"#rrggbb\"|[r,g,b]|{c,m,y,k}|{gray}|{l,a,b} (CIE Lab; #rrggbbaa and #rgba are refused), none?: true, swatch?: name (a global or spot colour stays linked, so swatch edits recolour it; a tint swatch links to its base at its tint; a gradient swatch is recorded as the gradient's swatch and fits each object, keeping its aspect; the built-in \"[Registration]\" prints on every plate), tint?: 0..100 (% of a global or spot `swatch`; default 100, or a tint swatch's own), gradient?: {kind?: linear|radial|freeform, method?: classic|perceptual (as paint.editGradient; default classic), stops?: [{offset 0..1, color, opacity? 0..1 (or 0..100), midpoint? 0.13..0.87, swatch?: global or spot colour (or tint) swatch the stop links to (its colour comes from the swatch), tint?: 0..100}] (at least 2; default white→black), angle?: deg, start?: [x,y], end?: [x,y] (the vector in document coordinates, both or neither; type objects keep it in text space), aspect?: % (radial; without start/end the gradient is placed on each object's bounds), focal?: [x,y] (radial, with start/end: the focal point, where the first stop sits), dither?: bool (linear and radial fills: drawn with fine noise that hides banding, and as pixels in SVG and PDF exports; strokes ignore it), swatch?: linked gradient swatch name}, item?: appearance item index|null (omitted: the Appearance panel's active item if it is a fill, else the top fill), ids?|id?, focus?: true (false keeps the active proxy), keepModel?: false (in a CMYK document, RGB colours and gradient stops are stored as CMYK unless true; Gray stays Gray), target?: \"object\"|\"contents\", span?: \"object\" (default: each target fits a gradient to its own bounds)|\"selection\" (a linear or radial `gradient` without start/end is placed once on the union of the targets' bounds, so it runs across them)} sets the selection's fill and the default (new art fits a gradient to itself); a solid colour recolours only the gradient mesh point last clicked with the Mesh tool or Direct Selection; while the Type tool has characters selected (and no ids or item are given), the paint goes to those characters only; without `item`, a grayscale or 1-bit image takes a solid color as the color it is drawn in (white pixels transparent; `none` takes it off; an image with an alpha channel takes only a spot color, black or white) → {objects: how many objects took the paint (the objects inside a group, unless an appearance item of the group's own is targeted; 0 when only the default changed)}",
+            "{color?: \"#rrggbb\"|[r,g,b]|{c,m,y,k}|{gray}|{l,a,b} (CIE Lab; #rrggbbaa and #rgba are refused), none?: true, swatch?: name (a global or spot colour stays linked, so swatch edits recolour it; a tint swatch links to its base at its tint; a gradient swatch is recorded as the gradient's swatch and fits each object, keeping its aspect; the built-in \"[Registration]\" prints on every plate), tint?: 0..100 (% of a global or spot `swatch`; default 100, or a tint swatch's own), gradient?: {kind?: linear|radial|freeform, method?: classic|perceptual (as paint.editGradient; default classic), stops?: [{offset 0..1, color, opacity? 0..1 (or 0..100), midpoint? 0.13..0.87, swatch?: global or spot colour (or tint) swatch the stop links to (its colour comes from the swatch), tint?: 0..100}] (at least 2; default white→black), angle?: deg, start?: [x,y], end?: [x,y] (the vector in document coordinates, both or neither; type objects keep it in text space), aspect?: % (radial; without start/end the gradient is placed on each object's bounds), focal?: [x,y] (radial, with start/end: the focal point, where the first stop sits), dither?: bool (linear and radial fills: drawn with fine noise that hides banding, and as pixels in SVG and PDF exports; strokes ignore it), swatch?: linked gradient swatch name}, item?: appearance item index|null (omitted: the Appearance panel's active item if it is a fill, else the top fill), ids?|id?, focus?: true (false keeps the active proxy), keepModel?: false (in a CMYK document, RGB colours and gradient stops are stored as CMYK unless true; Gray stays Gray), target?: \"object\"|\"contents\", span?: \"object\" (default: each target fits a gradient to its own bounds)|\"selection\" (a linear or radial `gradient` without start/end is placed once on the union of the targets' bounds, so it runs across them)} sets the selection's fill and the default (new art fits a gradient to itself); a solid colour recolours only the gradient mesh point last clicked with the Mesh tool or Direct Selection; while the Type tool has characters selected (and no ids or item are given), the paint goes to those characters only; without `item`, a grayscale or 1-bit image takes a solid color as the color it is drawn in (white pixels transparent; `none` takes it off; an image with an alpha channel takes only a spot color, black or white); with an object of a dynamic symbol instance selected by Direct Selection and no ids, id or item, a solid color or `none` changes that object for this instance only, and a gradient or pattern is refused → {objects: how many objects took the paint (the objects inside a group, unless an appearance item of the group's own is targeted; 0 when only the default changed)}",
             has_doc,
             |s, p| set_paint(s, p, true)
         ),
@@ -28,7 +30,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Stroke",
             [],
             None,
-            "{…as paint.setFill, item?: the stroke item to set} same as paint.setFill, for the stroke",
+            "{…as paint.setFill, item?: the stroke item to set} same as paint.setFill, for the stroke; with an object of a dynamic symbol instance selected by Direct Selection and no ids, id or item, a solid color or `none` changes that object for this instance only, and a gradient or pattern is refused",
             has_doc,
             |s, p| { set_paint(s, p, false) }
         ),
@@ -37,7 +39,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Swap Fill and Stroke",
             [],
             Some("Shift+X"),
-            "{ids?|id?} swap the fill and stroke of the selection (type too) and of the defaults",
+            "{ids?|id?} swap the fill and stroke of the selection (type too) and of the defaults. On a path directly in a graph series, the graph also stores the swapped paints and the stroke weight (exceptions: docs/mcp.md)",
             has_doc,
             swap
         ),
@@ -46,7 +48,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Default Fill and Stroke",
             [],
             Some("D"),
-            "{ids?|id?} white fill and 1 pt black stroke for the selection and the defaults; type gets black fill and no stroke",
+            "{ids?|id?} white fill and 1 pt black stroke for the selection and the defaults; type gets black fill and no stroke. On a path directly in a graph series, the graph also stores the paint, weight and opacity of the topmost visible fill and stroke (exceptions: docs/mcp.md)",
             has_doc,
             default_paint
         ),
@@ -86,7 +88,7 @@ pub fn proxy_specs() -> Vec<CommandSpec> {
             "Invert",
             [],
             None,
-            "{stroke?: bool (default: the active proxy), ids?|id?, item?: appearance item index|null, target?: \"object\"|\"contents\"} invert the active proxy's colours of the selection (or ids; groups recolour their contents) keeping each colour's model, as edit.colors.invert does; the Appearance panel's active fill/stroke item (appearance.setActiveItem) is inverted instead when it is of that kind and no ids are given; with nothing selected, invert the default → {changed}",
+            "{stroke?: bool (default: the active proxy), ids?|id?, item?: appearance item index|null, target?: \"object\"|\"contents\"} invert the active proxy's colours of the selection (or ids; groups recolour their contents) keeping each colour's model, as edit.colors.invert does; the Appearance panel's active fill/stroke item (appearance.setActiveItem) is inverted instead when it is of that kind and no ids are given; with an object of a dynamic symbol instance selected by Direct Selection and no ids, id or item, that object's solid color changes for this instance only, and a gradient or pattern, or type whose characters differ in color, is refused; with nothing selected, invert the default → {changed}",
             has_doc,
             |s, p| proxy_recolor(s, p, "paint.invert", "Invert", &super::colorcmds::invert)
         ),
@@ -95,7 +97,7 @@ pub fn proxy_specs() -> Vec<CommandSpec> {
             "Complement",
             [],
             None,
-            "{stroke?: bool (default: the active proxy), ids?|id?, item?: appearance item index|null, target?: \"object\"|\"contents\"} replace the active proxy's colours by their complements ((highest + lowest) − each component, over RGB or CMY; grey unchanged) keeping each colour's model; honours the Appearance panel's active item as paint.invert does; with nothing selected, the default → {changed}",
+            "{stroke?: bool (default: the active proxy), ids?|id?, item?: appearance item index|null, target?: \"object\"|\"contents\"} replace the active proxy's colours by their complements ((highest + lowest) − each component, over RGB or CMY; grey unchanged) keeping each colour's model; honours the Appearance panel's active item and a selected object of a dynamic symbol instance as paint.invert does; with nothing selected, the default → {changed}",
             has_doc,
             |s, p| proxy_recolor(s, p, "paint.complement", "Complement", &|c: Color| c.complement_keep_model())
         ),
@@ -172,7 +174,7 @@ impl Session {
     /// new art.
     pub fn proxy_paints(&self) -> (Paint, Paint) {
         let show = |stroke: bool| match self.proxy_source(stroke) {
-            Some((n, item)) => proxy_paint(n, stroke, item),
+            Some((n, item)) => proxy_paint(&n, stroke, item),
             None if stroke => self.paint.stroke.clone(),
             None => self.paint.fill.clone(),
         };
@@ -180,17 +182,22 @@ impl Session {
     }
 
     /// The object whose fill (or stroke) the proxy shows, with the Appearance panel's active item
-    /// when it stands for it (see [`Session::proxy_paints`]); None: the defaults for new art.
-    pub(crate) fn proxy_source(&self, stroke: bool) -> Option<(&Node, Option<usize>)> {
+    /// when it stands for it (see [`Session::proxy_paints`]); None: the defaults for new art. With
+    /// an object of a dynamic symbol instance selected ([`DocState::selected_symbol_part`]), that
+    /// object as the instance draws it.
+    pub(crate) fn proxy_source(&self, stroke: bool) -> Option<(Cow<'_, Node>, Option<usize>)> {
         let st = self.active()?;
+        if let Some(part) = st.selected_symbol_part() {
+            return Some((Cow::Owned(part), None));
+        }
         let first = st.doc.node(*st.selection.subjects().first()?)?;
         let item = self.appearance_item();
         if first.appearance.item_of_kind(item, !stroke).is_some() {
-            return Some((first, item));
+            return Some((Cow::Borrowed(first), item));
         }
         let mut nodes = vec![];
         painted(first, true, &mut nodes);
-        nodes.first().map(|n| (*n, None))
+        nodes.first().map(|n| (Cow::Borrowed(*n), None))
     }
 
     pub(crate) fn remember_paint_now(&mut self, p: &Paint) {
@@ -257,6 +264,9 @@ impl DocState {
         if self.selection.is_empty() {
             return (false, false);
         }
+        if self.selection.symbol_part.is_some() {
+            return (false, false);
+        }
         let ids: std::collections::HashSet<NodeId> = self.selection.objects.iter().copied().collect();
         let (mut selected, mut nodes) = (vec![], vec![]);
         self.doc.walk(|n| {
@@ -275,6 +285,18 @@ impl DocState {
         };
         (differ(false), differ(true))
     }
+
+    /// The object of a dynamic symbol instance's art selected with Direct Selection
+    /// ([`vectorcraft_doc::Selection::symbol_part`]), with the instance's own appearance changes
+    /// applied, in the symbol's coordinates. `None` without one.
+    pub(crate) fn selected_symbol_part(&self) -> Option<Node> {
+        let sp = self.selection.symbol_part.as_ref()?;
+        let inst = self.doc.node(sp.instance)?;
+        let NodeKind::SymbolInstance { symbol, .. } = &inst.kind else { return None };
+        let sym = self.doc.symbols.iter().find(|s| s.name == *symbol)?;
+        let art = vectorcraft_doc::symbol_overrides::dynamic_art(&sym.art, inst);
+        vectorcraft_doc::symbol_overrides::part(&art, &sp.path).cloned()
+    }
 }
 
 impl Session {
@@ -465,6 +487,26 @@ pub(crate) fn apply_paint(s: &mut Session, p: &Value, paint: Paint, fill: bool)
         s.remember_paint(&paint);
         return Ok(json!({"objects": ids.len()}));
     }
+    // An object of a dynamic symbol instance's art selected with Direct Selection: a solid color or
+    // none changes that object for this instance only, and anything else is refused.
+    if let Some((id, path)) = selected_part_target(s, p, cmd)? {
+        if !part_takes(&paint) {
+            return Err(super::brushsym::part_only());
+        }
+        super::brushsym::edit_part(s, id, &path, if fill { "Fill Color" } else { "Stroke Color" }, |o| {
+            if fill {
+                o.fill = Some(paint.clone());
+            } else {
+                o.stroke = Some(paint.clone());
+            }
+        })?;
+        paint_new_art(s, &paint, fill);
+        if focus {
+            s.fill_active = fill;
+        }
+        s.remember_paint(&paint);
+        return Ok(json!({"objects": 1}));
+    }
     // Resolve the requested targets before mutating defaults or the active proxy.
     let item = item_target(s, p, cmd)?.of_kind(s, fill);
     let selected = item.targets(s, p)?;
@@ -535,6 +577,9 @@ pub(crate) fn apply_paint(s: &mut Session, p: &Value, paint: Paint, fill: bool)
                 // A stroke without paint has no weight; painting it again restores the 1 pt default.
                 stroke.width = 0.0;
             }
+            if !fill {
+                super::object::snap_if_aligned(n);
+            }
             Ok(())
         },
         |d, changed| {
@@ -553,15 +598,7 @@ pub(crate) fn apply_paint(s: &mut Session, p: &Value, paint: Paint, fill: bool)
         },
     )?;
     // Rejected edits leave the next shape's appearance and active proxy untouched.
-    // New art takes an unplaced gradient so that it fits the new object's own bounds.
-    if fill {
-        s.paint.fill = unplaced(&paint);
-    } else {
-        if !paint.is_none() && s.paint.stroke.is_none() && s.paint.stroke_width == 0.0 {
-            s.paint.stroke_width = 1.0;
-        }
-        s.paint.stroke = unplaced(&paint);
-    }
+    paint_new_art(s, &paint, fill);
     if focus {
         s.fill_active = fill;
     }
@@ -569,6 +606,39 @@ pub(crate) fn apply_paint(s: &mut Session, p: &Value, paint: Paint, fill: bool)
     Ok(json!({"objects": ids.iter().collect::<std::collections::BTreeSet<_>>().len()}))
 }
 
+/// The instance whose object is selected with Direct Selection, and that object's path
+/// ([`super::brushsym::selected_part`]), when `p` names no `ids`, `id` or `item`: the paint commands
+/// then change that object. A bad `target` or `aligned` is refused as it is for any other selection.
+fn selected_part_target(s: &Session, p: &Value, cmd: &str) -> Result<Option<(NodeId, Vec<u32>)>> {
+    if p.get("ids").is_some() || p.get("id").is_some() || p.get("item").is_some() {
+        return Ok(None);
+    }
+    let part = super::brushsym::selected_part(s)?;
+    if part.is_some() {
+        item_target(s, p, cmd)?;
+    }
+    Ok(part)
+}
+
+/// Can an object of a dynamic symbol instance's art selected with Direct Selection take `paint`? A
+/// solid color or none can; a gradient or pattern cannot.
+pub(crate) fn part_takes(paint: &Paint) -> bool {
+    matches!(paint, Paint::Solid { .. } | Paint::None)
+}
+
+/// Make `paint` the fill or stroke of new art. New art takes an unplaced gradient so that it fits
+/// the new object's own bounds, and a painted stroke on art that had none gets the 1 pt default.
+fn paint_new_art(s: &mut Session, paint: &Paint, fill: bool) {
+    if fill {
+        s.paint.fill = unplaced(paint);
+    } else {
+        if !paint.is_none() && s.paint.stroke.is_none() && s.paint.stroke_width == 0.0 {
+            s.paint.stroke_width = 1.0;
+        }
+        s.paint.stroke = unplaced(paint);
+    }
+}
+
 /// Does `p` ask for `span: "selection"` (#2127)? Only a linear or radial gradient the targets
 /// would each fit to their own bounds can span them: one with its own vector (`start`/`end`),
 /// a freeform one or a gradient swatch already has its placement.
@@ -784,7 +854,9 @@ fn swap(s: &mut Session, p: &Value) -> Result<Value> {
                 restore_unpainted_stroke(&mut n.appearance, None, &f);
                 n.appearance.set_stroke(f);
             }
-            Ok(super::appearance::count_changed(d, &before, &ids))
+            // The swap writes the paint of the topmost fill and stroke, not their opacity.
+            let kept = super::appearance::capture_series_writes(&before, d, &ids, (true, true), (false, false), true);
+            Ok(super::appearance::count_changed(d, &before, &ids) + usize::from(kept))
         })?;
     }
     if s.paint.stroke.is_none() && !s.paint.fill.is_none() && s.paint.stroke_width == 0.0 {
@@ -812,7 +884,8 @@ fn default_paint(s: &mut Session, p: &Value) -> Result<Value> {
                     _ => n.appearance = Appearance::default_art().into(),
                 }
             }
-            Ok(super::appearance::count_changed(d, &before, &ids))
+            let kept = super::appearance::capture_series_writes(&before, d, &ids, (true, true), (true, true), false);
+            Ok(super::appearance::count_changed(d, &before, &ids) + usize::from(kept))
         })?;
     }
     super::newart::reset(s);
@@ -824,6 +897,32 @@ fn default_paint(s: &mut Session, p: &Value) -> Result<Value> {
 /// active item of the proxy's kind is recoloured in each selected object's own stack instead.
 fn proxy_recolor(s: &mut Session, p: &Value, cmd: &str, label: &str, f: &dyn Fn(Color) -> Color) -> Result<Value> {
     let stroke = stroke_param(s, p, cmd)?;
+    // An object of a dynamic symbol instance's art selected with Direct Selection: the solid color
+    // it shows is recolored for this instance only. A gradient or pattern is refused, and so is type
+    // whose characters differ in that paint, since one change holds one paint.
+    if let Some((id, path)) = selected_part_target(s, p, cmd)? {
+        let part = s.doc()?.selected_symbol_part();
+        let mut paint = part.as_ref().map_or(Paint::None, |n| proxy_paint(n, stroke, None));
+        let runs_differ = match part.as_ref().map(|n| &n.kind) {
+            Some(NodeKind::Text(t)) => t.runs.iter().any(|r| !same_in_proxy(if stroke { &r.style.stroke } else { &r.style.fill }, &paint)),
+            _ => false,
+        };
+        if runs_differ || !part_takes(&paint) {
+            return Err(super::brushsym::part_only());
+        }
+        let changed = super::colorcmds::map_paint(&mut paint, f);
+        if changed {
+            super::brushsym::edit_part(s, id, &path, label, |o| {
+                if stroke {
+                    o.stroke = Some(paint.clone());
+                } else {
+                    o.fill = Some(paint.clone());
+                }
+            })?;
+            s.remember_paint(&paint);
+        }
+        return Ok(json!({ "changed": changed as usize }));
+    }
     let ids = match super::given_objects(s, p, cmd)? {
         Some(ids) => ids,
         None => super::edit::selected_roots(s)?,
@@ -863,6 +962,7 @@ fn proxy_recolor(s: &mut Session, p: &Value, cmd: &str, label: &str, f: &dyn Fn(
 
 fn transparency(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "transparency.set";
+    super::opacitymask::refuse_symbol_part_unnamed(s, p)?;
     let ids = super::opacitymask::transparency_targets(s, p)?;
     if ids.is_empty() {
         return Err(bad(C, "select objects or give ids"));
diff --git a/crates/engine/src/cmd/panelcmds.rs b/crates/engine/src/cmd/panelcmds.rs
index 6eeafd7c3..052a5c69c 100644
--- a/crates/engine/src/cmd/panelcmds.rs
+++ b/crates/engine/src/cmd/panelcmds.rs
@@ -16,7 +16,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Duplicate Artboard",
             ["Window", "Artboards"],
             None,
-            "{index?: n | indices?: [n…] (default: the artboards the Artboard tool has selected), selectedArtboards?: [n…] (the journal records that default here, for a replay), art?: bool (default: the Artboard tool's moveArt option), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles), lockedAndHidden?: bool (locked and hidden art goes too; default: prefs moveLockedWithArtboard)} a copy of each artboard, the copies placed together right of the last artboard as they lay, with copies of the art fully inside each when `art`, in one undo step → {index: the first copy's index, indices: the copies' indices, ids: the art's copies}",
+            "{index?: n | indices?: [n…] (default: the artboards the Artboard tool has selected), selectedArtboards?: [n…] (the journal records that default here, for a replay), art?: bool (default: the Artboard tool's moveArt option), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles), lockedAndHidden?: bool (locked and hidden art goes too; default: prefs moveLockedWithArtboard), side?: \"left\"|\"right\"|\"top\"|\"bottom\" (the copies go together on that side of the artboards they copy, 20 pt away)} a copy of each artboard, the copies placed together right of the last artboard as they lay (or on `side`), with copies of the art fully inside each when `art`, in one undo step → {index: the first copy's index, indices: the copies' indices, ids: the art's copies}",
             has_doc,
             artboard_duplicate
         ),
@@ -297,9 +297,11 @@ pub(crate) fn beside_artboards(d: &vectorcraft_doc::Document, rect: Rect) -> Vec
 }
 
 /// Duplicate Artboards: a copy of each artboard with its art, in one undo step. The copies keep
-/// their places relative to each other, together right of the last artboard.
+/// their places relative to each other, together right of the last artboard, or with `side`
+/// together on that side of the artboards they copy.
 fn artboard_duplicate(s: &mut Session, p: &Value) -> Result<Value> {
     check_switches(p, &["patterns"], "artboard.duplicate")?;
+    let side = super::layer::artboard_side(p, "artboard.duplicate")?;
     let (indices, art) = boards_and_art_noted(s, p, "artboard.duplicate")?;
     let locked_art = locked_and_hidden(s, p, art, "artboard.duplicate")?;
     let arts = artboards_art(s, &indices, art, locked_art, false)?;
@@ -311,7 +313,7 @@ fn artboard_duplicate(s: &mut Session, p: &Value) -> Result<Value> {
             .filter_map(|(i, _)| d.artboards.get(*i))
             .map(|a| a.rect)
             .reduce(|a, b| a.union(b))
-            .map(|r| beside_artboards(d, r))
+            .map(|r| side.map_or_else(|| beside_artboards(d, r), |side| side.offset(r)))
             .unwrap_or_default();
         let (mut index, mut ids) = (vec![], vec![]);
         for (i, art) in &arts {
@@ -375,7 +377,10 @@ pub(crate) fn copy_artboard(d: &mut vectorcraft_doc::Document, i: usize, dv: Vec
     if let Some(id) = d.artboards.get(index).map(|a| a.id) {
         d.copy_artboard_guides(src.id, id, dv);
     }
-    let copies = super::edit::copy_above(d, art, |_, _, c| c.transform(Affine::translate(dv), sc))?;
+    let copies = super::edit::copy_above(d, art, |_, _, c| {
+        c.transform(Affine::translate(dv), sc);
+        super::object::keep_pixel_aligned(c, sc);
+    })?;
     Ok((index, copies))
 }
 
diff --git a/crates/engine/src/cmd/params.rs b/crates/engine/src/cmd/params.rs
index f2338d139..1d0601364 100644
--- a/crates/engine/src/cmd/params.rs
+++ b/crates/engine/src/cmd/params.rs
@@ -279,6 +279,29 @@ pub fn check_effect_params(id: &str, effect: &str, params: &Value) -> Result<()>
             _ => {}
         }
     }
+    // An SVG filter's XML is one drawable <filter> element.
+    if effect == vectorcraft_render::effects::SVG_FILTER
+        && let Some(xml) = given.get("xml")
+    {
+        let xml = xml.as_str().ok_or_else(|| bad(id, "`xml` must be a string"))?;
+        vectorcraft_render::effects::svg_filter::check(xml).map_err(|e| bad(id, e))?;
+    }
+    if effect == vectorcraft_render::effects::SVG_FILTER
+        && let Some(scale) = given.get("scale")
+        && !scale.as_f64().is_some_and(|k| (0.001..=1000.0).contains(&k))
+    {
+        return Err(bad(id, "`scale` must be a number from 0.001 to 1000"));
+    }
+    if effect == vectorcraft_render::effects::SVG_FILTER
+        && let Some(origin) = given.get("origin")
+        && !origin.as_array().is_some_and(|o| o.len() == 2 && o.iter().all(|v| v.as_f64().is_some_and(f64::is_finite)))
+    {
+        return Err(bad(id, "`origin` must be [x, y] in points"));
+    }
+    // Its name is the filter's id.
+    if effect == vectorcraft_render::effects::SVG_FILTER && given.contains_key("name") && !given.contains_key("xml") {
+        return Err(bad(id, "an SVG filter is named by its id: give `xml` with `name`"));
+    }
     check_effect_color(id, effect, params)?;
     check_effect_channel(id, effect, params)
 }
diff --git a/crates/engine/src/cmd/path.rs b/crates/engine/src/cmd/path.rs
index e0de6bd4a..fb81e1e49 100644
--- a/crates/engine/src/cmd/path.rs
+++ b/crates/engine/src/cmd/path.rs
@@ -40,7 +40,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Move Anchors",
             [],
             None,
-            "{dx, dy, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the objects that move whole; default: prefs transformPatternTiles)} move direct-selected anchors (whole paths if fully selected)",
+            "{dx, dy, patterns?: bool (Transform Patterns: pattern fills and strokes transform with the objects that move whole; default: prefs transformPatternTiles)} move direct-selected anchors (whole paths if fully selected); refused while an object of a symbol instance's art is selected",
             has_selection,
             move_anchors
         ),
@@ -226,6 +226,8 @@ fn close(s: &mut Session, p: &Value) -> Result<Value> {
 pub(crate) fn move_anchors(s: &mut Session, p: &Value) -> Result<Value> {
     let d = Vec2::new(number_or(p, "dx", 0.0, "path.moveAnchors")?, number_or(p, "dy", 0.0, "path.moveAnchors")?);
     check_switches(p, &["patterns"], "path.moveAnchors")?;
+    // An object selected in a symbol instance's art stays where the symbol puts it.
+    super::edit::refuse_symbol_part(s)?;
     // Objects selected whole move as objects, and their pattern tiles move with them when
     // `patterns` (default: General › Transform Pattern Tiles) is on.
     let whole = s.doc()?.selection.whole();
@@ -260,11 +262,19 @@ pub(crate) fn transform_anchors(s: &mut Session, label: &str, xf: vectorcraft_ge
                             *a = a.transform(xf);
                         }
                     }
+                    // A pixel-aligned path, or the pixel-aligned compound path that holds it, snaps
+                    // to the pixel grid again after its anchors move.
+                    let top = compound_or_self(doc, *id);
+                    if let Some(n) = doc.node_mut(top) {
+                        super::object::snap_if_aligned(n);
+                    }
                 }
                 None => {
                     if let Some(n) = doc.node_mut(*id) {
                         n.transform(xf, sc);
+                        super::object::keep_pixel_aligned(n, sc);
                     }
+                    super::object::keep_compound_aligned(doc, *id, sc);
                 }
             }
         }
@@ -306,6 +316,12 @@ fn move_anchor(s: &mut Session, p: &Value) -> Result<Value> {
         let path = path_mut(d, id)?;
         let a = path.anchor_mut(si, ai).ok_or_else(|| EngineError::Other("no such anchor".into()))?;
         *a = a.transform(vectorcraft_geom::Affine::translate(pos - a.p));
+        // A pixel-aligned path, or the pixel-aligned compound path that holds it, snaps to the
+        // pixel grid again.
+        let top = compound_or_self(d, id);
+        if let Some(n) = d.node_mut(top) {
+            super::object::snap_if_aligned(n);
+        }
         Ok(())
     })?;
     ok()
@@ -335,13 +351,14 @@ fn set_anchors(s: &mut Session, p: &Value) -> Result<Value> {
     );
     s.edit("Reshape", |d, _| {
         *path_mut(d, id)? = data;
+        super::object::resnap(d, id);
         Ok(())
     })?;
     ok()
 }
 
 /// The compound path enclosing `id`, or `id` itself if it is not inside a compound path.
-pub(super) fn compound_or_self(d: &Document, id: NodeId) -> NodeId {
+pub(crate) fn compound_or_self(d: &Document, id: NodeId) -> NodeId {
     d.parent_of(id).filter(|p| matches!(d.node(*p).map(|n| &n.kind), Some(NodeKind::Compound { .. }))).unwrap_or(id)
 }
 
diff --git a/crates/engine/src/cmd/patterncmds.rs b/crates/engine/src/cmd/patterncmds.rs
index 614a37d21..1e7f88d2b 100644
--- a/crates/engine/src/cmd/patterncmds.rs
+++ b/crates/engine/src/cmd/patterncmds.rs
@@ -189,8 +189,10 @@ fn has_selection_or_ids(s: &Session) -> std::result::Result<(), String> {
     has_doc(s)
 }
 
+/// The repeats of the selection: selected ones, and those around a selected object. None while
+/// an object of a dynamic symbol instance's art is selected.
 fn selected_repeats(s: &Session) -> Vec<NodeId> {
-    let Some(st) = s.active() else { return vec![] };
+    let Some(st) = s.active().filter(|st| st.selection.symbol_part.is_none()) else { return vec![] };
     let mut out = vec![];
     for id in &st.selection.objects {
         for a in st.doc.ancestry(*id).unwrap_or_default().into_iter().rev() {
@@ -207,6 +209,7 @@ fn selected_repeats(s: &Session) -> Vec<NodeId> {
 
 fn has_repeat(s: &Session) -> std::result::Result<(), String> {
     has_selection(s)?;
+    super::edit::no_symbol_part(s)?;
     if selected_repeats(s).is_empty() { Err("select a repeat".into()) } else { Ok(()) }
 }
 
diff --git a/crates/engine/src/cmd/place.rs b/crates/engine/src/cmd/place.rs
index 0de33a22c..40d176ab8 100644
--- a/crates/engine/src/cmd/place.rs
+++ b/crates/engine/src/cmd/place.rs
@@ -66,7 +66,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Place…",
             ["File"],
             Some("Cmd+Shift+P"),
-            "{path | name | dataBase64 (a file's path, or its name with its bytes), link?: true (a raster image keeps its file's path; a VectorCraft document at path becomes one locked placed document showing artboard `page`, linked to the file and read again when it changes (links.update; saving it in this app updates it at once), drawn as vectors in every output; so does a PDF/.ai page at path, showing its `crop` box, unless password or textAs: \"outlines\" is given; false: an editable copy of its art, as from dataBase64; other files are embedded), text?: {characterSet?: \"unicode\" (UTF-8, or UTF-16 with a byte-order mark; other bytes as the platform's 8-bit set) | \"ansi\" (the platform's 8-bit set), platform?: \"windows\" (Windows-1252) | \"mac\" (Mac Roman), removeLineReturns?: false (each block of lines becomes one paragraph; blank lines end paragraphs), removeParagraphReturns?: false (drop blank lines), replaceSpaces?: n (runs of n ≥ 2 spaces become a tab)} (a .txt file, placed as area type filling rect, the replaced object's bounds, or else the artboard less a 36 pt margin), template?: false (onto a new locked template layer below the current layer), replace?: false (swap the one selected object, keeping its stacking place and transform; no at/rect), at?: [x, y] centre (default: the first artboard's centre), rect?: [x, y, width, height] fit inside; aspect kept (wins over at), page?: 1 (PDF/.ai page, or a native document's artboard), crop?: \"crop\" (clipped to that page or artboard, default; an SVG, only when given: framed and clipped by its viewBox, else by its art's bounds) | \"bounding\" (the bounds of the art that shows, with its strokes and effects, as an export measures them: hidden objects and guides left out) | \"art\" | \"trim\" | \"bleed\" | \"media\" (a PDF page's boxes), password? (an encrypted PDF), dxf?: {…the DXF options of document.open} (a .dxf drawing: fit fills the artboard under at, else the first; fitted or uncentred art lands with its drawing's artboard on that artboard, else it is centred on at)} → {ids, name, format, linked, width, height, warnings}. Raster images come in at 100% of their physical size (the file's ppi, else 72); SVG, DXF, PDF/.ai, EMF/WMF (clipped to the picture's frame), EPS (clipped to its bounding box; as document.open reads it), a .ai saved without PDF compatibility (from its editing data, as document.open reads it: the art of the layers that show on artboard `page`, clipped to that artboard unless crop is \"bounding\") and native documents as one group, with the images, symbols, patterns, swatches and brushes they use. One undo step; selects what it placed (unless on a template layer); never touches the clipboard. A PNG, JPEG, GIF or WebP image whose pixels can't be read (a file cut short) is an error, and nothing is placed",
+            "{path | name | dataBase64 (a file's path, or its name with its bytes), link?: true (a raster image keeps its file's path; a VectorCraft document at path becomes one locked placed document showing artboard `page`, linked to the file and read again when it changes (links.update; saving it in this app updates it at once), drawn as vectors in every output; so does a PDF/.ai page at path, showing its `crop` box, unless password or textAs: \"outlines\" is given; false: an editable copy of its art, as from dataBase64; other files are embedded), text?: {characterSet?: \"unicode\" (UTF-8, or UTF-16 with a byte-order mark; other bytes as the platform's 8-bit set) | \"ansi\" (the platform's 8-bit set), platform?: \"windows\" (Windows-1252) | \"mac\" (Mac Roman), removeLineReturns?: false (each block of lines becomes one paragraph; blank lines end paragraphs), removeParagraphReturns?: false (drop blank lines), replaceSpaces?: n (runs of n ≥ 2 spaces become a tab)} (a .txt file, placed as area type filling rect, the replaced object's bounds, or else the artboard less a 36 pt margin), template?: false (onto a new locked template layer below the current layer), replace?: false (swap the one selected object, keeping its stacking place and transform; no at/rect; refused while an object of a symbol instance's art is selected), at?: [x, y] centre (default: the first artboard's centre), rect?: [x, y, width, height] fit inside; aspect kept (wins over at), page?: 1 (PDF/.ai page, or a native document's artboard), crop?: \"crop\" (clipped to that page or artboard, default; an SVG, only when given: framed and clipped by its viewBox, else by its art's bounds) | \"bounding\" (the bounds of the art that shows, with its strokes and effects, as an export measures them: hidden objects and guides left out) | \"art\" | \"trim\" | \"bleed\" | \"media\" (a PDF page's boxes), password? (an encrypted PDF), dxf?: {…the DXF options of document.open} (a .dxf drawing: fit fills the artboard under at, else the first; fitted or uncentred art lands with its drawing's artboard on that artboard, else it is centred on at)} → {ids, name, format, linked, width, height, warnings}. Raster images come in at 100% of their physical size (the file's ppi, else 72); SVG, DXF, PDF/.ai, EMF/WMF (clipped to the picture's frame), EPS (clipped to its bounding box; as document.open reads it), a .ai saved without PDF compatibility (from its editing data, as document.open reads it: the art of the layers that show on artboard `page`, clipped to that artboard unless crop is \"bounding\") and native documents as one group, with the images, symbols, patterns, swatches and brushes they use. One undo step; selects what it placed (unless on a template layer); never touches the clipboard. A PNG, JPEG, GIF or WebP image whose pixels can't be read (a file cut short) is an error, and nothing is placed",
             has_doc,
             place
         ),
@@ -308,8 +308,10 @@ pub(crate) fn pdf_art(
         read = Err(e);
     }
     let (mut doc, warnings, alone) = fileio::page_or_editing_data(src, bytes, &o, index, read).map_err(|e| bad(cmd, format!("{name}: {e}")))?;
-    if alone {
-        // Linked images show their files, found from its folder.
+    // Linked images show their files, found from its folder. Its placed documents can place this
+    // file again: one already being read further up, or past the most nested reads, keeps its links
+    // as stored, as a VectorCraft document's do.
+    if alone && let Some(_reading) = document::Reading::enter(bytes) {
         super::links::resolve(&mut doc, path, false, false);
     }
     doc.drop_edit_modes();
@@ -534,7 +536,7 @@ impl Session {
             if st.doc.node(old) != read.job.replaced.as_ref() {
                 return Err(bad(PLACE, "replace: the object to replace was changed or deleted"));
             }
-            if st.selection.objects != [old] {
+            if st.selection.objects != [old] || st.selection.symbol_part.is_some() {
                 self.execute("select.set", &json!({ "ids": [old.0] }))?;
             }
         }
@@ -565,6 +567,10 @@ fn prepare(s: &Session, p: &Value) -> Result<PlaceJob> {
     if corners.iter().flatten().any(|c| !(c.x.abs() <= MAX_COORD && c.y.abs() <= MAX_COORD)) {
         return Err(bad(PLACE, "at/rect lie outside the canvas"));
     }
+    // An object selected in a symbol instance's art can't be swapped, and its instance stays.
+    if replace {
+        super::edit::refuse_symbol_part(s)?;
+    }
     let st = s.doc()?;
     let old = match (replace, &st.selection.objects[..]) {
         (false, _) => None,
diff --git a/crates/engine/src/cmd/place/document.rs b/crates/engine/src/cmd/place/document.rs
index 9bc52c89b..bea33fcf3 100644
--- a/crates/engine/src/cmd/place/document.rs
+++ b/crates/engine/src/cmd/place/document.rs
@@ -157,11 +157,11 @@ std::thread_local! {
 }
 
 /// A document's links being resolved ([`READING`]): the entry goes when this does.
-struct Reading;
+pub(super) struct Reading;
 
 impl Reading {
     /// `None` when the document of `bytes` is already being read, or [`MAX_NESTED_READS`] are.
-    fn enter(bytes: &[u8]) -> Option<Self> {
+    pub(super) fn enter(bytes: &[u8]) -> Option<Self> {
         let hash = hash_bytes(bytes);
         READING.with_borrow_mut(|r| (r.len() < MAX_NESTED_READS && !r.contains(&hash)).then(|| r.push(hash))).map(|()| Reading)
     }
diff --git a/crates/engine/src/cmd/plugin.rs b/crates/engine/src/cmd/plugin.rs
index 61ad9e8cb..5405f02e7 100644
--- a/crates/engine/src/cmd/plugin.rs
+++ b/crates/engine/src/cmd/plugin.rs
@@ -33,7 +33,7 @@ use std::sync::{Arc, Mutex};
 
 use serde_json::{Map, Value, json};
 use vectorcraft_doc::{Effect, Node};
-use vectorcraft_plugins::{Budget, Kind, Plugin, effect, export, objects, registry};
+use vectorcraft_plugins::{Budget, Kind, Plugin, effect, export, objects, registry, safe_mode};
 
 use super::{CommandSpec, EngineError, NodeId, Result, Session, always, bad, cmd, has_doc, ids_param, str_param, switch_or};
 
@@ -142,7 +142,15 @@ impl FilterRun {
         let mut params = Value::Object(m.resolve_params(&plugin_params(p)).map_err(|e| bad(C, e.to_string()))?);
         let may = m.permissions();
         let st = s.doc()?;
-        let selected = ids_param(p, "ids").unwrap_or_else(|| st.selection.objects.clone());
+        // While an object of a dynamic symbol instance's art is selected, the selection is refused,
+        // as `selected_roots` refuses it.
+        let selected = match ids_param(p, "ids") {
+            Some(ids) => ids,
+            None => {
+                super::edit::refuse_symbol_part(s)?;
+                st.selection.objects.clone()
+            }
+        };
         // Without `doc.read` a filter is given no objects: it can only add new ones.
         let inputs = if may.contains(&Permission::DocRead) { objects::filter_targets(&st.doc, &selected) } else { Vec::new() };
         let parent = st.insertion_parent();
@@ -435,7 +443,21 @@ fn install(s: &mut Session, p: &Value) -> Result<Value> {
         s.store_grant(&m.id, Some(g));
     }
     // Installed plug-ins stay installed after a restart (#2541).
-    s.store_plugin(plugin.id(), &bytes);
+    let stored = s.store_plugin(plugin.id(), &bytes);
+    // Installing a disabled plug-in again (an updated version) turns it on for the next launch too,
+    // also when it is disabled by its stored file alone (it stopped a launch while loading). When
+    // the new version could not replace the stored file, the old one stays disabled.
+    let file = s.stored_plugin_file(plugin.id());
+    let mut changed = false;
+    if file.is_none() || stored {
+        changed = safe_mode::set_enabled(&safe_mode::Item::of(&plugin), true);
+        if let Some(file) = file {
+            changed |= safe_mode::set_enabled(&safe_mode::Item::file(file), true);
+        }
+    }
+    if changed {
+        s.store_disabled_plugins();
+    }
     Ok(describe(&registry::install(plugin)))
 }
 
@@ -472,7 +494,8 @@ static FOLDER: Mutex<Option<(String, Option<std::path::PathBuf>, Value)>> = Mute
 /// (startup, `prefs.set`). Native only.
 pub(crate) fn sync_prefs(s: &Session) {
     let folder = s.prefs.plugins_folder.trim();
-    if folder.is_empty() {
+    // In Safe Mode nothing loads, and the folder is loaded once it ends ([`load_prefs_folder`]).
+    if folder.is_empty() || safe_mode::active() {
         return;
     }
     let mut last = FOLDER.lock().unwrap_or_else(|e| e.into_inner());
@@ -482,8 +505,24 @@ pub(crate) fn sync_prefs(s: &Session) {
     *last = Some((folder.to_string(), s.plugin_dir.clone(), load_folder(s, folder)));
 }
 
+/// Turns Safe Mode on for `--safe-mode`, before the plug-in folder is attached: no plug-in loads or
+/// runs in this process from then on.
+pub fn start_in_safe_mode() {
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+}
+
+/// Loads the stored plug-ins and the Additional Plug-ins Folder preference: the app calls it when
+/// the user leaves the choice after a launch that stopped with Disable or Start Normally, which
+/// turns Safe Mode off first.
+pub fn load_prefs_folder(s: &mut Session) {
+    s.load_stored_plugins();
+    *FOLDER.lock().unwrap_or_else(|e| e.into_inner()) = None;
+    sync_prefs(s);
+}
+
 /// Loads the plug-ins in `folder`, those that list permissions only when `s` has them granted
-/// ([`Session::plugin_approved`], with the store's grants read once).
+/// ([`Session::plugin_approved`], with the store's grants read once) → its report; saves the
+/// disabled list when loading changed it.
 #[cfg(not(target_arch = "wasm32"))]
 fn load_folder(s: &Session, folder: &str) -> Value {
     if let Err(e) = crate::file_access::check_read(folder) {
@@ -498,6 +537,9 @@ fn load_folder(s: &Session, folder: &str) -> Value {
     };
     match registry::load_folder_where(std::path::Path::new(folder), allow, s.plugin_approver()) {
         Ok(r) => {
+            if r.disabled_changed {
+                s.store_disabled_plugins();
+            }
             json!({"folder": folder, "loaded": r.loaded, "failed": r.failed.iter().map(|(f, e)| json!({"file": f, "error": e})).collect::<Vec<_>>()})
         }
         Err(e) => json!({"folder": folder, "error": e.to_string()}),
@@ -528,7 +570,59 @@ fn reload(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn list(_: &mut Session, _: &Value) -> Result<Value> {
     let folder = FOLDER.lock().unwrap_or_else(|e| e.into_inner()).as_ref().map(|(_, _, r)| r.clone());
-    Ok(json!({"plugins": registry::list().iter().map(|p| describe(p)).collect::<Vec<_>>(), "folder": folder}))
+    let disabled: Vec<Value> = safe_mode::disabled().iter().map(safe_mode::Item::to_json).collect();
+    Ok(
+        json!({"plugins": registry::list().iter().map(|p| describe(p)).collect::<Vec<_>>(), "folder": folder, "safeMode": safe_mode::active(), "disabled": disabled}),
+    )
+}
+
+/// `plugin.safeMode`: whether Safe Mode is on and why, the plug-ins disabled for the next launch,
+/// and the plug-in the last launch was loading when it stopped while the user hasn't chosen yet.
+fn safe_mode_state(_: &mut Session, _: &Value) -> Result<Value> {
+    Ok(json!({
+        "active": safe_mode::active(),
+        "source": safe_mode::source().map(safe_mode::Source::name),
+        "disabled": safe_mode::disabled().iter().map(safe_mode::Item::to_json).collect::<Vec<_>>(),
+        "pendingItem": safe_mode::previous().map(|i| i.to_json()),
+    }))
+}
+
+/// `plugin.setEnabled`: turns a plug-in on or off for the next launch, by `id` or by `file` (a
+/// plug-in that stopped a launch while loading may be known by its file alone). It neither loads
+/// nor unloads anything now, and uninstalls nothing.
+fn set_enabled(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "plugin.setEnabled";
+    let Some(enabled) = p.get("enabled").and_then(Value::as_bool) else {
+        let key = "enabled";
+        return Err(bad(C, format!("`{key}` must be true or false")));
+    };
+    let text = |key: &str| match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(v)) => Ok(Some(v.trim().to_string()).filter(|v| !v.is_empty())),
+        Some(_) => Err(bad(C, format!("`{key}` must be a string"))),
+    };
+    // Turning on by id also matches the plug-in's stored file, which names it when it stopped a
+    // launch while loading.
+    let (item, stored) = match (text("id")?, text("file")?) {
+        (Some(id), _) => {
+            let stored = if enabled { s.stored_plugin_file(&id).map(safe_mode::Item::file) } else { None };
+            (registry::get(&id).map(|p| safe_mode::Item::of(&p)).unwrap_or(safe_mode::Item { id: Some(id), ..Default::default() }), stored)
+        }
+        (None, Some(file)) => (safe_mode::Item::file(file), None),
+        (None, None) => return Err(bad(C, "give `id` or `file` (see plugin.safeMode)")),
+    };
+    let items: Vec<&safe_mode::Item> = std::iter::once(&item).chain(stored.as_ref()).collect();
+    if enabled && !safe_mode::disabled().iter().any(|i| items.iter().any(|item| i.same(item))) {
+        return Err(bad(C, "that plug-in isn't disabled (see plugin.safeMode)"));
+    }
+    let mut changed = false;
+    for item in items {
+        changed |= safe_mode::set_enabled(item, enabled);
+    }
+    // Without a plug-in folder (a session confined to automation roots), or when the list there
+    // can't take the change, the change stays in this process and goes with the next change that saves.
+    let saved = !changed || s.store_disabled_plugins();
+    Ok(json!({"changed": changed, "saved": saved, "disabled": safe_mode::disabled().iter().map(safe_mode::Item::to_json).collect::<Vec<_>>()}))
 }
 
 fn info(_: &mut Session, p: &Value) -> Result<Value> {
@@ -549,8 +643,8 @@ fn remove(s: &mut Session, p: &Value) -> Result<Value> {
     if registry::remove(id) { Ok(json!({"removed": id})) } else { Err(err(vectorcraft_plugins::Error::NotFound(id.into()))) }
 }
 
-/// This module's commands: `plugin.list`, `.info`, `.run`, `.install`, `.inspect`, `.remove` and
-/// `.reload`.
+/// This module's commands: `plugin.list`, `.info`, `.run`, `.install`, `.inspect`, `.remove`,
+/// `.reload`, `.safeMode` and `.setEnabled`.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!(
@@ -558,7 +652,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "List Plug-ins",
             [],
             None,
-            "{} → {plugins: [{id, name, version, kind: \"filter\"|\"effect\"|\"exporter\", author, description, params (doc), paramsSchema, effect? (the effect id of a live effect: plugin.<id>), format? and extensions? (an exporter's format id, plugin.<id>, for document.export, and its file extensions), budget?: \"heavy\" (a filter that may compute for longer, see plugin.install's allowHeavy), size, source, permissions: [name] (what it may do: the ones its manifest lists, else the ones its kind implies; progress: it may report its progress, see Cancel and write log lines), hash (the module's SHA-256), api (the plug-in API level it was built for, 1 or 2)}], folder: the Additional Plug-ins Folder load report {folder, loaded, failed: [{file, error}]} | null}",
+            "{} → {plugins: [{id, name, version, kind: \"filter\"|\"effect\"|\"exporter\", author, description, params (doc), paramsSchema, effect? (the effect id of a live effect: plugin.<id>), format? and extensions? (an exporter's format id, plugin.<id>, for document.export, and its file extensions), budget?: \"heavy\" (a filter that may compute for longer, see plugin.install's allowHeavy), size, source, permissions: [name] (what it may do: the ones its manifest lists, else the ones its kind implies; progress: it may report its progress, see Cancel and write log lines), hash (the module's SHA-256), api (the plug-in API level it was built for, 1 or 2)}], folder: the Additional Plug-ins Folder load report {folder, loaded, failed: [{file, error}]} | null, safeMode: bool (no plug-in loads or runs, see plugin.safeMode), disabled: [{id, file, name, label}] (turned off for the next launch, see plugin.setEnabled)}",
             always,
             list
         ),
@@ -604,9 +698,27 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reload Plug-ins",
             ["Object", "Plug-ins"],
             None,
-            "{path?: a folder (default: the Additional Plug-ins Folder preference)} install every *.wasm in it (desktop; a bad module is reported and skipped, and so are a heavy filter and a plug-in that lists permissions the user hasn't granted this very module, its bytes included) → {folder, loaded: [id], failed: [{file, error}]}",
+            "{path?: a folder (default: the Additional Plug-ins Folder preference)} install every *.wasm in it (desktop; a bad module, and one disabled with plugin.setEnabled, is reported and skipped, and so are a heavy filter and a plug-in that lists permissions the user hasn't granted this very module, its bytes included; an error in Safe Mode) → {folder, loaded: [id], failed: [{file, error}]}",
             always,
             reload
         ),
+        cmd!(
+            query "plugin.safeMode",
+            "Safe Mode",
+            [],
+            None,
+            "{} → {active: bool (no plug-in loads or runs: plugin.install, .run, .reload and exporters fail, live effects draw their object's geometry unchanged and the objects keep their effects), source: \"flag\" (started with --safe-mode) | \"startup\" (the user chose Safe Mode, or hasn't chosen yet, after a launch that stopped while a plug-in was loading) | null, disabled: [{id, file, name, label}] (turned off for the next launch; id is null for one known only by its file), pendingItem: {id, file, name, label} | null (the plug-in the last launch was loading when it stopped, until the user chooses; it may not be what stopped it)}. Safe Mode is chosen at launch, never by a command",
+            always,
+            safe_mode_state
+        ),
+        cmd!(
+            query "plugin.setEnabled",
+            "Enable on Re-launch",
+            [],
+            None,
+            "{id | file: a plug-in as plugin.safeMode's disabled lists it, enabled: bool} turn a plug-in on or off for the next launch (Help › Safe Mode's Enable on Re-launch); nothing loads, unloads or is uninstalled now. Turning on by id also turns on the file the plug-in is stored in. Turning on one that isn't disabled is an error. plugin.install of a disabled plug-in turns it on → {changed, saved: false when the change isn't in the plug-in folder for the next launch (a session without one, or the list there can't be read or written or is full; it is saved with the next change that saves), disabled}",
+            always,
+            set_enabled
+        ),
     ]
 }
diff --git a/crates/engine/src/cmd/prefscmds.rs b/crates/engine/src/cmd/prefscmds.rs
index 0267725ef..60f0f4565 100644
--- a/crates/engine/src/cmd/prefscmds.rs
+++ b/crates/engine/src/cmd/prefscmds.rs
@@ -349,6 +349,7 @@ pub const PREF_SPECS: &[PrefSpec] = &[
     p!("openDocumentsAsTabs", "User Interface", "", "Open Documents As Tabs", bool),
     p!("largeTabs", "User Interface", "", "Large Tabs", bool),
     p!("systemTitleBar", "User Interface", "", "System Title Bar", bool),
+    p!("appTitleBar", "User Interface", "", "VectorCraft Title Bar on Every Desktop", bool),
     p!("uiScaling", "User Interface", "UI Scaling", "Scale", num(0.75, 2.0, "×")),
     p!("scaleCursorWithUi", "User Interface", "UI Scaling", "Scale Cursor Proportional to UI", bool),
     // `auto` or a language code the shell registers (`zh-hant`); the shell shows it as a dropdown.
diff --git a/crates/engine/src/cmd/rasterfx.rs b/crates/engine/src/cmd/rasterfx.rs
index 938d2643a..d41a4529b 100644
--- a/crates/engine/src/cmd/rasterfx.rs
+++ b/crates/engine/src/cmd/rasterfx.rs
@@ -455,8 +455,9 @@ fn placed_symbol(d: &Document, n: &Node) -> Option<Node> {
 enum Which {
     /// Every raster effect (PDF).
     All,
-    /// Effects SVG cannot represent faithfully, with their other raster effects.
-    Pixel { cmyk: bool },
+    /// Effects SVG cannot represent faithfully, with their other raster effects; `filters`: the SVG
+    /// written has filters (SVG Tiny 1.2 has none).
+    Pixel { cmyk: bool, filters: bool },
 }
 
 /// Has `n` (its own, its fills' or strokes') raster effects `which` turns into an image?
@@ -464,8 +465,14 @@ fn imaged(n: &Node, which: Which) -> bool {
     let fx = raster_fx(n);
     match which {
         Which::All => !fx.is_empty(),
-        Which::Pixel { cmyk } => {
-            fx.iter().any(|f| matches!(f, RasterFx::Pixel(_) | RasterFx::Rasterize(_)))
+        Which::Pixel { cmyk, filters } => {
+            // An SVG filter that is the object's last effect, and its only pixel effect, stays a filter.
+            let pixels = fx.iter().filter(|f| matches!(f, RasterFx::Pixel(_) | RasterFx::Rasterize(_))).count();
+            let live = filters
+                && pixels == 1
+                && effects::svg_filter::writes_live(&n.appearance.effects)
+                && fx.iter().any(|f| matches!(f, RasterFx::Pixel(effects::PixelFx::Svg(s)) if s.in_points() && (!s.measured() || fx.len() == 1) && s.writes_as_svg11()));
+            (pixels > 0 && !live)
                 || (fx.iter().any(|f| matches!(f, RasterFx::DropShadow { darkness: Some(_), .. })) && (cmyk || !simple_rgb_shadow_source(n, &fx)))
         }
     }
@@ -592,7 +599,13 @@ pub fn flatten_raster_effects(doc: &Document) -> Option<Document> {
 /// Mask…) or Rasterize are images as [`flatten_raster_effects`] makes them (SVG export: its
 /// filters draw the other raster effects live), or `None` when there are none.
 pub fn flatten_pixel_effects(doc: &Document) -> Option<Document> {
-    flatten(doc, &mut FlattenReport::new(Which::Pixel { cmyk: doc.color_mode == ColorMode::Cmyk }, doc))
+    flatten_pixel_effects_for(doc, true)
+}
+
+/// [`flatten_pixel_effects`] for SVG that has filters (`filters`) or not (SVG Tiny 1.2): without
+/// them an SVG filter (Effect › SVG Filters) also makes its object an image.
+pub fn flatten_pixel_effects_for(doc: &Document, filters: bool) -> Option<Document> {
+    flatten(doc, &mut FlattenReport::new(Which::Pixel { cmyk: doc.color_mode == ColorMode::Cmyk, filters }, doc))
 }
 
 fn flatten(doc: &Document, report: &mut FlattenReport) -> Option<Document> {
diff --git a/crates/engine/src/cmd/recolor.rs b/crates/engine/src/cmd/recolor.rs
index f4996f4ad..00b87c649 100644
--- a/crates/engine/src/cmd/recolor.rs
+++ b/crates/engine/src/cmd/recolor.rs
@@ -9,7 +9,7 @@ use std::collections::{BTreeSet, HashMap};
 use serde_json::{Value, json};
 use vectorcraft_color::recolor::{ColorKey, GlobalAdjust, Method, Preserve, Rng, RowMap, cluster, same_ink};
 use vectorcraft_color::{Color, Paint, Swatch};
-use vectorcraft_doc::swatches::{node_colors, node_paints};
+use vectorcraft_doc::swatches::{node_colors, node_paints, override_paints};
 use vectorcraft_doc::{Document, Node, NodeId, NodeKind};
 
 use super::colorcmds::{Recolor, Scope};
@@ -99,7 +99,7 @@ fn used_colors(d: &Document, ids: &[NodeId], only: Option<&BTreeSet<NodeId>>) ->
         read(n, only, &mut nodes);
     }
     for m in nodes {
-        for p in node_paints(m) {
+        for p in node_paints(m).chain(override_paints(m)) {
             match p {
                 Paint::Solid { color, swatch, .. } => count(color, swatch.as_deref()),
                 Paint::Gradient(g) => g.gradient.stops.iter().for_each(|s| count(&s.color, s.swatch.as_deref())),
@@ -522,6 +522,9 @@ fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     };
     let row_swatches: Vec<Option<Swatch>> =
         rows.iter().map(|r| r.new_color().and_then(|c| lib_swatches.iter().find(|w| w.paint.color() == Some(c)).cloned())).collect();
+    // While an object of a dynamic symbol instance's art is selected, the selection is refused, as
+    // `selected_roots` refuses it.
+    super::edit::refuse_symbol_part(s)?;
     let ids = s.doc()?.selection.objects.clone();
     let group = text_param(p, "group", C)?;
     if ids.is_empty() && group.is_none() {
diff --git a/crates/engine/src/cmd/recovery.rs b/crates/engine/src/cmd/recovery.rs
index 1ad456b94..8b5731b33 100644
--- a/crates/engine/src/cmd/recovery.rs
+++ b/crates/engine/src/cmd/recovery.rs
@@ -565,6 +565,10 @@ struct Meta {
     path: Option<String>,
     /// The format Save writes for it ([`SAVE_FORMATS`]).
     format: String,
+    /// A document's own native PDF choice before the recovery copy omits its PDF. None keeps
+    /// inheritance from the current application preference. Older copies did not record a choice.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    native_pdf_compatible: Option<bool>,
     /// When the copy was written (Unix seconds; none without a clock).
     saved: Option<i64>,
     /// The file it was read from when that import left things out of the document, and what
@@ -821,7 +825,7 @@ pub fn jobs(s: &mut Session, store: &Arc<dyn RecoveryStore>) -> Result<(Vec<Reco
             mode: SaveMode::Copy,
             path: st.path.clone(),
             format: native,
-            options: Default::default(),
+            options: serde_json::Map::from_iter([("pdfCompatible".into(), json!(false))]),
             name: format!("{file}{DOC_EXT}"),
             folder: None,
             modified: None,
@@ -832,6 +836,11 @@ pub fn jobs(s: &mut Session, store: &Arc<dyn RecoveryStore>) -> Result<(Vec<Reco
             title: title.clone(),
             path: st.path.clone(),
             format: st.format.to_string(),
+            native_pdf_compatible: if matches!(st.format, "vectorcraft" | "template") {
+                st.save_options.get("pdfCompatible").and_then(Value::as_bool)
+            } else {
+                None
+            },
             saved,
             imported_from: st.imported_from.clone(),
             import_losses: st.import_losses.clone(),
@@ -1060,6 +1069,9 @@ fn restore_one(s: &mut Session, store: &Arc<dyn RecoveryStore>, file: &str) -> R
     st.imported_from = meta.imported_from.clone();
     st.import_losses = meta.import_losses.clone();
     st.format = SAVE_FORMATS.iter().copied().find(|f| *f == meta.format).unwrap_or("vectorcraft");
+    if let Some(pdf) = meta.native_pdf_compatible {
+        st.save_options.insert("pdfCompatible".into(), json!(pdf));
+    }
     st.mark_unsaved();
     // The copy stays until the document is saved or closed.
     st.recovery = Some(RecoveryCopy { file: mine.clone(), doc: st.doc.clone() });
diff --git a/crates/engine/src/cmd/scripts.rs b/crates/engine/src/cmd/scripts.rs
index d175b4469..45f267048 100644
--- a/crates/engine/src/cmd/scripts.rs
+++ b/crates/engine/src/cmd/scripts.rs
@@ -62,7 +62,7 @@ impl Loader for Folder {
 
 /// The bytes the base64 text `b64` holds, up to `max` and a few more: only the text they take is
 /// decoded.
-fn decode_head(b64: &str, max: usize) -> Option<Vec<u8>> {
+pub(super) fn decode_head(b64: &str, max: usize) -> Option<Vec<u8>> {
     let chars = max.div_ceil(3).saturating_mul(4);
     let mut kept = 0usize;
     let end = b64
diff --git a/crates/engine/src/cmd/slices.rs b/crates/engine/src/cmd/slices.rs
index c2092da0a..f52c26a1c 100644
--- a/crates/engine/src/cmd/slices.rs
+++ b/crates/engine/src/cmd/slices.rs
@@ -708,7 +708,9 @@ fn move_slices(s: &mut Session, p: &Value) -> Result<Value> {
                 None => {
                     if let Some(n) = d.node_mut(*id) {
                         n.transform(vectorcraft_geom::Affine::translate(v), vectorcraft_doc::Scaling::default());
+                        super::object::keep_pixel_aligned(n, vectorcraft_doc::Scaling::default());
                     }
+                    super::object::keep_compound_aligned(d, *id, vectorcraft_doc::Scaling::default());
                 }
             }
         }
diff --git a/crates/engine/src/cmd/stroke.rs b/crates/engine/src/cmd/stroke.rs
index 4937ff200..1fb3373c7 100644
--- a/crates/engine/src/cmd/stroke.rs
+++ b/crates/engine/src/cmd/stroke.rs
@@ -266,6 +266,7 @@ fn stroke_set(s: &mut Session, p: &Value) -> Result<Value> {
         if let Some(st) = n.appearance.stroke_at_mut(index) {
             set(st);
         }
+        super::object::snap_if_aligned(n);
         Ok(())
     })?;
     // Commit the new-art template only after the complete request is validated
@@ -329,6 +330,7 @@ fn stroke_step(s: &mut Session, p: &Value, up: bool) -> Result<Value> {
         if let Some(st) = n.appearance.stroke_at_mut(index) {
             st.width = step_weight(st.width, unit, up);
         }
+        super::object::snap_if_aligned(n);
         Ok(())
     })?;
     Ok(json!({"objects": ids.iter().collect::<std::collections::BTreeSet<_>>().len()}))
@@ -343,10 +345,15 @@ impl Session {
     /// The stroke the Stroke panel, the Control bar and the Properties panel show, picked as the
     /// Stroke proxy picks its paint: the Appearance panel's active item when it is a stroke, else
     /// the first selected object's (a group's first painted object's) top stroke, type's first
-    /// run's character stroke; with nothing selected, the next object drawn's
-    /// ([`Session::new_art_stroke`]). None without a document or the selection's stroke.
+    /// run's character stroke; with an object of a dynamic symbol instance selected
+    /// ([`DocState::selected_symbol_part`]), that object's as the instance draws it; with nothing
+    /// selected, the next object drawn's ([`Session::new_art_stroke`]). None without a document or
+    /// the selection's stroke.
     pub fn shown_stroke(&self) -> Option<StrokeLayer> {
         let st = self.active()?;
+        if let Some(part) = st.selected_symbol_part() {
+            return node_stroke(&part);
+        }
         let Some(first) = st.selection.objects.first() else { return Some(self.new_art_stroke()) };
         let first = st.doc.node(*first)?;
         if let Some(i) = first.appearance.item_of_kind(self.appearance_item(), false) {
@@ -360,13 +367,19 @@ impl Session {
 
 impl DocState {
     /// Which Stroke panel values the selected objects' strokes (type: every run's) don't share,
-    /// and whether Align Stroke applies to them (no open path among them). One walk of the
-    /// selection, so callers that ask every frame cache it by revision.
+    /// and whether Align Stroke applies to them (no open path among them). With an object of a
+    /// dynamic symbol instance selected ([`DocState::selected_symbol_part`]), that object alone is
+    /// read. One walk of the selection, so callers that ask every frame cache it by revision.
     pub fn stroke_mixed(&self) -> StrokeMixed {
+        let part = self.selected_symbol_part();
         let mut nodes = vec![];
-        for id in &self.selection.objects {
-            if let Some(n) = self.doc.node(*id) {
-                painted(n, true, &mut nodes);
+        if let Some(part) = &part {
+            painted(part, true, &mut nodes);
+        } else {
+            for id in &self.selection.objects {
+                if let Some(n) = self.doc.node(*id) {
+                    painted(n, true, &mut nodes);
+                }
             }
         }
         let mut strokes = vec![];
diff --git a/crates/engine/src/cmd/style.rs b/crates/engine/src/cmd/style.rs
index 36780707f..5981396f1 100644
--- a/crates/engine/src/cmd/style.rs
+++ b/crates/engine/src/cmd/style.rs
@@ -30,7 +30,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Apply Graphic Style",
             ["Window", "Graphic Styles"],
             None,
-            "{name, add?: bool, ids?|id? (layers too), target?: \"object\"|\"contents\"} give the objects (default: the selection; a group or layer itself, its fills and strokes painting its members and its effects applying to them as one piece; target contents: the objects inside instead) the style's appearance, opacity, blend mode, isolate and knockout, and link them to it (placed gradients land at the same place relative to each object's bounds); add: true (Alt-click) adds its fills, strokes and effects on top of the existing appearance instead and unlinks. With nothing selected (and no ids) the next object drawn takes the style instead (see appearance.newArt) → {newArt: true}",
+            "{name, add?: bool, ids?|id? (layers too), target?: \"object\"|\"contents\"} give the objects (default: the selection; a group or layer itself, its fills and strokes painting its members and its effects applying to them as one piece; target contents: the objects inside instead) the style's appearance, opacity, blend mode, isolate and knockout, and link them to it (placed gradients land at the same place relative to each object's bounds); add: true (Alt-click) adds its fills, strokes and effects on top of the existing appearance instead and unlinks. On a path directly in a graph series, the graph also stores the paint, weight and opacity of the topmost visible fill and stroke (with `add`: of the kinds of row the style shows; exceptions: docs/mcp.md). With nothing selected (and no ids) the next object drawn takes the style instead (see appearance.newArt) → {newArt: true}",
             has_doc,
             style_apply
         ),
@@ -67,7 +67,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Redefine Graphic Style",
             ["Window", "Appearance"],
             None,
-            "{name?, id?} replace the style (default: the one the object was last linked to) with the look of object `id` or the first selected object; the objects still linked to it update, and that object becomes linked → {name}",
+            "{name?, id?} replace the style (default: the one the object was last linked to) with the look of object `id` or the first selected object; the objects still linked to it update, and that object becomes linked. On a linked path directly in a graph series, the graph also stores the paint, weight and opacity of the topmost visible fill and stroke (exceptions: docs/mcp.md) → {name}",
             has_doc,
             style_redefine
         ),
@@ -273,6 +273,7 @@ fn apply_style(d: &mut Document, id: NodeId, g: &GraphicStyle, chars: bool) {
     if let Some(n) = d.node_mut(id) {
         style_node(n, g, chars);
         n.extras_mut().graphic_style = Some(g.id);
+        super::object::snap_if_aligned(n);
     }
 }
 
@@ -333,6 +334,7 @@ fn style_apply(s: &mut Session, p: &Value) -> Result<Value> {
         s.new_art_style(&g, add);
         return Ok(json!({ "newArt": true }));
     }
+    let before = s.doc()?.doc.clone();
     s.edit("Apply Graphic Style", |d, _| {
         if add {
             let g = d.graphic_styles[i].clone();
@@ -344,12 +346,17 @@ fn style_apply(s: &mut Session, p: &Value) -> Result<Value> {
                     n.extras_mut().graphic_style = None;
                 }
             }
+            // The graph stores the rows of the kinds the style shows, now on top of each stack.
+            let shows = |kind: bool| g.appearance.items.iter().any(|it| it.is_fill() == kind && it.visible());
+            let kinds = (shows(true), shows(false));
+            super::appearance::capture_series_writes(&before, d, &ids, kinds, kinds, false);
         } else {
             d.graphic_style_id(i);
             let g = d.graphic_styles[i].clone();
             for id in &ids {
                 apply_style(d, *id, &g, chars);
             }
+            super::appearance::capture_series_writes(&before, d, &ids, (true, true), (true, true), false);
         }
         Ok(())
     })?;
@@ -456,6 +463,7 @@ fn style_redefine(s: &mut Session, p: &Value) -> Result<Value> {
     let look = GraphicStyle::of(String::new(), captured(n), n);
     let name = d.graphic_styles[i].name.clone();
     let chars = s.prefs.override_char_color;
+    let before = s.doc()?.doc.clone();
     s.edit_named("Redefine Graphic Style “{name}”", &name, false, |d, _| {
         let id = d.graphic_style_id(i);
         let old = std::mem::replace(&mut d.graphic_styles[i], GraphicStyle { name: name.clone(), id, ..look });
@@ -465,9 +473,10 @@ fn style_redefine(s: &mut Session, p: &Value) -> Result<Value> {
         let (follow, edited): (Vec<NodeId>, Vec<NodeId>) = linked.into_iter().partition(|nid| d.node(*nid).is_some_and(|n| in_sync(n, &old)));
         set_link(d, &edited, None);
         let g = d.graphic_styles[i].clone();
-        for nid in follow {
-            apply_style(d, nid, &g, chars);
+        for nid in &follow {
+            apply_style(d, *nid, &g, chars);
         }
+        super::appearance::capture_series_writes(&before, d, &follow, (true, true), (true, true), false);
         set_link(d, &[src], Some(id));
         Ok(())
     })?;
diff --git a/crates/engine/src/cmd/stylelib.rs b/crates/engine/src/cmd/stylelib.rs
index 2864f574b..7b0cad576 100644
--- a/crates/engine/src/cmd/stylelib.rs
+++ b/crates/engine/src/cmd/stylelib.rs
@@ -156,6 +156,9 @@ fn add(s: &mut Session, p: &Value) -> Result<Value> {
     let (apply, add) = (switch_or(p, "apply", false, C)?, switch_or(p, "add", false, C)?);
     if p.get("ids").is_some_and(|v| !v.is_null()) {
         checked_ids_param(s, p, "ids", C)?;
+    } else if apply {
+        // A selection that can't take a style is refused before any style is added.
+        super::appearance::appearance_targets(s, &json!({}))?;
     }
     let mut names = names_param(p, C)?;
     names.extend(text_param(p, "name", C)?.map(str::to_string));
diff --git a/crates/engine/src/cmd/svgfilter.rs b/crates/engine/src/cmd/svgfilter.rs
new file mode 100644
index 000000000..98b29a6e2
--- /dev/null
+++ b/crates/engine/src/cmd/svgfilter.rs
@@ -0,0 +1,234 @@
+//! Effect › SVG Filters: the SVG filters a document holds (`svgFilter.list`, `define`, `delete`,
+//! `import`) and applying one to objects as a live `svg.filter` effect (`svgFilter.apply`). An
+//! applied effect names the document's filter: editing the filter changes what every object that
+//! uses it draws, and deleting it leaves their effects in place, drawing nothing, until a filter of
+//! that name exists again. Each effect holds the definition it draws with, kept in step here.
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{Appearance, Document, SvgFilter};
+use vectorcraft_render::effects::{self, svg_filter};
+
+use super::fileio::{absolute_path, read_file_head};
+use super::{CommandSpec, Result, Session, bad, cmd, has_doc, text_param};
+
+/// The largest SVG file Import SVG Filter reads.
+const MAX_IMPORT_BYTES: usize = 16 << 20;
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            query "svgFilter.list",
+            "SVG Filters",
+            [],
+            None,
+            "{} → {filters: [{name, xml}…]} the SVG filters the document holds, in the SVG Filters submenu's order",
+            has_doc,
+            list
+        ),
+        cmd!(
+            "svgFilter.define",
+            "New SVG Filter",
+            [],
+            None,
+            "{xml: one SVG <filter> element (its id is its name; 1..64 primitives; at most 64 KB), replace?: the name of the filter it replaces and keeps (Edit SVG Filter)} add an SVG filter to the document, after the others, or replace one, as one undo step; every object whose svg.filter effect names it draws with the new definition; a name another filter has is refused and a document holds at most 64 filters → {name, filters}",
+            has_doc,
+            define
+        ),
+        cmd!(
+            "svgFilter.delete",
+            "Delete SVG Filter",
+            [],
+            None,
+            "{name} remove an SVG filter from the document, as one undo step; objects whose svg.filter effect names it keep the effect, which draws nothing until a filter of that name is defined or imported again → {filters}",
+            has_doc,
+            delete
+        ),
+        cmd!(
+            "svgFilter.import",
+            "Import SVG Filter…",
+            [],
+            None,
+            "{path?|svg?} add the <filter> elements of an SVG file (at most 16 MB; not SVGZ; its first 256 filters) or of SVG text to the document's SVG filters, as one undo step; a filter whose name the document already has, and one svgFilter.define would refuse, is left out; objects whose effect names an added filter draw with it → {added: [names…], skipped: count, filters}",
+            has_doc,
+            import
+        ),
+        cmd!(
+            "svgFilter.apply",
+            "Apply SVG Filter",
+            [],
+            None,
+            "{name, ids?|id?, item?} apply the document's SVG filter `name` (svgFilter.list) to ids or the selection as a live svg.filter effect, as one undo step, like effect.apply → {ids, index, item}",
+            has_doc,
+            apply
+        ),
+    ]
+}
+
+fn filters_json(d: &Document) -> Value {
+    json!(d.svg_filters.iter().map(|f| json!({ "name": f.name, "xml": f.xml })).collect::<Vec<_>>())
+}
+
+fn list(s: &mut Session, _: &Value) -> Result<Value> {
+    Ok(json!({ "filters": filters_json(&s.doc()?.doc) }))
+}
+
+/// `p`'s `name`, trimmed and not empty.
+fn name_param(p: &Value, cmd: &str) -> Result<String> {
+    let n = text_param(p, "name", cmd)?.map(str::trim).filter(|n| !n.is_empty());
+    n.map(str::to_string).ok_or_else(|| bad(cmd, "give `name`, an SVG filter's name"))
+}
+
+/// Is `e` an `svg.filter` effect that names filter `name`?
+fn names(e: &vectorcraft_doc::Effect, name: &str) -> bool {
+    e.id == effects::SVG_FILTER && e.params.get("name").and_then(Value::as_str) == Some(name)
+}
+
+/// The `svg.filter` effects of appearance `a` (its own and its fills' and strokes') that name
+/// filter `name`.
+fn named<'a>(a: &'a Appearance, name: &'a str) -> impl Iterator<Item = &'a vectorcraft_doc::Effect> + 'a {
+    let items = a.items.iter().flat_map(|i| i.effects().iter());
+    a.effects.iter().chain(items).filter(move |e| names(e, name))
+}
+
+/// Make the effects of appearance `a` that name filter `name` draw with `xml`.
+fn update_appearance(a: &mut Appearance, name: &str, xml: &str) {
+    let items = a.items.iter_mut().flat_map(|i| i.effects_mut().iter_mut());
+    for e in a.effects.iter_mut().chain(items) {
+        if names(e, name) && e.params.is_object() {
+            e.params["xml"] = json!(xml);
+        }
+    }
+}
+
+/// Does an effect in `d` that names filter `name` draw with something other than `xml` (`""`:
+/// nothing)? Symbol definitions, graph designs, patterns, opacity masks and graphic styles count.
+fn out_of_step(d: &Document, name: &str, xml: &str) -> bool {
+    let stale = |a: &Appearance| named(a, name).any(|e| e.params.get("xml").and_then(Value::as_str) != Some(xml));
+    d.any_node(|n| stale(&n.appearance)) || d.graphic_styles.iter().any(|s| stale(&s.appearance))
+}
+
+/// Make every effect in `d` that names filter `name` draw with `xml` (`""` when the document no
+/// longer has the filter: the effect keeps its name and draws nothing), symbol definitions, graph
+/// designs, patterns, opacity masks and graphic styles included.
+fn update_users(d: &mut Document, name: &str, xml: &str) {
+    // Through `DerefMut` only for an appearance that has such an effect (it is shared copy-on-write).
+    d.edit_nodes_where(|n| named(&n.appearance, name).next().is_some(), |n| update_appearance(&mut n.appearance, name, xml));
+    for s in d.graphic_styles.iter_mut().filter(|s| named(&s.appearance, name).next().is_some()) {
+        update_appearance(&mut s.appearance, name, xml);
+    }
+}
+
+fn define(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "svgFilter.define";
+    let xml = match p.get("xml") {
+        Some(Value::String(x)) => x.trim().to_string(),
+        Some(_) => return Err(bad(C, "`xml` must be a string")),
+        None => return Err(bad(C, "give `xml`, one SVG <filter> element")),
+    };
+    let replace = match p.get("replace") {
+        None | Some(Value::Null) => None,
+        Some(Value::String(r)) => Some(r.trim().to_string()),
+        Some(_) => return Err(bad(C, "`replace` must be a string")),
+    };
+    svg_filter::check(&xml).map_err(|e| bad(C, e))?;
+    let filters = &s.doc()?.doc.svg_filters;
+    let at = match &replace {
+        Some(r) => Some(filters.iter().position(|f| f.name == *r).ok_or_else(|| bad(C, format!("the document has no SVG filter named {r:?}")))?),
+        None => None,
+    };
+    // An edited filter keeps its name, whatever id its new code gives it.
+    let xml = match &replace {
+        Some(r) => svg_filter::with_id(&xml, r).ok_or_else(|| bad(C, "give one <filter> element"))?,
+        None => xml,
+    };
+    let name = svg_filter::check(&xml).map_err(|e| bad(C, e))?;
+    if filters.iter().enumerate().any(|(i, f)| f.name == name && Some(i) != at) {
+        return Err(bad(C, format!("the document already has an SVG filter named {name:?}")));
+    }
+    if at.is_none() && filters.len() >= SvgFilter::MAX {
+        return Err(bad(C, format!("a document holds at most {} SVG filters", SvgFilter::MAX)));
+    }
+    let new = SvgFilter { name: name.clone(), xml };
+    // Nothing to record when the filter, and every object that uses it, is already as given.
+    if at.and_then(|i| filters.get(i)) != Some(&new) || out_of_step(&s.doc()?.doc, &new.name, &new.xml) {
+        let label = if at.is_some() { "Edit SVG Filter" } else { "New SVG Filter" };
+        s.edit(label, |d, _| {
+            update_users(d, &new.name, &new.xml);
+            match at.and_then(|i| d.svg_filters.get_mut(i)) {
+                Some(f) => *f = new,
+                None => d.svg_filters.push(new),
+            }
+            Ok(())
+        })?;
+    }
+    Ok(json!({ "name": name, "filters": filters_json(&s.doc()?.doc) }))
+}
+
+fn delete(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "svgFilter.delete";
+    let name = name_param(p, C)?;
+    if !s.doc()?.doc.svg_filters.iter().any(|f| f.name == name) {
+        return Err(bad(C, format!("the document has no SVG filter named {name:?}")));
+    }
+    s.edit("Delete SVG Filter", |d, _| {
+        d.svg_filters.retain(|f| f.name != name);
+        update_users(d, &name, "");
+        Ok(())
+    })?;
+    Ok(json!({ "filters": filters_json(&s.doc()?.doc) }))
+}
+
+/// The bytes of `p`'s `path` (an SVG file, read up to [`MAX_IMPORT_BYTES`]) or `svg`.
+fn import_bytes(p: &Value, cmd: &str) -> Result<Vec<u8>> {
+    let bytes = match (text_param(p, "path", cmd)?, text_param(p, "svg", cmd)?) {
+        // One byte past the cap is enough to refuse the file below.
+        (Some(path), _) => read_file_head(&absolute_path(path), MAX_IMPORT_BYTES + 1)?,
+        (None, Some(svg)) => svg.as_bytes().to_vec(),
+        _ => return Err(bad(cmd, "give `path`, an SVG file, or `svg`, SVG text")),
+    };
+    if bytes.len() > MAX_IMPORT_BYTES {
+        return Err(bad(cmd, format!("the SVG file is larger than {MAX_IMPORT_BYTES} bytes")));
+    }
+    Ok(bytes)
+}
+
+fn import(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "svgFilter.import";
+    let bytes = import_bytes(p, C)?;
+    // SVGZ would unpack past the size read above.
+    if vectorcraft_svg::is_svgz(&bytes) {
+        return Err(bad(C, "Import SVG Filter reads SVG files, not SVGZ"));
+    }
+    let text = vectorcraft_svg::text_of(&bytes).map_err(|e| bad(C, format!("the file isn't valid SVG: {e}")))?;
+    let held = s.doc()?.doc.svg_filters.clone();
+    let room = SvgFilter::MAX.saturating_sub(held.len());
+    // Filters past the room left and names the document has are left out unchecked.
+    let (found, skipped) = vectorcraft_svg::svg_filters(&text, room, |name| held.iter().any(|f| f.name == name))
+        .map_err(|e| bad(C, format!("the file isn't valid SVG: {e}")))?;
+    let added: Vec<SvgFilter> = found.into_iter().map(|(name, xml)| SvgFilter { name, xml }).collect();
+    let names: Vec<String> = added.iter().map(|f| f.name.clone()).collect();
+    if !added.is_empty() {
+        s.edit("Import SVG Filter", |d, _| {
+            for f in &added {
+                update_users(d, &f.name, &f.xml);
+            }
+            d.svg_filters.extend(added);
+            Ok(())
+        })?;
+    }
+    Ok(json!({ "added": names, "skipped": skipped, "filters": filters_json(&s.doc()?.doc) }))
+}
+
+fn apply(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "svgFilter.apply";
+    let name = name_param(p, C)?;
+    let f = s.doc()?.doc.svg_filters.iter().find(|f| f.name == name).cloned();
+    let f = f.ok_or_else(|| bad(C, format!("the document has no SVG filter named {name:?}")))?;
+    let mut q = json!({ "effect": effects::SVG_FILTER, "params": { "name": f.name, "xml": f.xml } });
+    for key in ["ids", "id", "item"] {
+        if let Some(v) = p.get(key) {
+            q[key] = v.clone();
+        }
+    }
+    super::effectcmd::apply(s, &q)
+}
diff --git a/crates/engine/src/cmd/swatch.rs b/crates/engine/src/cmd/swatch.rs
index f19861685..2421441b9 100644
--- a/crates/engine/src/cmd/swatch.rs
+++ b/crates/engine/src/cmd/swatch.rs
@@ -19,7 +19,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "New Swatch",
             ["Window", "Swatches"],
             None,
-            "{name?, color? | colors?: [colour] (one swatch each, in one undo step; #rrggbbaa and #rgba are refused) | swatch? | gradient? | pattern?: name (default: the current fill), tint?: 0..100 (% of the global or spot `swatch`, or of the one the current fill links to), mode?: \"gray\"|\"rgb\"|\"hsb\"|\"lab\"|\"cmyk\"|\"web\" (convert the colour; lab: CIE L*a*b*, how spot colours are usually defined), global?, spot? (a spot colour, always global), group?: colour group name (solid colours only; default: ungrouped), none?: true (the None paint), paint?: paint.setFill params, keepModel?: bool (as paint.setFill)} save a colour, gradient or pattern as a swatch. A tint of a global or spot colour (below 100%, without mode, global or spot) becomes a tint swatch, \"Name 40%\", linked to its base: it follows edits to the base and applies as that tint of it. Names are unique (\"Sky 2\"); a colour's default name is its values (\"C=10 M=20 Y=30 K=0\", \"R=255 G=128 B=0\", \"Gray K=40\", \"L=55 a=60 b=40\") → {name, names: [every new swatch]}",
+            "{name?, color? | colors?: [colour] (one swatch each, in one undo step; #rrggbbaa and #rgba are refused) | swatch? | gradient? | pattern?: name (default: the current fill), tint?: 0..100 (% of the global or spot `swatch`, or of the one the current fill links to), mode?: \"gray\"|\"rgb\"|\"hsb\"|\"lab\"|\"cmyk\"|\"web\" (convert the colour; lab: CIE L*a*b*, how spot colours are usually defined), global?, spot? (a spot colour, always global), group?: colour group name (solid colours only; default: ungrouped), none?: true (the None paint), paint?: paint.setFill params, keepModel?: bool (as paint.setFill)} save a colour, gradient or pattern as a swatch. A tint of a global or spot colour (below 100%, without mode, global or spot) becomes a tint swatch, \"Name 40%\", linked to its base: it follows edits to the base and applies as that tint of it. A gradient swatch holds no link to the swatch its gradient came from, and a pattern swatch holds the pattern untransformed. Names are unique (\"Sky 2\"); a colour's default name is its values (\"C=10 M=20 Y=30 K=0\", \"R=255 G=128 B=0\", \"Gray K=40\", \"L=55 a=60 b=40\") → {name, names: [every new swatch]}",
             has_doc,
             swatch_new
         ),
@@ -187,7 +187,11 @@ fn swatch_new(s: &mut Session, p: &Value) -> Result<Value> {
             })),
             Paint::None => Err(bad(C, "a swatch needs a colour, gradient or pattern")),
             _ if spot || mode.is_some() || group.is_some() => Err(bad(C, "spot, mode and group apply to solid colours only")),
-            other => Ok(other),
+            // The swatch holds the gradient itself, not a link to the swatch it may have come from.
+            // It keeps `geom`, which holds the aspect the swatch is applied with.
+            Paint::Gradient(g) => Ok(Paint::Gradient(Box::new(vectorcraft_color::GradientPaint { swatch: None, ..*g }))),
+            // The swatch holds the pattern untransformed, not the placement of the art it came from.
+            Paint::Pattern { pattern, .. } => Ok(pattern_paint(&pattern)),
         })
         .collect::<Result<Vec<_>>>()?;
     // A name applies to a single new swatch.
diff --git a/crates/engine/src/cmd/symboledit.rs b/crates/engine/src/cmd/symboledit.rs
index 618ef2ee3..de262cf2b 100644
--- a/crates/engine/src/cmd/symboledit.rs
+++ b/crates/engine/src/cmd/symboledit.rs
@@ -78,6 +78,10 @@ pub(crate) fn enter(s: &mut Session, p: &Value) -> Result<Value> {
             (name, xf, ids.first().copied())
         }
         None => {
+            // Refused while an object of a dynamic instance's art is selected, unless `name` is given.
+            if str_param(p, "name").is_none() && st.selection.symbol_part.is_some() {
+                return Err(super::brushsym::part_only());
+            }
             let picked = if str_param(p, "name").is_some() { vec![] } else { selected_instances(st) };
             let symbols: Vec<(String, Affine)> = picked.iter().filter_map(|id| instance_of(&st.doc, *id)).collect();
             match symbols.first() {
diff --git a/crates/engine/src/cmd/xform.rs b/crates/engine/src/cmd/xform.rs
index 998109f3d..7af7cf1f8 100644
--- a/crates/engine/src/cmd/xform.rs
+++ b/crates/engine/src/cmd/xform.rs
@@ -414,6 +414,7 @@ fn artboard_move(s: &mut Session, p: &Value) -> Result<Value> {
             for id in art {
                 if let Some(n) = d.node_mut(*id) {
                     n.transform(Affine::translate(dv), sc);
+                    super::object::keep_pixel_aligned(n, sc);
                 }
             }
             index.push(*i);
diff --git a/crates/engine/src/command_sets.rs b/crates/engine/src/command_sets.rs
index a115498e1..2224ddccc 100644
--- a/crates/engine/src/command_sets.rs
+++ b/crates/engine/src/command_sets.rs
@@ -73,6 +73,11 @@ pub(crate) fn strip_replay_only(id: &str, p: &mut Value) {
     }
 }
 
+/// Journaled commands that write a file and change nothing in the document: with an object of a
+/// dynamic symbol instance's art selected, they read the instance as queries do
+/// ([`crate::Session::execute`]).
+pub(crate) const JOURNALED_READS: &[&str] = &["css.export"];
+
 /// Commands that act on the selection and take `ids` by selecting them first (`select.set`, with
 /// its checks), then running as on the selection: the result and the selection afterwards are the
 /// menu command's (#2130).
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index f2c12a7a0..3753b79fc 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -170,6 +170,10 @@ pub struct Session {
     /// has inherited the selection's appearance: the documents ([`DocState::uid`]) whose newest
     /// history step takes the colors the batch finally left.
     pub(crate) batch_paint_docs: Vec<u64>,
+    /// While a command that changes nothing in the document runs (a query, or one of
+    /// [`command_sets::JOURNALED_READS`]): it reads the instance of an object selected in a symbol
+    /// instance's art.
+    pub(crate) reading: bool,
     /// While [`Session::place_read`] runs `file.place`: the file read for it, which the command
     /// places instead of reading the file; `None` otherwise.
     pub(crate) place_hand_off: Option<cmd::place::PlaceRead>,
diff --git a/crates/engine/src/prefs.rs b/crates/engine/src/prefs.rs
index fc2530c03..e1346b457 100644
--- a/crates/engine/src/prefs.rs
+++ b/crates/engine/src/prefs.rs
@@ -174,6 +174,10 @@ pub struct Prefs {
     /// acting as the title bar (tiling window managers, desktops that draw their own decorations).
     /// Read when the app starts. macOS always uses the system's.
     pub system_title_bar: bool,
+    /// Linux and the BSDs: draw the app bar as the title bar in sessions where the desktop draws
+    /// the frame (X11, Wayland compositors with server-side decorations, XWayland), as on GNOME.
+    /// Read when the app starts; System Title Bar and `VECTORCRAFT_TITLEBAR` take precedence over it.
+    pub app_title_bar: bool,
     // Performance
     pub gpu_performance: bool,
     pub animated_zoom: bool,
@@ -457,6 +461,7 @@ impl Default for Prefs {
             scale_cursor_with_ui: false,
             interface_language: s("auto"),
             system_title_bar: false,
+            app_title_bar: false,
             gpu_performance: true,
             animated_zoom: true,
             gpu_preference: s("automatic"),
diff --git a/crates/engine/src/session.rs b/crates/engine/src/session.rs
index 1eaf15b88..27976ff51 100644
--- a/crates/engine/src/session.rs
+++ b/crates/engine/src/session.rs
@@ -1,4 +1,4 @@
-use super::command_sets::{SELECTS_GIVEN_IDS, given_ids, strip_replay_only};
+use super::command_sets::{JOURNALED_READS, SELECTS_GIVEN_IDS, given_ids, strip_replay_only};
 use super::doc_state::DocState;
 use super::error::{EngineError, Result};
 use super::history::NamedStep;
diff --git a/crates/engine/src/session/documents.rs b/crates/engine/src/session/documents.rs
index d46c9b9b8..f6dd7c8b6 100644
--- a/crates/engine/src/session/documents.rs
+++ b/crates/engine/src/session/documents.rs
@@ -83,6 +83,7 @@ impl Session {
             batch_stash: None,
             batch_steps: None,
             batch_paint_docs: Vec::new(),
+            reading: false,
             place_hand_off: None,
             queue_hand_off: None,
             place_queue_roots: None,
diff --git a/crates/engine/src/session/edit.rs b/crates/engine/src/session/edit.rs
index da285eb3d..7fcbdc912 100644
--- a/crates/engine/src/session/edit.rs
+++ b/crates/engine/src/session/edit.rs
@@ -26,7 +26,11 @@ impl Session {
             if let Some(ge) = &st.global_edit {
                 spread = cmd::globaledit::propagate(&before, doc, ge, [&before_sel.objects, &st.selection.objects]);
             }
-            cmd::objects_on_path::refresh(&before, doc);
+            // Pixel-aligned objects the edit changed go back on the pixel grid.
+            cmd::refresh_pixel_aligned(&before, doc);
+            let placed = cmd::objects_on_path::refresh(&before, doc);
+            // Pixel-aligned members that placing moved go back on the pixel grid.
+            cmd::keep_aligned_in(doc, &placed);
             dim_changed = cmd::dimension::refresh(&before, doc)?;
             Ok(v)
         }) {
@@ -35,7 +39,9 @@ impl Session {
                 Ok(shaper_changed) => {
                     // Attached Shaper groups whose art was rebuilt go back on their path.
                     if shaper_changed || dim_changed {
-                        cmd::objects_on_path::refresh(&before, Arc::make_mut(&mut st.doc));
+                        let doc = Arc::make_mut(&mut st.doc);
+                        let placed = cmd::objects_on_path::refresh(&before, doc);
+                        cmd::keep_aligned_in(doc, &placed);
                     }
                     // Symbol editing: the symbol follows its art on the editing layer, before
                     // inline graphics follow their symbols.
@@ -340,7 +346,7 @@ impl Session {
             preview.1.get("dy").and_then(Value::as_f64).unwrap_or(0.0),
         );
         st.keep_interaction(it);
-        if preview.0 == "object.transform" {
+        if preview.0 == "object.transform" && changed {
             let m = cmd::matrix_param(&preview.1, "matrix");
             if let Some(m) = m {
                 // The options are the last preview's params with the values it noted, without the
diff --git a/crates/engine/src/session/execute.rs b/crates/engine/src/session/execute.rs
index 21822583d..71f90e7e4 100644
--- a/crates/engine/src/session/execute.rs
+++ b/crates/engine/src/session/execute.rs
@@ -1,5 +1,6 @@
 use super::{
-    CommandSpec, EngineError, NodeId, Result, SELECTS_GIVEN_IDS, Selection, Session, Value, cmd, find_command, given_ids, guard, strip_replay_only,
+    CommandSpec, EngineError, JOURNALED_READS, NodeId, Result, SELECTS_GIVEN_IDS, Selection, Session, Value, cmd, find_command, given_ids, guard,
+    strip_replay_only,
 };
 
 impl Session {
@@ -35,6 +36,13 @@ impl Session {
     /// Execute a command by id. This is THE entry point for every frontend.
     pub fn execute(&mut self, id: &str, params: &Value) -> Result<Value> {
         let spec = find_command(id).ok_or_else(|| cmd::params::unknown_command(id))?;
+        let outer = std::mem::replace(&mut self.reading, !spec.journal || JOURNALED_READS.contains(&id));
+        let r = self.execute_spec(spec, id, params);
+        self.reading = outer;
+        r
+    }
+
+    fn execute_spec(&mut self, spec: &'static CommandSpec, id: &str, params: &Value) -> Result<Value> {
         // A key the command's params description doesn't name is a parameter error (#1442), before
         // anything runs, for the commands other commands run too. A `command.batch` or an
         // `action.batch` checks its steps before the first one runs, and each step is checked again
diff --git a/crates/engine/src/store.rs b/crates/engine/src/store.rs
index 3d8259361..003713d2f 100644
--- a/crates/engine/src/store.rs
+++ b/crates/engine/src/store.rs
@@ -13,7 +13,9 @@
 //!   move or go away). Attaching the folder registers them again.
 //! * **Plug-ins**: the module of each plug-in `plugin.install` installs, as a `.wasm` file named
 //!   after its id (as Illustrator keeps plug-ins in its Plug-ins folder); `plugin.remove` deletes it.
-//!   Attaching the folder installs them again. The Additional Plug-ins Folder preference is not
+//!   Attaching the folder installs them again, except in Safe Mode and except the ones the user
+//!   disabled, which `disabled.json` in the same folder lists (`plugin.setEnabled`; a window locks
+//!   `disabled.lock` while it writes the list). The Additional Plug-ins Folder preference is not
 //!   copied: it is loaded from where it is. `grants.json` holds what the user granted the plug-ins
 //!   stored there that list permissions (id, module hash, permissions); a stored plug-in whose
 //!   permissions it doesn't grant is skipped with a log record, and stays in the folder.
@@ -26,6 +28,7 @@ use std::io::Read;
 use std::path::{Path, PathBuf};
 
 use vectorcraft_pdf::{PdfPreset, builtin_preset};
+use vectorcraft_plugins::safe_mode;
 
 use crate::Session;
 use crate::cmd::pdfcmds::{PRESET_FORMAT, PresetFile};
@@ -44,6 +47,10 @@ const PROFILE_EXT: &str = "icc";
 pub const MAX_PLUGIN_STORE: u64 = 512 << 20;
 /// The extension of a stored plug-in.
 const PLUGIN_EXT: &str = "wasm";
+/// The file in the plug-in folder that lists the plug-ins the user disabled.
+pub const DISABLED_FILE: &str = "disabled.json";
+/// The file in the plug-in folder that a window locks while it reads and writes [`DISABLED_FILE`].
+pub const DISABLED_LOCK: &str = "disabled.lock";
 /// The file in the plug-in store that holds the permissions the user granted.
 const GRANTS_FILE: &str = "grants.json";
 /// The largest grants file read.
@@ -114,6 +121,25 @@ fn write_atomic(_: &Path, _: &[u8]) -> std::io::Result<()> {
     Err(std::io::Error::new(std::io::ErrorKind::Unsupported, "no file system"))
 }
 
+/// [`DISABLED_LOCK`] in `dir`, locked until the file is dropped, waiting while another window holds
+/// it; `None` when it can't be opened or locked.
+#[cfg(not(target_arch = "wasm32"))]
+fn lock_disabled(dir: &Path) -> Option<std::fs::File> {
+    let opened = std::fs::create_dir_all(dir)
+        .and_then(|()| std::fs::File::options().create(true).truncate(false).read(true).write(true).open(dir.join(DISABLED_LOCK)));
+    let file = opened.and_then(|f| f.lock().map(|()| f));
+    if let Err(e) = &file {
+        log::warn!("can't lock {}: {e}", dir.join(DISABLED_LOCK).display());
+    }
+    file.ok()
+}
+
+/// The browser has no folders to keep anything in.
+#[cfg(target_arch = "wasm32")]
+fn lock_disabled(_: &Path) -> Option<std::fs::File> {
+    None
+}
+
 /// Remove `dir/file`; a file that isn't there is what was wanted.
 fn take(dir: &Path, file: &str) {
     let path = dir.join(file);
@@ -223,10 +249,25 @@ impl Session {
         }
     }
 
-    /// Keep the plug-ins this session installs in `dir`, and install the ones already there (a
-    /// module that doesn't load, and one that lists permissions the grants there don't grant that
-    /// very module, is skipped with a log record, and stays in `dir` with its grant).
+    /// Keep the plug-ins this session installs in `dir`, take the disabled plug-ins saved there
+    /// ([`DISABLED_FILE`]), and install the stored ones ([`Session::load_stored_plugins`]).
     pub fn attach_plugin_store(&mut self, dir: PathBuf) {
+        let disabled =
+            read_capped(&dir.join(DISABLED_FILE), safe_mode::MAX_DISABLED_FILE_BYTES).map(|b| safe_mode::parse_disabled_file(&b)).unwrap_or_default();
+        safe_mode::set_disabled(disabled);
+        self.plugin_dir = Some(dir);
+        self.load_stored_plugins();
+    }
+
+    /// Install the plug-ins kept in the plug-in folder: none in Safe Mode, and none the user
+    /// disabled (matched by file name, which is made from the id). The launch marker names each
+    /// file while it loads. A module that doesn't load, and one that lists permissions the grants
+    /// there don't grant it, is skipped with a log record.
+    pub fn load_stored_plugins(&mut self) {
+        let Some(dir) = self.plugin_dir.clone() else { return };
+        if safe_mode::active() {
+            return;
+        }
         let grants = stored_grants(&dir);
         let limits = vectorcraft_plugins::Limits::default();
         let mut left = MAX_PLUGIN_STORE;
@@ -235,10 +276,19 @@ impl Session {
                 log::warn!("skipping the other stored plug-ins: they hold more than {MAX_PLUGIN_STORE} bytes together");
                 break;
             }
+            let item = safe_mode::Item::file(path.display().to_string());
+            let stem = path.file_stem().map(|s| s.to_string_lossy().to_string());
+            let by_id = safe_mode::skipped_ids().iter().any(|id| stem.as_deref() == Some(file_stem(id).as_str()));
+            if safe_mode::skipped(&item) || by_id {
+                log::info!("skipping the stored plug-in {}: disabled", path.display());
+                continue;
+            }
+            let token = safe_mode::loading(&item);
             let loaded = read_capped(&path, (limits.max_module_bytes as u64).min(left)).and_then(|bytes| {
                 left -= bytes.len() as u64;
                 vectorcraft_plugins::Plugin::load(&bytes, limits.clone()).map_err(|e| e.to_string())
             });
+            safe_mode::loaded(token);
             match loaded {
                 // Only this store's grants count: one given elsewhere in the process doesn't let a
                 // module stored here load.
@@ -258,7 +308,40 @@ impl Session {
                 Err(e) => log::warn!("skipping the stored plug-in {}: {e}", path.display()),
             }
         }
-        self.plugin_dir = Some(dir);
+    }
+
+    /// Write the disabled plug-ins saved for the next launch to the plug-in folder → whether they
+    /// went there, every change included (`false` without a folder, and when a plug-in turned off
+    /// found the file's list full: [`safe_mode::Merged::complete`]). The changes this launch made are applied to the list
+    /// the file holds now ([`safe_mode::merge_saved`]), so a change another window saved to the same
+    /// folder meanwhile stays. Windows that save at the same time take turns on [`DISABLED_LOCK`];
+    /// when it can't be locked, nothing is written, and the next change saves this one too. So is
+    /// a file that can't be read (too large, say) or that a later version wrote
+    /// ([`safe_mode::read_disabled_file`]): it is kept as it is.
+    pub fn store_disabled_plugins(&self) -> bool {
+        let Some(dir) = self.plugin_dir.as_deref() else { return false };
+        let Some(_turn) = lock_disabled(dir) else { return false };
+        let path = dir.join(DISABLED_FILE);
+        let theirs = match read_capped(&path, safe_mode::MAX_DISABLED_FILE_BYTES) {
+            Ok(bytes) => match safe_mode::read_disabled_file(&bytes) {
+                Some(items) => items,
+                None => {
+                    log::warn!("can't save {}: it holds another format or version of the list", path.display());
+                    return false;
+                }
+            },
+            Err(_) if !path.exists() => Vec::new(),
+            Err(e) => {
+                log::warn!("can't save {}: {e}", path.display());
+                return false;
+            }
+        };
+        let merged = safe_mode::merge_saved(Some(theirs));
+        let written = put(dir, DISABLED_FILE, &merged.bytes);
+        if written {
+            safe_mode::saved_written(&merged);
+        }
+        written && merged.complete()
     }
 
     /// Whether `plugin` installs without asking the user: it lists no permissions, or this very
@@ -282,11 +365,16 @@ impl Session {
         }
     }
 
-    /// Write the module `bytes` of the plug-in `id` to the store.
-    pub(crate) fn store_plugin(&self, id: &str, bytes: &[u8]) {
-        if let Some(dir) = &self.plugin_dir {
-            put(dir, &format!("{}.{PLUGIN_EXT}", file_stem(id)), bytes);
-        }
+    /// Write the module `bytes` of the plug-in `id` to the store → whether they went there (`false`
+    /// without a folder).
+    pub(crate) fn store_plugin(&self, id: &str, bytes: &[u8]) -> bool {
+        self.plugin_dir.as_deref().is_some_and(|dir| put(dir, &format!("{}.{PLUGIN_EXT}", file_stem(id)), bytes))
+    }
+
+    /// The file the plug-in `id` is stored in, spelled as [`Session::load_stored_plugins`] names it
+    /// (`None` without a plug-in folder).
+    pub(crate) fn stored_plugin_file(&self, id: &str) -> Option<String> {
+        self.plugin_dir.as_ref().map(|dir| dir.join(format!("{}.{PLUGIN_EXT}", file_stem(id))).display().to_string())
     }
 
     /// Record in the store what the user granted plug-in `id` (`None`: nothing), leaving the store's
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index b708c25ca..742d7a3ac 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -4,11 +4,13 @@ use super::*;
 use vectorcraft_geom::Point;
 use vectorcraft_tools::{PointerEvent, PointerKind, ToolKey};
 
+mod actionset;
 pub(super) mod adjust;
 mod ai_open_path;
 mod appearance;
 mod areafit;
 mod assets;
+mod assets_3d;
 mod attributes;
 mod bboxrotate;
 mod blendfidelity;
@@ -123,6 +125,7 @@ mod persp_planes;
 pub(super) mod persp_select;
 mod persp_text;
 mod perspgrid;
+mod pixelalign;
 mod place;
 mod placed_document;
 mod plugins;
@@ -163,6 +166,7 @@ mod strokeux;
 mod stylelib;
 mod stylepanel;
 mod styles;
+mod svgfilter;
 mod swatchcmds;
 mod swatches;
 mod swatchlib;
diff --git a/crates/engine/src/tests/actionset.rs b/crates/engine/src/tests/actionset.rs
new file mode 100644
index 000000000..d80e649ec
--- /dev/null
+++ b/crates/engine/src/tests/actionset.rs
@@ -0,0 +1,184 @@
+//! Action sets another app saved as text (`actionSet.read`): actions, steps, the tokens left unread
+//! and the caps. Every set here is written for the test, with invented names.
+
+use serde_json::json;
+
+use crate::cmd::actionset::{AiaStep, read_aia};
+use crate::*;
+
+/// `text` as a bracketed hexadecimal value.
+fn hex(text: &str) -> String {
+    let digits: String = text.bytes().map(|b| format!("{b:02x}")).collect();
+    format!("[ {} {digits} ]", text.len())
+}
+
+/// A set written from scratch in the layout the module describes: two actions, the second with a
+/// step left out of playback, a step with recorded values of each form, and names in several
+/// scripts.
+fn sample() -> String {
+    format!(
+        "/version 3\n/name {set}\n/isOpen 1\n/actionCount 2\n/action-1 {{\n\t/name {a1}\n\t/keyIndex 0\n\t/eventCount 1\n\t/event-1 {{\n\t\t/internalName (sample_join)\n\t\t/localizedName {join}\n\t\t/isOn 1\n\t\t/parameterCount 3\n\t\t/parameter-1 {{\n\t\t\t/key 1\n\t\t\t/type (unit real)\n\t\t\t/value 2.5\n\t\t}}\n\t\t/parameter-2 {{\n\t\t\t/type (ustring)\n\t\t\t/value {txt}\n\t\t}}\n\t\t/parameter-3 {{\n\t\t\t/type (raw)\n\t\t\t/value < 3\n\t\t\t\t0a7d0b\n\t\t\t>\n\t\t\t/size 3\n\t\t}}\n\t}}\n}}\r\n/action-2 {{\r\n\t/name {a2}\r\n\t/event-1 {{\r\n\t\t/internalName (sample\\)one)\r\n\t\t/isOn 0\r\n\t\t/parameterCount 0\r\n\t}}\r\n\t/event-2 {{\r\n\t\t/internalName (sample_two)\r\n\t\t/localizedName {two}\r\n\t}}\r\n}}\r\n",
+        set = hex("Prep Sätze"),
+        a1 = hex("First"),
+        join = hex("Join"),
+        txt = hex("a } brace"),
+        a2 = hex("二番目"),
+        two = hex("Second Step"),
+    )
+}
+
+/// The set's name, its actions and their steps come in with the step's names, its on state and how
+/// many values it was recorded with, and nothing is listed unread.
+#[test]
+fn a_set_reads_its_actions_and_steps() {
+    let set = read_aia(sample().as_bytes()).unwrap();
+    assert_eq!((set.version, set.name.as_deref(), set.truncated), (3, Some("Prep Sätze"), false));
+    assert!(set.unread.is_empty(), "{:?}", set.unread);
+    let names: Vec<&str> = set.actions.iter().map(|a| a.name.as_str()).collect();
+    assert_eq!(names, ["First", "二番目"]);
+    let step = |a: usize, s: usize| set.actions[a].steps[s].clone();
+    let join = AiaStep { name: "sample_join".into(), label: Some("Join".into()), on: Some(1), params: 3, declared: Some(3), line: 9 };
+    assert_eq!(step(0, 0), join);
+    assert_eq!((step(1, 0).name.as_str(), step(1, 0).label.clone(), step(1, 0).on), ("sample)one", None, Some(0)));
+    assert_eq!((step(1, 1).label.as_deref(), step(1, 1).on, step(1, 1).line), (Some("Second Step"), None, 39));
+}
+
+/// Every recorded value of a step is counted. A hexadecimal `/value` with the wrong byte count marks
+/// the set truncated; a long one or one that isn't UTF-8 does not.
+#[test]
+fn recorded_values_are_counted_and_checked() {
+    let set = |values: &[String]| {
+        let params: String = values.iter().enumerate().map(|(i, v)| format!("/parameter-{} {{ /key 1 {v} }} ", i + 1)).collect();
+        read_aia(format!("/version 3 /action-1 {{ /event-1 {{ {params} }} }}").as_bytes()).unwrap()
+    };
+    let value = |t: &str| format!("/type (ustring) /value {}", hex(t));
+    let read = set(&[value("one"), value("two"), value("three")]);
+    assert_eq!((read.actions[0].steps[0].params, read.truncated), (3, false));
+    let read = set(&[value(&"n".repeat(2000)), "/value [ 1 ff ]".to_string(), "/type (real) /value 4.5".to_string()]);
+    assert!(!read.truncated, "a long value or one that isn't UTF-8 is not damage");
+    assert!(set(&["/value [ 3 4142 ]".to_string()]).truncated);
+    assert!(set(&[value("one"), "/value [ 1 zz ]".to_string()]).truncated, "a second value that isn't hexadecimal");
+}
+
+/// `actionSet.read` takes exactly one of `path`, `data` and `dataBase64`, and text for the text
+/// params; any other value is an error.
+#[test]
+fn read_command_refuses_bad_params() {
+    let mut s = Session::new();
+    let text = "/version 3";
+    let dir = std::env::temp_dir().join(format!("vc-actionset-params-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let file = dir.join("Mine.aia");
+    std::fs::write(&file, text).unwrap();
+    let path = file.to_string_lossy();
+    assert!(s.execute("actionSet.read", &json!({ "path": path })).is_ok());
+    let b64 = vectorcraft_format::base64_encode(text.as_bytes());
+    for p in [
+        json!({ "path": 5, "data": text }),
+        json!({ "data": 5 }),
+        json!({ "dataBase64": 5 }),
+        json!({ "data": text, "name": 7 }),
+        json!({ "path": path, "data": text }),
+        json!({ "path": path, "dataBase64": b64 }),
+        json!({ "data": text, "dataBase64": b64 }),
+    ] {
+        assert!(s.execute("actionSet.read", &p).is_err(), "{p}");
+    }
+    let r = s.execute("actionSet.read", &json!({ "data": text, "name": null })).unwrap();
+    assert_eq!(r["set"], "", "no set name and no file name");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// `actionSet.read` names the set after the file when it has no name, gives a step without a label,
+/// or with a blank one, a null label, and refuses text that isn't an action set.
+#[test]
+fn read_command_answers_with_the_set() {
+    let mut s = Session::new();
+    let text = sample().replacen(&format!("/name {}", hex("Prep Sätze")), "", 1);
+    let r = s.execute("actionSet.read", &json!({ "data": text, "name": "/sets/Mine.aia" })).unwrap();
+    assert_eq!(r["set"], "Mine");
+    assert_eq!(r["actions"][1]["steps"][0], json!({"name": "sample)one", "label": null, "on": false, "params": 0, "line": 34}));
+    assert_eq!(r["actions"][0]["steps"][0]["on"], true);
+    assert_eq!(r["actions"][0]["steps"][0]["label"], "Join");
+    let blank = format!("/version 3 /action-1 {{ /event-1 {{ /internalName (x) /localizedName {} }} }}", hex(" "));
+    assert_eq!(s.execute("actionSet.read", &json!({ "data": blank })).unwrap()["actions"][0]["steps"][0]["label"], json!(null));
+    for text in ["/Menus { }", "", "version 3", "/version three"] {
+        assert!(s.execute("actionSet.read", &json!({ "data": text })).is_err(), "{text}");
+    }
+    assert!(s.execute("actionSet.read", &json!({})).is_err());
+}
+
+/// `path` and `dataBase64` read the same set as `data`, and a set's name falls back to the path's.
+#[test]
+fn a_set_reads_from_a_path_and_from_base64() {
+    let dir = std::env::temp_dir().join(format!("vc-actionset-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("Mine.aia");
+    let text = "/version 3 /action-1 { /name [ 1 41 ] }";
+    std::fs::write(&path, text).unwrap();
+    let mut s = Session::new();
+    let r = s.execute("actionSet.read", &json!({ "path": path.to_string_lossy() })).unwrap();
+    assert_eq!((r["set"].as_str(), r["actions"][0]["name"].as_str()), (Some("Mine"), Some("A")));
+    let b64 = vectorcraft_format::base64_encode(text.as_bytes());
+    assert_eq!(s.execute("actionSet.read", &json!({ "dataBase64": b64, "name": "B.aia" })).unwrap()["set"], "B");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// Tokens out of place are listed with their lines, and a cap marks the set truncated.
+#[test]
+fn stray_tokens_are_listed_and_caps_truncate() {
+    let set = read_aia(b"/version 3\n7 /name [ 1 zz ]\n/name [ 3 4142 ]\n/odd { /x 1 }\n}\n/action-1 { /name [ 1 41 ]").unwrap();
+    let unread: Vec<&str> = set.unread.iter().map(|(_, t)| t.as_str()).collect();
+    let bad = "[ … ] (not the hexadecimal bytes its count says)";
+    assert_eq!(unread, ["7", bad, bad, "/odd {", "}", "blocks left open at the end: 1"]);
+    let short = |text: &str| read_aia(text.as_bytes()).unwrap().truncated;
+    assert!(short("/version 3 /actionCount 1 /odd { /action-1 { } }"), "the action in a block that isn't read");
+    assert!(short("/version 3 /name [ 3 4142 ]"), "a set's name with the wrong byte count");
+    assert!(short("/version 3 /action-1 { /name [ 1 zz ] }"), "an action's name that isn't hexadecimal");
+    assert!(short("/version 3 /action-1 { /event-1 { /localizedName [ 3 4142 ] } }"), "a label with the wrong byte count");
+    let cuts = ["/name [ 4 4142", "/name (ab", "/value < 2 0a", "/name", "/action-2 {"];
+    let whole: Vec<&str> = cuts.into_iter().filter(|cut| !short(&format!("/version 3 /action-1 {{ }} {cut}"))).collect();
+    assert!(whole.is_empty(), "{whole:?}");
+    assert_eq!(set.name, None);
+    assert_eq!(set.actions[0].name, "A");
+    let many = format!("/version 3 {}", "/action-1 { } ".repeat(1001));
+    assert!(read_aia(many.as_bytes()).unwrap().truncated);
+    let deep = format!("/version 3 /action-1 {{ /event-1 {{ {} }} }}", "/parameter-1 { ".repeat(40));
+    assert!(read_aia(deep.as_bytes()).unwrap().truncated);
+    let long = format!("/version 3 /name {}", hex(&"n".repeat(2000)));
+    assert!(read_aia(long.as_bytes()).unwrap().truncated);
+}
+
+/// A count that differs from the actions, steps or recorded values that follow, or that isn't a
+/// number that fits an `i64`, marks the set truncated. A count is read only in its own block.
+#[test]
+fn counts_that_differ_truncate() {
+    let short = |text: &str| read_aia(text.as_bytes()).unwrap().truncated;
+    assert!(short("/version 3 /actionCount 2 /action-1 { }"), "one action of two");
+    assert!(short("/version 3 /action-1 { /eventCount 2 /event-1 { } }"), "one step of two");
+    assert!(!short("/version 3 /actionCount 1 /action-1 { /eventCount 1 /event-1 { } }"));
+    assert!(short("/version 3 /actionCount 1 /action-1 { } /action-2 { }"), "two actions of one");
+    assert!(short("/version 3 /action-1 { /eventCount 1 /event-1 { } /event-2 { } }"), "two steps of one");
+    assert!(short("/version 3 /action-1 { /event-1 { /parameterCount 1 } }"), "no recorded value of one");
+    assert!(short("/version 3 /action-1 { /event-1 { /parameterCount 0 /parameter-1 { } } }"), "a recorded value of none");
+    assert!(!short("/version 3 /action-1 { /event-1 { /parameterCount 1 /parameter-1 { } } }"));
+    assert!(short("/version 3 /actionCount -1"), "a negative count");
+    assert!(short("/version 3 /action-1 { /eventCount -1 }"), "a negative step count");
+    assert!(short("/version 3 /actionCount 99999999999999999999"), "a count too large for a number");
+    for count in ["nope", "1.5", "(1)", "[ 1 31 ]", "< 1 31 >", "{ }"] {
+        assert!(short(&format!("/version 3 /actionCount {count}")), "a count that isn't a number: {count}");
+        assert!(short(&format!("/version 3 /action-1 {{ /eventCount {count} }}")), "a step count: {count}");
+        assert!(short(&format!("/version 3 /action-1 {{ /event-1 {{ /parameterCount {count} }} }}")), "{count}");
+    }
+    assert!(short("/version 3 /actionCount /name [ 1 41 ]"), "a count followed by another field");
+    assert!(short("/version 3 /action-1 { /eventCount }"), "a count at the end of its block");
+    assert!(!short("/version 3 /action-1 { /event-1 { /parameter-1 { /actionCount nope } } }"), "a field inside a recorded value");
+    assert!(!short("/version 3 /action-1 { /actionCount (x) }"), "a set's count in an action is not read");
+}
+
+#[test]
+fn the_command_takes_only_the_keys_it_describes() {
+    // The control channel, MCP and the CLI check params against the description (#1442).
+    check_params("actionSet.read", &json!({"path": "/x/a.aia", "data": "", "dataBase64": "", "name": "a.aia"})).unwrap();
+    assert!(check_params("actionSet.read", &json!({"pth": "/x/a.aia"})).is_err());
+}
diff --git a/crates/engine/src/tests/assets_3d.rs b/crates/engine/src/tests/assets_3d.rs
new file mode 100644
index 000000000..cdef5b1df
--- /dev/null
+++ b/crates/engine/src/tests/assets_3d.rs
@@ -0,0 +1,220 @@
+//! 3D assets: Export 3D Object collects objects with a 3D effect as 3D assets, their Format picks
+//! the mesh file (USDA by default, USDZ, glTF or OBJ), and `assets.export3D` writes them, apart from
+//! the picture assets `assets.export` writes.
+
+use serde_json::{Value, json};
+use vectorcraft_color::Paint;
+
+use crate::*;
+
+fn session() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    // Unstroked art: each object is one solid.
+    s.paint.stroke = Paint::None;
+    s
+}
+
+fn run(s: &mut Session, id: &str, p: Value) -> Value {
+    s.execute(id, &p).unwrap_or_else(|e| panic!("{id}: {e}"))
+}
+
+/// A rectangle with Extrude & Bevel, named `name`.
+fn extruded(s: &mut Session, x: f64, name: &str) -> u64 {
+    let id = run(s, "shape.rectangle", json!({"x": x, "y": 10.0, "width": 40.0, "height": 30.0}))["id"].as_u64().unwrap();
+    run(s, "select.set", json!({"ids": [id]}));
+    run(s, "effect.apply", json!({"effect": "threeD.extrude", "params": {"depth": 20.0}}));
+    run(s, "layer.setProps", json!({"id": id, "name": name}));
+    id
+}
+
+fn undo_len(s: &Session) -> usize {
+    s.doc().unwrap().history.undo.len()
+}
+
+/// `(name, bytes)` of each file an export returned.
+fn files(r: &Value) -> Vec<(String, Vec<u8>)> {
+    r["files"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|f| (f["name"].as_str().unwrap().to_string(), vectorcraft_format::base64_decode(f["dataBase64"].as_str().unwrap()).unwrap()))
+        .collect()
+}
+
+#[test]
+fn export_3d_object_collects_each_3d_object_as_a_usda_asset() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    let b = extruded(&mut s, 100.0, "Crate");
+    run(&mut s, "select.set", json!({"ids": [a, b]}));
+    let before = undo_len(&s);
+    let r = run(&mut s, "assets.add3D", json!({}));
+    assert_eq!(r["added"], 2);
+    assert_eq!(undo_len(&s), before + 1, "one undo step for every object");
+    let list = run(&mut s, "assets.list", json!({}))["assets"].as_array().unwrap().clone();
+    assert_eq!(
+        list.iter().map(|a| (a["name"].clone(), a["format3D"].clone())).collect::<Vec<_>>(),
+        [(json!("Box"), json!("usda")), (json!("Crate"), json!("usda"))]
+    );
+    // Collected again: the same assets, and no undo step.
+    let again = run(&mut s, "assets.add3D", json!({"ids": [a]}));
+    assert_eq!((again["added"].clone(), again["assets"][0].clone()), (json!(0), r["assets"][0].clone()));
+    assert_eq!(undo_len(&s), before + 1);
+    // Collect for Export of the same object makes a picture asset beside it.
+    assert_eq!(run(&mut s, "assets.add", json!({"ids": [a]}))["added"], 1);
+    // Undo takes the 3D assets back out in one step.
+    run(&mut s, "edit.undo", json!({}));
+    run(&mut s, "edit.undo", json!({}));
+    assert!(s.doc().unwrap().doc.assets.is_empty());
+}
+
+#[test]
+fn export_3d_object_refuses_objects_without_a_3d_effect_and_bad_formats() {
+    let mut s = session();
+    let plain = run(&mut s, "shape.rectangle", json!({"x": 10.0, "y": 10.0, "width": 40.0, "height": 30.0}))["id"].as_u64().unwrap();
+    let box3d = extruded(&mut s, 100.0, "Box");
+    let before = undo_len(&s);
+    assert!(s.execute("assets.add3D", &json!({"ids": [box3d, plain]})).is_err(), "one object without a 3D effect refuses them all");
+    assert!(s.execute("assets.add3D", &json!({"ids": [box3d], "format": "fbx"})).is_err());
+    assert!(s.execute("assets.add3D", &json!({"ids": [box3d], "format": 3})).is_err());
+    assert!(s.execute("assets.add3D", &json!({"ids": [999_999]})).is_err());
+    run(&mut s, "select.set", json!({"ids": []}));
+    assert!(s.execute("assets.add3D", &json!({})).is_err(), "nothing selected");
+    assert!(s.doc().unwrap().doc.assets.is_empty());
+    assert_eq!(undo_len(&s), before);
+    run(&mut s, "select.set", json!({"ids": [box3d]}));
+    let r = run(&mut s, "assets.add3D", json!({"format": "gltf"}));
+    assert_eq!(run(&mut s, "assets.list", json!({}))["assets"][0]["format3D"], "gltf");
+    assert_eq!(r["added"], 1);
+}
+
+#[test]
+fn the_format_is_set_per_asset_and_only_a_change_is_an_undo_step() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    let asset = run(&mut s, "assets.add3D", json!({"ids": [a]}))["assets"][0].as_u64().unwrap();
+    let picture = run(&mut s, "assets.add", json!({"ids": [a]}))["assets"][0].as_u64().unwrap();
+    let before = undo_len(&s);
+    assert_eq!(run(&mut s, "assets.set3DFormat", json!({"assets": [asset], "format": "usda"}))["changed"], 0);
+    assert_eq!(undo_len(&s), before, "no change, no undo step");
+    assert!(s.execute("assets.set3DFormat", &json!({"assets": [asset], "format": "stl"})).is_err());
+    assert!(s.execute("assets.set3DFormat", &json!({"assets": [asset]})).is_err(), "the format is required");
+    assert!(s.execute("assets.set3DFormat", &json!({"assets": [picture], "format": "obj"})).is_err(), "a picture asset has no 3D format");
+    assert!(s.execute("assets.set3DFormat", &json!({"assets": [12345], "format": "obj"})).is_err());
+    assert_eq!(run(&mut s, "assets.set3DFormat", json!({"assets": [asset], "format": "obj"}))["changed"], 1);
+    assert_eq!(undo_len(&s), before + 1);
+    assert_eq!(s.doc().unwrap().doc.asset(asset).unwrap().format_3d.as_deref(), Some("obj"));
+}
+
+#[test]
+fn export_3d_writes_each_format() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    let asset = run(&mut s, "assets.add3D", json!({"ids": [a]}))["assets"][0].as_u64().unwrap();
+    let cases = [("usda", vec!["Box.usda"]), ("usdz", vec!["Box.usdz"]), ("gltf", vec!["Box.gltf"]), ("obj", vec!["Box.obj", "Box.mtl"])];
+    for (format, names) in cases {
+        run(&mut s, "assets.set3DFormat", json!({"assets": [asset], "format": format}));
+        let out = files(&run(&mut s, "assets.export3D", json!({})));
+        assert_eq!(out.iter().map(|(n, _)| n.as_str()).collect::<Vec<_>>(), names, "{format}");
+        assert!(out.iter().all(|(_, b)| !b.is_empty()), "{format}");
+    }
+    // The OBJ holds the box: a rectangle's front and back and four walls, two triangles each.
+    let out = files(&run(&mut s, "assets.export3D", json!({})));
+    let obj = String::from_utf8(out[0].1.clone()).unwrap();
+    assert_eq!(obj.lines().filter(|l| l.starts_with("f ")).count(), 12);
+}
+
+#[test]
+fn export_3d_numbers_files_that_would_share_a_name_and_cleans_path_characters() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    let b = extruded(&mut s, 100.0, "box");
+    let c = extruded(&mut s, 200.0, "../a:b");
+    run(&mut s, "assets.add3D", json!({"ids": [a, b, c]}));
+    let out = files(&run(&mut s, "assets.export3D", json!({})));
+    assert_eq!(out.iter().map(|(n, _)| n.as_str()).collect::<Vec<_>>(), ["Box.usda", "box-2.usda", "..-a-b.usda"]);
+}
+
+#[test]
+fn picture_and_3d_assets_export_apart() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    let three_d = run(&mut s, "assets.add3D", json!({"ids": [a]}))["assets"][0].as_u64().unwrap();
+    // assets.export leaves 3D assets to assets.export3D.
+    let e = s.execute("assets.export", &json!({"formats": [{"format": "png", "scale": "1x"}]})).unwrap_err().to_string();
+    assert!(e.contains("no assets yet"), "{e}");
+    let e = s.execute("assets.export", &json!({"assets": [three_d]})).unwrap_err().to_string();
+    assert!(e.contains("assets.export3D"), "{e}");
+    let e = s.execute("document.exportForScreens", &json!({"assets": [three_d]})).unwrap_err().to_string();
+    assert!(e.contains("assets.export3D"), "Export for Screens refuses it too: {e}");
+    let picture = run(&mut s, "assets.add", json!({"ids": [a]}))["assets"][0].as_u64().unwrap();
+    let pngs = files(&run(&mut s, "assets.export", json!({"formats": [{"format": "png", "scale": "1x"}]})));
+    assert_eq!(pngs.len(), 1);
+    assert!(s.execute("assets.export3D", &json!({"assets": [picture]})).is_err());
+}
+
+#[test]
+fn export_3d_needs_3d_assets() {
+    let mut s = session();
+    assert!(s.execute("assets.export3D", &json!({})).is_err());
+    assert!(s.execute("assets.export3D", &json!({"assets": [77]})).is_err());
+    assert!(s.execute("assets.export3D", &json!({"assets": "all"})).is_err());
+}
+
+#[test]
+fn bad_3d_params_are_refused() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    assert!(s.execute("assets.add3D", &json!({"ids": [a], "format": null})).is_err(), "a given format must be a format");
+    run(&mut s, "assets.add3D", json!({"ids": [a]}));
+    assert!(s.execute("assets.export3D", &json!({"folder": 123})).is_err());
+    assert!(s.execute("assets.export3D", &json!({"zip": "true"})).is_err());
+}
+
+#[test]
+fn an_asset_whose_object_lost_its_effect_is_refused_at_export() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    run(&mut s, "assets.add3D", json!({"ids": [a]}));
+    run(&mut s, "select.set", json!({"ids": [a]}));
+    run(&mut s, "effect.remove", json!({"index": 0}));
+    let e = s.execute("assets.export3D", &json!({})).unwrap_err().to_string();
+    assert!(e.contains("Box"), "{e}");
+}
+
+#[test]
+fn export_3d_writes_into_a_folder_or_one_zip() {
+    let dir = std::env::temp_dir().join(format!("vc-assets-3d-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let folder = dir.to_string_lossy().replace('\\', "/");
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    let asset = run(&mut s, "assets.add3D", json!({"ids": [a], "format": "obj"}))["assets"][0].as_u64().unwrap();
+    let r = run(&mut s, "assets.export3D", json!({"folder": folder}));
+    assert_eq!(r["files"], json!([format!("{folder}/Box.obj"), format!("{folder}/Box.mtl")]));
+    assert!(dir.join("Box.obj").is_file() && dir.join("Box.mtl").is_file());
+    let zip = run(&mut s, "assets.export3D", json!({"assets": [asset], "zip": true}));
+    assert_eq!(zip["files"], json!(["Box.obj", "Box.mtl"]));
+    assert!(zip["name"].as_str().unwrap().ends_with("-3D.zip"), "{}", zip["name"]);
+    // A picture ZIP and a 3D ZIP in one folder are two files.
+    run(&mut s, "assets.add", json!({"ids": [a]}));
+    let pictures = run(&mut s, "assets.export", json!({"formats": [{"format": "png", "scale": "1x"}], "folder": folder, "zip": true}));
+    let meshes = run(&mut s, "assets.export3D", json!({"folder": folder, "zip": true}));
+    let (p, m) = (pictures["path"].as_str().unwrap(), meshes["path"].as_str().unwrap());
+    assert_ne!(p, m);
+    assert!(std::path::Path::new(p).is_file() && std::path::Path::new(m).is_file());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn three_d_assets_round_trip_through_the_native_format() {
+    let mut s = session();
+    let a = extruded(&mut s, 10.0, "Box");
+    run(&mut s, "assets.add3D", json!({"ids": [a], "format": "usdz"}));
+    let saved = s.doc().unwrap().doc.assets.clone();
+    let b64 = run(&mut s, "document.serialize", json!({"format": "vectorcraft"}))["dataBase64"].as_str().unwrap().to_string();
+    run(&mut s, "document.open", json!({"name": "assets3d.vectorcraft", "dataBase64": b64}));
+    assert_eq!(s.doc().unwrap().doc.assets, saved);
+    assert_eq!(saved[0].format_3d.as_deref(), Some("usdz"));
+}
diff --git a/crates/engine/src/tests/clipboard.rs b/crates/engine/src/tests/clipboard.rs
index 79b336df0..24d6d387d 100644
--- a/crates/engine/src/tests/clipboard.rs
+++ b/crates/engine/src/tests/clipboard.rs
@@ -278,6 +278,54 @@ fn gradient_swatches_come_along_with_their_stop_links() {
     assert_eq!(sw.gradient, g.gradient, "the added gradient swatch links its stop to the added Sky too");
 }
 
+/// A gradient swatch made from another one (by name, from a fill linked to it, or from a gradient
+/// that names it, placed or not) holds the gradient alone, so copying art that uses it brings only
+/// that swatch. A placed gradient keeps its aspect, and the swatch still fits each object it is
+/// applied to.
+#[test]
+fn a_gradient_swatch_made_from_another_holds_no_link_to_it() {
+    let mut s = session();
+    let glow = json!({"kind": "radial", "stops": [{"offset": 0, "color": "#3080ff"}, {"offset": 1, "color": "#ffffff"}]});
+    s.execute("swatch.new", &json!({"name": "Glow", "gradient": glow})).unwrap();
+    let r = rect(&mut s, 0.0, 0.0, 50.0, 50.0);
+    s.execute("paint.setFill", &json!({"ids": [r.0], "swatch": "Glow"})).unwrap();
+    let Paint::Gradient(applied) = fill(&s, r) else { panic!("a gradient fill") };
+    assert_eq!(applied.swatch.as_deref(), Some("Glow"));
+    let mut by_gradient = vectorcraft_tools::params::gradient_params(&applied);
+    by_gradient["swatch"] = json!("Glow");
+    let mut placed = by_gradient.clone();
+    placed["start"] = json!([25, 25]);
+    placed["end"] = json!([50, 25]);
+    placed["aspect"] = json!(50);
+    let made = [
+        ("By Name", json!({"name": "By Name", "swatch": "Glow"})),
+        ("From Fill", json!({"name": "From Fill"})),
+        ("From Gradient", json!({"name": "From Gradient", "gradient": by_gradient})),
+        ("Placed", json!({"name": "Placed", "gradient": placed})),
+    ];
+    let mut links = vec![];
+    for (name, p) in &made {
+        s.execute("swatch.new", p).unwrap();
+        let Paint::Gradient(sw) = doc(&s).swatch(name).unwrap().paint.clone() else { panic!("{name}: a gradient swatch") };
+        assert_eq!(sw.gradient, applied.gradient, "{name}: Glow's gradient");
+        links.push(sw.swatch.clone());
+    }
+    assert_eq!(links, [None, None, None, None], "no swatch links to Glow");
+    let Paint::Gradient(sw) = doc(&s).swatch("Placed").unwrap().paint.clone() else { panic!("a gradient swatch") };
+    assert!(sw.geom.is_some_and(|g| (g.aspect - 0.5).abs() < 1e-9), "the placed gradient keeps its aspect: {:?}", sw.geom);
+    for (name, _) in &made {
+        let t = rect(&mut s, 100.0, 0.0, 100.0, 60.0);
+        s.execute("paint.setFill", &json!({"ids": [t.0], "swatch": name})).unwrap();
+        if *name == "Placed" {
+            let Paint::Gradient(g) = fill(&s, t) else { panic!("a gradient fill") };
+            let geom = g.geom.unwrap();
+            assert!(geom.start.distance(Point::new(150.0, 30.0)) < 1e-9 && (geom.aspect - 0.5).abs() < 1e-9, "{geom:?}");
+        }
+        copy(&mut s, &[t]);
+        assert_eq!(s.clipboard.swatches.iter().map(|w| w.name.as_str()).collect::<Vec<_>>(), [*name], "Glow stays behind");
+    }
+}
+
 #[test]
 fn lab_spot_colours_show_as_the_target_documents_spot_option_says() {
     let mut s = session();
diff --git a/crates/engine/src/tests/dynamic_symbols.rs b/crates/engine/src/tests/dynamic_symbols.rs
index 1c46d5302..9ec00cd24 100644
--- a/crates/engine/src/tests/dynamic_symbols.rs
+++ b/crates/engine/src/tests/dynamic_symbols.rs
@@ -1,10 +1,14 @@
 //! Dynamic symbols (#4938): an instance changes the appearance of objects in its symbol's art and
-//! stays linked; editing the symbol keeps those changes, Reset and Break Link handle them.
+//! stays linked; editing the symbol keeps those changes, Reset and Break Link handle them. Direct
+//! Selection picks one path, compound path or type object of an instance's art, and a solid color
+//! Fill or Stroke changes it.
 
 use serde_json::{Value, json};
 use vectorcraft_doc::{Node, NodeKind};
 use vectorcraft_geom::Rect;
+use vectorcraft_tools::{Mods, PointerEvent, PointerKind};
 
+use crate::tooling::{UiRequest, ViewInfo};
 use crate::*;
 
 fn session() -> Session {
@@ -46,6 +50,9 @@ fn pixel(s: &Session, x: u32, y: u32) -> [u8; 4] {
 const RED: [u8; 4] = [255, 0, 0, 255];
 const BLUE: [u8; 4] = [0, 0, 255, 255];
 
+/// The refusal of anything but a solid fill or stroke on a picked object says so.
+const REFUSED: &str = "solid color fill and stroke";
+
 #[test]
 fn a_dynamic_instance_paints_one_object_its_own_way_and_stays_linked() {
     let mut s = session();
@@ -58,6 +65,10 @@ fn a_dynamic_instance_paints_one_object_its_own_way_and_stays_linked() {
     assert_eq!(pixel(&s, 80, 30), RED, "the changed object");
     assert_eq!(pixel(&s, 30, 30), BLUE, "its sibling keeps the symbol's look");
     assert_eq!(overrides(&s, other), 0, "other instances keep the symbol's look");
+    // The same value again records nothing.
+    let undo = undo_steps(&s);
+    assert_eq!(s.execute("symbol.instance.setAppearance", &json!({"id": inst.0, "path": [1], "fill": "#ff0000"})).unwrap()["overrides"], 1);
+    assert_eq!(undo_steps(&s), undo, "no undo step");
     // A later change to the same object merges with the first; null takes one back.
     s.execute("symbol.instance.setAppearance", &json!({"id": inst.0, "path": [1], "opacity": 50})).unwrap();
     assert_eq!(node(&s, inst).extras().symbol_overrides[0].opacity, Some(0.5));
@@ -176,6 +187,666 @@ fn break_link_bakes_the_changes_and_edit_symbol_shows_the_symbols_own_art() {
     assert_eq!(overrides(&s, other), 1, "the instance keeps its changes");
 }
 
+/// Press the Direct Selection tool at (`x`, `y`), drag to `to` and release, with `m` held: what the
+/// drag asked of the UI.
+fn direct(s: &mut Session, (x, y): (f64, f64), to: (f64, f64), m: Mods) -> Vec<UiRequest> {
+    let v = ViewInfo { smart_guides: false, ..Default::default() };
+    s.select_tool("directSelection", v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Down, x, y).with_mods(m), v).unwrap();
+    let mut out = vec![];
+    if to != (x, y) {
+        out = s.pointer(&PointerEvent::new(PointerKind::Drag, to.0, to.1).with_mods(m), v).unwrap();
+    }
+    s.pointer(&PointerEvent::new(PointerKind::Up, to.0, to.1).with_mods(m), v).unwrap();
+    out
+}
+
+fn undo_steps(s: &Session) -> usize {
+    s.doc().unwrap().history.undo.len()
+}
+
+/// The fills of the symbol's own art.
+fn symbol_fills(s: &Session) -> Vec<String> {
+    let art = s.doc().unwrap().doc.symbols[0].art.clone();
+    art.children().unwrap().iter().map(|c| c.appearance.fill_paint().color().unwrap().to_hex()).collect()
+}
+
+#[test]
+fn direct_selection_paints_one_object_of_one_dynamic_instance() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let other = id(&s.execute("symbol.place", &json!({"name": "Pair", "x": 55, "y": 80})).unwrap());
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    let sel = s.doc().unwrap().selection.clone();
+    assert_eq!(sel.objects, [inst]);
+    assert_eq!(sel.symbol_part, Some(vectorcraft_doc::SymbolPart { instance: inst, path: vec![1] }));
+    let undo = undo_steps(&s);
+    // The Swatches panel, the Color panel and the Control bar set the fill with paint.setFill.
+    assert_eq!(s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap()["objects"], 1);
+    assert_eq!(undo_steps(&s), undo + 1, "one undo step");
+    assert_eq!(pixel(&s, 80, 30), RED, "the picked object");
+    assert_eq!(pixel(&s, 30, 30), BLUE, "its sibling keeps the symbol's look");
+    assert_eq!(overrides(&s, other), 0, "the other instance keeps the symbol's look");
+    assert_eq!(symbol_fills(&s), ["#0000ff", "#0000ff"], "the symbol's art is unchanged");
+    assert_eq!(s.paint.fill.color().map(|c| c.to_hex()), Some("#ff0000".into()), "new art takes the fill");
+    // The same paint again records nothing.
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    assert_eq!(undo_steps(&s), undo + 1);
+    // Stroke goes to the same object.
+    s.execute("paint.setStroke", &json!({"color": "#00ff00"})).unwrap();
+    assert_eq!(s.paint.stroke.color().map(|c| c.to_hex()), Some("#00ff00".into()), "new art takes the stroke");
+    assert!(s.paint.stroke_width > 0.0, "a painted stroke has a weight");
+    let o = node(&s, inst).extras().symbol_overrides[0].clone();
+    assert_eq!(o.path, vec![1]);
+    assert!(o.fill.is_some() && o.stroke.is_some());
+    // The Eyedropper's click on another object gives the selected object its paint.
+    let green = square(&mut s, 150.0);
+    s.execute("paint.setFill", &json!({"ids": [green.0], "color": "#00ff00"})).unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    assert_eq!(s.execute("appearance.copyFrom", &json!({"source": green.0})).unwrap()["ids"], json!([inst.0]));
+    assert_eq!(pixel(&s, 80, 30), [0, 255, 0, 255], "the eyedropper's paint");
+    assert_eq!(symbol_fills(&s), ["#0000ff", "#0000ff"]);
+    for _ in 0..7 {
+        s.execute("edit.undo", &json!({})).unwrap();
+    }
+    assert_eq!(overrides(&s, inst), 0, "undo takes each change back");
+    assert_eq!(pixel(&s, 80, 30), BLUE);
+}
+
+#[test]
+fn a_drag_of_a_picked_object_moves_nothing_and_says_why() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    let (before, undo) = (node(&s, inst).kind.clone(), undo_steps(&s));
+    let ui = direct(&mut s, (80.0, 30.0), (120.0, 60.0), Mods::default());
+    assert!(ui.iter().any(|r| matches!(r, UiRequest::Status(m) if m.contains("symbol instance"))), "{ui:?}");
+    assert_eq!(node(&s, inst).kind, before, "the instance stays put");
+    assert_eq!(undo_steps(&s), undo, "no undo step");
+    assert!(s.execute("object.nudge", &json!({"dx": 1})).is_err(), "the arrow keys too");
+    assert!(s.execute("object.rotate", &json!({"angle": 10})).is_err());
+    // The Selection tool picks the instance whole again, and it moves.
+    s.select_tool("selection", ViewInfo::default()).unwrap();
+    assert!(s.doc().unwrap().selection.symbol_part.is_none());
+    s.execute("object.nudge", &json!({"dx": 1})).unwrap();
+    assert_ne!(node(&s, inst).kind, before);
+}
+
+/// The Stroke panel and the Control bar show the stroke of the object picked in a dynamic instance.
+#[test]
+fn the_stroke_panel_shows_a_picked_objects_stroke() {
+    let mut s = session();
+    let (a, b) = (square(&mut s, 10.0), square(&mut s, 60.0));
+    s.execute("paint.setStroke", &json!({"ids": [a.0, b.0], "color": "#00ff00"})).unwrap();
+    s.execute("stroke.set", &json!({"ids": [a.0], "weight": 2})).unwrap();
+    s.execute("stroke.set", &json!({"ids": [b.0], "weight": 7})).unwrap();
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Pair", "ids": [a.0, b.0], "type": "dynamic"})).unwrap());
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    assert_eq!(s.shown_stroke().map(|st| st.width), Some(7.0), "the picked object's weight");
+    assert!(!s.doc().unwrap().stroke_mixed().weight, "the instance's art has two weights, the object one");
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [0]})).unwrap();
+    assert_eq!(s.shown_stroke().map(|st| st.width), Some(2.0));
+}
+
+#[test]
+fn delete_and_cut_of_a_picked_object_remove_nothing() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    let undo = undo_steps(&s);
+    for cmd in ["edit.cut", "edit.clear"] {
+        let e = s.execute(cmd, &json!({})).unwrap_err().to_string();
+        assert!(e.contains("symbol instance"), "{cmd}: {e}");
+        assert!(s.doc().unwrap().doc.node(inst).is_some(), "{cmd} keeps the instance");
+    }
+    assert_eq!(undo_steps(&s), undo, "no undo step");
+    // Named by id, the instance is removed.
+    s.execute("edit.clear", &json!({"ids": [inst.0]})).unwrap();
+    assert!(s.doc().unwrap().doc.node(inst).is_none());
+}
+
+#[test]
+fn commands_on_the_selection_leave_a_picked_objects_instance_alone() {
+    // A dynamic instance with an opacity mask, a plain square and the Desaturate plug-in, with an
+    // object of the instance picked.
+    let setup = || {
+        let mut s = session();
+        let inst = pair(&mut s, "dynamic");
+        let other = square(&mut s, 150.0);
+        let desaturate = include_bytes!("../../../plugins/tests/fixtures/desaturate.wasm");
+        let plugin = s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(desaturate)})).unwrap();
+        let mask = square(&mut s, 20.0);
+        s.execute("transparency.makeOpacityMask", &json!({"ids": [inst.0, mask.0]})).unwrap();
+        assert!(node(&s, inst).extras().mask.is_some());
+        s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+        (s, inst, other, plugin["id"].clone())
+    };
+    let (mut s, inst, other, plugin) = setup();
+    let doc = s.doc().unwrap().doc.clone();
+    // Each command runs on its own copy of the setup, compared with that copy as it was, so every
+    // command that fails is reported.
+    let mut failures = Vec::new();
+    for (cmd, p) in [
+        ("object.puppetWarp", json!({"pins": [[80, 30]], "moved": [[90, 40]], "rest": true})),
+        ("recolor.apply", json!({"map": {"#0000ff": "#00ff00"}})),
+        ("plugin.run", json!({"id": plugin, "params": {"amount": 100}})),
+        ("object.group", json!({})),
+        ("object.ungroup", json!({})),
+        ("object.hide", json!({})),
+        ("object.lock", json!({})),
+        ("object.arrange.bringToFront", json!({})),
+        ("object.expand", json!({})),
+        ("object.rotate", json!({"angle": 45})),
+        ("symbol.instance.reset", json!({})),
+        ("symbol.instance.setAppearance", json!({"path": [1], "opacity": 50})),
+        ("symbol.adjust", json!({"tool": "shift", "points": [[80, 30], [95, 30]], "radius": 200})),
+        ("symbol.edit", json!({})),
+        ("select.globalEdit", json!({})),
+        ("object.blend.release", json!({})),
+        ("object.repeat.release", json!({})),
+        ("object.intertwine.release", json!({})),
+        ("object.objectsOnPath.expand", json!({})),
+        ("transparency.set", json!({"opacity": 50})),
+        ("transparency.set", json!({"blend": "multiply"})),
+        ("transparency.releaseOpacityMask", json!({})),
+        ("transparency.setOpacityMask", json!({"invert": true, "clip": false})),
+        ("transparency.disableOpacityMask", json!({})),
+        ("transparency.unlinkOpacityMask", json!({})),
+        ("transparency.editOpacityMask", json!({})),
+        ("transparency.viewOpacityMask", json!({"on": true})),
+        ("paint.editGradient", json!({"angle": 30})),
+        ("paint.setGradientGeom", json!({"start": [62, 30], "end": [98, 30]})),
+        ("paint.swap", json!({})),
+        ("stroke.set", json!({"weight": 3})),
+        ("path.moveAnchors", json!({"dx": 5, "dy": 5})),
+        (
+            "file.place",
+            json!({"name": "a.svg", "dataBase64": vectorcraft_format::base64_encode(b"<svg xmlns='http://www.w3.org/2000/svg' width='9' height='9'><rect width='9' height='9'/></svg>"), "replace": true}),
+        ),
+        ("object.intertwine.arrange", json!({"at": [80, 30]})),
+        ("transparency.editOpacityMask", json!({"id": null})),
+        ("transparency.viewOpacityMask", json!({"on": true, "id": null})),
+    ] {
+        let (mut t, ..) = setup();
+        let (doc, undo) = (t.doc().unwrap().doc.clone(), undo_steps(&t));
+        match t.execute(cmd, &p) {
+            Ok(r) => failures.push(format!("{cmd}: ran ({r})")),
+            Err(e) if !e.to_string().contains("symbol instance") => failures.push(format!("{cmd}: {e}")),
+            Err(_) => {}
+        }
+        if t.doc().unwrap().selection.symbol_part.is_none() {
+            failures.push(format!("{cmd}: the object is no longer picked"));
+        }
+        if t.doc().unwrap().doc != doc {
+            failures.push(format!("{cmd}: the document changed"));
+        }
+        if undo_steps(&t) != undo {
+            failures.push(format!("{cmd}: an undo step was added"));
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+    // Copy copies the instance whole.
+    s.execute("edit.copy", &json!({})).unwrap();
+    assert!(matches!(&s.clipboard.nodes[..], [n] if matches!(n.kind, NodeKind::SymbolInstance { .. })));
+    // The picked object's paint still changes.
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    assert!(node(&s, inst).extras().symbol_overrides[0].fill.is_some());
+    // A command given ids acts on them.
+    s.execute("object.rotate", &json!({"ids": [other.0], "angle": 45})).unwrap();
+    assert_ne!(node(&s, other).kind, doc.node(other).unwrap().kind, "the named object turns");
+    s.execute("transparency.setOpacityMask", &json!({"id": inst.0, "invert": true})).unwrap();
+    assert!(node(&s, inst).extras().mask.as_ref().is_some_and(|m| m.invert), "the named instance's mask changes");
+}
+
+#[test]
+fn the_commands_without_a_check_for_a_picked_object_use_its_instance() {
+    let setup = || {
+        let mut s = session();
+        let inst = pair(&mut s, "dynamic");
+        s.execute("symbol.instance.setAppearance", &json!({"id": inst.0, "path": [1], "fill": "#ff0000"})).unwrap();
+        s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+        (s, inst)
+    };
+    // Export Selection: the whole instance, x 10..100, and not the object at 60..100.
+    let (mut s, _) = setup();
+    let r = s.execute("document.exportSelection", &json!({"format": "svg"})).unwrap();
+    assert_eq!(r["bounds"], json!([10.0, 10.0, 90.0, 40.0]));
+    // Fit to Selection: the whole instance too.
+    let (mut s, _) = setup();
+    s.execute("artboard.fitToSelection", &json!({})).unwrap();
+    let r = s.doc().unwrap().doc.artboards[0].rect;
+    assert_eq!((r.x0, r.x1), (10.0, 100.0));
+    // Liquify: the instance is its target, skipped and left as it is.
+    let (mut s, inst) = setup();
+    let doc = s.doc().unwrap().doc.clone();
+    let r = s.execute("object.liquify", &json!({"tool": "pucker", "points": [[80, 30]], "diameter": 150, "intensity": 1})).unwrap();
+    assert_eq!((&r["ids"], &r["skipped"]), (&json!([]), &json!([inst.0])));
+    assert!(s.doc().unwrap().doc == doc);
+    // Isolate: the instance, with the selection cleared.
+    let (mut s, inst) = setup();
+    s.execute("object.isolate", &json!({})).unwrap();
+    assert_eq!(s.doc().unwrap().isolation, Some(inst));
+    assert!(s.doc().unwrap().selection.is_empty());
+    // Add to Library: a copy of the whole instance, 90 pt wide, and not the object's paint.
+    let (mut s, _) = setup();
+    let lib = s.execute("library.add", &json!({"kind": "graphic"})).unwrap()["library"].clone();
+    let got = s.execute("library.get", &json!({"library": lib})).unwrap();
+    assert_eq!(got["graphics"][0]["width"], 90.0);
+    assert_ne!(s.execute("library.add", &json!({"kind": "fillColor"})).unwrap()["name"], "#ff0000");
+    // Save Selection: the instance, which Recall selects whole.
+    let (mut s, inst) = setup();
+    s.execute("select.save", &json!({"name": "Saved"})).unwrap();
+    assert_eq!(s.doc().unwrap().doc.saved_selections[0].objects, vec![inst]);
+    s.execute("select.recall", &json!({"name": "Saved"})).unwrap();
+    let sel = &s.doc().unwrap().selection;
+    assert_eq!((&sel.objects, &sel.symbol_part), (&vec![inst], &None));
+}
+
+#[test]
+fn a_blend_around_a_picked_objects_instance_is_left_alone() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let other = square(&mut s, 150.0);
+    let blend = id(&s.execute("object.blend.make", &json!({"ids": [inst.0, other.0], "steps": 1})).unwrap());
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    let (doc, undo) = (s.doc().unwrap().doc.clone(), undo_steps(&s));
+    let e = s.execute("object.blend.release", &json!({})).unwrap_err().to_string();
+    assert!(e.contains("symbol instance"), "{e}");
+    assert!(s.doc().unwrap().doc == doc, "the blend stays");
+    assert_eq!(undo_steps(&s), undo, "no undo step");
+    // With the blend selected, it is released.
+    s.execute("select.set", &json!({"ids": [blend.0]})).unwrap();
+    s.execute("object.blend.release", &json!({})).unwrap();
+    assert!(s.doc().unwrap().doc.node(blend).is_none());
+}
+
+/// Dynamic symbol "Photo" of a gray 2 × 1 image and a blue square, made in place: its instance and
+/// the image's path in the art.
+fn image_symbol(s: &mut Session) -> (NodeId, Value) {
+    let mut png = Vec::new();
+    let pixels = image::DynamicImage::ImageLuma8(image::GrayImage::from_raw(2, 1, vec![0, 255]).unwrap());
+    pixels.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let im = s
+        .edit("Place", |d, _| {
+            d.images.insert("gray".into(), vectorcraft_doc::ImageBlob::png(png));
+            let id = d.alloc_id();
+            let im = vectorcraft_doc::ImageObject {
+                key: "gray".into(),
+                width: 40,
+                height: 40,
+                xf: vectorcraft_geom::Affine::translate((10.0, 10.0)),
+                link: None,
+                placement: Default::default(),
+                pixels: None,
+            };
+            d.insert(d.default_layer(), 0, Node::new(id, NodeKind::Image(Box::new(im))))?;
+            Ok(id)
+        })
+        .unwrap();
+    let sq = square(s, 60.0);
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Photo", "ids": [im.0, sq.0], "type": "dynamic"})).unwrap());
+    let art = s.doc().unwrap().doc.symbols[0].art.clone();
+    let i = art.children().unwrap().iter().position(|c| matches!(c.kind, NodeKind::Image(_))).unwrap();
+    (inst, json!([i]))
+}
+
+#[test]
+fn only_paths_compound_paths_and_type_of_the_art_are_picked() {
+    let mut s = session();
+    // A compound path, type, a blend and a static symbol's instance beside a path, in a group.
+    let (a, b) = (square(&mut s, 10.0), square(&mut s, 20.0));
+    let compound = id(&s.execute("object.compoundPath.make", &json!({"ids": [a.0, b.0]})).unwrap());
+    let text = id(&s.execute("text.create", &json!({"x": 10, "y": 50, "text": "Hi"})).unwrap());
+    let (c, d) = (square(&mut s, 60.0), square(&mut s, 150.0));
+    let blend = id(&s.execute("object.blend.make", &json!({"ids": [c.0, d.0], "steps": 1})).unwrap());
+    let inner = pair(&mut s, "static");
+    let plain = square(&mut s, 100.0);
+    let group = id(&s.execute("object.group", &json!({"ids": [plain.0]})).unwrap());
+    let ids = [compound.0, text.0, blend.0, inner.0, group.0];
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Mixed", "ids": ids, "type": "dynamic"})).unwrap());
+    let art = s.doc().unwrap().doc.symbols.iter().find(|y| y.name == "Mixed").unwrap().art.clone();
+    let at = |kind: &dyn Fn(&NodeKind) -> bool| art.children().unwrap().iter().position(|c| kind(&c.kind)).unwrap();
+    let compound = at(&|k| matches!(k, NodeKind::Compound { .. }));
+    let text = at(&|k| matches!(k, NodeKind::Text(_)));
+    let blend = at(&|k| matches!(k, NodeKind::Blend { .. }));
+    let inner = at(&|k| matches!(k, NodeKind::SymbolInstance { .. }));
+    let group = at(&|k| matches!(k, NodeKind::Group { .. }));
+    for path in [json!([compound]), json!([text]), json!([group, 0])] {
+        s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": path})).unwrap();
+        s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+        s.execute("paint.setStroke", &json!({"color": "#00ff00"})).unwrap();
+    }
+    assert_eq!(overrides(&s, inst), 3);
+    let undo = undo_steps(&s);
+    s.execute("select.none", &json!({})).unwrap();
+    for path in [json!([]), json!([group]), json!([blend]), json!([inner])] {
+        let e = s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": path})).unwrap_err().to_string();
+        assert!(e.contains(REFUSED), "{path}: {e}");
+    }
+    assert!(s.doc().unwrap().selection.symbol_part.is_none(), "nothing is picked");
+    assert_eq!((overrides(&s, inst), undo_steps(&s)), (3, undo), "nothing changes");
+}
+
+/// A Direct Selection press on an image of the art is refused with the status message, and a drag
+/// from it does not move what was selected.
+#[test]
+fn a_press_on_an_image_of_the_art_is_refused_and_moves_nothing() {
+    let mut s = session();
+    let (inst, path) = image_symbol(&mut s);
+    let other = square(&mut s, 150.0);
+    let e = s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": path})).unwrap_err().to_string();
+    assert!(e.contains(REFUSED), "{e}");
+    s.execute("select.set", &json!({"ids": [other.0]})).unwrap();
+    let before = node(&s, other).kind.clone();
+    let v = ViewInfo { smart_guides: false, ..Default::default() };
+    s.select_tool("directSelection", v).unwrap();
+    let e = s.pointer(&PointerEvent::new(PointerKind::Down, 30.0, 30.0), v).unwrap_err().to_string();
+    assert!(e.contains(REFUSED), "{e}");
+    s.pointer(&PointerEvent::new(PointerKind::Drag, 60.0, 60.0), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Up, 60.0, 60.0), v).unwrap();
+    assert_eq!(node(&s, other).kind, before, "what was selected stays put");
+    assert_eq!(s.doc().unwrap().selection.objects, [other], "and stays selected");
+    assert_eq!(overrides(&s, inst), 0);
+}
+
+/// A gradient or pattern for a picked object is refused and changes nothing, new art's paint
+/// included. An object that shows a gradient takes a solid color.
+#[test]
+fn gradients_and_patterns_on_a_picked_object_are_refused() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let g = json!({"kind": "linear", "stops": [{"offset": 0, "color": "#ff0000"}, {"offset": 1, "color": "#0000ff"}]});
+    s.execute("swatch.new", &json!({"name": "Ramp", "gradient": g})).unwrap();
+    let tile = square(&mut s, 150.0);
+    s.execute("object.pattern.make", &json!({"ids": [tile.0], "name": "Dots", "edit": false})).unwrap();
+    // An object to sample a gradient from.
+    let far = square(&mut s, 150.0);
+    s.execute("paint.setFill", &json!({"ids": [far.0], "gradient": g})).unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    let undo = undo_steps(&s);
+    let (fill, stroke) = (s.paint.fill.clone(), s.paint.stroke.clone());
+    for (cmd, p) in [
+        ("paint.setFill", json!({"gradient": g})),
+        ("paint.setStroke", json!({"gradient": g})),
+        ("paint.setFill", json!({"gradient": g, "span": "selection"})),
+        ("paint.setFill", json!({"swatch": "Ramp"})),
+        ("paint.setFill", json!({"swatch": "Dots"})),
+        ("appearance.copyFrom", json!({"source": far.0})),
+    ] {
+        let e = s.execute(cmd, &p).unwrap_err().to_string();
+        assert!(e.contains(REFUSED), "{cmd} {p}: {e}");
+    }
+    assert_eq!((overrides(&s, inst), undo_steps(&s)), (0, undo), "nothing changes");
+    assert_eq!((&s.paint.fill, &s.paint.stroke), (&fill, &stroke), "new art keeps its paint");
+    // An object whose art has a gradient takes a solid color; Invert, Complement and selecting one
+    // of its stops are refused.
+    s.execute("symbol.instance.setAppearance", &json!({"id": inst.0, "path": [1], "fill": {"gradient": g}})).unwrap();
+    for cmd in ["paint.invert", "paint.complement"] {
+        let e = s.execute(cmd, &json!({"stroke": false})).unwrap_err().to_string();
+        assert!(e.contains(REFUSED), "{cmd}: {e}");
+    }
+    s.fill_active = true;
+    for index in [json!(1), Value::Null] {
+        let e = s.execute("gradient.selectStop", &json!({"index": index})).unwrap_err().to_string();
+        assert!(e.contains(REFUSED), "gradient.selectStop {index}: {e}");
+    }
+    assert_eq!(s.selected_stop(), None);
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    assert_eq!(pixel(&s, 80, 30), RED);
+    // The Eyedropper's options can leave the gradient out: the fill stays.
+    s.execute("appearance.copyFrom", &json!({"source": far.0, "pickUp": {"appearance": {"fill": {"color": false}}}})).unwrap();
+    assert_eq!(pixel(&s, 80, 30), RED);
+    // Options that pick up neither color leave nothing to change, so the click is refused.
+    let (undo, fill) = (undo_steps(&s), s.paint.fill.clone());
+    let neither = json!({"source": far.0, "pickUp": {"appearance": {"fill": {"color": false}, "stroke": {"color": false}}}});
+    let e = s.execute("appearance.copyFrom", &neither).unwrap_err().to_string();
+    assert!(e.contains(REFUSED), "{e}");
+    assert_eq!((undo_steps(&s), &s.paint.fill), (undo, &fill), "nothing changes");
+}
+
+#[test]
+fn select_part_refuses_hidden_and_locked_objects_of_the_art() {
+    let mut s = session();
+    let (a, b, c) = (square(&mut s, 10.0), square(&mut s, 60.0), square(&mut s, 110.0));
+    let group = id(&s.execute("object.group", &json!({"ids": [b.0, c.0]})).unwrap());
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Three", "ids": [a.0, group.0], "type": "dynamic"})).unwrap());
+    // The art's first square is hidden and its group locked.
+    let mut art = (*s.doc().unwrap().doc.symbols[0].art).clone();
+    let children = art.children_mut().unwrap();
+    std::sync::Arc::make_mut(&mut children[0]).visible = false;
+    std::sync::Arc::make_mut(&mut children[1]).locked = true;
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).symbols[0].art = std::sync::Arc::new(art);
+    for path in [json!([0]), json!([1]), json!([1, 0])] {
+        let e = s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": path})).unwrap_err().to_string();
+        assert!(e.contains("hidden or locked"), "{path}: {e}");
+    }
+    assert!(s.doc().unwrap().selection.symbol_part.is_none(), "nothing is picked");
+    // With the art's group unlocked, a locked instance's objects are still not picked.
+    let mut art = (*s.doc().unwrap().doc.symbols[0].art).clone();
+    std::sync::Arc::make_mut(&mut art.children_mut().unwrap()[1]).locked = false;
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).symbols[0].art = std::sync::Arc::new(art);
+    s.execute("object.lock", &json!({"ids": [inst.0]})).unwrap();
+    let e = s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1, 1]})).unwrap_err().to_string();
+    assert!(e.contains("hidden or locked"), "locked instance: {e}");
+    s.execute("object.unlockAll", &json!({})).unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1, 1]})).unwrap();
+}
+
+#[test]
+fn choosing_the_selection_tool_again_picks_the_instance_whole() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.select_tool("selection", ViewInfo::default()).unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    assert!(s.doc().unwrap().selection.symbol_part.is_some());
+    let before = node(&s, inst).kind.clone();
+    let revision = s.doc().unwrap().revision;
+    s.select_tool("selection", ViewInfo::default()).unwrap();
+    assert!(s.doc().unwrap().selection.symbol_part.is_none());
+    assert_ne!(s.doc().unwrap().revision, revision, "panels cached by revision read the instance");
+    s.execute("object.nudge", &json!({"dx": 1})).unwrap();
+    assert_ne!(node(&s, inst).kind, before, "the instance moves");
+}
+
+#[test]
+fn the_eyedropper_sample_taken_for_a_picked_object_is_kept() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let green = square(&mut s, 150.0);
+    s.execute("paint.setFill", &json!({"ids": [green.0], "color": "#00ff00"})).unwrap();
+    let target = square(&mut s, 150.0);
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("appearance.copyFrom", &json!({"source": green.0})).unwrap();
+    assert_eq!(s.paint.fill.color().map(|c| c.to_hex()), Some("#00ff00".into()), "new art takes the sample's fill");
+    // A reverse Eyedropper click with nothing selected applies that sample.
+    s.execute("select.none", &json!({})).unwrap();
+    assert_eq!(s.execute("appearance.copyFrom", &json!({"source": target.0, "reverse": true})).unwrap()["ids"], json!([target.0]));
+    assert_eq!(node(&s, target).appearance.fill_paint().color().unwrap().to_hex(), "#00ff00");
+}
+
+#[test]
+fn invert_and_complement_recolor_a_picked_object_for_its_instance_only() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let other = id(&s.execute("symbol.place", &json!({"name": "Pair", "x": 55, "y": 80})).unwrap());
+    let art = s.doc().unwrap().doc.symbols[0].art.clone();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    let undo = undo_steps(&s);
+    let r = s.execute("paint.invert", &json!({"stroke": false})).unwrap();
+    assert_eq!(r["changed"], 1, "{r}");
+    assert_eq!(undo_steps(&s), undo + 1, "one undo step");
+    assert_eq!(symbol_part_fill(&s, inst), "#ffff00", "the picked object's own blue, inverted");
+    assert_eq!(overrides(&s, inst), 1, "only the picked object changes");
+    assert_eq!(overrides(&s, other), 0, "the other instance keeps the symbol's look");
+    assert!(*s.doc().unwrap().doc.symbols[0].art == *art, "the symbol's art stays");
+    assert_eq!(pixel(&s, 80, 30), [255, 255, 0, 255], "the changed object");
+    assert_eq!(pixel(&s, 30, 30), BLUE, "its sibling keeps the symbol's look");
+    s.execute("paint.complement", &json!({"stroke": false})).unwrap();
+    assert_eq!(symbol_part_fill(&s, inst), "#0000ff", "the complement of yellow");
+    assert_eq!(undo_steps(&s), undo + 2, "one undo step");
+}
+
+/// One change holds one paint, so Invert and Complement are refused for type whose characters
+/// differ in color, and each character's color stays. A fill gives all of them one color.
+#[test]
+fn invert_and_complement_are_refused_for_picked_type_whose_characters_differ() {
+    let mut s = session();
+    let t = id(&s.execute("text.create", &json!({"x": 10, "y": 50, "text": "Hi"})).unwrap());
+    s.execute("paint.setFill", &json!({"ids": [t.0], "color": "#ff0000"})).unwrap();
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Word", "ids": [t.0], "type": "dynamic"})).unwrap());
+    let mut art = (*s.doc().unwrap().doc.symbols[0].art).clone();
+    let NodeKind::Text(tx) = &mut art.kind else { panic!("type: {art:?}") };
+    let mut second = tx.runs[0].clone();
+    second.style.fill = vectorcraft_color::Paint::solid(vectorcraft_color::Color::rgb(0.0, 0.0, 1.0));
+    tx.runs.push(second);
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).symbols[0].art = std::sync::Arc::new(art);
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": []})).unwrap();
+    let undo = undo_steps(&s);
+    for cmd in ["paint.invert", "paint.complement"] {
+        let e = s.execute(cmd, &json!({"stroke": false})).unwrap_err().to_string();
+        assert!(e.contains(REFUSED), "{cmd}: {e}");
+    }
+    assert_eq!((overrides(&s, inst), undo_steps(&s)), (0, undo), "nothing changes");
+    s.execute("paint.setFill", &json!({"color": "#00ff00"})).unwrap();
+    s.execute("paint.invert", &json!({"stroke": false})).unwrap();
+    assert_eq!(symbol_part_fill(&s, inst), "#ff00ff", "one color inverts");
+}
+
+/// The color of the fill instance `inst`'s first change sets.
+fn symbol_part_fill(s: &Session, inst: NodeId) -> String {
+    let o = node(s, inst).extras().symbol_overrides[0].clone();
+    o.fill.as_ref().and_then(|p| p.color()).map(|c| c.to_hex()).unwrap_or_else(|| panic!("a solid fill: {o:?}"))
+}
+
+#[test]
+fn a_stroke_on_a_picked_type_object_without_a_weight_draws() {
+    let mut s = session();
+    let t = id(&s.execute("text.create", &json!({"x": 10, "y": 50, "text": "Hi"})).unwrap());
+    s.execute("paint.setStroke", &json!({"ids": [t.0], "none": true})).unwrap();
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Word", "ids": [t.0], "type": "dynamic"})).unwrap());
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": []})).unwrap();
+    s.execute("paint.setStroke", &json!({"color": "#ff0000"})).unwrap();
+    let part = s.doc().unwrap().selected_symbol_part().unwrap();
+    let NodeKind::Text(tx) = &part.kind else { panic!("type: {part:?}") };
+    assert!(tx.runs.iter().all(|r| r.style.stroke_width == 1.0 && !r.style.stroke.is_none()), "{:?}", tx.runs);
+}
+
+/// The colors the Fill and Stroke proxies show, as `paint.proxies` replies them.
+fn proxy_colors(s: &mut Session) -> (Option<String>, Option<String>) {
+    let r = s.execute("paint.proxies", &json!({})).unwrap();
+    assert_eq!((r["fillMixed"].clone(), r["strokeMixed"].clone()), (json!(false), json!(false)), "{r}");
+    let (fill, stroke) = s.proxy_paints();
+    assert_eq!((r["fill"].clone(), r["stroke"].clone()), (json!(fill), json!(stroke)));
+    (fill.color().map(|c| c.to_hex()), stroke.color().map(|c| c.to_hex()))
+}
+
+#[test]
+fn the_fill_and_stroke_proxies_show_the_picked_object() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    assert_eq!(proxy_colors(&mut s), (Some("#0000ff".into()), None), "the symbol's own paint");
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    s.execute("paint.setStroke", &json!({"color": "#00ff00"})).unwrap();
+    assert_eq!(proxy_colors(&mut s), (Some("#ff0000".into()), Some("#00ff00".into())), "the object's own paint");
+    // The other object of the same instance shows the symbol's paint.
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [0]})).unwrap();
+    assert_eq!(proxy_colors(&mut s), (Some("#0000ff".into()), None));
+}
+
+#[test]
+fn selecting_a_guide_too_lets_go_of_the_picked_object() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let g = s.execute("guide.add", &json!({"vertical": true, "pos": 150})).unwrap()["index"].as_u64().unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("guide.select", &json!({"indexes": [g], "toggle": true})).unwrap();
+    let sel = s.doc().unwrap().selection.clone();
+    assert_eq!((sel.objects, sel.guides.len(), sel.symbol_part), (vec![inst], 1, None));
+    // Paint now goes to the instance, not to the object.
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    assert_eq!(overrides(&s, inst), 0);
+    // Pruning a selection with a guide in it lets go of the object as well.
+    let mut sel = s.doc().unwrap().selection.clone();
+    sel.symbol_part = Some(vectorcraft_doc::SymbolPart { instance: inst, path: vec![1] });
+    sel.prune(&s.doc().unwrap().doc);
+    assert_eq!(sel.symbol_part, None);
+}
+
+/// A dynamic symbol with 9-slice guides at 25%: a 100 × 100 frame at (50, 50), a 10 × 10 square
+/// in its top-left corner and one in its center; its instance resized to 300 × 100.
+fn sliced_panel() -> (Session, NodeId) {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+    let rect =
+        |s: &mut Session, x: f64, y: f64, w: f64| id(&s.execute("shape.rectangle", &json!({"x": x, "y": y, "width": w, "height": w})).unwrap()).0;
+    let ids = [rect(&mut s, 50.0, 50.0, 100.0), rect(&mut s, 50.0, 50.0, 10.0), rect(&mut s, 95.0, 95.0, 10.0)];
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Panel", "ids": ids, "type": "dynamic", "nineSlice": true})).unwrap());
+    s.execute("object.setBounds", &json!({"x": 50, "y": 50, "width": 300, "height": 100, "reference": 0})).unwrap();
+    (s, inst)
+}
+
+#[test]
+fn direct_selection_picks_and_outlines_the_object_where_a_9_slice_instance_draws_it() {
+    let (mut s, inst) = sliced_panel();
+    let part_box = |s: &Session, path: &[u32]| {
+        let d = &s.doc().unwrap().doc;
+        let o = vectorcraft_doc::hit::symbol_part_outline(d, d.node(inst).unwrap(), path).unwrap();
+        vectorcraft_geom::kurbo::Shape::bounding_box(&o)
+    };
+    let close = |a: Rect, b: Rect| [(a.x0, b.x0), (a.y0, b.y0), (a.x1, b.x1), (a.y1, b.y1)].iter().all(|(x, y)| (x - y).abs() < 1e-6);
+    // The center cell (75..125 of the art) is drawn at 75..325, so the center square at 175..225;
+    // placed by the instance's transform alone it would be at 185..215.
+    assert!(close(part_box(&s, &[2]), Rect::new(175.0, 95.0, 225.0, 105.0)), "{:?}", part_box(&s, &[2]));
+    assert!(close(part_box(&s, &[1]), Rect::new(50.0, 50.0, 60.0, 60.0)), "the corner keeps its size: {:?}", part_box(&s, &[1]));
+    direct(&mut s, (177.0, 100.0), (177.0, 100.0), Mods::default());
+    assert_eq!(s.doc().unwrap().selection.symbol_part, Some(vectorcraft_doc::SymbolPart { instance: inst, path: vec![2] }));
+    direct(&mut s, (165.0, 100.0), (165.0, 100.0), Mods::default());
+    let picked = s.doc().unwrap().selection.symbol_part.clone().map(|p| p.path);
+    assert_ne!(picked, Some(vec![2]), "where the square is not drawn");
+}
+
+/// An object that is drawn once in each 9-slice cell it reaches, rather than cut at the guides
+/// (here area type), is outlined where its copies are drawn.
+#[test]
+fn the_outline_of_an_object_drawn_in_each_9_slice_cell_matches_what_is_drawn() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 300})).unwrap();
+    let frame = id(&s.execute("shape.rectangle", &json!({"x": 50, "y": 50, "width": 100, "height": 100})).unwrap()).0;
+    let area = json!({"width": 80, "height": 10});
+    let text = id(&s.execute("text.create", &json!({"x": 60, "y": 95, "area": area, "size": 6, "text": "Hi"})).unwrap()).0;
+    let ids = [frame, text];
+    let inst = id(&s.execute("symbol.new", &json!({"name": "Bar", "ids": ids, "type": "dynamic", "nineSlice": true})).unwrap());
+    s.execute("object.setBounds", &json!({"x": 50, "y": 50, "width": 300, "height": 100, "reference": 0})).unwrap();
+    let d = &s.doc().unwrap().doc;
+    let o = vectorcraft_doc::hit::symbol_part_outline(d, d.node(inst).unwrap(), &[1]).unwrap();
+    let b = vectorcraft_geom::kurbo::Shape::bounding_box(&o);
+    // The left copy is drawn at 60..75, the center one (placed whole it reaches 0..400) at 75..325
+    // and the right one at 325..340.
+    let want = Rect::new(60.0, 95.0, 340.0, 105.0);
+    assert!([(b.x0, want.x0), (b.y0, want.y0), (b.x1, want.x1), (b.y1, want.y1)].iter().all(|(x, y)| (x - y).abs() < 1e-6), "{b:?}");
+}
+
+#[test]
+fn direct_selection_picks_a_static_instance_whole_as_before() {
+    let mut s = session();
+    let inst = pair(&mut s, "static");
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    let sel = s.doc().unwrap().selection.clone();
+    assert_eq!((sel.objects, sel.symbol_part), (vec![inst], None));
+    assert!(s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).is_err(), "a static symbol");
+    // A dynamic one: Alt picks the instance whole, and a path naming no object is refused.
+    s.execute("symbol.options", &json!({"name": "Pair", "type": "dynamic"})).unwrap();
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods { alt: true, ..Mods::default() });
+    assert!(s.doc().unwrap().selection.symbol_part.is_none());
+    assert!(s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [2]})).is_err());
+    assert!(s.execute("symbol.instance.selectPart", &json!({"path": [1]})).is_err(), "no id");
+    // Making the symbol static again lets go of the picked object.
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("symbol.options", &json!({"name": "Pair", "type": "static"})).unwrap();
+    assert!(s.doc().unwrap().selection.symbol_part.is_none());
+}
+
 #[test]
 fn dynamic_symbols_and_their_changes_round_trip_and_old_documents_save_as_before() {
     let mut s = session();
@@ -191,3 +862,201 @@ fn dynamic_symbols_and_their_changes_round_trip_and_old_documents_save_as_before
     assert_eq!(back.node(inst).unwrap().extras().symbol_overrides, doc.node(inst).unwrap().extras().symbol_overrides);
     assert_eq!(back.symbols, doc.symbols);
 }
+
+#[test]
+fn a_swatch_edit_recolors_a_picked_objects_own_paints() {
+    let mut s = session();
+    s.execute("swatch.new", &json!({"name": "Brand", "color": "#ff0000", "global": true})).unwrap();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("paint.setFill", &json!({"swatch": "Brand"})).unwrap();
+    assert_eq!(pixel(&s, 80, 30), RED);
+    s.execute("swatch.edit", &json!({"name": "Brand", "color": "#00ff00"})).unwrap();
+    let fill = s.doc().unwrap().selected_symbol_part().unwrap().appearance.fill_paint();
+    assert_eq!(fill.color().map(|c| c.to_hex()), Some("#00ff00".into()), "{fill:?}");
+    assert_eq!(pixel(&s, 80, 30), [0, 255, 0, 255]);
+}
+
+#[test]
+fn a_swatch_or_color_only_a_picked_objects_paint_uses_counts_as_used() {
+    let mut s = session();
+    s.execute("swatch.new", &json!({"name": "Brand", "color": "#ff0000", "global": true})).unwrap();
+    let inst = pair(&mut s, "dynamic");
+    let unused = |s: &mut Session| s.execute("swatch.unused", &json!({})).unwrap()["names"].clone();
+    assert!(unused(&mut s).as_array().unwrap().contains(&json!("Brand")));
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("paint.setFill", &json!({"swatch": "Brand"})).unwrap();
+    assert!(!unused(&mut s).as_array().unwrap().contains(&json!("Brand")), "only the object's own paint uses it");
+    let colors = s.execute("recolor.colors", &json!({"ids": [inst.0]})).unwrap();
+    assert!(colors["colors"].as_array().unwrap().iter().any(|c| c["hex"] == "#ff0000" && c["swatch"] == "Brand"), "{colors}");
+    // A swatch edit maps the same paint once.
+    s.execute("swatch.edit", &json!({"name": "Brand", "color": "#00ff00"})).unwrap();
+    assert_eq!(symbol_part_fill(&s, inst), "#00ff00");
+}
+
+/// The Eyedropper takes a picked object's paints only from a path, compound path or type.
+#[test]
+fn the_eyedropper_refuses_a_source_that_is_not_painted_art() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let other = id(&s.execute("symbol.place", &json!({"name": "Pair", "x": 55, "y": 80})).unwrap());
+    let (a, b) = (square(&mut s, 150.0), square(&mut s, 150.0));
+    let group = id(&s.execute("object.group", &json!({"ids": [a.0, b.0]})).unwrap());
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    let (fill, stroke, own, undo) = (s.paint.fill.clone(), s.paint.stroke.clone(), node(&s, inst).extras().symbol_overrides.clone(), undo_steps(&s));
+    s.eyedropper_sample = None;
+    for source in [inst, other, group] {
+        let e = s.execute("appearance.copyFrom", &json!({"source": source.0})).unwrap_err().to_string();
+        assert!(e.contains(REFUSED), "{e}");
+    }
+    // A click with the tool on an instance, the picked one included.
+    let v = ViewInfo { smart_guides: false, ..Default::default() };
+    s.select_tool("eyedropper", v).unwrap();
+    let e = s.pointer(&PointerEvent::new(PointerKind::Down, 80.0, 30.0), v).unwrap_err().to_string();
+    assert!(e.contains(REFUSED), "{e}");
+    s.pointer(&PointerEvent::new(PointerKind::Up, 80.0, 30.0), v).unwrap();
+    assert_eq!(node(&s, inst).extras().symbol_overrides, own, "the object keeps its paints");
+    assert_eq!(undo_steps(&s), undo, "no undo step");
+    assert_eq!((&s.paint.fill, &s.paint.stroke), (&fill, &stroke), "the defaults for new art stay");
+    assert!(s.eyedropper_sample.is_none(), "nothing was sampled");
+    assert_eq!(pixel(&s, 80, 30), RED);
+}
+
+/// A path of a compound path gives the paint of the compound path, which holds it.
+#[test]
+fn the_eyedropper_samples_a_compound_path_through_its_member() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    let (a, b) = (square(&mut s, 120.0), square(&mut s, 170.0));
+    let compound = id(&s.execute("object.compoundPath.make", &json!({"ids": [a.0, b.0]})).unwrap());
+    s.execute("paint.setFill", &json!({"ids": [compound.0], "color": "#00ff00"})).unwrap();
+    let member = node(&s, compound).children().unwrap()[0].id;
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("appearance.copyFrom", &json!({"source": member.0})).unwrap();
+    assert_eq!(symbol_part_fill(&s, inst), "#00ff00");
+    assert_eq!(pixel(&s, 80, 30), [0, 255, 0, 255]);
+}
+
+/// A Cmd-drag lends the Selection tool, or with Alt Group Selection, which act on the whole instance.
+#[test]
+fn a_lent_selection_tool_moves_the_instance_of_a_picked_object() {
+    let cmd = Mods { cmd: true, ..Mods::default() };
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    assert!(s.doc().unwrap().selection.symbol_part.is_some());
+    let before = node(&s, inst).kind.clone();
+    direct(&mut s, (80.0, 30.0), (100.0, 40.0), cmd);
+    assert!(s.doc().unwrap().selection.symbol_part.is_none());
+    assert_ne!(node(&s, inst).kind, before, "the instance moves");
+
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods { alt: true, ..cmd });
+    assert!(s.doc().unwrap().selection.symbol_part.is_none(), "Group Selection selects the instance whole");
+    assert_eq!(s.doc().unwrap().selection.objects, [inst]);
+    // A plain Direct Selection click picks the object again once the tool is back.
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    assert!(s.doc().unwrap().selection.symbol_part.is_some());
+}
+
+/// The commands that change nothing in the document read the instance of a picked object, so the
+/// Attributes and CSS Properties panels and the others keep showing it.
+#[test]
+fn read_only_commands_read_the_instance_of_a_picked_object() {
+    let mut failures = Vec::new();
+    for spec in crate::cmd::command_specs().iter().filter(|c| !c.journal) {
+        let mut s = session();
+        let inst = pair(&mut s, "dynamic");
+        s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+        let doc = s.doc().unwrap().doc.clone();
+        if let Err(e) = s.execute(spec.id, &json!({}))
+            && e.to_string().contains("symbol instance")
+        {
+            failures.push(format!("{}: {e}", spec.id));
+        }
+        if s.doc().is_ok_and(|st| st.doc != doc) {
+            failures.push(format!("{}: the document changed", spec.id));
+        }
+        // A command run after one of these is refused as before.
+        if s.doc().is_ok_and(|st| st.selection.symbol_part.is_some()) && s.execute("object.hide", &json!({})).is_ok() {
+            failures.push(format!("{}: the refusal stays off afterward", spec.id));
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.execute("css.selection", &json!({})).unwrap();
+    s.execute("attributes.info", &json!({})).unwrap();
+}
+
+/// Export CSS writes a file and changes nothing in the document, so it reads the instance of a
+/// picked object as it reads an instance selected whole, and the next edit is refused as before.
+#[test]
+fn css_export_reads_the_instance_of_a_picked_object() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("select.set", &json!({"ids": [inst.0]})).unwrap();
+    let whole = s.execute("css.export", &json!({})).unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    let doc = s.doc().unwrap().doc.clone();
+    let picked = s.execute("css.export", &json!({})).unwrap();
+    assert_eq!(picked["rules"], 1);
+    assert_eq!(picked["data"], whole["data"]);
+    assert!(s.doc().unwrap().doc == doc, "the document changed");
+    assert!(s.doc().unwrap().selection.symbol_part.is_some());
+    assert!(s.execute("object.hide", &json!({})).is_err());
+}
+
+/// A drag that moved nothing leaves Transform Again repeating the last real transformation.
+#[test]
+fn a_refused_drag_of_a_picked_object_is_not_kept_for_transform_again() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    direct(&mut s, (80.0, 30.0), (80.0, 30.0), Mods::default());
+    assert!(s.doc().unwrap().selection.symbol_part.is_some());
+    direct(&mut s, (80.0, 30.0), (120.0, 60.0), Mods::default());
+    assert!(s.doc().unwrap().last_transform.is_none(), "{:?}", s.doc().unwrap().last_transform);
+    assert_eq!(s.doc().unwrap().selection.objects, [inst]);
+}
+
+/// A bad `target` or `aligned` on a paint command is refused with an object picked too.
+#[test]
+fn bad_paint_parameters_leave_a_picked_object_alone() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    let undo = undo_steps(&s);
+    for (cmd, p) in [
+        ("paint.setFill", json!({"color": "#ff0000", "target": "bogus"})),
+        ("paint.setStroke", json!({"color": "#ff0000", "target": "bogus"})),
+        ("paint.invert", json!({"target": "bogus"})),
+        ("paint.complement", json!({"target": "bogus"})),
+        ("paint.setFill", json!({"color": "#ff0000", "aligned": "yes"})),
+    ] {
+        let e = s.execute(cmd, &p).unwrap_err().to_string();
+        assert!(e.contains("`target` must") || e.contains("aligned"), "{cmd} {p}: {e}");
+        assert_eq!(overrides(&s, inst), 0, "{cmd} {p}");
+    }
+    assert_eq!(undo_steps(&s), undo, "no undo step");
+}
+
+/// An object picked while Replace read its file: the instance selected when Place started is
+/// selected again first, so a replay of the journal replaces it.
+#[test]
+fn a_replace_that_finishes_after_an_object_was_picked_selects_the_instance_again() {
+    let mut s = session();
+    let inst = pair(&mut s, "dynamic");
+    s.execute("select.set", &json!({"ids": [inst.0]})).unwrap();
+    let svg = "<svg xmlns='http://www.w3.org/2000/svg' width='9' height='9'><rect width='9' height='9'/></svg>";
+    let p = json!({"name": "a.svg", "dataBase64": vectorcraft_format::base64_encode(svg.as_bytes()), "replace": true});
+    let read = s.prepare_place(&p).unwrap().read().unwrap();
+    s.execute("symbol.instance.selectPart", &json!({"id": inst.0, "path": [1]})).unwrap();
+    s.place_read(read).unwrap();
+    assert!(s.doc().unwrap().doc.node(inst).is_none());
+    let last: Vec<_> = s.journal.iter().rev().take(2).rev().map(|(id, _)| id.clone()).collect();
+    assert_eq!(last, ["select.set", "file.place"]);
+}
diff --git a/crates/engine/src/tests/live.rs b/crates/engine/src/tests/live.rs
index c7479ce8f..08fc120e0 100644
--- a/crates/engine/src/tests/live.rs
+++ b/crates/engine/src/tests/live.rs
@@ -537,6 +537,25 @@ fn envelope_top_object_maps_corners() {
     assert!(close(b.x0, 350.0) && close(b.y1, 250.0));
 }
 
+/// Each piece of a top object's side takes a share of the content in proportion to its control
+/// polygon, spread by its curve parameter. The top side's two curves have polygons of 64.7 and
+/// 166.5, so the content's middle lands on the second curve at t = 0.3056, (482.6, 106.4); by
+/// length it would land at (493.7, 106.9), and by equal shares at the anchor (440, 100).
+#[test]
+fn envelope_top_object_shares_a_side_by_control_polygon_length() {
+    let mut s = session();
+    let left = rect(&mut s, 100.0, 100.0, 100.0, 100.0);
+    let right = rect(&mut s, 200.0, 100.0, 100.0, 100.0);
+    let d = "M400 100 C410 80 430 80 440 100 C460 110 590 110 600 100 L600 200 L400 200 Z";
+    let t = id_of(&s.execute("path.create", &json!({ "d": d })).unwrap());
+    sel(&mut s, &[left, right, t]);
+    let e = id_of(&s.execute("object.envelope.makeWithTopObject", &json!({})).unwrap());
+    let pts = all_anchors(&live::expand_live(&node(&s, e)));
+    let near = |c: Point| pts.iter().map(|p| p.distance(c)).fold(f64::INFINITY, f64::min);
+    assert!(near(Point::new(482.6, 106.37)) < 0.5, "the middle of the top: {pts:?}");
+    assert!(near(Point::new(500.0, 200.0)) < 0.5, "the middle of the bottom: {pts:?}");
+}
+
 #[test]
 fn envelope_release_and_expand() {
     let mut s = session();
diff --git a/crates/engine/src/tests/nativefile.rs b/crates/engine/src/tests/nativefile.rs
index e3a5588b7..4156dc759 100644
--- a/crates/engine/src/tests/nativefile.rs
+++ b/crates/engine/src/tests/nativefile.rs
@@ -222,7 +222,8 @@ fn a_version_1_documents_twist_turns_as_it_was_saved() {
 
 /// A save records the date the document was made in, so the same commands twice gave different
 /// bytes (#2880). A pinned date makes them identical — `file.new {created}` here, and
-/// `SOURCE_DATE_EPOCH` for an export that takes no date param.
+/// `SOURCE_DATE_EPOCH` for an export that takes no date param. The PDF a native file carries by
+/// default is dated by the document's dates, not by the time of writing.
 #[test]
 fn a_pinned_date_makes_saves_byte_identical() {
     let once = |t: i64| {
@@ -232,6 +233,9 @@ fn a_pinned_date_makes_saves_byte_identical() {
         saved(&mut s, json!({}))
     };
     let at = 1_791_208_980;
+    let pdf = vectorcraft_format::pdf_content(&once(at)).expect("a native save carries a PDF by default");
+    let info = vectorcraft_pdf::file_info(&pdf, None).unwrap();
+    assert_eq!((info.created, info.modified), (Some(at), Some(at)), "the PDF has the document's dates");
     assert_eq!(once(at), once(at), "the same document and date give the same bytes");
     // The date really is in the bytes, so the comparison above is not vacuous.
     assert_ne!(once(at), once(at + 1), "another date shows in the bytes");
diff --git a/crates/engine/src/tests/objexpand.rs b/crates/engine/src/tests/objexpand.rs
index 59b8db890..4210a1d96 100644
--- a/crates/engine/src/tests/objexpand.rs
+++ b/crates/engine/src/tests/objexpand.rs
@@ -133,6 +133,37 @@ fn white_black() -> Value {
     json!({"kind": "linear", "stops": [{"offset": 0, "color": "#ffffff"}, {"offset": 1, "color": "#000000"}]})
 }
 
+#[test]
+fn a_placed_gradient_moved_by_a_transform_or_free_distort_expands_as_the_canvas_draws_it() {
+    // The object's own effect, and the fill's (the first appearance item).
+    let slant = json!({"corners": [[0.25, 0.0], [1.25, 0.0], [1.0, 1.0], [0.0, 1.0]]});
+    for (effect, params, item) in [
+        ("distort.transform", json!({"rotate": 90}), json!(null)),
+        ("distort.transform", json!({"rotate": 30, "scaleH": 60}), json!(null)),
+        ("distort.transform", json!({"rotate": 90}), json!(0)),
+        ("distort.freeDistort", slant.clone(), json!(null)),
+        ("distort.freeDistort", slant, json!(0)),
+    ] {
+        let mut s = session();
+        let id = gradient_rect(&mut s, Rect::new(40.0, 70.0, 160.0, 130.0), white_black(), false);
+        // Placed from a quarter of the way across to the right edge.
+        run(&mut s, "paint.setGradientGeom", json!({"start": [70, 100], "end": [160, 100], "stroke": false}));
+        let placed = s.doc().unwrap().doc.node(id).and_then(|n| match n.appearance.fill_paint() {
+            vectorcraft_color::Paint::Gradient(g) => g.geom,
+            _ => None,
+        });
+        assert!(placed.is_some(), "the fill's gradient is placed");
+        run(&mut s, "effect.apply", json!({"effect": effect, "params": params, "ids": [id.0], "item": item}));
+        let before = render(&s);
+        // Fill alone: the gradient becomes strips inside the outline the effect makes.
+        run(&mut s, "object.expand", json!({"object": false, "stroke": false, "steps": 64}));
+        let after = render(&s);
+        // The gradient moves with the rectangle on the canvas, and the strips follow it.
+        let diff = mean_diff(&before, &after);
+        assert!(diff < 1.0, "{effect} {params} on item {item}: mean difference {diff}");
+    }
+}
+
 #[test]
 fn eight_strips_match_the_gradient_samples() {
     let mut s = session();
diff --git a/crates/engine/src/tests/panelcmds.rs b/crates/engine/src/tests/panelcmds.rs
index 0f95fc2f6..0870ffb87 100644
--- a/crates/engine/src/tests/panelcmds.rs
+++ b/crates/engine/src/tests/panelcmds.rs
@@ -119,6 +119,60 @@ fn artboards_reorder_and_duplicate() {
     assert_eq!(s.doc().unwrap().doc.artboards[0].name, "Second");
 }
 
+/// `artboard.new {beside, side}` adds an empty artboard the size of artboard `beside`, 20 pt from
+/// that side of it, and `artboard.duplicate {index, side}` puts the copy and its art there; each is
+/// one undo step. An unknown side, `beside` without `side`, and `side` with a size or place are
+/// refused and change nothing.
+#[test]
+fn artboards_are_added_and_duplicated_on_a_side() {
+    let mut s = session();
+    let id = rect(&mut s);
+    let board = |s: &Session, i: usize| s.doc().unwrap().doc.artboards[i].rect;
+    let undo = |s: &Session| s.doc().unwrap().history.undo.len();
+    let src = board(&s, 0);
+    let before = undo(&s);
+    assert_eq!(s.execute("artboard.new", &json!({"beside": 0, "side": "bottom"})).unwrap()["index"], 1);
+    assert_eq!(board(&s, 1), src + vectorcraft_geom::Vec2::new(0.0, src.height() + 20.0), "same size, 20 pt below");
+    assert_eq!(undo(&s), before + 1, "one undo step");
+    assert!(!s.doc().unwrap().doc.artboard_has_art(board(&s, 1)), "the new artboard is empty");
+    s.execute("artboard.new", &json!({"beside": 0, "side": "left"})).unwrap();
+    assert_eq!(board(&s, 2), src + vectorcraft_geom::Vec2::new(-(src.width() + 20.0), 0.0));
+    s.execute("artboard.new", &json!({"side": "top"})).unwrap();
+    assert_eq!(board(&s, 3), board(&s, 2) + vectorcraft_geom::Vec2::new(0.0, -(src.height() + 20.0)), "by default beside the last");
+    s.execute("artboard.new", &json!({"side": "top", "beside": null, "x": null})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+
+    let before = undo(&s);
+    let out = s.execute("artboard.duplicate", &json!({"index": 0, "side": "right", "art": true})).unwrap();
+    assert_eq!(out["index"], 4);
+    let dv = vectorcraft_geom::Vec2::new(src.width() + 20.0, 0.0);
+    assert_eq!(board(&s, 4), src + dv, "the copy sits 20 pt right of the artboard it copies");
+    let copies: Vec<NodeId> = out["ids"].as_array().unwrap().iter().map(|v| NodeId(v.as_u64().unwrap())).collect();
+    assert_eq!(copies.len(), 1);
+    let bounds = |s: &Session, id: NodeId| s.doc().unwrap().doc.bounds_of(&[id], false).unwrap();
+    assert_eq!(bounds(&s, copies[0]), bounds(&s, id) + dv, "its art goes with it");
+    assert_eq!(undo(&s), before + 1, "one undo step");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.doc().unwrap().doc.artboards.len(), 4, "undo takes the copy and its art away together");
+    assert!(s.doc().unwrap().doc.node(copies[0]).is_none());
+
+    let before = s.doc().unwrap().doc.clone();
+    let steps = undo(&s);
+    for (cmd, p, msg) in [
+        ("artboard.new", json!({"beside": 0, "side": "middle"}), "`side` must be"),
+        ("artboard.new", json!({"beside": 0, "side": 3}), "`side` must be"),
+        ("artboard.new", json!({"beside": 0}), "`beside` needs `side`"),
+        ("artboard.new", json!({"side": "left", "width": 100}), "leave out x, y, width and height"),
+        ("artboard.new", json!({"beside": 9, "side": "left"}), "no such artboard"),
+        ("artboard.duplicate", json!({"index": 0, "side": "inside"}), "`side` must be"),
+    ] {
+        let e = s.execute(cmd, &p).unwrap_err().to_string();
+        assert!(e.contains(msg), "{cmd} {p}: {e}");
+        assert_eq!(*s.doc().unwrap().doc, *before, "{cmd} {p} changes nothing");
+        assert_eq!(undo(&s), steps, "{cmd} {p}");
+    }
+}
+
 /// An artboard's background color (Properties › Artboards › Fill): `artboard.setProps {color}` sets
 /// it and `{color: null}` clears it, each in one undo step. A change without `color` leaves it, a
 /// duplicate keeps it, `inspect_document` reports it, `artboard.new {color}` starts with it, an
diff --git a/crates/engine/src/tests/pattern.rs b/crates/engine/src/tests/pattern.rs
index 544dcce96..c36d84fd9 100644
--- a/crates/engine/src/tests/pattern.rs
+++ b/crates/engine/src/tests/pattern.rs
@@ -979,6 +979,32 @@ fn picking_another_pattern_swatch_keeps_the_pattern_transform() {
     assert_eq!(xf.as_coeffs(), [2.0, 0.0, 0.0, 2.0, 15.0, 10.0]);
 }
 
+/// A pattern swatch made from the current fill holds the pattern untransformed: a fill picked up
+/// from art whose tiles were moved does not carry that placement to the art the swatch is applied
+/// to, which keeps its own (#1970).
+#[test]
+fn a_pattern_swatch_made_from_a_transformed_fill_holds_the_pattern_untransformed() {
+    let mut s = session();
+    make_dots(&mut s);
+    let src = rect(&mut s, 100.0, 100.0, 50.0, 50.0);
+    s.execute("paint.setFill", &json!({"ids": [src.0], "swatch": "Dots"})).unwrap();
+    s.execute("pattern.transform", &json!({"ids": [src.0], "matrix": [2, 0, 0, 2, 15, 10]})).unwrap();
+    sel(&mut s, &[]);
+    s.execute("appearance.copyFrom", &json!({"source": src.0})).unwrap();
+    let Paint::Pattern { xf, .. } = &s.paint.fill else { panic!("the picked-up pattern fill") };
+    assert_eq!(xf.as_coeffs(), [2.0, 0.0, 0.0, 2.0, 15.0, 10.0], "the current fill has the tiles' placement");
+    s.execute("swatch.new", &json!({"name": "Picked"})).unwrap();
+    let Paint::Pattern { pattern, xf } = doc(&s).swatch("Picked").unwrap().paint.clone() else { panic!("a pattern swatch") };
+    assert_eq!((pattern.as_str(), xf.as_coeffs()), ("Dots", [1.0, 0.0, 0.0, 1.0, 0.0, 0.0]));
+    let dst = rect(&mut s, 300.0, 100.0, 50.0, 50.0);
+    s.execute("paint.setFill", &json!({"ids": [dst.0], "color": "#00ff00"})).unwrap();
+    s.execute("paint.setFill", &json!({"ids": [dst.0], "swatch": "Dots"})).unwrap();
+    s.execute("pattern.transform", &json!({"ids": [dst.0], "matrix": [3, 0, 0, 3, 0, 0]})).unwrap();
+    s.execute("paint.setFill", &json!({"ids": [dst.0], "swatch": "Picked"})).unwrap();
+    let Paint::Pattern { xf, .. } = node(&s, dst).appearance.fill_paint() else { panic!("a pattern fill") };
+    assert_eq!(xf.as_coeffs(), [3.0, 0.0, 0.0, 3.0, 0.0, 0.0], "the art keeps its own placement");
+}
+
 #[test]
 fn inner_glow_on_a_pattern_fill_stays_inside_the_object_on_the_threaded_renderer() {
     // #2426: the glow's pixmap was drawn with the pattern's paint transform, so it landed
diff --git a/crates/engine/src/tests/pixelalign.rs b/crates/engine/src/tests/pixelalign.rs
new file mode 100644
index 000000000..d348b13ae
--- /dev/null
+++ b/crates/engine/src/tests/pixelalign.rs
@@ -0,0 +1,768 @@
+//! Transform panel › Align to Pixel Grid (`object.setPixelAligned`): a pixel-aligned path keeps its
+//! horizontal and vertical segments on the pixel grid through transforms.
+
+use serde_json::{Value, json};
+use vectorcraft_doc::{NodeId, NodeKind};
+
+use crate::Session;
+
+fn new_doc() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 400, "height": 400})).unwrap();
+    s
+}
+
+/// A closed path from SVG path data `d`, selected, with a stroke of `weight` points.
+fn path(s: &mut Session, d: &str, weight: f64) -> u64 {
+    let id = s.execute("path.create", &json!({"d": d})).unwrap()["id"].as_u64().unwrap();
+    s.execute("select.set", &json!({"ids": [id]})).unwrap();
+    s.execute("stroke.set", &json!({"weight": weight})).unwrap();
+    id
+}
+
+/// The anchor points of path object `id`, every subpath's in order.
+fn points(s: &Session, id: u64) -> Vec<(f64, f64)> {
+    let n = s.doc().unwrap().doc.node(NodeId(id)).unwrap().clone();
+    n.path_data().unwrap().anchors().map(|(_, _, a)| (a.p.x, a.p.y)).collect()
+}
+
+fn aligned(s: &Session, id: u64) -> bool {
+    s.doc().unwrap().doc.node(NodeId(id)).unwrap().extras().pixel_aligned
+}
+
+fn undo_len(s: &Session) -> usize {
+    s.doc().unwrap().history.undo.len()
+}
+
+/// Whether every coordinate is a whole number of points (within rounding error).
+fn whole(points: &[(f64, f64)]) -> bool {
+    points.iter().all(|(x, y)| (x - x.round()).abs() < 1e-9 && (y - y.round()).abs() < 1e-9)
+}
+
+fn close(a: (f64, f64), b: (f64, f64)) -> bool {
+    (a.0 - b.0).abs() < 1e-9 && (a.1 - b.1).abs() < 1e-9
+}
+
+/// Turning it on sets the property and snaps the path's horizontal and vertical edges to whole
+/// points, in one undo step; turning it on again changes nothing and makes no undo step; undo
+/// puts the path and the property back.
+#[test]
+fn turning_it_on_snaps_the_path_in_one_undo_step() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    let before = points(&s, id);
+    let steps = undo_len(&s);
+    let r = s.execute("object.setPixelAligned", &json!({"on": true})).unwrap();
+    assert_eq!(r["ids"], json!([id]));
+    assert!(aligned(&s, id));
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    assert_eq!(undo_len(&s), steps + 1);
+    let r = s.execute("object.setPixelAligned", &json!({"ids": [id]})).unwrap();
+    assert_eq!(r["ids"], json!([]));
+    assert_eq!(undo_len(&s), steps + 1);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(!aligned(&s, id));
+    assert_eq!(points(&s, id), before);
+    // An odd stroke weight centered on the path puts the edges on half points, and the stroke
+    // weight becomes whole.
+    s.execute("stroke.set", &json!({"weight": 0.8})).unwrap();
+    s.execute("object.setPixelAligned", &json!({"on": true})).unwrap();
+    assert_eq!(points(&s, id), [(10.5, 20.5), (40.5, 20.5), (40.5, 30.5), (10.5, 30.5)]);
+    assert_eq!(s.doc().unwrap().doc.node(NodeId(id)).unwrap().appearance.stroke_width(), 1.0);
+    // Off keeps the geometry.
+    s.execute("object.setPixelAligned", &json!({"on": false})).unwrap();
+    assert!(!aligned(&s, id));
+    assert_eq!(points(&s, id), [(10.5, 20.5), (40.5, 20.5), (40.5, 30.5), (10.5, 30.5)]);
+}
+
+/// A pixel-aligned path stays on the pixel grid after a fractional move, a scale, a rotation about
+/// a fractional point, a reflection, Transform Each and a move of its group; one that is not
+/// moves exactly as before.
+#[test]
+fn it_stays_aligned_through_transforms() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    let other = path(&mut s, "M10 121 L41 121 L41 130 L10 130 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [id]})).unwrap();
+    s.execute("select.set", &json!({"ids": [id, other]})).unwrap();
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.45})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    assert!(close(points(&s, other)[0], (10.3, 121.45)), "{:?}", points(&s, other));
+    s.execute("select.set", &json!({"ids": [id]})).unwrap();
+    for (cmd, p) in [
+        ("object.move", json!({"dx": 5.7, "dy": -2.2})),
+        ("object.scale", json!({"sx": 133, "sy": 71})),
+        ("object.rotate", json!({"angle": 90, "origin": [20.2, 20.7]})),
+        ("object.reflect", json!({"axis": "horizontal", "origin": [0.3, 0.3]})),
+        ("object.transformEach", json!({"moveH": 0.4, "moveV": 0.35})),
+        ("object.setBounds", json!({"width": 17.3})),
+    ] {
+        s.execute(cmd, &p).unwrap();
+        let pts = points(&s, id);
+        assert!(whole(&pts), "{cmd}: {pts:?}");
+        let xs: Vec<f64> = pts.iter().map(|p| p.0).collect();
+        assert!(xs.iter().any(|x| (x - xs[0]).abs() >= 1.0), "{cmd}: the path collapsed: {pts:?}");
+    }
+    // In a group that moves.
+    s.execute("select.set", &json!({"ids": [id, other]})).unwrap();
+    s.execute("object.group", &json!({})).unwrap();
+    let before = points(&s, other);
+    s.execute("object.move", &json!({"dx": 0.25, "dy": 0.0})).unwrap();
+    assert!(whole(&points(&s, id)), "{:?}", points(&s, id));
+    assert!(close(points(&s, other)[0], (before[0].0 + 0.25, before[0].1)));
+}
+
+/// Art moved with its artboard stays on the pixel grid.
+#[test]
+fn it_stays_aligned_when_its_artboard_moves() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    s.execute("artboard.move", &json!({"index": 0, "dx": 0.4, "dy": 0.3, "moveArt": true})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    s.execute("artboard.move", &json!({"index": 0, "dx": 0.6, "dy": 0.7, "moveArt": true})).unwrap();
+    assert_eq!(points(&s, id), [(11.0, 22.0), (42.0, 22.0), (42.0, 31.0), (11.0, 31.0)]);
+}
+
+/// Diagonal segments and curves keep their shape: only the anchors that horizontal and vertical
+/// segments share move, each with its handles.
+#[test]
+fn diagonal_segments_and_curves_keep_their_shape() {
+    let mut s = new_doc();
+    // A triangle: a horizontal base and two diagonal sides. Only the base's y snaps.
+    let tri = path(&mut s, "M0.2 0.2 L20.4 0.2 L10.3 15.7 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    let pts = points(&s, tri);
+    assert!(close(pts[0], (0.2, 0.0)) && close(pts[1], (20.4, 0.0)) && close(pts[2], (10.3, 15.7)), "{pts:?}");
+    s.execute("object.move", &json!({"dx": 0.5, "dy": 0.3})).unwrap();
+    let pts = points(&s, tri);
+    assert!(close(pts[0], (0.7, 0.0)) && close(pts[1], (20.9, 0.0)) && close(pts[2], (10.8, 16.0)), "{pts:?}");
+    // A curve between two horizontal segments: its ends move with them and its handles with its
+    // ends.
+    let curved = path(&mut s, "M100.3 100.3 L120.3 100.3 C125 105 125 115 120.3 120.3 L100.3 120.3 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    let n = s.doc().unwrap().doc.node(NodeId(curved)).unwrap().clone();
+    let sp = &n.path_data().unwrap().subpaths[0];
+    let a = &sp.anchors;
+    assert!(close((a[0].p.x, a[0].p.y), (100.0, 100.0)) && close((a[3].p.x, a[3].p.y), (100.0, 120.0)));
+    assert!(close((a[1].p.x, a[1].p.y), (120.3, 100.0)) && close((a[1].h_out.x, a[1].h_out.y), (125.0, 104.7)));
+    assert!(close((a[2].p.x, a[2].p.y), (120.3, 120.0)) && close((a[2].h_in.x, a[2].h_in.y), (125.0, 114.7)));
+    // A rectangle turned 45° has no horizontal or vertical segment, and stays as it is.
+    let turned = path(&mut s, "M200.5 200 L210.5 210.3 L200.5 220.6 L190.5 210.3 Z", 2.0);
+    let before = points(&s, turned);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    assert_eq!(points(&s, turned), before);
+}
+
+/// Live shapes stay live, and compound paths snap each of their paths.
+#[test]
+fn live_shapes_and_compound_paths_snap() {
+    let mut s = new_doc();
+    let rect = s.execute("shape.rectangle", &json!({"x": 10.3, "y": 20.6, "width": 30.4, "height": 9.7})).unwrap()["id"].as_u64().unwrap();
+    s.execute("stroke.set", &json!({"weight": 2})).unwrap();
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    let n = s.doc().unwrap().doc.node(NodeId(rect)).unwrap().clone();
+    assert!(n.live_shape().is_some());
+    let b = n.geometric_bounds().unwrap();
+    assert_eq!((b.x0, b.y0, b.x1, b.y1), (10.0, 21.0, 41.0, 30.0));
+    s.execute("object.move", &json!({"dx": 0.4, "dy": 0.4})).unwrap();
+    let b = s.doc().unwrap().doc.node(NodeId(rect)).unwrap().geometric_bounds().unwrap();
+    assert_eq!((b.x0, b.y0, b.x1, b.y1), (10.0, 21.0, 41.0, 30.0));
+    let a = path(&mut s, "M100.2 100.2 L110.6 100.2 L110.6 110.6 L100.2 110.6 Z", 2.0);
+    let b = path(&mut s, "M200.2 100.2 L210.6 100.2 L210.6 110.6 L200.2 110.6 Z", 2.0);
+    s.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+    let c = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [c]})).unwrap();
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.0})).unwrap();
+    let n = s.doc().unwrap().doc.node(NodeId(c)).unwrap().clone();
+    let pts: Vec<(f64, f64)> =
+        n.children().unwrap().iter().flat_map(|k| k.path_data().unwrap().anchors().map(|(_, _, a)| (a.p.x, a.p.y)).collect::<Vec<_>>()).collect();
+    assert_eq!(pts.len(), 8);
+    assert!(whole(&pts), "{pts:?}");
+}
+
+/// The anchor points of every path in compound path `id`.
+fn compound_points(s: &Session, id: u64) -> Vec<(f64, f64)> {
+    let n = s.doc().unwrap().doc.node(NodeId(id)).unwrap().clone();
+    n.children().unwrap().iter().flat_map(|k| k.path_data().unwrap().anchors().map(|(_, _, a)| (a.p.x, a.p.y)).collect::<Vec<_>>()).collect()
+}
+
+/// A stroke edit on a pixel-aligned path rounds the new weight and snaps the path again: a 0.8 pt
+/// weight becomes 1 pt with the edges on half points, a centered 3 pt stroke keeps the edges on
+/// half points, and Stroke Weight Up keeps the weight whole; all in the stroke edit's one undo step.
+#[test]
+fn stroke_edits_keep_it_aligned() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    let steps = undo_len(&s);
+    s.execute("stroke.set", &json!({"weight": 0.8})).unwrap();
+    assert_eq!(s.doc().unwrap().doc.node(NodeId(id)).unwrap().appearance.stroke_width(), 1.0);
+    assert_eq!(points(&s, id), [(10.5, 21.5), (41.5, 21.5), (41.5, 30.5), (10.5, 30.5)]);
+    assert_eq!(undo_len(&s), steps + 1);
+    s.execute("stroke.set", &json!({"weight": 2})).unwrap();
+    assert!(whole(&points(&s, id)), "{:?}", points(&s, id));
+    s.execute("stroke.set", &json!({"weight": 3})).unwrap();
+    let pts = points(&s, id);
+    assert!(pts.iter().all(|(x, y)| (x - x.floor() - 0.5).abs() < 1e-9 && (y - y.floor() - 0.5).abs() < 1e-9), "{pts:?}");
+    // Inside alignment puts the stroke within the path, so the anchors go back to whole points.
+    s.execute("stroke.set", &json!({"align": "inside"})).unwrap();
+    assert!(whole(&points(&s, id)), "{:?}", points(&s, id));
+    s.execute("stroke.set", &json!({"align": "center", "weight": 0.6})).unwrap();
+    s.execute("stroke.weightUp", &json!({})).unwrap();
+    let w = s.doc().unwrap().doc.node(NodeId(id)).unwrap().appearance.stroke_width();
+    assert_eq!(w, w.round(), "{w}");
+    // A path that is not pixel-aligned takes the weight as given.
+    let plain = path(&mut s, "M110.3 20.6 L140.7 20.6 L140.7 30.3 L110.3 30.3 Z", 0.8);
+    assert_eq!(s.doc().unwrap().doc.node(NodeId(plain)).unwrap().appearance.stroke_width(), 0.8);
+    assert_eq!(points(&s, plain), [(110.3, 20.6), (140.7, 20.6), (140.7, 30.3), (110.3, 30.3)]);
+}
+
+/// Make Compound Path from pixel-aligned paths gives a pixel-aligned compound path whose paths do
+/// not keep the property; they snap with the compound path's stroke, so a centered 1 pt stroke puts
+/// them on half points after a move. Release gives each path the property back.
+#[test]
+fn a_compound_path_of_aligned_paths_is_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M100.2 100.2 L110.6 100.2 L110.6 110.6 L100.2 110.6 Z", 1.0);
+    let b = path(&mut s, "M200.2 100.2 L210.6 100.2 L210.6 110.6 L200.2 110.6 Z", 1.0);
+    s.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    let c = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    assert!(aligned(&s, c));
+    let n = s.doc().unwrap().doc.node(NodeId(c)).unwrap().clone();
+    assert!(n.children().unwrap().iter().all(|k| !k.extras().pixel_aligned));
+    let half = |pts: &[(f64, f64)]| pts.iter().all(|(x, y)| (x - x.floor() - 0.5).abs() < 1e-9 && (y - y.floor() - 0.5).abs() < 1e-9);
+    assert!(half(&compound_points(&s, c)), "{:?}", compound_points(&s, c));
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.2})).unwrap();
+    let pts = compound_points(&s, c);
+    assert_eq!(pts.len(), 8);
+    assert!(half(&pts), "{pts:?}");
+    // A path inside the compound path cannot take the property alone.
+    let member = n.children().unwrap()[0].id.0;
+    let e = s.execute("object.setPixelAligned", &json!({"ids": [member]})).unwrap_err().to_string();
+    assert!(e.contains("only paths and compound paths"), "{e}");
+    s.execute("select.set", &json!({"ids": [c]})).unwrap();
+    s.execute("object.compoundPath.release", &json!({})).unwrap();
+    let released = s.doc().unwrap().selection.objects.clone();
+    assert_eq!(released.len(), 2);
+    assert!(released.iter().all(|id| aligned(&s, id.0)));
+}
+
+/// Make Compound Path from a pixel-aligned compound path and another path gives a pixel-aligned
+/// compound path, which keeps snapping after a move.
+#[test]
+fn a_compound_path_of_an_aligned_compound_path_is_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M100.2 100.2 L110.6 100.2 L110.6 110.6 L100.2 110.6 Z", 2.0);
+    let b = path(&mut s, "M200.2 100.2 L210.6 100.2 L210.6 110.6 L200.2 110.6 Z", 2.0);
+    s.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+    let c = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [c]})).unwrap();
+    let other = path(&mut s, "M300.2 100.2 L310.6 100.2 L310.6 110.6 L300.2 110.6 Z", 2.0);
+    s.execute("select.set", &json!({"ids": [c, other]})).unwrap();
+    let joined = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    assert!(aligned(&s, joined));
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.4})).unwrap();
+    let pts = compound_points(&s, joined);
+    assert_eq!(pts.len(), 12);
+    assert!(whole(&pts), "{pts:?}");
+}
+
+/// A stroke with no paint does not count: a fill-only path whose stroke item keeps an odd weight
+/// snaps to whole points.
+#[test]
+fn a_stroke_without_paint_snaps_to_whole_points() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 1.0);
+    // An imported file can hold a stroke item without paint that keeps its weight.
+    let n = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).node_mut(NodeId(id)).unwrap();
+    let Some(vectorcraft_doc::AppearanceItem::Stroke(st)) =
+        n.appearance.items.iter_mut().find(|i| matches!(i, vectorcraft_doc::AppearanceItem::Stroke(_)))
+    else {
+        panic!("no stroke");
+    };
+    st.paint = vectorcraft_color::Paint::None;
+    assert_eq!(st.width, 1.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+}
+
+/// With direct-selected anchors in the selection, a move snaps the pixel-aligned path whose anchors
+/// moved and the pixel-aligned object selected whole.
+#[test]
+fn moving_direct_selected_anchors_keeps_it_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    let b = path(&mut s, "M110.3 20.6 L140.7 20.6 L140.7 30.3 L110.3 30.3 Z", 2.0);
+    s.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    s.execute("select.set", &json!({"ids": [b]})).unwrap();
+    s.execute("select.anchors", &json!({"id": a, "anchors": [[0, 1], [0, 2]], "mode": "add"})).unwrap();
+    s.execute("path.moveAnchors", &json!({"dx": 0.4, "dy": 0.0})).unwrap();
+    assert_eq!(points(&s, a), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    assert_eq!(points(&s, b), [(110.0, 21.0), (141.0, 21.0), (141.0, 30.0), (110.0, 30.0)]);
+    s.execute("path.moveAnchors", &json!({"dx": 0.7, "dy": 0.0})).unwrap();
+    assert_eq!(points(&s, a), [(10.0, 21.0), (42.0, 21.0), (42.0, 30.0), (10.0, 30.0)]);
+    assert_eq!(points(&s, b), [(111.0, 21.0), (142.0, 21.0), (142.0, 30.0), (111.0, 30.0)]);
+}
+
+/// A path with Live Corners snaps the outline its corners are cut from, inner edges included, and
+/// keeps its Live Corners.
+#[test]
+fn a_path_with_live_corners_snaps_its_inner_edges() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 10 L40 10 L40 20.3 L25 20.3 L25 40 L10 40 Z", 2.0);
+    s.execute("object.setLiveShape", &json!({"id": id, "radius": 2})).unwrap();
+    let base = |s: &Session| {
+        let n = s.doc().unwrap().doc.node(NodeId(id)).unwrap().clone();
+        let NodeKind::Path { live: Some(live), .. } = &n.kind else { panic!("no Live Corners") };
+        let vectorcraft_doc::LiveShape::Path { base, .. } = &**live else { panic!("not a path with Live Corners") };
+        base.anchors().map(|(_, _, a)| (a.p.x, a.p.y)).collect::<Vec<_>>()
+    };
+    assert!(base(&s).iter().any(|p| close(*p, (40.0, 20.3))));
+    s.execute("object.setPixelAligned", &json!({"ids": [id]})).unwrap();
+    assert_eq!(base(&s), [(10.0, 10.0), (40.0, 10.0), (40.0, 20.0), (25.0, 20.0), (25.0, 40.0), (10.0, 40.0)]);
+    let pts = points(&s, id);
+    assert!(pts.iter().all(|p| (p.1 - 20.3).abs() > 1e-6), "{pts:?}");
+}
+
+/// `path.setAnchors` and `object.setLiveShape` snap a pixel-aligned path again after they replace
+/// its geometry.
+#[test]
+fn geometry_edits_keep_it_aligned() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [id]})).unwrap();
+    let anchors = json!([{"x": 10.3, "y": 21.4}, {"x": 41.3, "y": 21.4}, {"x": 41.3, "y": 30.4}, {"x": 10.3, "y": 30.4}]);
+    s.execute("path.setAnchors", &json!({"id": id, "subpaths": [{"anchors": anchors, "closed": true}]})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    let poly = s.execute("shape.polygon", &json!({"cx": 100, "cy": 100, "radius": 50, "sides": 6})).unwrap()["id"].as_u64().unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [poly]})).unwrap();
+    s.execute("object.setLiveShape", &json!({"id": poly, "sides": 5})).unwrap();
+    let n = s.doc().unwrap().doc.node(NodeId(poly)).unwrap().clone();
+    let b = n.geometric_bounds().unwrap();
+    let on_grid = |v: f64| ((v - 0.5) - (v - 0.5).round()).abs() < 1e-9 || (v - v.round()).abs() < 1e-9;
+    assert!(on_grid(b.y1), "{b:?}");
+}
+
+/// Any other edit of a pixel-aligned path, here Object › Path › Average, snaps it again too.
+#[test]
+fn other_path_edits_keep_it_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    let b = path(&mut s, "M60.3 50 L80 50 L80 60 L60.3 60 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [a]})).unwrap();
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    s.execute("select.anchors", &json!({"id": a, "anchors": [[0, 1], [0, 2]], "mode": "add"})).unwrap();
+    s.execute("select.anchors", &json!({"id": b, "anchors": [[0, 0]], "mode": "add"})).unwrap();
+    s.execute("path.average", &json!({"axis": "vertical"})).unwrap();
+    assert_eq!(points(&s, a), [(10.0, 21.0), (47.0, 21.0), (47.0, 30.0), (10.0, 30.0)]);
+    assert!((points(&s, b)[0].0 - (41.0 + 41.0 + 60.3) / 3.0).abs() < 1e-9, "{:?}", points(&s, b));
+}
+
+/// A stroke edit that Global Edit carries to the other members snaps the pixel-aligned ones.
+#[test]
+fn global_edit_keeps_its_members_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    // The same shape at twice the size.
+    let b = path(&mut s, "M110 21 L172 21 L172 39 L110 39 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [a, b]})).unwrap();
+    s.execute("select.set", &json!({"ids": [a]})).unwrap();
+    let r = s.execute("select.globalEdit", &json!({})).unwrap();
+    assert_eq!(r["active"], true);
+    s.execute("stroke.set", &json!({"weight": 1})).unwrap();
+    assert_eq!(strokes(&s, b)[0].1, 1.0);
+    assert_eq!(points(&s, a), [(10.5, 21.5), (41.5, 21.5), (41.5, 30.5), (10.5, 30.5)]);
+    assert!(halves(&points(&s, b)), "{:?}", points(&s, b));
+}
+
+/// Align with direct-selected anchors snaps the pixel-aligned path whose anchors moved.
+#[test]
+fn aligning_direct_selected_anchors_keeps_it_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    let b = path(&mut s, "M60.4 50.3 L80 50.3 L80 60 L60.4 60 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [a]})).unwrap();
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    s.execute("select.anchors", &json!({"id": a, "anchors": [[0, 1], [0, 2]], "mode": "add"})).unwrap();
+    s.execute("select.anchors", &json!({"id": b, "anchors": [[0, 0]], "mode": "add"})).unwrap();
+    s.execute("object.align", &json!({"horizontal": "right"})).unwrap();
+    assert_eq!(points(&s, a), [(10.0, 21.0), (60.0, 21.0), (60.0, 30.0), (10.0, 30.0)]);
+    assert!(close(points(&s, b)[0], (60.4, 50.3)), "{:?}", points(&s, b));
+}
+
+/// The art of a linked opacity mask moves and scales with a path that snaps, and a placed gradient
+/// keeps its place too.
+#[test]
+fn a_linked_opacity_mask_follows_a_snap() {
+    let mut s = new_doc();
+    let o = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    let m = path(&mut s, "M12 23 L39 23 L39 28 L12 28 Z", 2.0);
+    s.execute("transparency.makeOpacityMask", &json!({"ids": [o, m]})).unwrap();
+    let mask_bounds = |s: &Session| {
+        let n = s.doc().unwrap().doc.node(NodeId(o)).unwrap().clone();
+        n.extras().mask.clone().expect("an opacity mask").art.geometric_bounds().unwrap()
+    };
+    let (from, mask) = (s.doc().unwrap().doc.node(NodeId(o)).unwrap().geometric_bounds().unwrap(), mask_bounds(&s));
+    s.execute("object.setPixelAligned", &json!({"ids": [o]})).unwrap();
+    let to = s.doc().unwrap().doc.node(NodeId(o)).unwrap().geometric_bounds().unwrap();
+    assert_eq!(points(&s, o), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    let at = |r: vectorcraft_geom::Rect, x: f64, y: f64| ((x - r.x0) / r.width(), (y - r.y0) / r.height());
+    let after = mask_bounds(&s);
+    assert!(close(at(to, after.x0, after.y0), at(from, mask.x0, mask.y0)), "{after:?} from {mask:?}");
+    assert!(close(at(to, after.x1, after.y1), at(from, mask.x1, mask.y1)), "{after:?} from {mask:?}");
+}
+
+/// `path.moveAnchor` (the Anchor Point tool, Smart Pen) snaps a pixel-aligned path again: two moves
+/// that leave a horizontal segment off the grid put it back on whole points.
+#[test]
+fn moving_one_anchor_keeps_it_aligned() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    s.execute("path.moveAnchor", &json!({"id": id, "anchor": 0, "x": 10, "y": 21.3})).unwrap();
+    s.execute("path.moveAnchor", &json!({"id": id, "anchor": 1, "x": 41, "y": 21.3})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+}
+
+/// A path of a pixel-aligned compound path moved on its own (Group Selection) snaps with the
+/// compound path.
+#[test]
+fn moving_a_path_of_an_aligned_compound_path_keeps_it_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M100 100 L110 100 L110 110 L100 110 Z", 2.0);
+    let b = path(&mut s, "M200 100 L210 100 L210 110 L200 110 Z", 2.0);
+    s.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+    let c = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [c]})).unwrap();
+    let n = s.doc().unwrap().doc.node(NodeId(c)).unwrap().clone();
+    let member = n.children().unwrap()[0].id.0;
+    s.execute("select.set", &json!({"ids": [member]})).unwrap();
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.4})).unwrap();
+    let pts = compound_points(&s, c);
+    assert_eq!(pts.len(), 8);
+    assert!(whole(&pts), "{pts:?}");
+}
+
+/// A path that Paste in Front puts inside a pixel-aligned compound path, or that an object slice
+/// move moves there, snaps with the compound path's stroke, and a pasted path drops its own
+/// property there.
+#[test]
+fn paths_added_to_or_moved_in_an_aligned_compound_path_keep_it_aligned() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M100 100 L110 100 L110 110 L100 110 Z", 1.0);
+    let b = path(&mut s, "M200 100 L210 100 L210 110 L200 110 Z", 1.0);
+    let loose = path(&mut s, "M300 100 L310 100 L310 110 L300 110 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [loose]})).unwrap();
+    s.execute("select.set", &json!({"ids": [a, b]})).unwrap();
+    let c = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [c]})).unwrap();
+    assert!(halves(&compound_points(&s, c)));
+    let member = s.doc().unwrap().doc.node(NodeId(c)).unwrap().children().unwrap()[0].id.0;
+    s.execute("select.set", &json!({"ids": [loose]})).unwrap();
+    s.execute("edit.copy", &json!({})).unwrap();
+    s.execute("select.set", &json!({"ids": [member]})).unwrap();
+    s.execute("edit.pasteInFront", &json!({})).unwrap();
+    let pasted = s.doc().unwrap().selection.objects[0];
+    assert_eq!(s.doc().unwrap().doc.parent_of(pasted), Some(NodeId(c)));
+    assert!(!aligned(&s, pasted.0));
+    let pts = compound_points(&s, c);
+    assert_eq!(pts.len(), 12);
+    assert!(halves(&pts), "paste: {pts:?}");
+    s.execute("object.slice.make", &json!({"ids": [member]})).unwrap();
+    s.execute("object.slice.move", &json!({"slices": [member], "dx": 0.3, "dy": 0.4})).unwrap();
+    let pts = compound_points(&s, c);
+    assert!(halves(&pts), "slice: {pts:?}");
+}
+
+/// Art moved by Artboard Options with Move Artwork with Artboard, and the art copies of an
+/// artboard copied with its art, stay on the pixel grid.
+#[test]
+fn artboard_options_and_artboard_copies_keep_it_aligned() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({})).unwrap();
+    let r = s.doc().unwrap().doc.artboards[0].rect;
+    s.execute("artboard.setProps", &json!({"index": 0, "x": r.x0 + 0.4, "y": r.y0 + 0.3, "moveArt": true})).unwrap();
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+    let out = s.execute("artboard.move", &json!({"index": 0, "dx": 500.4, "dy": 0.3, "copy": true, "moveArt": true})).unwrap();
+    let copies = out["moved"].as_array().unwrap();
+    assert_eq!(copies.len(), 1);
+    let copy = copies[0].as_u64().unwrap();
+    assert!(aligned(&s, copy));
+    assert!(whole(&points(&s, copy)), "{:?}", points(&s, copy));
+    assert_eq!(points(&s, id), [(10.0, 21.0), (41.0, 21.0), (41.0, 30.0), (10.0, 30.0)]);
+}
+
+/// Type, images and groups cannot be aligned: the command is an error and nothing changes, also
+/// for a path selected with one of them.
+#[test]
+fn type_and_images_cannot_be_aligned() {
+    let mut s = new_doc();
+    let p = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    let before = points(&s, p);
+    let text = s.execute("text.create", &json!({"x": 10, "y": 100, "text": "Hi"})).unwrap()["id"].as_u64().unwrap();
+    let png = crate::tests_links::png(4, 4, [255, 0, 0]);
+    s.execute("file.place", &json!({"name": "red.png", "dataBase64": vectorcraft_format::base64_encode(&png), "link": false})).unwrap();
+    let image = {
+        let st = s.doc().unwrap();
+        let id = st.selection.objects[0];
+        assert!(matches!(st.doc.node(id).unwrap().kind, NodeKind::Image(_)));
+        id.0
+    };
+    let steps = undo_len(&s);
+    for ids in [json!([text]), json!([image]), json!([p, text])] {
+        let e = s.execute("object.setPixelAligned", &json!({"ids": ids})).unwrap_err().to_string();
+        assert!(e.contains("only paths and compound paths"), "{ids}: {e}");
+        assert_eq!(undo_len(&s), steps, "{ids}");
+        assert!(!aligned(&s, p));
+        assert_eq!(points(&s, p), before);
+    }
+    let e = s.execute("object.setPixelAligned", &json!({"ids": [p], "on": "yes"})).unwrap_err().to_string();
+    assert!(e.contains("`on` must be true or false"), "{e}");
+    assert_eq!(undo_len(&s), steps);
+}
+
+/// The property is saved in the native file and read back; an object without it is saved without
+/// the key and reads back off.
+#[test]
+fn the_property_is_saved_and_read_back() {
+    let mut s = new_doc();
+    let a = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    let b = path(&mut s, "M110.3 20.6 L140.7 20.6 L140.7 30.3 L110.3 30.3 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [a]})).unwrap();
+    let d = &s.doc().unwrap().doc;
+    let back = vectorcraft_format::load(&vectorcraft_format::save(d, false)).unwrap();
+    assert!(back.node(NodeId(a)).unwrap().extras().pixel_aligned);
+    assert!(!back.node(NodeId(b)).unwrap().extras().pixel_aligned);
+    let plain: Value = serde_json::to_value(d.node(NodeId(b)).unwrap()).unwrap();
+    assert!(plain.get("pixel_aligned").is_none(), "{plain}");
+    let node = s.execute("document.node", &json!({"id": a})).unwrap();
+    assert_eq!(node["pixel_aligned"], true, "{node}");
+}
+
+/// A copy of a pixel-aligned path that Duplicate or Paste moves by a fractional offset is snapped
+/// to the pixel grid and keeps the property, and so is a pixel-aligned object slice that moves.
+#[test]
+fn duplicates_and_pastes_keep_it_aligned() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [id]})).unwrap();
+    s.execute("edit.duplicate", &json!({"dx": 100.3, "dy": 0.4})).unwrap();
+    let copy = s.doc().unwrap().selection.objects[0].0;
+    assert_ne!(copy, id);
+    assert!(aligned(&s, copy));
+    assert_eq!(points(&s, copy), [(110.0, 21.0), (141.0, 21.0), (141.0, 30.0), (110.0, 30.0)]);
+    s.execute("select.set", &json!({"ids": [id]})).unwrap();
+    s.execute("edit.copy", &json!({})).unwrap();
+    s.execute("edit.paste", &json!({"dx": 0.3, "dy": 50.4})).unwrap();
+    let pasted = s.doc().unwrap().selection.objects[0].0;
+    assert!(pasted != id && pasted != copy);
+    assert!(aligned(&s, pasted));
+    assert_eq!(points(&s, pasted), [(10.0, 71.0), (41.0, 71.0), (41.0, 80.0), (10.0, 80.0)]);
+    // Moving an object slice moves its object, which snaps too.
+    s.execute("object.slice.make", &json!({"ids": [pasted]})).unwrap();
+    s.execute("object.slice.move", &json!({"slices": [pasted], "dx": 0.3, "dy": 0.4})).unwrap();
+    assert_eq!(points(&s, pasted), [(10.0, 71.0), (41.0, 71.0), (41.0, 80.0), (10.0, 80.0)]);
+}
+
+/// Pixel-aligned art of a linked opacity mask snaps when its object moves.
+#[test]
+fn the_art_of_a_linked_opacity_mask_keeps_it_aligned() {
+    let mut s = new_doc();
+    let o = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    let m = path(&mut s, "M12 23 L39 23 L39 28 L12 28 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [m]})).unwrap();
+    s.execute("transparency.makeOpacityMask", &json!({"ids": [o, m]})).unwrap();
+    let mask_points = |s: &Session| {
+        let n = s.doc().unwrap().doc.node(NodeId(o)).unwrap().clone();
+        let mask = n.extras().mask.clone().expect("an opacity mask");
+        assert!(mask.art.extras().pixel_aligned);
+        mask.art.path_data().unwrap().anchors().map(|(_, _, a)| (a.p.x, a.p.y)).collect::<Vec<_>>()
+    };
+    s.execute("select.set", &json!({"ids": [o]})).unwrap();
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.4})).unwrap();
+    assert_eq!(mask_points(&s), [(12.0, 23.0), (39.0, 23.0), (39.0, 28.0), (12.0, 28.0)]);
+    // The masked path inside a pixel-aligned compound path.
+    let other = path(&mut s, "M110 21 L141 21 L141 30 L110 30 Z", 2.0);
+    s.execute("select.set", &json!({"ids": [o, other]})).unwrap();
+    let c = s.execute("object.compoundPath.make", &json!({})).unwrap()["id"].as_u64().unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [c]})).unwrap();
+    s.execute("select.set", &json!({"ids": [c]})).unwrap();
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.4})).unwrap();
+    assert!(whole(&mask_points(&s)), "{:?}", mask_points(&s));
+}
+
+/// The start point of path object `id`'s placed gradient fill.
+fn gradient_start(s: &Session, id: u64) -> (f64, f64) {
+    let n = s.doc().unwrap().doc.node(NodeId(id)).unwrap().clone();
+    let Some(vectorcraft_color::Paint::Gradient(g)) = n.appearance.paint_at(None, true) else { panic!("no gradient fill") };
+    let p = g.geom.expect("a placed gradient").start;
+    (p.x, p.y)
+}
+
+/// A placed gradient moves with a pixel-aligned path when a stroke edit snaps it.
+#[test]
+fn placed_gradients_follow_the_snapped_path() {
+    let mut s = new_doc();
+    let id = path(&mut s, "M10 21 L41 21 L41 30 L10 30 Z", 2.0);
+    s.execute("paint.setFill", &json!({"gradient": {"kind": "linear"}, "ids": [id]})).unwrap();
+    {
+        let n = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).node_mut(NodeId(id)).unwrap();
+        let bounds = n.geometric_bounds().unwrap();
+        let Some(vectorcraft_doc::AppearanceItem::Fill(f)) = n.appearance.items.iter_mut().find(|i| i.is_fill()) else { panic!("no fill") };
+        let vectorcraft_color::Paint::Gradient(g) = &mut f.paint else { panic!("no gradient fill") };
+        g.pin(bounds);
+    }
+    s.execute("object.setPixelAligned", &json!({"ids": [id]})).unwrap();
+    let before = gradient_start(&s, id);
+    let i = strokes(&s, id)[0].0;
+    s.execute("appearance.setItem", &json!({"ids": [id], "index": i, "weight": 1})).unwrap();
+    assert_eq!(points(&s, id), [(10.5, 21.5), (41.5, 21.5), (41.5, 30.5), (10.5, 30.5)]);
+    assert!(close(gradient_start(&s, id), (before.0 + 0.5, before.1 + 0.5)), "{:?} from {before:?}", gradient_start(&s, id));
+}
+
+/// The paint-order indices of path object `id`'s strokes, and their weights.
+fn strokes(s: &Session, id: u64) -> Vec<(usize, f64)> {
+    let n = s.doc().unwrap().doc.node(NodeId(id)).unwrap().clone();
+    n.appearance
+        .items
+        .iter()
+        .enumerate()
+        .filter_map(|(i, it)| match it {
+            vectorcraft_doc::AppearanceItem::Stroke(st) => Some((i, st.width)),
+            _ => None,
+        })
+        .collect()
+}
+
+/// Whether every coordinate is a whole number of points plus a half (within rounding error).
+fn halves(points: &[(f64, f64)]) -> bool {
+    points.iter().all(|(x, y)| ((x - 0.5) - (x - 0.5).round()).abs() < 1e-9 && ((y - 0.5) - (y - 0.5).round()).abs() < 1e-9)
+}
+
+/// Appearance edits that add, remove, hide, repaint or reweigh a stroke snap a pixel-aligned path
+/// again: Appearance panel item edits, Remove Item, Add New Stroke, Clear Appearance, Reduce to
+/// Basic Appearance, Show All Hidden Attributes, moving or copying an appearance,
+/// `paint.setStroke`, a graphic style and the Eyedropper. The edges go to half
+/// points while a visible, painted centered stroke has an odd weight, otherwise to whole points.
+#[test]
+fn appearance_edits_keep_it_aligned() {
+    let mut s = new_doc();
+    let b = path(&mut s, "M110.3 20.6 L140.7 20.6 L140.7 30.3 L110.3 30.3 Z", 2.2);
+    let c = path(&mut s, "M210.3 20.6 L240.7 20.6 L240.7 30.3 L210.3 30.3 Z", 1.0);
+    s.execute("graphicStyle.new", &json!({"id": c, "name": "One"})).unwrap();
+    let a = path(&mut s, "M10.3 20.6 L40.7 20.6 L40.7 30.3 L10.3 30.3 Z", 2.0);
+    s.execute("object.setPixelAligned", &json!({"ids": [a]})).unwrap();
+    assert!(whole(&points(&s, a)));
+    let top = |s: &Session| strokes(s, a).last().map(|(i, _)| *i).unwrap();
+    let i = top(&s);
+    s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "weight": 3.3})).unwrap();
+    assert_eq!(strokes(&s, a).last().unwrap().1, 3.0);
+    assert!(halves(&points(&s, a)), "weight: {:?}", points(&s, a));
+    // Hiding and showing the stroke again puts the path back where it was.
+    let shown = points(&s, a);
+    for _ in 0..2 {
+        s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "visible": false})).unwrap();
+        assert!(whole(&points(&s, a)), "hidden: {:?}", points(&s, a));
+        s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "visible": true})).unwrap();
+        assert_eq!(points(&s, a), shown);
+    }
+    s.execute("paint.setStroke", &json!({"ids": [a], "none": true})).unwrap();
+    assert!(whole(&points(&s, a)), "no paint: {:?}", points(&s, a));
+    s.execute("paint.setStroke", &json!({"ids": [a], "color": "#00ff00"})).unwrap();
+    assert_eq!(strokes(&s, a).last().unwrap().1, 1.0);
+    assert!(halves(&points(&s, a)), "painted: {:?}", points(&s, a));
+    let i = top(&s);
+    s.execute("appearance.removeItem", &json!({"ids": [a], "index": i})).unwrap();
+    assert!(strokes(&s, a).is_empty());
+    assert!(whole(&points(&s, a)), "removed: {:?}", points(&s, a));
+    s.execute("appearance.addStroke", &json!({"ids": [a]})).unwrap();
+    assert!(halves(&points(&s, a)), "added: {:?}", points(&s, a));
+    s.execute("appearance.clear", &json!({"ids": [a]})).unwrap();
+    assert!(whole(&points(&s, a)), "cleared: {:?}", points(&s, a));
+    s.execute("graphicStyle.apply", &json!({"ids": [a], "name": "One"})).unwrap();
+    assert!(halves(&points(&s, a)), "style: {:?}", points(&s, a));
+    s.execute("appearance.copyFrom", &json!({"source": b, "ids": [a]})).unwrap();
+    assert_eq!(strokes(&s, a).last().unwrap().1, 2.0);
+    assert!(whole(&points(&s, a)), "eyedropper: {:?}", points(&s, a));
+    // A 1 pt stroke below a 2 pt one: half points, and whole points once Reduce to Basic Appearance
+    // keeps only the top stroke.
+    let i = top(&s);
+    s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "weight": 1})).unwrap();
+    s.execute("appearance.addStroke", &json!({"ids": [a]})).unwrap();
+    let i = top(&s);
+    s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "weight": 2})).unwrap();
+    assert_eq!(strokes(&s, a).iter().map(|(_, w)| *w).collect::<Vec<_>>(), [1.0, 2.0]);
+    assert!(halves(&points(&s, a)), "two strokes: {:?}", points(&s, a));
+    s.execute("appearance.reduceToBasic", &json!({"ids": [a]})).unwrap();
+    assert_eq!(strokes(&s, a).iter().map(|(_, w)| *w).collect::<Vec<_>>(), [2.0]);
+    assert!(whole(&points(&s, a)), "reduced: {:?}", points(&s, a));
+    // Show All Hidden Attributes, and moving or copying an appearance onto or off the path.
+    let i = top(&s);
+    s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "weight": 1})).unwrap();
+    s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "visible": false})).unwrap();
+    assert!(whole(&points(&s, a)), "hidden: {:?}", points(&s, a));
+    s.execute("appearance.showAllHidden", &json!({"ids": [a]})).unwrap();
+    assert!(halves(&points(&s, a)), "show all: {:?}", points(&s, a));
+    s.execute("appearance.transfer", &json!({"source": b, "target": a, "copy": true})).unwrap();
+    assert!(whole(&points(&s, a)), "copied onto: {:?}", points(&s, a));
+    let i = top(&s);
+    s.execute("appearance.setItem", &json!({"ids": [a], "index": i, "weight": 1})).unwrap();
+    assert!(halves(&points(&s, a)), "1 pt: {:?}", points(&s, a));
+    s.execute("appearance.transfer", &json!({"source": a, "target": c})).unwrap();
+    assert!(whole(&points(&s, a)), "moved off: {:?}", points(&s, a));
+    // A path that is not aligned keeps its coordinates through the same edits.
+    let before = points(&s, b);
+    s.execute("appearance.setItem", &json!({"ids": [b], "index": strokes(&s, b)[0].0, "weight": 3.3})).unwrap();
+    s.execute("appearance.addStroke", &json!({"ids": [b]})).unwrap();
+    assert_eq!(points(&s, b), before);
+}
+
+#[test]
+fn patterns_follow_the_snap_with_transform_patterns() {
+    let mut s = new_doc();
+    let tile = s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap()["id"].as_u64().unwrap();
+    s.execute("paint.setFill", &json!({"ids": [tile], "color": "#ff0000"})).unwrap();
+    s.execute("select.set", &json!({"ids": [tile]})).unwrap();
+    s.execute("object.pattern.make", &json!({"name": "Dots", "width": 20, "height": 20})).unwrap();
+    s.execute("object.pattern.done", &json!({})).unwrap();
+    let a = path(&mut s, "M 100 100 L 150 100 L 150 150 L 100 150 Z", 2.0);
+    s.execute("paint.setFill", &json!({"ids": [a], "swatch": "Dots"})).unwrap();
+    s.execute("object.setPixelAligned", &json!({"ids": [a]})).unwrap();
+    let tiles = |s: &Session| {
+        let n = s.doc().unwrap().doc.node(NodeId(a)).unwrap().clone();
+        let vectorcraft_color::Paint::Pattern { xf, .. } = n.appearance.fill_paint() else { panic!("no pattern fill") };
+        xf.as_coeffs()
+    };
+    let (before, xf) = (points(&s, a), tiles(&s));
+    // The move snaps the path back to where it was, and its tiles go back with it.
+    s.execute("select.set", &json!({"ids": [a]})).unwrap();
+    s.execute("object.move", &json!({"dx": 0.3, "dy": 0.0, "patterns": true})).unwrap();
+    assert_eq!(points(&s, a), before);
+    assert!(tiles(&s).iter().zip(xf).all(|(t, x)| (t - x).abs() < 1e-9), "tiles: {:?}, before {xf:?}", tiles(&s));
+    // A move that the snap keeps moves the tiles as far as the path.
+    s.execute("object.move", &json!({"dx": 0.7, "dy": 0.0, "patterns": true})).unwrap();
+    assert_eq!(points(&s, a)[0], (before[0].0 + 1.0, before[0].1));
+    assert!((tiles(&s)[4] - (xf[4] + 1.0)).abs() < 1e-9, "tiles: {:?}, before {xf:?}", tiles(&s));
+}
+
+#[test]
+fn objects_on_path_members_stay_on_the_grid() {
+    let mut s = new_doc();
+    let spine = s.execute("path.create", &json!({"d": "M 0.3 100.4 L 300.3 100.4"})).unwrap()["id"].as_u64().unwrap();
+    let a = path(&mut s, "M 10 10 L 30 10 L 30 30 L 10 30 Z", 2.0);
+    s.execute("object.objectsOnPath.attach", &json!({"path": spine, "ids": [a]})).unwrap();
+    assert!(!whole(&points(&s, a)), "placed: {:?}", points(&s, a));
+    // Placing the member on the path after the edit must not move it off the grid again.
+    s.execute("object.setPixelAligned", &json!({"ids": [a]})).unwrap();
+    assert!(whole(&points(&s, a)), "aligned: {:?}", points(&s, a));
+    // Editing the path places the member again, and it goes back on the grid.
+    let anchors = json!([{"x": 0.6, "y": 120.7}, {"x": 300.6, "y": 120.7}]);
+    s.execute("path.setAnchors", &json!({"id": spine, "subpaths": [{"anchors": anchors, "closed": false}]})).unwrap();
+    assert!(whole(&points(&s, a)), "path edited: {:?}", points(&s, a));
+    assert!(points(&s, a).iter().all(|(_, y)| *y > 105.0), "followed the path: {:?}", points(&s, a));
+}
diff --git a/crates/engine/src/tests/placed_document.rs b/crates/engine/src/tests/placed_document.rs
index 7616a4529..5f989db78 100644
--- a/crates/engine/src/tests/placed_document.rs
+++ b/crates/engine/src/tests/placed_document.rs
@@ -474,6 +474,26 @@ fn update_links_on_open_reads_a_modified_file_again() {
     assert!(near(centre_colour(&s.doc().unwrap().doc), BLUE));
 }
 
+/// A placed document whose link keeps no size or hash and whose file's bytes are gone shows no
+/// preview: resolving its links reports the file as modified and leaves the object as it is.
+#[test]
+fn a_placed_document_without_its_bytes_or_a_hash_is_reported_not_read() {
+    let dir = Folder::new("placed-no-hash");
+    let src = dir.file("logo.vectorcraft");
+    source(&src, 100.0, 50.0, RED, 0);
+    let mut s = session();
+    let id = place(&mut s, &src);
+    let key = placed(&s, id).key;
+    let mut d = (*s.doc().unwrap().doc).clone();
+    d.images.remove(&key);
+    let Some(NodeKind::PlacedDocument(p)) = d.node_mut(id).map(|n| &mut n.kind) else { panic!("a placed document") };
+    p.link.hash = None;
+    p.link.size = None;
+    let r = crate::cmd::links::resolve(&mut d, None, false, false).to_json();
+    assert_eq!(r["modifiedLinks"].as_array().map(Vec::len), Some(1), "{r}");
+    assert!(!d.images.contains_key(&key), "not read");
+}
+
 #[test]
 fn relink_points_a_placed_document_at_another_file() {
     let dir = Folder::new("placed-relink");
@@ -663,6 +683,78 @@ fn saving_and_reopening_keeps_a_linked_pdf_pages_number_and_box() {
     assert!(near(centre_colour(&s.doc().unwrap().doc), RED));
 }
 
+/// A placed PDF page in a `.ai` file's editing data is a placed document of the page and box the
+/// dictionary after it names. Its file missing, it shows the preview the file keeps, in the same
+/// place. Its file found in the folder kept relative to the document, it shows that page.
+#[test]
+fn a_pdf_page_placed_in_an_ai_files_editing_data_opens_as_a_placed_document() {
+    use vectorcraft_testkit::ai;
+    let dir = Folder::new("placed-pdf-in-ai");
+    let place = "%AI5_BeginPlace\n%%FileType: 1\n[0.1 0 0 -0.1 20 80] 0 0 600 600 4 4 0\n(/no/such/folder/src/flyer.pdf)`\n\
+         %%IncludeFile:/no/such/folder/src/flyer.pdf\n%AI17_Begin_Content_if_version_gt:24 12\n%AI28_BeginPlacedRelativePath\n(src/)\n\
+         %AI28_EndPlacedRelativePath\n%AI17_Alternate_Content\n%AI17_End_Versioned_Content\n%AI26_BeginPlacedObjectPreview\n\
+         2 1 8 32 17 \x7f\x0a\x0a\x73\x7f\x0a\x0a\x73\n%AI26_EndPlacedObjectPreview\n~\n%AI5_EndPlace\n\
+         %_/ArtDictionary :\n%_2 /Int (AI11 PlacedPDFPageIndex) ,\n%_4 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n";
+    let doc_path = dir.file("poster.ai");
+    let data = ai::editing_data(200.0, 100.0, &ai::layer("Art", place));
+    // The page draws what the half-covering preview draws over white.
+    write(&doc_path, &ai::ai(data.as_bytes(), "0.54 0.54 0.95 rg 20 20 60 60 re f"));
+    let shown = |s: &Session| {
+        let img = vectorcraft_render::Renderer::new().render_region(&s.doc().unwrap().doc, Rect::new(0.0, 0.0, 100.0, 100.0), 1.0, true);
+        let [r, g, b, _] = img.pixel(50, 50);
+        [r, g, b]
+    };
+    let one = |s: &Session| {
+        let mut found = vec![];
+        s.doc().unwrap().doc.visit_placed(|n, p| found.push((n.id, p.clone())));
+        let [(id, p)] = &found[..] else { panic!("one placed document: {found:?}") };
+        (*id, p.clone(), s.doc().unwrap().doc.images[&p.key].is_proxy())
+    };
+    let mut s = session();
+
+    let r = open(&mut s, &doc_path);
+    assert_eq!(r["missingLinks"][0]["name"].as_str(), Some("flyer.pdf"), "{r}");
+    let (id, p, proxy) = one(&s);
+    assert!(proxy, "the preview");
+    assert_eq!((p.link.page, p.page_box, p.bounding), (Some(2), vectorcraft_doc::PageBox::Media, false));
+    assert_eq!(p.link.relative.as_deref(), Some("src/flyer.pdf"));
+    let place = bounds(&s, id);
+    assert!((place.x0 - 20.0).abs() < 0.01 && (place.width() - 60.0).abs() < 0.01 && (place.height() - 60.0).abs() < 0.01, "{place:?}");
+    assert!(near(shown(&s), [138, 138, 243]), "the preview shows: {:?}", shown(&s));
+
+    pdf_source(&dir.file("src/flyer.pdf"), "pdf", &[BLUE, RED], 0);
+    let r = open(&mut s, &doc_path);
+    assert_eq!((r["missingLinks"].clone(), r["modifiedLinks"].clone()), (json!([]), json!([])), "{r}");
+    let (id, p, proxy) = one(&s);
+    assert!(!proxy, "the file's bytes, not the preview");
+    assert_eq!((p.link.page, p.page_box, p.bounding), (Some(2), vectorcraft_doc::PageBox::Media, false));
+    assert!(p.link.hash.is_some() && p.link.size.is_some(), "{:?}", p.link);
+    assert_eq!(bounds(&s, id), place, "the same place");
+    assert!(near(shown(&s), RED), "page 2 of the file shows: {:?}", shown(&s));
+}
+
+/// A `.ai` saved without PDF compatibility (its page only text) that places itself as a page is
+/// read once inside itself: the copy inside keeps its link as stored, and the file opens.
+#[test]
+fn an_ai_file_that_places_itself_opens() {
+    use vectorcraft_testkit::ai;
+    let dir = Folder::new("ai-places-itself");
+    let doc_path = dir.file("poster.ai");
+    let at = doc_path.replace('\\', "/");
+    let place = format!(
+        "%AI5_BeginPlace\n%%FileType: 1\n[0.1 0 0 -0.1 20 80] 0 0 600 600 4 4 0\n({at})`\n%%IncludeFile:{at}\n%AI26_BeginPlacedObjectPreview\n\
+         2 1 8 32 17 \x7f\x0a\x0a\x73\x7f\x0a\x0a\x73\n%AI26_EndPlacedObjectPreview\n~\n%AI5_EndPlace\n\
+         %_/ArtDictionary :\n%_1 /Int (AI11 PlacedPDFPageIndex) ,\n%_4 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n"
+    );
+    let data = ai::editing_data(200.0, 100.0, &ai::layer("Art", &format!("0 g\n{}f\n{place}", ai::rect(120.0, 20.0, 180.0, 80.0))));
+    write(&doc_path, &ai::ai(data.as_bytes(), "BT /F1 12 Tf 10 50 Td (Saved without its PDF part) Tj ET"));
+    let mut s = session();
+    let r = open(&mut s, &doc_path);
+    let mut found = vec![];
+    s.doc().unwrap().doc.visit_placed(|_, p| found.push(p.link.path.replace('\\', "/")));
+    assert_eq!(found, [at], "{r}");
+}
+
 #[test]
 fn a_pdf_compatible_ai_file_places_linked_like_a_pdf() {
     let dir = Folder::new("placed-ai-linked");
diff --git a/crates/engine/src/tests/recovery.rs b/crates/engine/src/tests/recovery.rs
index 56c8d899d..9fe2d846c 100644
--- a/crates/engine/src/tests/recovery.rs
+++ b/crates/engine/src/tests/recovery.rs
@@ -59,6 +59,57 @@ fn restored(r: serde_json::Value) -> usize {
     r["restored"].as_array().unwrap().len()
 }
 
+#[test]
+fn native_recovery_copies_leave_out_the_pdf() {
+    let (mut s, store) = session();
+    let r = s.execute("file.recovery.save", &json!({})).unwrap();
+    let file = format!("{}.vectorcraft", r["saved"][0]["file"].as_str().unwrap());
+    let bytes = store.read(&file).unwrap();
+    assert!(vectorcraft_format::pdf_content(&bytes).is_none());
+    assert_eq!(vectorcraft_format::load(&bytes).unwrap().node_count(), s.doc().unwrap().doc.node_count());
+}
+
+#[test]
+fn restored_recovery_copies_keep_the_original_pdf_preference() {
+    let dir = crate::tests_links::Folder::new("recovered-pdf-preference");
+    for pdf in [false, true] {
+        let (mut s, store) = session();
+        s.execute("file.saveAs", &json!({"path": dir.file(&format!("original-{pdf}.vectorcraft")), "pdfCompatible": pdf})).unwrap();
+        s.execute("shape.ellipse", &json!({"x": 80, "y": 20, "width": 20, "height": 20})).unwrap();
+        let copied = s.execute("file.recovery.save", &json!({})).unwrap();
+        let file = format!("{}.vectorcraft", copied["saved"][0]["file"].as_str().unwrap());
+        assert!(vectorcraft_format::pdf_content(&store.read(&file).unwrap()).is_none());
+        drop(s);
+        let mut s = relaunch(&store);
+        assert_eq!(restored(s.execute("file.recovery.restore", &json!({})).unwrap()), 1);
+        assert_eq!(s.doc().unwrap().save_options.get("pdfCompatible"), Some(&json!(pdf)));
+        let saved = s.execute("document.save", &json!({})).unwrap();
+        let bytes = vectorcraft_format::base64_decode(saved["dataBase64"].as_str().unwrap()).unwrap();
+        assert_eq!(vectorcraft_format::pdf_content(&bytes).is_some(), pdf);
+    }
+}
+
+#[test]
+fn recovered_unsaved_documents_keep_inheriting_the_current_pdf_preference() {
+    let dir = crate::tests_links::Folder::new("recovered-inherited-pdf-choice");
+    let (mut s, store) = session();
+    s.execute("file.recovery.save", &json!({})).unwrap();
+    assert!(s.doc().unwrap().save_options.get("pdfCompatible").is_none());
+    s.execute("file.new", &json!({"width": 10, "height": 10})).unwrap();
+    s.execute("file.saveAs", &json!({"path":dir.file("other.vectorcraft"),"pdfCompatible":false})).unwrap();
+    assert!(s.execute("file.recovery.save", &json!({})).unwrap()["saved"].as_array().unwrap().is_empty());
+    let latest_preferences = s.prefs.clone();
+    drop(s);
+    let mut s = relaunch(&store);
+    // The host loads its latest preferences before offering recovery.
+    s.prefs = latest_preferences;
+    assert_eq!(restored(s.execute("file.recovery.restore", &json!({})).unwrap()), 1);
+    assert!(s.doc().unwrap().save_options.get("pdfCompatible").is_none());
+    let saved = s.execute("document.save", &json!({})).unwrap();
+    let bytes = vectorcraft_format::base64_decode(saved["dataBase64"].as_str().unwrap()).unwrap();
+    assert!(vectorcraft_format::pdf_content(&bytes).is_none());
+}
+
 #[test]
 fn recovery_save_writes_modified_documents_once() {
     let (mut s, store) = session();
diff --git a/crates/engine/src/tests/saveoptions.rs b/crates/engine/src/tests/saveoptions.rs
index 9324b1f4b..a5b19563a 100644
--- a/crates/engine/src/tests/saveoptions.rs
+++ b/crates/engine/src/tests/saveoptions.rs
@@ -157,7 +157,146 @@ fn pdf_compatible_files_carry_a_pdf() {
     assert!(pdf.starts_with(b"%PDF"));
     let info = s.execute("document.pdfInfo", &json!({"dataBase64": vectorcraft_format::base64_encode(&pdf)})).unwrap();
     assert_eq!(info["pages"], 3);
-    assert!(vectorcraft_format::pdf_content(&bytes_of(&s.execute("file.saveCopy", &json!({})).unwrap()["dataBase64"])).is_none());
+    assert!(
+        vectorcraft_format::pdf_content(&bytes_of(&s.execute("file.saveCopy", &json!({"pdfCompatible": false})).unwrap()["dataBase64"])).is_none()
+    );
+}
+
+/// A native save is portable to the other apps by default. The option is still an explicit
+/// opt-out, and a remembered opt-out survives later saves of the document.
+#[test]
+fn native_saves_carry_all_artboards_as_pdf_by_default() {
+    let mut s = three_boards();
+    for compress in [false, true] {
+        let result = s.execute("file.saveCopy", &json!({"compress": compress})).unwrap();
+        let file = bytes_of(&result["dataBase64"]);
+        let pdf = vectorcraft_format::pdf_content(&file).expect("the default native save carries a PDF");
+        let info = s.execute("document.pdfInfo", &json!({"dataBase64": vectorcraft_format::base64_encode(&pdf)})).unwrap();
+        assert_eq!(info["pages"], 3);
+        assert_eq!(vectorcraft_format::load(&file).unwrap().artboards.len(), 3);
+    }
+    let dir = Folder::new("pdf-opt-out");
+    let path = dir.file("compact.vectorcraft");
+    s.execute("file.saveAs", &json!({"path": path, "pdfCompatible": false})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 60, "y": 10, "width": 10, "height": 10})).unwrap();
+    s.execute("document.save", &json!({})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_none());
+    let options = s.execute("file.formatOptions", &json!({"format":"vectorcraft"})).unwrap();
+    assert_eq!(options["options"]["pdfCompatible"]["value"], false);
+    s.execute("document.save", &json!({"compress": true})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_none());
+    s.execute("document.open", &json!({"path": path})).unwrap();
+    assert_eq!(s.doc().unwrap().save_options["pdfCompatible"], false);
+    let options = s.execute("file.formatOptions", &json!({"format": "vectorcraft"})).unwrap();
+    assert_eq!(options["options"]["pdfCompatible"]["value"], false);
+    s.execute("document.save", &json!({})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_none());
+    s.execute("document.save", &json!({"pdfCompatible": true})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_some());
+}
+
+#[test]
+fn native_saves_without_artboards_keep_the_editable_document() {
+    let mut s = three_boards();
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).artboards.clear();
+    let result = s.execute("file.saveCopy", &json!({})).unwrap();
+    let file = bytes_of(&result["dataBase64"]);
+    let restored = vectorcraft_format::load(&file).unwrap();
+    assert!(restored.artboards.is_empty());
+    assert_eq!(restored.node_count(), s.doc().unwrap().doc.node_count());
+    assert!(vectorcraft_format::pdf_content(&file).is_none());
+    s.execute("document.open", &json!({"name": "no-artboards.vectorcraft", "dataBase64": vectorcraft_format::base64_encode(&file)})).unwrap();
+    assert_eq!(s.doc().unwrap().save_options["pdfCompatible"], true);
+    s.execute("artboard.new", &json!({"x": 0, "y": 0, "width": 100, "height": 80})).unwrap();
+    let result = s.execute("file.saveCopy", &json!({})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&bytes_of(&result["dataBase64"])).is_some());
+}
+
+#[test]
+fn native_template_saves_keep_the_document_pdf_preference() {
+    let mut s = three_boards();
+    let dir = Folder::new("template-pdf-preference");
+    s.execute("file.saveAs", &json!({"path": dir.file("compact.vectorcraft"), "pdfCompatible": false, "version": 3})).unwrap();
+    let options = s.execute("file.formatOptions", &json!({"format": "template"})).unwrap();
+    assert_eq!(options["options"]["pdfCompatible"]["value"], false, "the save dialog must offer the same retained choice");
+    let r = s.execute("file.saveAsTemplate", &json!({"format": "template"})).unwrap();
+    let bytes = bytes_of(&r["dataBase64"]);
+    assert!(vectorcraft_format::pdf_content(&bytes).is_none());
+    assert_eq!(
+        vectorcraft_format::load_file(&bytes).unwrap().info.version,
+        vectorcraft_format::VERSION,
+        "unrelated format options are not carried over"
+    );
+    let r = s.execute("file.saveAsTemplate", &json!({"format": "template", "pdfCompatible": true})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&bytes_of(&r["dataBase64"])).is_some());
+}
+
+#[test]
+fn a_default_native_save_keeps_its_pdf_after_another_document_opts_out() {
+    let dir = Folder::new("default-native-pdf-choice");
+    for (index, options) in [json!({}), json!({"options":{"pdfCompatible":null}})].into_iter().enumerate() {
+        let mut s = three_boards();
+        let path = dir.file(&format!("first-{index}.vectorcraft"));
+        let mut params = options.as_object().unwrap().clone();
+        params.insert("path".into(), json!(path));
+        s.execute("file.saveAs", &Value::Object(params)).unwrap();
+        assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_some());
+        s.execute("file.new", &json!({"width": 10, "height": 10})).unwrap();
+        s.execute("file.saveAs", &json!({"path":dir.file(&format!("other-{index}.vectorcraft")),"pdfCompatible":false})).unwrap();
+        s.execute("document.activate", &json!({"index":0})).unwrap();
+        s.execute("document.save", &json!({})).unwrap();
+        assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_some(), "the first document keeps the PDF it was saved with");
+        assert_eq!(s.doc().unwrap().save_options.get("pdfCompatible"), Some(&json!(true)));
+    }
+}
+
+#[test]
+fn a_null_nested_pdf_option_keeps_the_saved_opt_out() {
+    let dir = Folder::new("null-nested-pdf-option");
+    let mut s = three_boards();
+    let path = dir.file("compact.vectorcraft");
+    s.execute("file.saveAs", &json!({"path": path, "pdfCompatible": false})).unwrap();
+    s.execute("document.save", &json!({"options": {"pdfCompatible": null}})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_none(), "null leaves the saved choice");
+    assert_eq!(s.doc().unwrap().save_options.get("pdfCompatible"), Some(&json!(false)));
+}
+
+#[test]
+fn reopening_native_files_keeps_each_files_pdf_compatibility() {
+    let dir = Folder::new("pdf-reopened-options");
+    let mut s = three_boards();
+    let pdf = dir.file("portable.vectorcraft");
+    let compact = dir.file("compact.vectorcraft");
+    s.execute("file.saveAs", &json!({"path": pdf, "pdfCompatible": true})).unwrap();
+    s.execute("file.saveAs", &json!({"path": compact, "pdfCompatible": false})).unwrap();
+    s.execute("file.new", &json!({"width": 20, "height": 20})).unwrap();
+    let copy = s.execute("file.saveCopy", &json!({})).unwrap();
+    assert!(vectorcraft_format::pdf_content(&bytes_of(&copy["dataBase64"])).is_none(), "new files use the last native preference");
+    for (path, expected) in [(&pdf, true), (&compact, false)] {
+        s.execute("document.open", &json!({"path": path})).unwrap();
+        let options = s.execute("file.formatOptions", &json!({"format": "vectorcraft"})).unwrap();
+        assert_eq!(options["options"]["pdfCompatible"]["value"], expected);
+        s.execute("document.save", &json!({})).unwrap();
+        assert_eq!(vectorcraft_format::pdf_content(&std::fs::read(path).unwrap()).is_some(), expected);
+    }
+}
+
+#[test]
+fn reverting_native_files_updates_their_pdf_compatibility() {
+    let dir = Folder::new("pdf-revert-options");
+    for saved in [false, true] {
+        let mut s = three_boards();
+        let path = dir.file(if saved { "with-pdf.vectorcraft" } else { "compact.vectorcraft" });
+        s.execute("file.saveAs", &json!({"path": path, "pdfCompatible": saved})).unwrap();
+        let replacement = s.execute("file.saveCopy", &json!({"pdfCompatible": !saved})).unwrap();
+        std::fs::write(&path, bytes_of(&replacement["dataBase64"])).unwrap();
+        s.execute("shape.rectangle", &json!({"x": 70, "y": 20, "width": 8, "height": 8})).unwrap();
+        s.execute("file.revert", &json!({})).unwrap();
+        let options = s.execute("file.formatOptions", &json!({"format": "vectorcraft"})).unwrap();
+        assert_eq!(options["options"]["pdfCompatible"]["value"], !saved);
+        s.execute("document.save", &json!({})).unwrap();
+        assert_eq!(vectorcraft_format::pdf_content(&std::fs::read(&path).unwrap()).is_some(), !saved);
+    }
 }
 
 #[test]
@@ -429,7 +568,7 @@ fn format_options_list_the_save_options() {
         assert_eq!(v["options"][k]["value"], value, "{k}");
     }
     let v = s.execute("file.formatOptions", &json!({"format": "vectorcraft"})).unwrap();
-    assert_eq!((v["options"]["pdfCompatible"]["value"].as_bool(), v["options"]["range"]["value"].is_null()), (Some(false), true));
+    assert_eq!((v["options"]["pdfCompatible"]["value"].as_bool(), v["options"]["range"]["value"].is_null()), (Some(true), true));
     // Saved with them, a document remembers them for Save.
     let dir = Folder::new("remember");
     let path = dir.file("r.vectorcraft");
diff --git a/crates/engine/src/tests/svgfilter.rs b/crates/engine/src/tests/svgfilter.rs
new file mode 100644
index 000000000..c9f5cef44
--- /dev/null
+++ b/crates/engine/src/tests/svgfilter.rs
@@ -0,0 +1,476 @@
+//! Effect › SVG Filters (`svgFilter.*`): the filters a document holds, applying one as a live
+//! `svg.filter` effect, and what SVG export and the native format keep of them.
+
+use serde_json::{Value, json};
+
+use crate::*;
+
+fn session() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 100, "height": 100})).unwrap();
+    s
+}
+
+fn run(s: &mut Session, id: &str, p: Value) -> Value {
+    s.execute(id, &p).unwrap()
+}
+
+fn err(s: &mut Session, id: &str, p: Value) -> String {
+    s.execute(id, &p).unwrap_err().to_string()
+}
+
+fn rect(s: &mut Session, x: f64) -> NodeId {
+    NodeId(run(s, "shape.rectangle", json!({"x": x, "y": 10, "width": 30, "height": 30}))["id"].as_u64().unwrap())
+}
+
+fn steps(s: &Session) -> usize {
+    s.doc().unwrap().history.undo.len()
+}
+
+fn names(s: &mut Session) -> Vec<String> {
+    run(s, "svgFilter.list", json!({}))["filters"].as_array().unwrap().iter().map(|f| f["name"].as_str().unwrap().to_string()).collect()
+}
+
+const BLUR: &str = r#"<filter id="Soft"><feGaussianBlur stdDeviation="2"/></filter>"#;
+const SHIFT: &str = r#"<filter id="Shift"><feOffset dx="3" dy="3"/></filter>"#;
+
+#[test]
+fn filters_are_defined_edited_and_deleted_in_one_undo_step_each() {
+    let mut s = session();
+    assert_eq!(run(&mut s, "svgFilter.list", json!({}))["filters"], json!([]));
+    assert_eq!(run(&mut s, "svgFilter.define", json!({"xml": format!(" {BLUR} ")}))["name"], "Soft");
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    assert_eq!(names(&mut s), ["Soft", "Shift"], "in the order they were added");
+    assert_eq!(run(&mut s, "svgFilter.list", json!({}))["filters"][0]["xml"], BLUR, "the XML trimmed");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(names(&mut s), ["Soft"], "one step");
+    run(&mut s, "edit.redo", json!({}));
+    // A name another filter has is refused; replace edits one in place, and it keeps its name.
+    assert!(err(&mut s, "svgFilter.define", json!({"xml": BLUR})).contains("already has an SVG filter named \"Soft\""));
+    let renamed = r#"<filter id="Softer"><feGaussianBlur stdDeviation="4"/></filter>"#;
+    run(&mut s, "svgFilter.define", json!({"xml": renamed, "replace": "Soft"}));
+    assert_eq!(names(&mut s), ["Soft", "Shift"]);
+    assert!(err(&mut s, "svgFilter.define", json!({"xml": SHIFT, "replace": "Nope"})).contains("no SVG filter named \"Nope\""));
+    // The same filter again changes nothing and makes no undo step.
+    let before = steps(&s);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT, "replace": "Shift"}));
+    assert_eq!(steps(&s), before);
+    assert_eq!(run(&mut s, "svgFilter.delete", json!({"name": "Soft"}))["filters"].as_array().unwrap().len(), 1);
+    assert!(err(&mut s, "svgFilter.delete", json!({"name": "Soft"})).contains("no SVG filter named"));
+    assert!(err(&mut s, "svgFilter.delete", json!({"name": " "})).contains("give `name`"));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(names(&mut s), ["Soft", "Shift"]);
+}
+
+#[test]
+fn define_refuses_what_is_not_one_filter() {
+    let mut s = session();
+    for (p, why) in [
+        (json!({}), "give `xml`"),
+        (json!({"xml": 3}), "`xml` must be a string"),
+        (json!({"xml": "<filter><feOffset/></filter>"}), "needs an id"),
+        (json!({"xml": "<filter id=\"a\"/>"}), "no primitives"),
+        (json!({"xml": "<g/>"}), "give one <filter> element"),
+        (json!({"xml": SHIFT, "replace": 1}), "`replace` must be a string"),
+    ] {
+        let e = err(&mut s, "svgFilter.define", p.clone());
+        assert!(e.contains(why), "{p}: {e}");
+    }
+    assert_eq!(steps(&s), 0, "nothing recorded");
+}
+
+#[test]
+fn a_document_holds_at_most_64_filters() {
+    let mut s = session();
+    for i in 0..64 {
+        run(&mut s, "svgFilter.define", json!({"xml": format!("<filter id=\"f{i}\"><feOffset/></filter>")}));
+    }
+    assert!(err(&mut s, "svgFilter.define", json!({"xml": SHIFT})).contains("at most 64 SVG filters"));
+    run(&mut s, "svgFilter.define", json!({"xml": "<filter id=\"g0\"><feOffset dx=\"1\"/></filter>", "replace": "f0"}));
+    assert_eq!(names(&mut s).len(), 64, "a replacement still fits");
+}
+
+#[test]
+fn import_adds_the_files_filters_it_does_not_have() {
+    let mut s = session();
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    let svg = format!(
+        "<svg xmlns=\"http://www.w3.org/2000/svg\"><defs>{BLUR}<filter id=\"Shift\"><feOffset dx=\"9\"/></filter><filter id=\"Bad\"/></defs><rect width=\"1\" height=\"1\"/></svg>"
+    );
+    let path = std::env::temp_dir().join(format!("vc-svgfilters-{}.svg", std::process::id()));
+    std::fs::write(&path, &svg).unwrap();
+    let r = run(&mut s, "svgFilter.import", json!({"path": path.to_string_lossy()}));
+    std::fs::remove_file(&path).ok();
+    assert_eq!(r["added"], json!(["Soft"]));
+    assert_eq!(r["skipped"], 2, "a name the document has, and a filter without primitives");
+    assert_eq!(names(&mut s), ["Shift", "Soft"]);
+    assert_eq!(run(&mut s, "svgFilter.list", json!({}))["filters"][0]["xml"], SHIFT, "the document's own filter stays");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(names(&mut s), ["Shift"], "one step");
+    // Nothing new: no undo step.
+    let before = steps(&s);
+    assert_eq!(run(&mut s, "svgFilter.import", json!({"svg": "<svg xmlns=\"http://www.w3.org/2000/svg\"/>"}))["added"], json!([]));
+    assert_eq!(steps(&s), before);
+    assert!(err(&mut s, "svgFilter.import", json!({"svg": "<svg"})).contains("isn't valid SVG"));
+    // Read with SVG import's limits: elements nested past them are refused before parsing.
+    let deep = format!("<svg xmlns=\"http://www.w3.org/2000/svg\">{}{BLUR}{}</svg>", "<g>".repeat(5000), "</g>".repeat(5000));
+    assert!(err(&mut s, "svgFilter.import", json!({"svg": deep})).contains("isn't valid SVG"));
+    assert!(err(&mut s, "svgFilter.import", json!({})).contains("give `path`"));
+    let svg_text = format!("<svg xmlns=\"http://www.w3.org/2000/svg\">{BLUR}</svg>");
+    assert!(err(&mut s, "svgFilter.import", json!({"path": 3, "svg": svg_text})).contains("`path` must be a string"));
+    assert!(err(&mut s, "svgFilter.import", json!({"svg": ["x"]})).contains("`svg` must be a string"));
+    assert!(err(&mut s, "svgFilter.delete", json!({"name": 3})).contains("`name` must be a string"));
+    let svgz = std::env::temp_dir().join(format!("vc-svgfilters-{}.svgz", std::process::id()));
+    std::fs::write(&svgz, vectorcraft_svg::compress(&format!("<svg xmlns=\"http://www.w3.org/2000/svg\">{BLUR}</svg>"))).unwrap();
+    let e = err(&mut s, "svgFilter.import", json!({"path": svgz.to_string_lossy()}));
+    std::fs::remove_file(&svgz).ok();
+    assert!(e.contains("not SVGZ"), "{e}");
+    let missing = std::env::temp_dir().join("vc-no-such-svgfilter-file (1).svg");
+    assert!(s.execute("svgFilter.import", &json!({"path": missing.to_string_lossy()})).is_err());
+}
+
+#[test]
+fn apply_adds_the_filter_as_a_live_effect_in_one_undo_step() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let b = rect(&mut s, 50.0);
+    run(&mut s, "svgFilter.define", json!({"xml": BLUR}));
+    let before = steps(&s);
+    run(&mut s, "select.set", json!({"ids": [a.0, b.0]}));
+    let r = run(&mut s, "svgFilter.apply", json!({"name": "Soft"}));
+    assert_eq!(r["ids"].as_array().unwrap().len(), 2);
+    assert_eq!(steps(&s), before + 1, "one step for both objects");
+    for id in [a, b] {
+        let fx = s.doc().unwrap().doc.node(id).unwrap().appearance.effects.clone();
+        assert_eq!(fx.len(), 1);
+        assert_eq!(fx[0].id, "svg.filter");
+        assert_eq!((fx[0].params["name"].as_str(), fx[0].params["xml"].as_str()), (Some("Soft"), Some(BLUR)));
+    }
+    run(&mut s, "svgFilter.delete", json!({"name": "Soft"}));
+    assert!(err(&mut s, "svgFilter.apply", json!({"name": "Soft"})).contains("no SVG filter named"));
+    assert!(err(&mut s, "svgFilter.apply", json!({})).contains("give `name`"));
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    run(&mut s, "select.set", json!({"ids": []}));
+    assert!(s.execute("svgFilter.apply", &json!({"name": "Shift"})).is_err(), "nothing selected");
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [b.0]}));
+    assert_eq!(s.doc().unwrap().doc.node(b).unwrap().appearance.effects.len(), 2, "given ids, nothing selected");
+}
+
+/// The xml the first effect of `id` draws with.
+fn drawn(s: &Session, id: NodeId) -> Value {
+    s.doc().unwrap().doc.node(id).unwrap().appearance.effects[0].params["xml"].clone()
+}
+
+const SHIFT_MORE: &str = r#"<filter id="Shift"><feOffset dx="9" dy="9"/></filter>"#;
+
+/// Objects name the document's filter: an edit changes what every one of them draws, in one undo
+/// step, and a later application takes the edited filter.
+#[test]
+fn editing_a_filter_changes_every_object_that_uses_it() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let b = rect(&mut s, 50.0);
+    let c = rect(&mut s, 90.0);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [a.0, b.0]}));
+    let before = steps(&s);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT_MORE, "replace": "Shift"}));
+    assert_eq!(steps(&s), before + 1);
+    assert_eq!((drawn(&s, a), drawn(&s, b)), (json!(SHIFT_MORE), json!(SHIFT_MORE)));
+    // One undo puts both back.
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!((drawn(&s, a), drawn(&s, b)), (json!(SHIFT), json!(SHIFT)));
+    run(&mut s, "edit.redo", json!({}));
+    // Applied after the edit: the edited filter.
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [c.0]}));
+    assert_eq!(drawn(&s, c), json!(SHIFT_MORE));
+    // An edit whose code names another id keeps the filter's name.
+    run(&mut s, "svgFilter.define", json!({"xml": r#"<filter id="Renamed"><feOffset dx="1"/></filter>"#, "replace": "Shift"}));
+    assert_eq!(names(&mut s), ["Shift"]);
+    assert_eq!(drawn(&s, a), json!(r#"<filter id="Shift"><feOffset dx="1"/></filter>"#));
+}
+
+/// Deleting a filter that objects use leaves their effects, which draw nothing until a filter of
+/// that name exists again.
+#[test]
+fn deleting_a_filter_in_use_leaves_the_effect_drawing_nothing() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [a.0]}));
+    run(&mut s, "svgFilter.delete", json!({"name": "Shift"}));
+    let fx = s.doc().unwrap().doc.node(a).unwrap().appearance.effects.clone();
+    assert_eq!((fx.len(), fx[0].params["name"].as_str()), (1, Some("Shift")), "the effect stays, named");
+    assert!(vectorcraft_render::effects::raster_effects(&fx).is_empty(), "drawn without the filter");
+    // Imported again: the effect draws with it.
+    run(&mut s, "svgFilter.import", json!({"svg": format!("<svg xmlns=\"http://www.w3.org/2000/svg\">{SHIFT_MORE}</svg>")}));
+    assert_eq!(drawn(&s, a), json!(SHIFT_MORE));
+}
+
+/// Art in a symbol's definition that uses a filter follows its edits too.
+#[test]
+fn a_symbols_art_follows_a_filter_edit() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [a.0]}));
+    run(&mut s, "select.set", json!({"ids": [a.0]}));
+    run(&mut s, "symbol.new", json!({"name": "Mark"}));
+    let in_symbol = |s: &Session| {
+        let mut xml = vec![];
+        s.doc().unwrap().doc.symbols[0].art.walk(&mut |n| xml.extend(n.appearance.effects.iter().map(|e| e.params["xml"].clone())));
+        xml
+    };
+    assert_eq!(in_symbol(&s), [json!(SHIFT)]);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT_MORE, "replace": "Shift"}));
+    assert_eq!(in_symbol(&s), [json!(SHIFT_MORE)]);
+}
+
+/// A graphic style that holds a filter follows its edits, so applying it later gives the edited
+/// filter.
+#[test]
+fn a_graphic_style_follows_a_filter_edit() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let b = rect(&mut s, 50.0);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [a.0]}));
+    run(&mut s, "graphicStyle.new", json!({"name": "Shifted", "id": a.0}));
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT_MORE, "replace": "Shift"}));
+    run(&mut s, "graphicStyle.apply", json!({"name": "Shifted", "ids": [b.0]}));
+    assert_eq!(drawn(&s, b), json!(SHIFT_MORE));
+}
+
+/// An edited filter keeps its name, characters XML escapes included.
+#[test]
+fn an_edit_keeps_a_name_with_escaped_characters() {
+    let mut s = session();
+    run(&mut s, "svgFilter.define", json!({"xml": r#"<filter id="a&amp;b"><feOffset/></filter>"#}));
+    assert_eq!(names(&mut s), ["a&b"]);
+    run(&mut s, "svgFilter.define", json!({"xml": r#"<filter id="x"><feOffset dx="2"/></filter>"#, "replace": "a&b"}));
+    assert_eq!(names(&mut s), ["a&b"]);
+}
+
+#[test]
+fn effect_apply_takes_a_filter_and_names_it_by_its_id() {
+    let mut s = session();
+    rect(&mut s, 10.0);
+    let r = run(&mut s, "effect.apply", json!({"effect": "svg.filter", "params": {"xml": SHIFT}}));
+    let id = NodeId(r["ids"][0].as_u64().unwrap());
+    assert_eq!(s.doc().unwrap().doc.node(id).unwrap().appearance.effects[0].params["name"], "Shift");
+    assert!(err(&mut s, "effect.apply", json!({"effect": "svg.filter"})).contains("give `xml`"));
+    for scale in [json!(0), json!(1001), json!("2")] {
+        let e = err(&mut s, "effect.apply", json!({"effect": "svg.filter", "params": {"xml": SHIFT, "scale": scale}}));
+        assert!(e.contains("`scale` must be a number"), "{scale}: {e}");
+    }
+    assert!(err(&mut s, "effect.apply", json!({"effect": "svg.filter", "params": {"xml": "<g/>"}})).contains("give one <filter> element"));
+    assert!(err(&mut s, "effect.setParams", json!({"index": 0, "params": {"xml": "<filter/>"}})).contains("needs an id"));
+    assert!(err(&mut s, "effect.setParams", json!({"index": 0, "params": {"scale": 0}})).contains("`scale` must be a number from 0.001"));
+    assert!(err(&mut s, "effect.setParams", json!({"index": 0, "params": {"name": "Other"}})).contains("give `xml` with `name`"));
+    // Another filter renames the effect.
+    run(&mut s, "effect.setParams", json!({"index": 0, "params": {"xml": BLUR}}));
+    let p = &s.doc().unwrap().doc.node(id).unwrap().appearance.effects[0].params;
+    assert_eq!((p["name"].as_str(), p["xml"].as_str()), (Some("Soft"), Some(BLUR)));
+}
+
+/// An effect names the document's filter, so effect.apply and effect.setParams refuse XML that
+/// differs from the document's filter of the same id, and take XML that matches it.
+#[test]
+fn effect_commands_refuse_another_definition_of_a_document_filter() {
+    let mut s = session();
+    rect(&mut s, 10.0);
+    run(&mut s, "svgFilter.define", json!({"xml": BLUR}));
+    let other = r#"<filter id="Soft"><feGaussianBlur stdDeviation="9"/></filter>"#;
+    let before = steps(&s);
+    let e = err(&mut s, "effect.apply", json!({"effect": "svg.filter", "params": {"xml": other}}));
+    assert!(e.contains("another SVG filter named \"Soft\""), "{e}");
+    assert_eq!(steps(&s), before, "nothing recorded");
+    run(&mut s, "effect.apply", json!({"effect": "svg.filter", "params": {"xml": format!(" {BLUR} ")}}));
+    run(&mut s, "effect.apply", json!({"effect": "svg.filter", "params": {"xml": SHIFT}}));
+    let e = err(&mut s, "effect.setParams", json!({"index": 1, "params": {"xml": other}}));
+    assert!(e.contains("another SVG filter named \"Soft\""), "{e}");
+    run(&mut s, "effect.setParams", json!({"index": 1, "params": {"xml": BLUR}}));
+}
+
+/// An effect whose filter `check` refuses (put there by an opened file or a script, not by a
+/// command) is neither drawn nor written to SVG.
+#[test]
+fn svg_export_leaves_out_a_filter_that_fails_the_check() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let bad = r#"<filter id="Bad"><feOffset/><script>alert(1)</script></filter>"#;
+    assert!(err(&mut s, "effect.apply", json!({"effect": "svg.filter", "ids": [a.0], "params": {"xml": bad}})).contains("<script>"));
+    let effect = vectorcraft_doc::Effect { id: "svg.filter".into(), params: json!({"name": "Bad", "xml": bad}), visible: true };
+    s.edit("Plant", |d, _| {
+        d.node_mut(a).unwrap().appearance.effects.push(effect);
+        Ok(())
+    })
+    .unwrap();
+    let out = svg(&mut s);
+    assert!(!out.contains("script") && !out.contains("<filter"), "{out}");
+}
+
+/// A user-space region in percentages is measured against what the filter runs on: SVG export keeps
+/// the filter only when it runs on the object alone, and otherwise writes the object as an image.
+#[test]
+fn svg_export_keeps_a_measured_region_only_on_the_object_alone() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let measured = r#"<filter id="M" filterUnits="userSpaceOnUse" x="-50%" y="-50%" width="200%" height="200%"><feOffset dx="3"/></filter>"#;
+    run(&mut s, "effect.apply", json!({"effect": "svg.filter", "ids": [a.0], "params": {"xml": measured}}));
+    let alone = svg(&mut s);
+    assert!(alone.contains("<feOffset dx=\"3\"/>") && !alone.contains("<image"), "{alone}");
+    // On a second object, after a blur: an image.
+    let mut t = session();
+    let b = rect(&mut t, 10.0);
+    run(&mut t, "effect.apply", json!({"effect": "blur.gaussian", "ids": [b.0], "params": {"radius": 1}}));
+    run(&mut t, "effect.apply", json!({"effect": "svg.filter", "ids": [b.0], "params": {"xml": measured}}));
+    let after = svg(&mut t);
+    assert!(after.contains("<image") && !after.contains("<feOffset dx=\"3\""), "{after}");
+}
+
+/// SVG export writes a filter rebuilt from its filter elements and filter attributes, not the XML
+/// the effect holds.
+#[test]
+fn svg_export_writes_the_filter_rebuilt() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    let noted = r#"<filter id="Noted" data-x="1"><!-- <script>x</script> --><desc>&lt;b&gt;note</desc><feOffset dx="3" dy="3" foo="bar"/></filter>"#;
+    run(&mut s, "effect.apply", json!({"effect": "svg.filter", "ids": [a.0], "params": {"xml": noted}}));
+    let out = svg(&mut s);
+    assert!(out.contains("<feOffset dx=\"3\" dy=\"3\"/></filter>"), "{out}");
+    assert!(!out.contains("script") && !out.contains("note") && !out.contains("data-x") && !out.contains("foo"), "{out}");
+}
+
+/// The filter's user space moves with the object: its `origin` follows a move.
+#[test]
+fn moving_the_object_moves_the_filters_origin() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    run(&mut s, "effect.apply", json!({"effect": "svg.filter", "ids": [a.0], "params": {"xml": SHIFT, "origin": [3, 4]}}));
+    run(&mut s, "object.move", json!({"ids": [a.0], "dx": 5, "dy": -2}));
+    let p = &s.doc().unwrap().doc.node(a).unwrap().appearance.effects[0].params;
+    assert_eq!(p["origin"], json!([8.0, 2.0]));
+}
+
+#[test]
+fn filters_survive_a_native_round_trip() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    run(&mut s, "svgFilter.define", json!({"xml": BLUR}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Soft", "ids": [a.0]}));
+    let doc = s.doc().unwrap().doc.clone();
+    let back = vectorcraft_format::load(&vectorcraft_format::save(&doc, false)).unwrap();
+    assert_eq!(back.svg_filters, doc.svg_filters);
+    assert_eq!(back.node(a).unwrap().appearance.effects, doc.node(a).unwrap().appearance.effects);
+}
+
+const RED: &str = r##"<filter id="Red"><feFlood flood-color="#ff0000"/><feComposite in2="SourceGraphic" operator="in"/></filter>"##;
+
+/// A blue square with no stroke, 100 pt at (50, 50) in a 200 pt document.
+fn blue_square() -> (Session, NodeId) {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    let id = rect_at(&mut s, 50.0, 100.0);
+    run(&mut s, "paint.setFill", json!({"color": "#0000ff", "ids": [id.0]}));
+    run(&mut s, "paint.setStroke", json!({"none": true, "ids": [id.0]}));
+    (s, id)
+}
+
+fn rect_at(s: &mut Session, at: f64, size: f64) -> NodeId {
+    NodeId(run(s, "shape.rectangle", json!({"x": at, "y": at, "width": size, "height": size}))["id"].as_u64().unwrap())
+}
+
+fn render(s: &Session) -> vectorcraft_render::Rendered {
+    vectorcraft_render::Renderer::new().render_region(&s.doc().unwrap().doc, vectorcraft_geom::Rect::new(0.0, 0.0, 200.0, 200.0), 1.0, true)
+}
+
+#[test]
+fn the_canvas_and_pdf_draw_the_filter() {
+    let (mut s, id) = blue_square();
+    assert_eq!(&render(&s).pixel(100, 100)[..3], &[0, 0, 255]);
+    run(&mut s, "svgFilter.define", json!({"xml": RED}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Red", "ids": [id.0]}));
+    let r = render(&s);
+    assert_eq!(&r.pixel(100, 100)[..3], &[255, 0, 0], "the flood, cut to the square");
+    assert_eq!(r.pixel(20, 20), render(&session_without_art()).pixel(20, 20), "outside the square: nothing");
+    // PDF writes the effected square as an image that reads back as the canvas shows it.
+    let doc = s.doc().unwrap().doc.clone();
+    let out = crate::cmd::rasterfx::export_pdf_with_report(&doc, &Default::default()).unwrap();
+    let back = vectorcraft_pdf::import(&out.bytes).unwrap();
+    let again = vectorcraft_render::Renderer::new().render_region(&back, vectorcraft_geom::Rect::new(0.0, 0.0, 200.0, 200.0), 1.0, true);
+    let px = again.pixel(100, 100);
+    assert!(px[0] > 240 && px[1] < 15 && px[2] < 15, "{px:?}");
+}
+
+fn session_without_art() -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    s
+}
+
+/// The SVG `document.serialize` writes.
+fn svg(s: &mut Session) -> String {
+    run(s, "document.serialize", json!({"format": "svg"}))["text"].as_str().unwrap().to_string()
+}
+
+#[test]
+fn svg_export_writes_the_filter_when_it_is_the_last_effect() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0);
+    run(&mut s, "svgFilter.define", json!({"xml": SHIFT}));
+    run(&mut s, "svgFilter.apply", json!({"name": "Shift", "ids": [a.0]}));
+    let out = svg(&mut s);
+    assert!(out.contains("<feOffset dx=\"3\" dy=\"3\"/></filter>"), "{out}");
+    assert!(out.contains("<g filter=\"url(#"), "{out}");
+    assert!(!out.contains("<image"), "the object stays vector art: {out}");
+    // SVG import reads it back as the same filter.
+    let (back, warnings) = vectorcraft_svg::import_with_report(&out).unwrap();
+    assert!(warnings.is_empty(), "{warnings:?}");
+    let mut kept = vec![];
+    back.walk(|n| kept.extend(n.appearance.effects.iter().filter(|e| e.id == "svg.filter").cloned()));
+    assert_eq!(kept.len(), 1);
+    assert!(kept[0].params["xml"].as_str().unwrap().ends_with("<feOffset dx=\"3\" dy=\"3\"/></filter>"), "{kept:?}");
+    // SVG Tiny 1.2 has no filters: the object is written as an image.
+    let tiny = run(&mut s, "document.export", json!({"format": "svg", "profile": "tiny12"}));
+    let tiny = String::from_utf8(vectorcraft_format::base64_decode(tiny["dataBase64"].as_str().unwrap()).unwrap()).unwrap();
+    assert!(tiny.contains("<image") && !tiny.contains("<filter"), "{tiny}");
+    // An artboard away from the origin: the object keeps the document's coordinates, which the
+    // filter's user space measures, in a group that moves it.
+    let user = r#"<filter id="Here" filterUnits="userSpaceOnUse" x="0" y="0" width="60" height="60"><feOffset dx="1"/></filter>"#;
+    let mut t = session();
+    run(&mut t, "artboard.setProps", json!({"index": 0, "x": 5, "y": 5}));
+    let b = rect(&mut t, 10.0);
+    run(&mut t, "effect.apply", json!({"effect": "svg.filter", "ids": [b.0], "params": {"xml": user}}));
+    let moved = svg(&mut t);
+    let at = moved.find("<g transform=\"matrix(1 0 0 1 -5 -5)\">").unwrap_or_else(|| panic!("{moved}"));
+    assert!(moved[at..].contains("10"), "the object in document coordinates: {moved}");
+    assert!(!moved[at..].contains(" 5 5 ") && moved.contains("x=\"0\" y=\"0\" width=\"60\""), "the filter as written: {moved}");
+    // Opened again, the filter's user space starts where the group places it.
+    let (back, warnings) = vectorcraft_svg::import_with_report(&moved).unwrap();
+    assert!(warnings.is_empty(), "{warnings:?}");
+    let mut kept = vec![];
+    back.walk(|n| kept.extend(n.appearance.effects.iter().filter(|e| e.id == "svg.filter").cloned()));
+    assert_eq!(kept.len(), 1, "{moved}");
+    assert_eq!(kept[0].params["origin"], json!([-5.0, -5.0]));
+    assert!(err(&mut t, "effect.setParams", json!({"ids": [b.0], "index": 0, "params": {"origin": [1]}})).contains("`origin` must be [x, y]"));
+    // An effect after it: the object is drawn as an image.
+    run(&mut s, "effect.apply", json!({"effect": "blur.gaussian", "ids": [a.0], "params": {"radius": 1}}));
+    let out = svg(&mut s);
+    assert!(out.contains("<image"), "{out}");
+    assert!(!out.contains("<feOffset dx=\"3\""), "{out}");
+}
+
+/// A filter SVG 1.1 can't hold (a blend mode SVG 1.1 lacks) is exported as an image, as the canvas
+/// draws it; an SVG 1.1 one stays a filter.
+#[test]
+fn svg_export_draws_a_filter_svg_1_1_lacks_as_an_image() {
+    for (mode, image) in [("overlay", true), ("multiply", false)] {
+        let mut s = session();
+        let a = rect(&mut s, 10.0);
+        let xml = format!(r#"<filter id="B"><feFlood flood-color="red"/><feBlend in2="SourceGraphic" mode="{mode}"/></filter>"#);
+        run(&mut s, "effect.apply", json!({"effect": "svg.filter", "ids": [a.0], "params": {"xml": xml}}));
+        let out = svg(&mut s);
+        assert_eq!((out.contains("<image"), out.contains("<feBlend")), (image, !image), "{mode}: {out}");
+    }
+}
diff --git a/crates/engine/src/tooling.rs b/crates/engine/src/tooling.rs
index c1c4df67d..fa389583f 100644
--- a/crates/engine/src/tooling.rs
+++ b/crates/engine/src/tooling.rs
@@ -117,6 +117,8 @@ impl Session {
         // `select_tool` calls its [`Tool::chosen_again`] (the Blend tool finishes its blend).
         let again = self.lender.as_ref().unwrap_or(&self.tool).id() == id;
         self.switch_tool(id, view)?;
+        // `switch_tool` returns early for the tool already active.
+        self.select_whole_instance(id);
         if again {
             let acts = self.with_tool_cx(view, |t, cx| t.chosen_again(cx));
             self.apply_actions(acts)?;
@@ -147,10 +149,24 @@ impl Session {
         }
         if vectorcraft_tools::catalog::is_selection_tool(id) {
             self.last_selection_tool = Some(self.tool.id());
+            self.select_whole_instance(id);
         }
         Ok(())
     }
 
+    /// The selection tools other than Direct Selection pick whole objects: with one of them chosen,
+    /// an object selected in a symbol instance's art gives way to the instance. The revision
+    /// changes with it, so panels that cache by revision show the instance.
+    fn select_whole_instance(&mut self, id: &str) {
+        if id != "directSelection"
+            && vectorcraft_tools::catalog::is_selection_tool(id)
+            && let Some(st) = self.active_mut()
+            && st.selection.symbol_part.take().is_some()
+        {
+            st.revision += 1;
+        }
+    }
+
     /// The selection tool Cmd lends tool `id` for a drag: the one chosen last; until one is,
     /// Direct Selection to the tools that edit anchors (the Pen) and Selection to the others.
     /// Cmd+Alt lends Group Selection while Direct Selection is active. Cmd still lends the last
@@ -200,6 +216,8 @@ impl Session {
             // Fails only without a document, and then there is no typing to keep.
             let _ = crate::cmd::settle_interaction(self);
         }
+        // The Selection and Group Selection tools act on the instance whole.
+        self.select_whole_instance(id);
         let lent = self.make_tool(id);
         self.lender = Some(std::mem::replace(&mut self.tool, lent));
         PointerEvent { mods: Mods { cmd: false, ..ev.mods }, ..*ev }
diff --git a/crates/engine/tests/command_sweep.rs b/crates/engine/tests/command_sweep.rs
index 5f16715da..aca3d27a8 100644
--- a/crates/engine/tests/command_sweep.rs
+++ b/crates/engine/tests/command_sweep.rs
@@ -432,6 +432,37 @@ fn structured_junk() {
         ("effect.apply", json!({"effect": "addon.color.halftone", "params": {"frequency": 300, "invert": true, "clip": false, "fromArt": true}})),
         ("effect.apply", json!({"effect": "addon.color.halftone", "params": {"frequency": -1e308, "mode": "cmyk", "color": "#123456", "target": 3}})),
         ("effect.apply", json!({"effect": "addon.color.duotone", "params": {"tones": "x", "skipSpot": "yes"}})),
+        // Effect › SVG Filters: hostile filters are refused or drawn within their bounds.
+        ("effect.apply", json!({"effect": "svg.filter", "params": {"xml": "<filter id=\"a\"><feTurbulence numOctaves=\"1e308\"/></filter>"}})),
+        (
+            "effect.apply",
+            json!({"effect": "svg.filter", "params": {"xml": "<filter id=\"a\"><feGaussianBlur stdDeviation=\"1e308\"/></filter>", "scale": 1e308}}),
+        ),
+        (
+            "effect.apply",
+            json!({"effect": "svg.filter", "params": {"xml": "<filter id=\"a\" filterUnits=\"userSpaceOnUse\" x=\"-1e308\" width=\"1e308\"><feFlood/></filter>"}}),
+        ),
+        (
+            "effect.apply",
+            json!({"effect": "svg.filter", "params": {"xml": "<filter id=\"a\"><feImage xlink:href=\"/etc/passwd\"/></filter>", "scale": -1}}),
+        ),
+        (
+            "effect.apply",
+            json!({"effect": "svg.filter", "params": {"xml": "<!DOCTYPE x [<!ENTITY a \"aaaa\">]><filter id=\"&a;\"><feOffset/></filter>"}}),
+        ),
+        ("effect.apply", json!({"effect": "svg.filter", "params": {"xml": ["x"], "name": 3}})),
+        ("svgFilter.define", json!({"xml": "<filter id=\"a\"><feConvolveMatrix order=\"4294967295\" kernelMatrix=\"1\"/></filter>"})),
+        ("svgFilter.define", json!({"xml": format!("<filter id=\"a\">{}</filter>", "<feOffset/>".repeat(100_000)), "replace": "a"})),
+        (
+            "svgFilter.import",
+            json!({"svg": format!(
+                "<!DOCTYPE svg [<!ENTITY a \"aaaaaaaaaa\"><!ENTITY b \"{}\"><!ENTITY c \"{}\">]><svg xmlns=\"http://www.w3.org/2000/svg\"><filter id=\"&c;\"><feOffset/></filter></svg>",
+                "&a;".repeat(10),
+                "&b;".repeat(10)
+            )}),
+        ),
+        ("svgFilter.apply", json!({"name": "\u{0}", "ids": [u64::MAX]})),
+        ("svgFilter.delete", json!({"name": ["a"]})),
         (
             "effect.apply",
             json!({"effect": "addon.color.duotone", "params": {"tones": [1, null, {"color": [1e308, -1e308, "x"], "curve": [[1e308, -1e308], ["a"]]}]}}),
diff --git a/crates/engine/tests/import_fuzz.rs b/crates/engine/tests/import_fuzz.rs
index 59d079bcd..f72240edf 100644
--- a/crates/engine/tests/import_fuzz.rs
+++ b/crates/engine/tests/import_fuzz.rs
@@ -1,6 +1,6 @@
 //! Untrusted files never crash the app: garbage, truncated, mutated and hostile SVG, PDF and DXF input,
 //! mutated raster images (Photoshop documents among them) placed with File → Place, and swatch (`.vcswatches`, `.gpl`, `.ase`), graphic style (`.vcstyles`), flattener preset
-//! (`.vcflattener`) and export preset (`.vcexportpresets`) libraries, shortcut sets other apps save as text (`.kys`), and native files (compressed, damaged, saved for older versions),
+//! (`.vcflattener`) and export preset (`.vcexportpresets`) libraries, shortcut sets and action sets other apps save as text (`.kys`, `.aia`), and native files (compressed, damaged, saved for older versions),
 //! must load as an error or as a document that then renders and exports, without a panic; nor may
 //! bitmaps, PDF and text pasted from other apps, nor EMF and WMF pictures (damaged files, records
 //! of every kind with random contents) opened, placed or pasted, nor EPS and PostScript files
@@ -1617,6 +1617,93 @@ fn shortcut_sets_past_the_caps_are_truncated() {
     }
 }
 
+// ---------- action sets ----------
+
+/// Action set `bytes` read with `actionSet.read`: an error, or a set within the caps.
+fn action_set(bytes: &[u8]) -> Result<(), TestCaseError> {
+    let read = json!({"dataBase64": vectorcraft_format::base64_encode(bytes), "name": "fuzz.aia"});
+    if let Ok(r) = no_panic(vectorcraft_engine::Session::new().execute("actionSet.read", &read)) {
+        let actions = r["actions"].as_array().cloned().unwrap_or_default();
+        prop_assert!(actions.len() <= 1000);
+        prop_assert!(actions.iter().all(|a| a["steps"].as_array().map_or(0, Vec::len) <= 10_000));
+        prop_assert!(actions.iter().map(|a| a["steps"].as_array().map_or(0, Vec::len)).sum::<usize>() <= 100_000);
+        prop_assert!(r["unread"].as_array().map_or(0, Vec::len) <= 1000);
+    }
+    Ok(())
+}
+
+/// A token of a text action set: a block or field name, a number of any size and sign, text in
+/// parentheses (unclosed, nested or escaped too), bracketed or angled hexadecimal, a brace, a line
+/// end, NUL or bytes that aren't UTF-8.
+fn arb_aia_token() -> impl Strategy<Value = Vec<u8>> {
+    prop_oneof![
+        prop::sample::select(vec![
+            "/action-1",
+            "/event-2",
+            "/parameter-1",
+            "/name",
+            "/internalName",
+            "/localizedName",
+            "/isOn",
+            "/value",
+            "/x",
+            "/version",
+        ])
+        .prop_map(|t| t.as_bytes().to_vec()),
+        any::<i64>().prop_map(|n| n.to_string().into_bytes()),
+        Just(b"99999999999999999999999".to_vec()),
+        "[a-z ()\\\\]{0,12}".prop_map(|t| format!("({t})").into_bytes()),
+        prop::sample::select(vec!["(", ")", "\\", "[ 2 4142 ]", "[ 3 41 4", "[ 1 zz ]", "[", "]", "< 2 0a0b >", "<", ">", "2.5"])
+            .prop_map(|t| t.as_bytes().to_vec()),
+        prop::sample::select(vec!["{", "}", "\r\n", "\r", "\n"]).prop_map(|t| t.as_bytes().to_vec()),
+        prop::sample::select(vec![vec![0u8], vec![0xFF, 0xFE], vec![0xC3]]),
+    ]
+}
+
+proptest! {
+    #![proptest_config(config())]
+
+    #[test]
+    fn action_set_garbage_never_panics(bytes in prop::collection::vec(any::<u8>(), 0..600), head in any::<bool>()) {
+        let mut data = if head { b"/version 3 ".to_vec() } else { vec![] };
+        data.extend(bytes);
+        action_set(&data)?;
+    }
+
+    #[test]
+    fn hostile_action_sets_never_panic(tokens in prop::collection::vec(arb_aia_token(), 0..200), sep in prop::sample::select(vec![" ", "", "\t"])) {
+        let mut data = b"/version 3".to_vec();
+        for t in tokens {
+            data.extend(sep.as_bytes());
+            data.extend(t);
+        }
+        action_set(&data)?;
+    }
+}
+
+/// An action set past any cap (nesting, actions, steps, name length, file size) is read up to it
+/// and marked truncated.
+#[test]
+fn action_sets_past_the_caps_are_truncated() {
+    let read = |text: String| vectorcraft_engine::Session::new().execute("actionSet.read", &json!({ "data": text })).unwrap();
+    let deep = format!("/version 3 /action-1 {{ {} }}", "/x { ".repeat(40));
+    let actions = format!("/version 3 {}", "/action-1 { } ".repeat(1001));
+    let steps = format!("/version 3 /action-1 {{ {} }}", "/event-1 { } ".repeat(10_001));
+    let action = format!("/action-1 {{ {} }} ", "/event-1 { } ".repeat(10_000));
+    let all_steps = format!("/version 3 {}", action.repeat(11));
+    let long = format!("/version 3 /name [ 2000 {} ]", "6e".repeat(2000));
+    let big = format!("/version 3 /action-1 {{ }} {}", " ".repeat(8 << 20));
+    let uncapped: Vec<&str> = [("deep", deep), ("actions", actions), ("steps", steps), ("long", long), ("big", big)]
+        .into_iter()
+        .filter(|(_, text)| read(text.clone())["truncated"] != true)
+        .map(|(name, _)| name)
+        .collect();
+    assert!(uncapped.is_empty(), "{uncapped:?}");
+    let r = read(all_steps);
+    assert_eq!(r["truncated"], true);
+    assert_eq!(r["actions"].as_array().unwrap().iter().map(|a| a["steps"].as_array().unwrap().len()).sum::<usize>(), 100_000);
+}
+
 /// A small image of each raster format Place reads, with resolution metadata where it has some.
 fn raster_samples() -> Vec<(&'static str, Vec<u8>)> {
     let img = image::RgbImage::from_pixel(5, 3, image::Rgb([200, 40, 10]));
@@ -3013,11 +3100,17 @@ fn the_vertical_fixture_reads_as_vertical_type() {
     l.doc.walk(|n| {
         if let vectorcraft_doc::NodeKind::Text(t) = &n.kind {
             let tcy: Vec<&str> = t.runs.iter().filter(|r| r.style.tate_chu_yoko).map(|r| r.text.as_str()).collect();
-            found.push((t.plain_text(), t.vertical, tcy.join("|")));
+            let roman: Vec<&str> = t.runs.iter().filter(|r| r.style.standard_vertical_roman).map(|r| r.text.as_str()).collect();
+            found.push((t.plain_text(), t.vertical, tcy.join("|"), roman.join("|")));
         }
     });
-    let want = [("Day 12\nnext", true, "12"), ("Vertical area type wraps", true, ""), ("On a path", true, "On a path")];
-    assert_eq!(found, want.map(|(a, b, c)| (a.to_string(), b, c.to_string())), "{:?}", l.warnings);
+    // Key 35 at 1 in the defaults: Standard Vertical Roman Alignment, except where a run has 3 or 2.
+    let want = [
+        ("Day 12\nnext", true, "12", "Day "),
+        ("Vertical area type wraps", true, "", "Vertical area type wraps"),
+        ("On a path", true, "On a path", ""),
+    ];
+    assert_eq!(found, want.map(|(a, b, c, d)| (a.to_string(), b, c.to_string(), d.to_string())), "{:?}", l.warnings);
 }
 
 /// The text objects of [`frames_document_text`]: story 0 in its two frames, story 1 in its one (a
@@ -3572,7 +3665,8 @@ proptest! {
                       %_/ArtDictionary :\n%_/Mask :\n%_X=\n%_0 g\n%_0 0 m\n%_5 0 l\n%_5 -5 l\n%_f\n%_X+\n%_ (Art) ,\n%_; (AI9_Mask) ,\n%_/XMLUID : (Photo) ; (AI10_ArtUID) ,\n%_;\n%_\n";
         let place = "%AI5_BeginPlace\n%%FileType: 1\n[1 0 0 -1 -8000 8000] 8000 8000 8002 8001 4 4 0\n(/tmp/p.png)`\n%%IncludeFile:/tmp/p.png\n\
                      %AI17_Begin_Content_if_version_gt:24 12\n%AI28_BeginPlacedRelativePath\n()\n%AI28_EndPlacedRelativePath\n%AI17_Alternate_Content\n%AI17_End_Versioned_Content\n\
-                     %AI17_Begin_Content_if_version_gt:24 5\n%AI26_BeginPlacedObjectPreview\n2 1 8 32 17 @@\n%AI26_EndPlacedObjectPreview\n%AI17_End_Versioned_Content\n~\n%AI5_EndPlace\n";
+                     %AI17_Begin_Content_if_version_gt:24 5\n%AI26_BeginPlacedObjectPreview\n2 1 8 32 17 @@\n%AI26_EndPlacedObjectPreview\n%AI17_End_Versioned_Content\n~\n%AI5_EndPlace\n\
+                     %_/ArtDictionary :\n%_2 /Int (AI11 PlacedPDFPageIndex) ,\n%_4 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n";
         let text = ai::editing_data(100.0, 100.0, &ai::layer("L", &format!("{raster}{place}")));
         let samples: &[u8] = &[255, 0, 0, 0, 0, 255, 128, 0];
         let preview: &[u8] = &[255, 255, 0, 0, 0, 0, 0, 0];
@@ -3825,6 +3919,19 @@ proptest! {
         survive("mutated .ai Art brushed path", || Some(vectorcraft_eps::layered_ai(&private, Document::new(100.0, 100.0), vec![], false, false, 1.0).0))?;
     }
 
+    /// [`styled_definitions_text`] (objects with an art style in a pattern's art and in a brush's
+    /// art), damaged or hostile.
+    #[test]
+    fn ai_styled_definitions_never_panic(cut in 0usize..2_400, edits in prop::collection::vec((0usize..2_400, prop::sample::select(vec!['0', '1', '-', '.', ' ', '\n', '(', ')', '/', ':', ';', ',', '%', '_', 'u', 'U', 'X', 'W', 'E'])), 0..12)) {
+        let text = mutate_text(&styled_definitions_text(), cut, &edits);
+        let private = [b"%AI24_ZStandard_Data".as_slice(), &zstd(&text)].concat();
+        survive("mutated .ai styled definitions", || {
+            let d = vectorcraft_eps::layered_ai(&private, Document::new(100.0, 100.0), vec![], false, false, 1.0).0;
+            let _ = vectorcraft_brush::library(&d);
+            Some(d)
+        })?;
+    }
+
     /// Brush objects of every kind with any parameters, the brush manager's order with any names,
     /// and brush art sections nested or cut short, their art alone or in a group after a frame of
     /// any corners, painted or not, open or closed, the group ended or not: read with the layers,
@@ -4112,6 +4219,44 @@ fn the_art_brushed_fuzz_data_opens_live() {
     assert_eq!(n.appearance.stroke().and_then(|s| s.brush.as_deref()), Some("R"), "{warnings:?} {n:?}");
 }
 
+/// Editing data with an art style (a blue fill and a drop shadow), a pattern, a pattern in the
+/// version 7 form (its tile string) and a Scatter brush's art each holding a square with its drawn
+/// look and that style, and a path filled with the first pattern.
+fn styled_definitions_text() -> String {
+    use vectorcraft_testkit::ai;
+    let style = "%AI9_BeginArtStyles\n/KnownStyle :\n(S) /Name ,\n/ActiveStyle :\n/CompoundFilter :\n(Chain Style Filter) 0 0 /Filter ,\n1 /Visible ,\n\
+                 /CompoundFilter :\n(Stack Style Filter) 0 0 /Filter ,\n1 /Visible ,\n\
+                 /BasicFilter :\n(Fill Style Filter) 0 0 /Filter ,\n1 /Visible ,\n/Dictionary : /NotRecorded ,\n/FillStyle : 0 O\n0 0 0 0 0 0 1 Xa\n0 1 Xd\n/Def ;\n (FillStyle) ,\n; /Dict ;\n /Part ,\n\
+                 /BasicFilter :\n(Conduit Filter) 0 0 /Filter ,\n1 /Visible ,\n;\n /Part ,\n;\n /Part ,\n\
+                 /BasicFilter :\n(Adobe Drop Shadow) 1 0 /Filter ,\n1 /Visible ,\n/Dictionary : /NotRecorded ,\n1 /Int (blnd) ,\n0.75 /Real (opac) ,\n5 /Real (blur) ,\n\
+                 0 /Int (csrc) ,\n/FillStyle : 0 O\n0 0 0 1 0 0 0 Xa\n0 1 Xd\n/Def ;\n (sclr) ,\n3 /Real (horz) ,\n4 /Real (vert) ,\n; /Dict ;\n /Part ,\n;\n%AI9_EndArtStyles\n";
+    let square = "0 Ae\nu\n1 0 0 0 0 0 0 Xa\n0 0 m\n10 0 L\n10 10 L\n0 10 L\nf\nU\n%_0 0 m\n%_10 0 L\n%_10 10 L\n%_0 10 L\n%_f\n1 (S) XW\n";
+    let pattern = format!("%AI3_BeginPattern: (P)\n(P) 0 0 10 10\n0 A\n0 Xw\n{square}E\n%AI3_EndPattern\n");
+    let tile = square.replace('\n', "\r");
+    let legacy = format!("%AI3_BeginPattern: (Q)\n(Q) 0 0 20 20 [\n%AI3_Tile\n(0 O 0 R 0 0 0 1 k 0 0 0 1 K) @\n(\r{tile}) &\n] E\n%AI3_EndPattern\n");
+    let art = format!("%AI8_BeginBrushPattern\n(D)\n0 A\n{square}%AI8_EndBrushPattern\n");
+    let object = "%AI8_BeginPluginObject\n(Adobe Scatter Brush Tool)\n(B)\n(2 /D/ 5 1 0 0 / 0 0.5 1.5 1) -\n( 1.2 2 0 -0.25 0.25 2 -45 30 1 1 0) .\n%AI8_EndPluginObject\n";
+    let path = format!("(P) 0 0 1 1 0 0 0 0 0 [1 0 0 1 0 0] p\n{}f\n", ai::rect(20.0, 20.0, 80.0, 80.0));
+    ai::editing_data(100.0, 100.0, &format!("{style}{pattern}{legacy}{art}{object}{}", ai::layer("L", &path)))
+}
+
+/// The data [`ai_styled_definitions_never_panic`] damages, as it is, opens with the patterns' and
+/// the brush's squares live.
+#[test]
+fn the_styled_definitions_fuzz_data_opens_live() {
+    let private = [b"%AI24_ZStandard_Data".as_slice(), &zstd(&styled_definitions_text())].concat();
+    // Trusted: the empty page it is read beside isn't compared with its art.
+    let (doc, warnings, _) = vectorcraft_eps::layered_ai(&private, Document::new(100.0, 100.0), vec![], false, true, 1.0);
+    let live = |n: &vectorcraft_doc::Node| matches!(n.kind, vectorcraft_doc::NodeKind::Path { .. }) && n.appearance.effects.len() == 1;
+    for name in ["P", "Q"] {
+        let tile = doc.pattern(name).map(|p| p.art.clone()).unwrap_or_else(|| panic!("{name}: {warnings:?}"));
+        assert!(tile.len() == 1 && live(&tile[0]), "{name}: {warnings:?} {tile:?}");
+    }
+    let lib = vectorcraft_brush::library(&doc);
+    let brush = lib.iter().find(|b| b.name == "B").unwrap_or_else(|| panic!("{warnings:?}"));
+    assert!(matches!(brush.art().as_slice(), [n] if live(n)), "{warnings:?} {brush:?}");
+}
+
 /// The ids of the objects of an Objects on Path group in the fuzz cases.
 const ON_PATH_IDS: [&str; 5] = ["f-0001", "f-0002", "f-0003", "f-0004", "f-0005"];
 
@@ -4644,6 +4789,9 @@ fn arb_ai_token() -> impl Strategy<Value = String> {
             "\n%AI26_EndPlacedObjectPreview\n",
             "[1 0 0 -1 0 0] 0 0 2 1 4 4 0 (a.png) `",
             "[1e308 0 0 1e308 0 0] 0 0 -1e308 1e308 4 4 0 (a.png) `",
+            "\n%_/ArtDictionary :\n%_2 /Int (AI11 PlacedPDFPageIndex) ,\n%_4 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n",
+            "\n%_/ArtDictionary :\n%_-1e308 /Real (AI11 PlacedPDFPageIndex) ,\n%_99 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n",
+            "\n%_/ArtDictionary :\n%_(2) /String (AI11 PlacedPDFPageIndex) ,\n%_5 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n",
             "\n%AI28_BeginPlacedRelativePath\n",
             "\n%AI28_BeginPlacedRelativePath\n(src/)\n%AI28_EndPlacedRelativePath\n",
             "\n%AI28_BeginPlacedRelativePath\n(..\\\\..\\\\art\\\\)\n%AI28_EndPlacedRelativePath\n",
@@ -4720,6 +4868,13 @@ fn arb_ai_token() -> impl Strategy<Value = String> {
             "(Fill Style Filter) 0 0 /Filter ,",
             "(Adobe Outer Glow) 1 0 /Filter ,",
             "(Adobe Drop Shadow) 1 0 /Filter ,",
+            "(PSAdapter_plugin_BsRl) 1 0 /Filter ,",
+            "/Binary : /ASCII85Decode ,",
+            "/Binary : /ASCII85Decode ,\n%!!!!\"z~>\n; (data) ,",
+            "\n%zzzz~>\n",
+            "; (data) ,",
+            "8 /Int (dataSize) ,",
+            "8 /Real (dataSize) ,",
             "(Adobe Pathfinder) 1 0 /Filter ,",
             "0 /Int (Command) ,",
             "0.5 /Real (Mix) ,",
@@ -5229,6 +5384,53 @@ proptest! {
             survive(what, || vectorcraft_engine::cmd::fileio::load("x.eps", &file).ok().map(|l| l.doc))?;
         }
     }
+
+    /// A filter-gallery effect's settings block in an art style: fields of any key, marker, type and
+    /// value, objects nested in objects, any version and `dataSize`, and its ASCII85 lines damaged or cut.
+    #[test]
+    fn ai_filter_gallery_settings_never_panic(
+        fields in prop::collection::vec(arb_settings_field(), 0..8),
+        inner in prop::collection::vec(arb_settings_field(), 0..4),
+        nesting in 0usize..4,
+        version in prop_oneof![Just(1u32), any::<u32>()],
+        size in prop_oneof![Just(None), any::<i64>().prop_map(Some)],
+        cut in 0usize..600,
+        edits in prop::collection::vec((0usize..600, prop::sample::select(vec!['%', '~', '>', 'z', 'v', '!', 'u', '\n', ';', ' '])), 0..6),
+    ) {
+        use vectorcraft_testkit::ai;
+        let object = |body: Vec<u8>| [&b"Objc"[..], &0x8000_0000u32.to_be_bytes(), b"Clss", &(body.len() as u32 + 4).to_be_bytes(), &1u32.to_be_bytes(), &body].concat();
+        let mut nested = inner.concat();
+        for _ in 0..nesting {
+            nested = object(nested);
+        }
+        let data = [version.to_be_bytes().to_vec(), fields.concat(), nested].concat();
+        let lines: String = ascii85(&data).as_bytes().chunks(60).map(|c| format!("%{}\n", String::from_utf8_lossy(c))).collect();
+        let size = size.unwrap_or(data.len() as i64);
+        let block = mutate_text(&format!("/Binary : /ASCII85Decode ,\n{lines}; (data) ,\n{size} /Int (dataSize) ,\n"), cut, &edits);
+        let styles = format!(
+            "%AI9_BeginArtStyles\n/KnownStyle :\n(R) /Name ,\n/ActiveStyle :\n/CompoundFilter :\n(Chain Style Filter) 0 0 /Filter ,\n1 /Visible ,\n\
+             /BasicFilter :\n(PSAdapter_plugin_BsRl) 1 0 /Filter ,\n1 /Visible ,\n/Dictionary : /NotRecorded ,\n{block}; /Dict ;\n /Part ,\n;\n%AI9_EndArtStyles\n"
+        );
+        let hidden = ai::rect(0.0, 0.0, 10.0, 10.0).replace('\n', "\n%_");
+        let art = format!("0 Ae\nu\n0 1 1 0 1 0 0 Xa\n{}f\nU\n%_{hidden}f\n1 (R) XW\n", ai::rect(0.0, 0.0, 10.0, 10.0));
+        let data = ai::editing_data(200.0, 100.0, &format!("{styles}{}", ai::layer("L", &art)));
+        survive("filter-gallery settings", || Some(vectorcraft_eps::layered_ai(data.as_bytes(), Document::new(200.0, 100.0), vec![], false, false, 1.0).0))?;
+        let eps = ai::eps(data.as_bytes(), ai::page_ps());
+        survive("filter-gallery settings in an EPS", || vectorcraft_engine::cmd::fileio::load("x.eps", &eps).ok().map(|l| l.doc))?;
+    }
+}
+
+/// A field of a filter-gallery settings descriptor: a key, a marker, a type and a value, each one
+/// that is read or anything else.
+fn arb_settings_field() -> impl Strategy<Value = Vec<u8>> {
+    let key = prop_oneof![prop::sample::select(vec![*b"GEfk", *b"Dtl ", *b"Smth", *b"LghD", *b"Xtra"]), any::<[u8; 4]>()];
+    let marker = prop_oneof![Just(0u32), Just(0x2000), Just(0x8000_0000), any::<u32>()];
+    let kind = prop_oneof![prop::sample::select(vec![*b"long", *b"doub", *b"bool", *b"LghD", *b"GEft"]), any::<[u8; 4]>()];
+    let value = prop_oneof![
+        prop::sample::select(vec![b"LDBt".to_vec(), b"BsRl".to_vec(), 8i32.to_be_bytes().to_vec(), vec![1], f64::NAN.to_be_bytes().to_vec()]),
+        prop::collection::vec(any::<u8>(), 0..12),
+    ];
+    (key, marker, kind, value).prop_map(|(k, m, t, v)| [&k[..], &m.to_be_bytes(), &t, &v].concat())
 }
 
 // ---------- font files a folder search reads ----------
diff --git a/crates/engine/tests/plugin_export.rs b/crates/engine/tests/plugin_export.rs
index 1a49f800a..df06b5ee2 100644
--- a/crates/engine/tests/plugin_export.rs
+++ b/crates/engine/tests/plugin_export.rs
@@ -69,9 +69,8 @@ fn an_exporter_adds_a_write_only_format_while_it_is_installed() {
     assert!(e.to_string().contains("unknown format"), "{e}");
 }
 
-/// The exporter is given the document as a native file's JSON: what `document.save` writes before
-/// the data of large images, which stays behind (compact, where a save of a small document is
-/// indented).
+/// The exporter receives the native document JSON without optional save renditions or preference
+/// metadata. Large image bytes stay in the saved file's tail; plug-in input stays compact.
 #[test]
 fn the_exporter_is_given_the_native_file_s_json() {
     let mut s = session();
@@ -94,8 +93,14 @@ fn the_exporter_is_given_the_native_file_s_json() {
     let saved = exported(&s.execute("document.save", &json!({})).unwrap());
     assert!(saved.len() > given.len() + png.len(), "the image data follows the JSON in the saved file");
     let doc: Value = serde_json::from_slice(&given).unwrap();
-    let saved_json: Value = serde_json::from_slice(vectorcraft_format::json_part(&saved)).unwrap();
-    assert_eq!(doc, saved_json, "the saved file's JSON");
+    let mut saved_json: Value = serde_json::from_slice(vectorcraft_format::json_part(&saved)).unwrap();
+    assert!(saved_json.get("pdf").is_some(), "a default application save carries a PDF");
+    assert_eq!(saved_json["pdfCompatible"], true);
+    assert!(doc.get("pdf").is_none() && doc.get("pdfCompatible").is_none(), "the plug-in input omits optional save members");
+    let saved_members = saved_json.as_object_mut().unwrap();
+    saved_members.remove("pdf");
+    saved_members.remove("pdfCompatible");
+    assert_eq!(doc, saved_json, "the native document JSON without optional save members");
     assert!(!given.contains(&b'\n'), "without indentation");
     assert_eq!((&doc["format"], &doc["version"]), (&json!("vectorcraft"), &json!(vectorcraft_format::VERSION)));
     let images = doc["images"].as_object().unwrap();
diff --git a/crates/engine/tests/plugin_fuzz.rs b/crates/engine/tests/plugin_fuzz.rs
index 5a42300b1..ccb8bb1c9 100644
--- a/crates/engine/tests/plugin_fuzz.rs
+++ b/crates/engine/tests/plugin_fuzz.rs
@@ -1,9 +1,11 @@
 //! Untrusted plug-ins never crash the app: mutated and garbage modules handed to `plugin.install`,
 //! and plug-ins returning hostile output (random JSON in the object model's shape: huge or
 //! malformed coordinates, unknown ids, broken paints and gradients, junk of every type) as object
-//! filters (`plugin.run`) or live effects (`effect.apply`). Each run must end as an error that
-//! leaves the document as it was, or as a document that then renders and exports, without a
-//! panic.
+//! filters (`plugin.run`) or live effects (`effect.apply`), and plug-ins running bulk memory
+//! instructions (`memory.fill`, `memory.copy`, `memory.init`, `data.drop`) on ranges in, at and past
+//! the ends of memory and the data segment, under small and default budgets. Each run must end as
+//! an error that leaves the document as it was, or as a document that then renders and exports,
+//! without a panic. A bulk memory run traps exactly when a range leaves its region.
 //!
 //! `PROPTEST_CASES=2000 cargo test -p vectorcraft-engine --test plugin_fuzz` runs a deeper search.
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
@@ -13,6 +15,7 @@ use proptest::prelude::*;
 use serde_json::{Map, Value, json};
 use vectorcraft_engine::Session;
 use vectorcraft_plugins::wat as tpl;
+use vectorcraft_plugins::{Error, Limits, Plugin};
 use vectorcraft_testkit::catch_quiet;
 use vectorcraft_testkit::fixtures::rich_session;
 
@@ -157,6 +160,272 @@ fn arb_paint() -> impl Strategy<Value = Value> {
     ]
 }
 
+/// Bytes in the passive data segment that bulk memory cases initialize memory from.
+const SEGMENT_LEN: u32 = 4096;
+
+/// Fuel the host hands a run per slice (`FUEL_SLICE` in `vectorcraft_plugins`' runtime).
+const FUEL_SLICE: u64 = 20_000_000;
+
+/// Where a bulk memory plug-in keeps its output (the manifest sits at 16).
+const BULK_OUTPUT_AT: u32 = 0x8000;
+
+/// The output a bulk memory plug-in returns.
+const BULK_OUTPUT: &str = r#"{"objects":[]}"#;
+
+/// The input and parameters a bulk memory plug-in is run on directly: each takes one page, so the
+/// memory then ends two pages after the module's initial pages.
+const BULK_INPUT: &[u8] = BULK_OUTPUT.as_bytes();
+const BULK_PARAMS: &[u8] = b"{}";
+
+/// The end of memory in WAT, read when the instruction runs.
+const MEMORY_END: &str = "(i32.shl (memory.size) (i32.const 16))";
+
+/// A bulk memory instruction a generated plug-in runs.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum BulkOp {
+    /// `memory.fill` over the destination range.
+    Fill,
+    /// `memory.copy` from the source range to the destination range, which may overlap.
+    Copy,
+    /// `memory.init` from the data segment, then `data.drop`.
+    Init,
+    /// `data.drop`, then `memory.init` from the emptied segment.
+    Drop,
+}
+
+impl BulkOp {
+    const ALL: [BulkOp; 4] = [BulkOp::Fill, BulkOp::Copy, BulkOp::Init, BulkOp::Drop];
+
+    /// The instruction a module running this operation contains.
+    fn opcode(self) -> &'static str {
+        match self {
+            BulkOp::Fill => "memory.fill",
+            BulkOp::Copy => "memory.copy",
+            BulkOp::Init => "memory.init",
+            BulkOp::Drop => "data.drop",
+        }
+    }
+}
+
+/// What an offset is measured from: the start, the end, or the end less the length (a range that
+/// ends exactly at the end).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Base {
+    Start,
+    End,
+    EndLessLen,
+}
+
+/// An offset into memory or the data segment: `base` plus `delta`, in the wrapping 32-bit
+/// arithmetic the module computes it in.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Offset {
+    base: Base,
+    delta: i32,
+}
+
+impl Offset {
+    const fn start(delta: i32) -> Self {
+        Offset { base: Base::Start, delta }
+    }
+
+    /// The offset in a region that ends at `end`, for a range of `len` bytes.
+    fn value(self, end: u32, len: u32) -> u32 {
+        let base = match self.base {
+            Base::Start => 0,
+            Base::End => end,
+            Base::EndLessLen => end.wrapping_sub(len),
+        };
+        base.wrapping_add_signed(self.delta)
+    }
+
+    /// The WAT computing the offset, with `end` the WAT of the region's end.
+    fn wat(self, end: &str, len: u32) -> String {
+        let base = match self.base {
+            Base::Start => "(i32.const 0)".to_string(),
+            Base::End => end.to_string(),
+            Base::EndLessLen => format!("(i32.sub {end} (i32.const {len}))"),
+        };
+        format!("(i32.add {base} (i32.const {}))", self.delta)
+    }
+}
+
+/// A plug-in whose run executes one bulk memory instruction.
+#[derive(Clone, Copy, Debug)]
+struct BulkCase {
+    op: BulkOp,
+    /// The destination in memory.
+    dst: Offset,
+    /// The source: in memory for `Copy`, in the data segment for `Init` and `Drop`.
+    src: Offset,
+    len: u32,
+    /// The byte `Fill` writes.
+    value: u8,
+    /// How many times `Fill` and `Copy` run; `Init` and `Drop` run once.
+    repeat: u32,
+    /// Initial memory pages.
+    pages: u32,
+}
+
+impl BulkCase {
+    fn runs(self) -> u32 {
+        match self.op {
+            BulkOp::Fill | BulkOp::Copy => self.repeat.max(1),
+            BulkOp::Init | BulkOp::Drop => 1,
+        }
+    }
+
+    /// The memory end when the plug-in is run on [`BULK_INPUT`] and [`BULK_PARAMS`].
+    fn end(self) -> u32 {
+        (self.pages + 2) << 16
+    }
+
+    /// Whether every range the instruction touches lies inside memory ending at `end` and inside
+    /// the data segment (empty once dropped). A range may end exactly at the end; an offset past
+    /// the end traps even for zero bytes.
+    fn in_bounds(self, end: u32) -> bool {
+        let fits = |off: u32, end: u32| u64::from(off) + u64::from(self.len) <= u64::from(end);
+        let dst = fits(self.dst.value(end, self.len), end);
+        let segment = self.src.value(SEGMENT_LEN, self.len);
+        match self.op {
+            BulkOp::Fill => dst,
+            BulkOp::Copy => dst && fits(self.src.value(end, self.len), end),
+            BulkOp::Init => dst && fits(segment, SEGMENT_LEN),
+            BulkOp::Drop => dst && fits(segment, 0),
+        }
+    }
+
+    /// A generous estimate of the fuel the instructions use: a unit per 64 bytes moved, and a few
+    /// per pass.
+    fn fuel(self) -> u64 {
+        u64::from(self.runs()) * (u64::from(self.len) / 64 + 16)
+    }
+
+    /// The plug-in module in WAT, with `manifest`.
+    fn wat(self, manifest: &str) -> String {
+        let (dst, len) = (self.dst.wat(MEMORY_END, self.len), self.len);
+        let segment = self.src.wat(&format!("(i32.const {SEGMENT_LEN})"), len);
+        let op = match self.op {
+            BulkOp::Fill => format!("(memory.fill {dst} (i32.const {}) (i32.const {len}))", self.value),
+            BulkOp::Copy => format!("(memory.copy {dst} {} (i32.const {len}))", self.src.wat(MEMORY_END, len)),
+            BulkOp::Init => format!("(memory.init $seg {dst} {segment} (i32.const {len})) (data.drop $seg)"),
+            BulkOp::Drop => format!("(data.drop $seg) (memory.init $seg {dst} {segment} (i32.const {len}))"),
+        };
+        let run = format!(
+            "(local $n i32) (local.set $n (i32.const {runs}))
+    (block $done (loop $again
+      (br_if $done (i32.eqz (local.get $n)))
+      (local.set $n (i32.sub (local.get $n) (i32.const 1)))
+      {op}
+      (br $again)))
+    (i64.or (i64.shl (i64.const {out_len}) (i64.const 32)) (i64.const {BULK_OUTPUT_AT}))",
+            runs = self.runs(),
+            out_len = BULK_OUTPUT.len(),
+        );
+        let bytes: String = (0..SEGMENT_LEN).map(|i| char::from(b'a' + (i % 26) as u8)).collect();
+        let extra = format!(r#"(data $seg "{}") (data (i32.const {BULK_OUTPUT_AT}) "{}")"#, bytes, tpl::string(BULK_OUTPUT));
+        tpl::module(manifest, &run, &extra, self.pages)
+    }
+}
+
+/// Lengths: zero, a byte, around the 64 bytes a unit of fuel pays for, the data segment's length,
+/// a page, a mebibyte, or anything up to four pages.
+fn arb_bulk_len() -> impl Strategy<Value = u32> {
+    prop_oneof![
+        3 => prop::sample::select(vec![0u32, 1, 63, 64, 65, SEGMENT_LEN - 1, SEGMENT_LEN, SEGMENT_LEN + 1, 0xffff, 0x1_0000, 0x1_0001, 1 << 20]),
+        1 => 0u32..0x4_0000,
+    ]
+}
+
+/// Offsets: near the start, ending at, before or past the end, at the end, or one past it.
+fn arb_bulk_offset() -> impl Strategy<Value = Offset> {
+    prop_oneof![
+        3 => prop::sample::select(vec![0i32, 1, 100, BULK_OUTPUT_AT as i32]).prop_map(Offset::start),
+        3 => (-2i32..=2).prop_map(|delta| Offset { base: Base::EndLessLen, delta }),
+        2 => (-1i32..=1).prop_map(|delta| Offset { base: Base::End, delta }),
+        1 => any::<i32>().prop_map(Offset::start),
+    ]
+}
+
+/// How many times `Fill` and `Copy` run.
+#[derive(Clone, Copy, Debug)]
+enum Repeat {
+    Times(u32),
+    /// As many passes as a slice of fuel pays for the bytes, plus this (at most 2,000 passes).
+    AroundSlice(i64),
+}
+
+/// Bulk memory cases in initial memories of 1, 2 or 17 pages.
+fn arb_bulk_case() -> impl Strategy<Value = BulkCase> {
+    (
+        prop::sample::select(BulkOp::ALL.to_vec()),
+        arb_bulk_offset(),
+        arb_bulk_offset(),
+        arb_bulk_len(),
+        any::<u8>(),
+        prop_oneof![8 => Just(Repeat::Times(1)), 2 => (2u32..=4).prop_map(Repeat::Times), 1 => (-1i64..=1).prop_map(Repeat::AroundSlice)],
+        prop::sample::select(vec![1u32, 2, 17]),
+    )
+        .prop_map(|(op, dst, src, len, value, repeat, pages)| {
+            let repeat = match repeat {
+                Repeat::Times(n) => n,
+                Repeat::AroundSlice(k) => {
+                    let slice = (FUEL_SLICE * 64 / u64::from(len.max(1))) as i64;
+                    (slice + k).clamp(1, 2_000) as u32
+                }
+            };
+            BulkCase { op, dst, src, len, value, repeat, pages }
+        })
+}
+
+/// The fuel a direct run gets: the default budget, or a budget of its own for each call with none
+/// added per input byte: a small fixed one, or [`BulkCase::fuel`] plus or minus a little.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Fuel {
+    Default,
+    Fixed(u64),
+    AroundCost(i64),
+}
+
+fn arb_fuel() -> impl Strategy<Value = Fuel> {
+    prop_oneof![
+        4 => Just(Fuel::Default),
+        1 => prop::sample::select(vec![1u64, 100, 1_000, 10_000]).prop_map(Fuel::Fixed),
+        2 => (-64i64..64).prop_map(Fuel::AroundCost),
+    ]
+}
+
+/// Runs `case` directly under `fuel`, without the engine.
+fn run_bulk(case: BulkCase, fuel: Fuel) -> Result<Vec<u8>, Error> {
+    let wasm = wat::parse_str(case.wat(&tpl::manifest("fuzz.bulk", "filter", "{}"))).unwrap();
+    let plugin = Plugin::load(&wasm, Limits::default()).unwrap();
+    let fuel_base = match fuel {
+        Fuel::Default => return plugin.run(BULK_INPUT, BULK_PARAMS),
+        Fuel::Fixed(f) => f,
+        Fuel::AroundCost(k) => case.fuel().saturating_add_signed(k).max(1),
+    };
+    plugin.run_limited(BULK_INPUT, BULK_PARAMS, &Limits { fuel_base, fuel_per_byte: 0, ..Limits::default() })
+}
+
+#[test]
+fn bulk_memory_cases_reach_their_instruction() {
+    for op in BulkOp::ALL {
+        let base = BulkCase { op, dst: Offset::start(0x1_0000), src: Offset::start(0), len: 1, value: 7, repeat: 1, pages: 2 };
+        let (inside, outside) = match op {
+            BulkOp::Fill | BulkOp::Copy => (base, BulkCase { dst: Offset { base: Base::End, delta: 0 }, ..base }),
+            BulkOp::Init => (base, BulkCase { src: Offset { base: Base::End, delta: 0 }, ..base }),
+            BulkOp::Drop => (BulkCase { len: 0, ..base }, base),
+        };
+        let src = inside.wat(&tpl::manifest("fuzz.bulk", "filter", "{}"));
+        assert!(src.contains(op.opcode()), "{op:?} emits no {}", op.opcode());
+        wat::parse_str(&src).unwrap();
+        assert!(inside.in_bounds(inside.end()) && !outside.in_bounds(outside.end()), "{op:?}");
+        assert!(run_bulk(inside, Fuel::Default).is_ok(), "{op:?} failed in bounds");
+        let r = run_bulk(outside, Fuel::Default);
+        assert!(matches!(r, Err(Error::Trap(_))), "{op:?} out of bounds gave {r:?}");
+    }
+}
+
 /// An output object: an input object's id (by index into the inputs) or a random one, and any of
 /// the object keys.
 fn arb_object() -> impl Strategy<Value = (Option<usize>, Value)> {
@@ -242,6 +511,33 @@ proptest! {
         renders(&s, &out)?;
     }
 
+    #[test]
+    fn bulk_memory_plugins_never_crash(case in arb_bulk_case(), fuel in arb_fuel()) {
+        let r = catch_quiet(|| run_bulk(case, fuel)).map_err(|msg| TestCaseError::fail(format!("panicked on {case:?}: {msg}")))?;
+        let in_bounds = case.in_bounds(case.end());
+        let ample = fuel == Fuel::Default && case.fuel() <= FUEL_SLICE / 4;
+        match &r {
+            Ok(_) => prop_assert!(in_bounds, "{:?} ran out of bounds without a trap", case),
+            Err(Error::Trap(e)) => prop_assert!(!in_bounds && !e.contains("panicked"), "{:?} trapped: {}", case, e),
+            Err(Error::Limit(e)) => prop_assert!(fuel != Fuel::Default || (in_bounds && !ample), "{:?} hit a limit: {}", case, e),
+            Err(e) => return Err(TestCaseError::fail(format!("{case:?} failed: {e}"))),
+        }
+        if ample {
+            prop_assert!(r.is_ok() == in_bounds, "{:?} gave {:?}", case, r.err());
+        }
+
+        let mut s = rich_session();
+        s.execute("select.all", &json!({})).unwrap();
+        install(&mut s, &wat::parse_str(case.wat(&tpl::manifest("fuzz.bulk", "filter", "{}"))).unwrap()).unwrap();
+        let before = s.doc().unwrap().doc.clone();
+        match catch_quiet(|| s.execute("plugin.run", &json!({"id": "fuzz.bulk"})).map(|_| ())) {
+            Err(msg) => return Err(TestCaseError::fail(format!("panicked on {case:?}: {msg}"))),
+            Ok(Err(_)) => prop_assert!(s.doc().unwrap().doc == before, "a failed run changed the document: {:?}", case),
+            Ok(Ok(())) => {}
+        }
+        renders(&s, &format!("{case:?}"))?;
+    }
+
     #[test]
     fn mutated_and_garbage_modules_never_crash(
         flips in prop::collection::vec((any::<prop::sample::Index>(), any::<u8>()), 0..8),
diff --git a/crates/engine/tests/plugin_safe_mode.rs b/crates/engine/tests/plugin_safe_mode.rs
new file mode 100644
index 000000000..6923df616
--- /dev/null
+++ b/crates/engine/tests/plugin_safe_mode.rs
@@ -0,0 +1,413 @@
+//! Safe Mode and disabled plug-ins through the engine: `plugin.safeMode`, `plugin.setEnabled`, the
+//! plug-in folder skipping disabled plug-ins at the next launch, and the `plugin.*` commands in Safe
+//! Mode.
+//!
+//! A test binary of its own: Safe Mode and installed plug-ins are process-wide, so these tests run
+//! one at a time and no other test sees them.
+// Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::PathBuf;
+use std::sync::Mutex;
+
+use serde_json::{Value, json};
+use vectorcraft_engine::Session;
+use vectorcraft_plugins::safe_mode;
+use vectorcraft_plugins::wat as tpl;
+
+static LOCK: Mutex<()> = Mutex::new(());
+
+/// Safe Mode off, nothing disabled or installed.
+fn reset() {
+    safe_mode::set_active(None);
+    safe_mode::set_disabled(vec![]);
+    for p in vectorcraft_plugins::registry::list() {
+        vectorcraft_plugins::registry::remove(p.id());
+    }
+}
+
+/// Holds the lock for one test and resets the process-wide state when the test starts and when it
+/// ends, so a test that fails leaves the next one as it would find a new process.
+struct Fresh {
+    _guard: std::sync::MutexGuard<'static, ()>,
+}
+
+fn fresh() -> Fresh {
+    let guard = LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    reset();
+    Fresh { _guard: guard }
+}
+
+impl Drop for Fresh {
+    fn drop(&mut self) {
+        reset();
+    }
+}
+
+fn filter(id: &str) -> Vec<u8> {
+    wat::parse_str(tpl::returning(&tpl::manifest(id, "filter", "{}"), r#"{"objects":[]}"#)).unwrap()
+}
+
+fn tmp_dir(tag: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("vc-plugin-safe-mode-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn installed(id: &str) -> bool {
+    vectorcraft_plugins::registry::get(id).is_some()
+}
+
+/// A new launch: nothing installed, the plug-in folder `dir` attached.
+fn launch(dir: &std::path::Path) -> Session {
+    for p in vectorcraft_plugins::registry::list() {
+        vectorcraft_plugins::registry::remove(p.id());
+    }
+    let mut s = Session::new();
+    s.attach_plugin_store(dir.to_path_buf());
+    s
+}
+
+#[test]
+fn a_disabled_plug_in_stays_installed_and_loads_again_once_enabled_at_the_next_launch() {
+    let _f = fresh();
+    let dir = tmp_dir("enable");
+    let mut s = launch(&dir);
+    for id in ["test.sm.x", "test.sm.y"] {
+        s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter(id))})).unwrap();
+    }
+    let r = s.execute("plugin.setEnabled", &json!({"id": "test.sm.x", "enabled": false})).unwrap();
+    assert_eq!(r["changed"], true);
+    assert_eq!(r["disabled"][0]["id"], "test.sm.x");
+    assert!(installed("test.sm.x"), "disabling waits for the next launch");
+    let again = s.execute("plugin.setEnabled", &json!({"id": "test.sm.x", "enabled": false})).unwrap();
+    assert_eq!(again["changed"], false, "already disabled: nothing changes");
+
+    let mut s = launch(&dir);
+    assert!(!installed("test.sm.x") && installed("test.sm.y"), "only the disabled one is skipped");
+    assert!(dir.read_dir().unwrap().flatten().filter(|e| e.path().extension().is_some_and(|x| x == "wasm")).count() == 2, "nothing uninstalled");
+    let list = s.execute("plugin.list", &json!({})).unwrap();
+    assert_eq!((list["safeMode"].clone(), list["disabled"][0]["id"].clone()), (json!(false), json!("test.sm.x")));
+    let state = s.execute("plugin.safeMode", &json!({})).unwrap();
+    assert_eq!(state, json!({"active": false, "source": null, "pendingItem": null, "disabled": state["disabled"].clone()}));
+    assert_eq!(state["disabled"].as_array().map(Vec::len), Some(1));
+
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.x", "enabled": true})).unwrap();
+    assert!(!installed("test.sm.x"), "enabling waits for the next launch");
+    launch(&dir);
+    assert!(installed("test.sm.x") && installed("test.sm.y"));
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Two windows share a plug-in folder: a plug-in the other one disabled after this one started stays
+/// disabled when this one saves its own changes.
+#[test]
+fn saving_the_disabled_list_keeps_what_another_window_saved_meanwhile() {
+    let _f = fresh();
+    let dir = tmp_dir("two-windows");
+    let mut s = launch(&dir);
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.a", "enabled": false})).unwrap();
+    // The other window disabled b and saved its list.
+    let other = |ids: &[&str]| {
+        let items: Vec<Value> = ids.iter().map(|id| json!({"id": id})).collect();
+        let file = json!({"format": "vectorcraft-disabled-plugins", "version": 1, "items": items});
+        std::fs::write(dir.join(vectorcraft_engine::store::DISABLED_FILE), serde_json::to_vec(&file).unwrap()).unwrap();
+    };
+    other(&["test.sm.a", "test.sm.b"]);
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.c", "enabled": false})).unwrap();
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.a", "enabled": true})).unwrap();
+    let saved = |s: &mut Session| -> Vec<String> {
+        let state = s.execute("plugin.safeMode", &json!({})).unwrap();
+        state["disabled"].as_array().unwrap().iter().map(|i| i["id"].as_str().unwrap().to_string()).collect()
+    };
+    assert_eq!(saved(&mut s), ["test.sm.b", "test.sm.c"], "b is kept, c added, and a turned on again");
+    // The other window turns b back on; this window's next change keeps that too.
+    other(&["test.sm.c"]);
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.d", "enabled": false})).unwrap();
+    assert_eq!(saved(&mut s), ["test.sm.c", "test.sm.d"]);
+    let mut next = launch(&dir);
+    assert_eq!(saved(&mut next), ["test.sm.c", "test.sm.d"], "the file holds the merged list");
+    // While the lock file can't be locked (here a folder stands in its place), nothing is written;
+    // the next change that is written carries this one too.
+    let lock = dir.join(vectorcraft_engine::store::DISABLED_LOCK);
+    std::fs::remove_file(&lock).unwrap();
+    std::fs::create_dir_all(&lock).unwrap();
+    let in_file = || -> Vec<String> {
+        let bytes = std::fs::read(dir.join(vectorcraft_engine::store::DISABLED_FILE)).unwrap();
+        safe_mode::parse_disabled_file(&bytes).into_iter().filter_map(|i| i.id).collect()
+    };
+    next.execute("plugin.setEnabled", &json!({"id": "test.sm.e", "enabled": false})).unwrap();
+    assert_eq!(in_file(), ["test.sm.c", "test.sm.d"]);
+    std::fs::remove_dir(&lock).unwrap();
+    next.execute("plugin.setEnabled", &json!({"id": "test.sm.f", "enabled": false})).unwrap();
+    assert_eq!(in_file(), ["test.sm.c", "test.sm.d", "test.sm.e", "test.sm.f"]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_full_list_of_long_disabled_items_is_read_back_at_the_next_launch() {
+    let _f = fresh();
+    let dir = tmp_dir("full-list");
+    let field = |i: usize, tag: &str| format!("{tag}{i:04}{}", "\u{1}".repeat(1024));
+    let items: Vec<safe_mode::Item> = (0..safe_mode::MAX_DISABLED)
+        .map(|i| safe_mode::Item { id: Some(field(i, "i")), file: Some(field(i, "f")), name: Some(field(i, "n")) })
+        .collect();
+    safe_mode::set_disabled(items);
+    let saved = safe_mode::disabled();
+    std::fs::write(dir.join(vectorcraft_engine::store::DISABLED_FILE), safe_mode::disabled_file()).unwrap();
+    safe_mode::set_disabled(vec![]);
+    launch(&dir);
+    assert_eq!(safe_mode::disabled(), saved, "every disabled item stays disabled");
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_folder_plug_in_disabled_by_id_is_saved_with_its_file() {
+    let _f = fresh();
+    let dir = tmp_dir("by-id");
+    let extra = tmp_dir("by-id-extra");
+    let f = extra.join("f.wasm");
+    std::fs::write(&f, filter("test.sm.f")).unwrap();
+    let mut s = launch(&dir);
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.f", "enabled": false})).unwrap();
+    let mut s = launch(&dir);
+    let r = s.execute("plugin.reload", &json!({"path": extra.to_string_lossy()})).unwrap();
+    assert_eq!(r["failed"][0]["error"], vectorcraft_plugins::registry::DISABLED);
+    safe_mode::set_disabled(vec![]);
+    launch(&dir);
+    assert_eq!(safe_mode::disabled()[0].file.as_deref(), Some(f.display().to_string().as_str()), "the next launch skips the file before it loads");
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+    let _ = std::fs::remove_dir_all(&extra);
+}
+
+#[test]
+fn installing_a_disabled_plug_in_again_turns_it_on() {
+    let _f = fresh();
+    let dir = tmp_dir("reinstall");
+    let mut s = launch(&dir);
+    s.execute("plugin.setEnabled", &json!({"id": "test.sm.r", "enabled": false})).unwrap();
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter("test.sm.r"))})).unwrap();
+    assert!(safe_mode::disabled().is_empty());
+    launch(&dir);
+    assert!(installed("test.sm.r"));
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A launch where the stored plug-in `id` stopped while loading: it is installed, then disabled by
+/// its stored file alone (as Disable and Continue saves it), and the next launch skips it.
+fn stored_plug_in_disabled_by_file(dir: &std::path::Path, id: &str) -> Session {
+    let mut s = launch(dir);
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter(id))})).unwrap();
+    let stored = dir.read_dir().unwrap().flatten().map(|e| e.path()).find(|p| p.extension().is_some_and(|x| x == "wasm")).unwrap();
+    s.execute("plugin.setEnabled", &json!({"file": stored.display().to_string(), "enabled": false})).unwrap();
+    let s = launch(dir);
+    assert!(!installed(id), "the next launch skips the file");
+    assert_eq!(safe_mode::disabled()[0].id, None);
+    s
+}
+
+fn nothing_disabled(s: &mut Session, dir: &std::path::Path) {
+    assert_eq!(s.execute("plugin.safeMode", &json!({})).unwrap()["disabled"], json!([]));
+    let saved = std::fs::read(dir.join(vectorcraft_engine::store::DISABLED_FILE)).unwrap();
+    assert!(safe_mode::parse_disabled_file(&saved).is_empty(), "nothing disabled is saved");
+}
+
+#[test]
+fn installing_a_stored_plug_in_disabled_by_its_file_turns_it_on() {
+    let _f = fresh();
+    let dir = tmp_dir("reinstall-file");
+    let mut s = stored_plug_in_disabled_by_file(&dir, "test.sm.p");
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter("test.sm.p"))})).unwrap();
+    nothing_disabled(&mut s, &dir);
+    launch(&dir);
+    assert!(installed("test.sm.p"));
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_stored_plug_in_disabled_by_its_file_stays_disabled_when_its_update_cannot_be_saved() {
+    let _f = fresh();
+    let dir = tmp_dir("reinstall-unsaved");
+    let mut s = stored_plug_in_disabled_by_file(&dir, "test.sm.u");
+    let stored = PathBuf::from(safe_mode::disabled()[0].file.clone().unwrap());
+    std::fs::remove_file(&stored).unwrap();
+    std::fs::create_dir_all(stored.join("block")).unwrap();
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter("test.sm.u"))})).unwrap();
+    assert_eq!(safe_mode::disabled().len(), 1, "the file the update could not replace stays disabled");
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn enabling_a_stored_plug_in_disabled_by_its_file_by_its_id_turns_it_on() {
+    let _f = fresh();
+    let dir = tmp_dir("enable-file");
+    let mut s = stored_plug_in_disabled_by_file(&dir, "test.sm.q");
+    let r = s.execute("plugin.setEnabled", &json!({"id": "test.sm.q", "enabled": true})).unwrap();
+    assert_eq!(r["changed"], true);
+    nothing_disabled(&mut s, &dir);
+    launch(&dir);
+    assert!(installed("test.sm.q"));
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn set_enabled_rejects_bad_parameters() {
+    let _f = fresh();
+    safe_mode::set_disabled(vec![]);
+    let mut s = Session::new();
+    let err = |s: &mut Session, p: Value| s.execute("plugin.setEnabled", &p).unwrap_err().to_string();
+    assert!(err(&mut s, json!({"id": "a"})).contains("`enabled` must be true or false"));
+    assert!(err(&mut s, json!({"id": "a", "enabled": "yes"})).contains("`enabled` must be true or false"));
+    assert!(err(&mut s, json!({"id": 3, "enabled": false})).contains("`id` must be a string"));
+    assert!(err(&mut s, json!({"enabled": false})).contains("give `id` or `file`"));
+    assert!(err(&mut s, json!({"id": "  ", "enabled": false})).contains("give `id` or `file`"));
+    assert!(err(&mut s, json!({"id": "a", "enabled": true})).contains("isn't disabled"));
+    assert!(safe_mode::disabled().is_empty(), "nothing changed");
+    let r = s.execute("plugin.setEnabled", &json!({"file": "/p/a.wasm", "enabled": false})).unwrap();
+    assert_eq!(
+        (r["changed"].clone(), r["disabled"][0]["file"].clone(), r["disabled"][0]["label"].clone()),
+        (json!(true), json!("/p/a.wasm"), json!("a.wasm"))
+    );
+    assert_eq!(r["saved"], false, "a session without a plug-in folder can't keep the change for the next launch");
+    safe_mode::set_disabled(vec![]);
+}
+
+/// A disabled list too large to read, or one of a later version, stays as it is: the changes wait
+/// for a save that can merge them. A file that isn't JSON holds nothing to keep and is replaced.
+#[test]
+fn a_disabled_list_this_version_cannot_read_is_kept() {
+    let _f = fresh();
+    let dir = tmp_dir("kept");
+    let file = dir.join(vectorcraft_engine::store::DISABLED_FILE);
+    let mut s = launch(&dir);
+    let later = serde_json::to_vec(&json!({"format": "vectorcraft-disabled-plugins", "version": 2, "items": [{"id": "test.sm.k"}]})).unwrap();
+    let large = vec![b' '; safe_mode::MAX_DISABLED_FILE_BYTES as usize + 1];
+    for (kept, id) in [(later, "test.sm.a"), (large, "test.sm.b")] {
+        std::fs::write(&file, &kept).unwrap();
+        let r = s.execute("plugin.setEnabled", &json!({"id": id, "enabled": false})).unwrap();
+        assert_eq!((r["changed"].clone(), r["saved"].clone()), (json!(true), json!(false)), "{id}");
+        assert!(std::fs::read(&file).unwrap() == kept, "{id}: the file is kept");
+    }
+    std::fs::write(&file, b"{\"format\": \"vectorcraft-disab").unwrap();
+    let r = s.execute("plugin.setEnabled", &json!({"id": "test.sm.c", "enabled": false})).unwrap();
+    assert_eq!(r["saved"], true);
+    let ids: Vec<String> = safe_mode::parse_disabled_file(&std::fs::read(&file).unwrap()).into_iter().filter_map(|i| i.id).collect();
+    assert_eq!(ids, ["test.sm.a", "test.sm.b", "test.sm.c"], "the waiting changes are saved too");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Another window filled the list after this one read it: a plug-in turned off here has no room in
+/// the file, and `saved` says so.
+#[test]
+fn a_disable_that_finds_the_saved_list_full_is_not_saved() {
+    let _f = fresh();
+    let dir = tmp_dir("full-merge");
+    let mut s = launch(&dir);
+    let items: Vec<Value> = (0..safe_mode::MAX_DISABLED).map(|i| json!({"id": format!("test.sm.full{i}")})).collect();
+    let file = json!({"format": "vectorcraft-disabled-plugins", "version": 1, "items": items});
+    std::fs::write(dir.join(vectorcraft_engine::store::DISABLED_FILE), serde_json::to_vec(&file).unwrap()).unwrap();
+    let r = s.execute("plugin.setEnabled", &json!({"id": "test.sm.late", "enabled": false})).unwrap();
+    assert_eq!((r["changed"].clone(), r["saved"].clone()), (json!(true), json!(false)));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn in_safe_mode_the_plug_in_folder_and_commands_load_and_run_nothing() {
+    let _f = fresh();
+    let dir = tmp_dir("safe");
+    let mut s = launch(&dir);
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter("test.sm.s"))})).unwrap();
+    let extra = tmp_dir("safe-extra");
+    std::fs::write(extra.join("e.wasm"), filter("test.sm.e")).unwrap();
+
+    vectorcraft_engine::cmd::plugin::start_in_safe_mode();
+    let mut s = launch(&dir);
+    assert!(!installed("test.sm.s"), "stored plug-ins don't load");
+    let safe = "Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally";
+    let install = s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter("test.sm.t"))}));
+    assert!(install.unwrap_err().to_string().contains(safe));
+    let reload = s.execute("plugin.reload", &json!({"path": extra.to_string_lossy()}));
+    assert!(reload.unwrap_err().to_string().contains(safe));
+    assert!(!installed("test.sm.e") && !installed("test.sm.t"));
+    let state = s.execute("plugin.safeMode", &json!({})).unwrap();
+    assert_eq!((state["active"].clone(), state["source"].clone()), (json!(true), json!("flag")));
+    assert_eq!(s.execute("plugin.list", &json!({})).unwrap()["safeMode"], true);
+
+    // Leaving the choice after a launch that stopped with Start Normally loads them.
+    safe_mode::set_active(None);
+    vectorcraft_engine::cmd::plugin::load_prefs_folder(&mut s);
+    assert!(installed("test.sm.s"));
+    let _ = std::fs::remove_dir_all(&dir);
+    let _ = std::fs::remove_dir_all(&extra);
+}
+
+#[test]
+fn a_live_effect_skipped_in_safe_mode_stays_on_its_object_and_says_so() {
+    let _f = fresh();
+    let mut s = Session::new();
+    let fx = wat::parse_str(tpl::returning(&tpl::manifest("test.sm.fx", "effect", "{}"), r#"{"objects":[]}"#)).unwrap();
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&fx)})).unwrap();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 50})).unwrap();
+    s.execute("effect.apply", &json!({"effect": "plugin.test.sm.fx"})).unwrap();
+    let effect = |s: &mut Session| s.execute("effect.list", &json!({})).unwrap()["applied"][0]["effects"][0].clone();
+    assert_eq!((effect(&mut s)["id"].clone(), effect(&mut s).get("skipped").cloned()), (json!("plugin.test.sm.fx"), None));
+
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+    let skipped = effect(&mut s);
+    assert_eq!((skipped["id"].clone(), skipped["skipped"].clone()), (json!("plugin.test.sm.fx"), json!(true)), "the object keeps it");
+
+    safe_mode::set_active(None);
+    assert_eq!(effect(&mut s).get("skipped"), None);
+}
+
+/// In Safe Mode, Expand Appearance refuses an object whose plug-in effect it would drop, its own or
+/// in a symbol's art it places, and changes nothing.
+#[test]
+fn expand_appearance_keeps_a_plug_in_effect_safe_mode_skips() {
+    let _f = fresh();
+    let mut s = Session::new();
+    let fx = wat::parse_str(tpl::returning(&tpl::manifest("test.sm.xp", "effect", "{}"), r#"{"objects":[]}"#)).unwrap();
+    s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&fx)})).unwrap();
+    s.execute("file.new", &json!({"width": 200, "height": 200})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 50, "height": 50})).unwrap();
+    s.execute("effect.apply", &json!({"effect": "plugin.test.sm.xp"})).unwrap();
+    let doc = |s: &mut Session| s.execute("document.inspect", &json!({})).unwrap();
+    let refused = |s: &mut Session| {
+        let before = doc(s);
+        let err = s.execute("effect.expandAppearance", &json!({})).unwrap_err().to_string();
+        assert!(err.contains("a plug-in effect in the selection can't be expanded in Safe Mode"), "{err}");
+        assert_eq!(doc(s), before, "nothing changes");
+    };
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+    refused(&mut s);
+    // An instance, with an effect of its own, of a symbol whose art holds the plug-in effect.
+    safe_mode::set_active(None);
+    s.execute("symbol.new", &json!({"name": "fx"})).unwrap();
+    s.execute("effect.apply", &json!({"effect": "distort.puckerBloat"})).unwrap();
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+    refused(&mut s);
+    safe_mode::set_active(None);
+    s.execute("effect.expandAppearance", &json!({})).unwrap();
+    // A plain instance of that symbol doesn't expand: selected with an object that does, they expand.
+    let plain = s.execute("symbol.place", &json!({"name": "fx", "x": 150, "y": 150})).unwrap()["id"].clone();
+    let other = s.execute("shape.rectangle", &json!({"x": 10, "y": 120, "width": 30, "height": 30})).unwrap()["id"].clone();
+    s.execute("effect.apply", &json!({"effect": "distort.puckerBloat"})).unwrap();
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+    s.execute("effect.expandAppearance", &json!({"ids": [plain, other]})).unwrap();
+    safe_mode::set_active(None);
+    // A plug-in effect on a hidden fill: Expand Appearance drops that fill, so it expands.
+    s.execute("shape.rectangle", &json!({"x": 100, "y": 10, "width": 50, "height": 50})).unwrap();
+    s.execute("effect.apply", &json!({"effect": "plugin.test.sm.xp", "item": 0})).unwrap();
+    s.execute("appearance.setItem", &json!({"index": 0, "visible": false})).unwrap();
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+    s.execute("effect.expandAppearance", &json!({})).unwrap();
+}
diff --git a/crates/eps/src/ai_editing/tests.rs b/crates/eps/src/ai_editing/tests.rs
index f25944060..780e7ddd0 100644
--- a/crates/eps/src/ai_editing/tests.rs
+++ b/crates/eps/src/ai_editing/tests.rs
@@ -833,6 +833,40 @@ fn nested_symbol_instances_stop_at_the_symbol_art_limit() {
     assert_eq!(layers.matches("\r\nf\r\n").count(), 3198, "the squares of the leaves written");
 }
 
+/// On a canvas of the usual size, nested symbols whose instances multiply, written as their art in
+/// art cut to a clipping object, stop at [`vectorcraft_doc::MAX_SYMBOL_NODES`] objects of symbol art
+/// in all, with a warning.
+#[test]
+fn clipped_nested_symbol_instances_stop_at_the_symbol_art_limit() {
+    let mut doc = Document::new(200.0, 100.0);
+    let layer = doc.layers[0].id;
+    // Empty paths: counted, but written as nothing, so the test stays small; and one filled square.
+    let empty = Arc::new(Node::path(doc.alloc_id(), PathData::new(vec![]), Appearance::default()));
+    let mut members = vec![empty; 4999];
+    let square_art = shapes::rectangle(Rect::new(0.0, 0.0, 1.0, 1.0));
+    members.push(Arc::new(Node::path(doc.alloc_id(), square_art, Appearance::basic(solid(Color::gray(0.5)), Paint::None, 0.0))));
+    let leaves = Node::group(doc.alloc_id(), members);
+    doc.symbols.push(Symbol { dynamic: false, name: "Leaf".into(), art: Arc::new(leaves) });
+    let leaf = Arc::new(Node::new(doc.alloc_id(), NodeKind::SymbolInstance { symbol: "Leaf".into(), xf: Affine::IDENTITY }));
+    let trees = Node::group(doc.alloc_id(), vec![leaf; 5000]);
+    doc.symbols.push(Symbol { dynamic: false, name: "Tree".into(), art: Arc::new(trees) });
+    let tree = Node::new(doc.alloc_id(), NodeKind::SymbolInstance { symbol: "Tree".into(), xf: Affine::IDENTITY });
+    // A group as the clipping object cuts the art instead of clipping it with a path, so the
+    // instances in it are written as their art. Its square is unpainted, so the only filled squares
+    // are the leaves'.
+    let outline = Node::path(doc.alloc_id(), shapes::rectangle(Rect::new(0.0, 0.0, 50.0, 50.0)), Appearance::default());
+    let clip = group(&mut doc, vec![outline], false);
+    let clipped = group(&mut doc, vec![clip, tree], true);
+    doc.insert(Some(layer), usize::MAX, clipped).unwrap();
+    let out = export_ai_editing(&doc, &opts()).unwrap();
+    assert!(out.warnings.iter().any(|w| w == writer::SYMBOL_LIMIT), "{:?}", out.warnings);
+    assert!(out.warnings.iter().any(|w| w == writer::SYMBOL_ART), "{:?}", out.warnings);
+    // 5,001 objects for the tree and each leaf: 3,198 leaves fit in 16,000,000.
+    let text = String::from_utf8(out.program).unwrap();
+    let layers = text.split_once("%%EndSetup").unwrap().1;
+    assert_eq!(layers.matches("\r\nf\r\n").count(), 3198, "the squares of the leaves written");
+}
+
 #[test]
 fn a_stained_symbol_instance_is_written_in_its_stained_colors() {
     let mut doc = Document::new(200.0, 100.0);
@@ -2013,6 +2047,37 @@ fn gradients_and_patterns_are_read_back() {
     same_lines(&gradient_looks(&read_back(&doc)), &gradient_looks(&doc));
 }
 
+/// A new document's gradient swatches read back with the paint they were written with, not linked
+/// to a swatch, and art filled with one of them reads back linked to it.
+#[test]
+fn gradient_swatches_read_back_unlinked() {
+    let mut doc = Document::new(200.0, 100.0);
+    let Some(Paint::Gradient(sunset)) = doc.swatch("Sunset").map(|s| s.paint.clone()) else { panic!("no Sunset swatch") };
+    let layer = doc.layers[0].id;
+    let linked = gradient_paint(sunset.gradient.clone(), None, Some("Sunset"));
+    let rect = painted(&mut doc, shapes::rectangle(Rect::new(10.0, 10.0, 90.0, 50.0)), vec![AppearanceItem::Fill(FillLayer::new(linked))]);
+    doc.insert(Some(layer), usize::MAX, rect).unwrap();
+    let back = read_back(&doc);
+    let gradients = |d: &Document| -> Vec<String> {
+        d.swatches_iter()
+            .filter_map(|s| match &s.paint {
+                Paint::Gradient(g) => {
+                    Some(format!("{} {:?} stops={} geom={:?} swatch={:?}", s.name, g.gradient.kind, g.gradient.stops.len(), g.geom, g.swatch))
+                }
+                _ => None,
+            })
+            .collect()
+    };
+    let want = gradients(&doc);
+    assert_eq!(want.len(), 4, "{want:?}");
+    assert_eq!(gradients(&back), want);
+    let link = back.layers[0].children().and_then(|c| c.first()).map(|n| match n.appearance.items.first().map(AppearanceItem::paint) {
+        Some(Paint::Gradient(g)) => g.swatch.clone(),
+        other => panic!("{other:?}"),
+    });
+    assert_eq!(link, Some(Some("Sunset".to_string())));
+}
+
 #[test]
 fn gradients_and_patterns_write_the_same_bytes_again() {
     let doc = gradients_and_patterns();
@@ -3328,7 +3393,7 @@ fn type_lines(doc: &Document) -> Vec<String> {
         for r in &t.runs {
             let s = &r.style;
             out.push(format!(
-                "  run {:?} {} {} {} {:?} {} {} {} {} fill {} stroke {} {} caps={} small={:?} tcy={}",
+                "  run {:?} {} {} {} {:?} {} {} {} {} fill {} stroke {} {} caps={} small={:?} tcy={} roman={}",
                 r.text,
                 s.font_family,
                 s.font_style,
@@ -3344,6 +3409,7 @@ fn type_lines(doc: &Document) -> Vec<String> {
                 s.all_caps,
                 s.small_caps.map(r3),
                 s.tate_chu_yoko,
+                s.standard_vertical_roman,
             ));
         }
     }
@@ -3491,6 +3557,62 @@ fn type_is_written_again_as_the_same_bytes() {
     assert_eq!(String::from_utf8_lossy(&again.program), String::from_utf8_lossy(&first.program));
 }
 
+/// Standard Vertical Roman Alignment comes back on or off, in vertical type and in horizontal
+/// type, and Tate-chu-yoko stays as it was: each run's key 35 is 1 (Standard) when it's on, 2
+/// (rotated) when it's off and 3 for Tate-chu-yoko, and the document's defaults and the normal
+/// character style carry 1. Each object lays out as it did. A Tate-chu-yoko run with the
+/// setting on comes back without it, and that is reported.
+#[test]
+fn standard_vertical_roman_alignment_comes_back() {
+    use vectorcraft_doc::{CharStyle, TextObject, TextRun};
+    let plain = style(14.0, Color::BLACK);
+    let roman = CharStyle { standard_vertical_roman: true, ..plain.clone() };
+    let tcy = CharStyle { tate_chu_yoko: true, ..plain.clone() };
+    let mut doc = Document::new(200.0, 200.0);
+    let layer = doc.layers[0].id;
+    let mut down = TextObject::point(vectorcraft_geom::Point::new(150.0, 20.0), "", plain.clone());
+    down.runs = vec![TextRun::new("Up AB ", roman.clone()), TextRun::new("turned CD ", plain.clone()), TextRun::new("12", tcy.clone())];
+    down.vertical = true;
+    let mut across = TextObject::point(vectorcraft_geom::Point::new(20.0, 40.0), "", plain.clone());
+    across.runs = vec![TextRun::new("Marked ", roman.clone()), TextRun::new("plain", plain.clone())];
+    for t in [down, across] {
+        let n = text_node(&mut doc, t);
+        doc.insert(Some(layer), usize::MAX, n).unwrap();
+    }
+    let out = export_ai_editing(&doc, &opts()).unwrap();
+    assert!(out.warnings.is_empty(), "{:?}", out.warnings);
+    let back = read_back(&doc);
+    same_lines(&type_lines(&back), &type_lines(&doc));
+    let texts = |d: &Document| -> Vec<TextObject> {
+        d.layers[0].children().unwrap().iter().filter_map(|n| if let NodeKind::Text(t) = &n.kind { Some((**t).clone()) } else { None }).collect()
+    };
+    let flags = |t: &TextObject| t.runs.iter().map(|r| (r.style.standard_vertical_roman, r.style.tate_chu_yoko)).collect::<Vec<_>>();
+    let (written, read) = (texts(&doc), texts(&back));
+    assert_eq!(read.iter().map(flags).collect::<Vec<_>>(), [vec![(true, false), (false, false), (false, true)], vec![(true, false), (false, false)]]);
+    let origins = |t: &TextObject| {
+        vectorcraft_text::layout(vectorcraft_text::FontDb::global(), t).glyphs.iter().map(|g| (r3(g.origin.x), r3(g.origin.y))).collect::<Vec<_>>()
+    };
+    for (w, r) in written.iter().zip(&read) {
+        assert_eq!(origins(r), origins(w), "vertical={}", w.vertical);
+    }
+    let decoded = text_document(&program(&doc));
+    // Two runs on, two off and one Tate-chu-yoko; the defaults and the normal style add a 1 each.
+    for (key, count) in [("/35 1 ", 4), ("/35 2 ", 2), ("/35 3 ", 1)] {
+        assert_eq!(decoded.matches(key).count(), count, "{key}: {decoded}");
+    }
+    let normal = decoded.find("[Normal Character Style]").unwrap();
+    let sheet = &decoded[normal..decoded.find("[Normal Paragraph Style]").unwrap()];
+    assert!(sheet.contains("/35 1 "), "{sheet}");
+    // Key 35 holds one value: Tate-chu-yoko wins, and the setting it leaves out is reported.
+    let mut both = doc.clone();
+    let id = both.layers[0].children().unwrap()[0].id;
+    if let Some(NodeKind::Text(t)) = both.node_mut(id).map(|n| &mut n.kind) {
+        t.runs[2].style.standard_vertical_roman = true;
+    }
+    assert_eq!(export_ai_editing(&both, &opts()).unwrap().warnings, [writer::TYPE_ATTRIBUTES]);
+    assert_eq!(flags(&texts(&read_back(&both))[0])[2], (false, true));
+}
+
 /// The text document of program `text` (LF line ends), decoded, with its UTF-16 strings' zero
 /// bytes left out.
 fn text_document(text: &str) -> String {
diff --git a/crates/eps/src/ai_editing/writer/texts.rs b/crates/eps/src/ai_editing/writer/texts.rs
index e8ccda106..f494e859a 100644
--- a/crates/eps/src/ai_editing/writer/texts.rs
+++ b/crates/eps/src/ai_editing/writer/texts.rs
@@ -29,7 +29,7 @@ use vectorcraft_geom::{Affine, PathData, Point};
 use crate::ps;
 
 /// What the text document holds of type, and what it leaves out.
-pub(in crate::ai_editing) const TYPE_ATTRIBUTES: &str = "attributes of type other than its font, size, leading, tracking, baseline shift, horizontal and vertical scale, solid fill, solid stroke and stroke weight, capitals, small capitals at the document's size, Tate-chu-yoko, paragraph alignment, indents, space before and after, hyphenation on or off and right-to-left direction (for example underline, kerning, OpenType features, swatch links of its colors, character and paragraph styles, tabs, lists, optical margin alignment, area type's inset spacing, vertical alignment and flow, a minimum first baseline with the Ascent first baseline, and type on a path's effect, alignment and spacing and an end bracket at the very end of an open path) are left out of the editing data for other apps";
+pub(in crate::ai_editing) const TYPE_ATTRIBUTES: &str = "attributes of type other than its font, size, leading, tracking, baseline shift, horizontal and vertical scale, solid fill, solid stroke and stroke weight, capitals, small capitals at the document's size, Tate-chu-yoko, Standard Vertical Roman Alignment, paragraph alignment, indents, space before and after, hyphenation on or off and right-to-left direction (for example underline, kerning, OpenType features, swatch links of its colors, character and paragraph styles, tabs, lists, optical margin alignment, area type's inset spacing, vertical alignment and flow, a minimum first baseline with the Ascent first baseline, and type on a path's effect, alignment and spacing and an end bracket at the very end of an open path) are left out of the editing data for other apps";
 
 /// The version of the text document's form (`/98 << /0 n >>`), as the newest files users sent have it.
 const STREAM_VERSION: u32 = 14;
@@ -350,6 +350,8 @@ pub(in crate::ai_editing) fn loses(t: &TextObject) -> bool {
             all_caps: s.all_caps,
             small_caps: s.small_caps.filter(|v| *v == default_small_caps),
             tate_chu_yoko: s.tate_chu_yoko,
+            // Key 35 holds one of the two: a Tate-chu-yoko run is read back without the other.
+            standard_vertical_roman: s.standard_vertical_roman && !s.tate_chu_yoko,
             ..CharStyle::default()
         }
     };
@@ -403,6 +405,18 @@ pub(in crate::ai_editing) fn loses(t: &TextObject) -> bool {
             && (t.path_effect != PathEffect::default() || t.path_align != PathAlign::default() || t.path_spacing != 0.0 || end_read_as_none(t)))
 }
 
+/// Key 35 of a run in style `st`, as the reader's `Texts::style` reads it: 3 for Tate-chu-yoko, 1
+/// (Standard) for Standard Vertical Roman Alignment, else 2 (rotated).
+fn baseline_direction(st: &CharStyle) -> i64 {
+    if st.tate_chu_yoko {
+        3
+    } else if st.standard_vertical_roman {
+        1
+    } else {
+        2
+    }
+}
+
 /// The name the font of style `st` is written under, and whether it's TrueType: an installed
 /// face's PostScript name; else its family and style as `family-style` (the family alone for
 /// Regular), the form the reader's `family_style` splits.
@@ -556,9 +570,7 @@ impl TextDoc {
             0
         };
         d.push((12, V::Int(caps)));
-        if st.tate_chu_yoko {
-            d.push((35, V::Int(3)));
-        }
+        d.push((35, V::Int(baseline_direction(st))));
         let fill = solid(&st.fill).flatten();
         // A stroke of no width keeps its paint.
         let stroke = solid(&st.stroke).flatten();
@@ -943,6 +955,8 @@ impl TextDoc {
             (8, real(0.0)),
             (9, real(0.0)),
             (12, V::Int(0)),
+            // Every run writes its own key 35, so this only sets where new type starts: Standard (1).
+            (35, V::Int(1)),
             (53, paint(&Color::gray(1.0))),
             (56, V::Bool(true)),
             (57, V::Bool(false)),
diff --git a/crates/eps/src/import/ai.rs b/crates/eps/src/import/ai.rs
index 5537b5d06..b0359e172 100644
--- a/crates/eps/src/import/ai.rs
+++ b/crates/eps/src/import/ai.rs
@@ -41,8 +41,8 @@ pub(crate) use envelope::{WARPED_TYPE_DRAWN, WarpedType};
 pub(crate) use frames::text_frames;
 pub(crate) use paint::MAX_STOPS as MAX_GRADIENT_STOPS;
 pub use read::{
-    BindingRef, Brushes, IMAGE_TOO_LARGE, PaletteSwatches, Structure, active_artboard, artboards, bindings_note, brushes, graphic_styles, palette,
-    read, read_beside, variables,
+    BindingRef, Brushes, IMAGE_TOO_LARGE, PaletteSwatches, PlacedPage, Structure, active_artboard, artboards, bindings_note, brushes, graphic_styles,
+    palette, read, read_beside, variables,
 };
 pub(crate) use read::{MAX_SYMBOLS, join_and, read_art_style, slot_frame, slot_of, symbol_art_member};
 
diff --git a/crates/eps/src/import/ai/envelope.rs b/crates/eps/src/import/ai/envelope.rs
index bccaa050a..a421bbd6a 100644
--- a/crates/eps/src/import/ai/envelope.rs
+++ b/crates/eps/src/import/ai/envelope.rs
@@ -290,7 +290,9 @@ pub(super) fn live(o: &Obj, before: Option<Node>, inner: Vec<Node>) -> Option<No
         }
         3 => {
             let (rows, cols, pts) = upright(shape?)?;
-            EnvelopeKind::TopObject { path: outline(rows, cols, &pts)? }
+            // The outline runs clockwise from the top left corner, one segment per grid edge.
+            let corners = [0, cols, cols.checked_add(rows)?, cols.checked_mul(2)?.checked_add(rows)?];
+            EnvelopeKind::TopObject { path: outline(rows, cols, &pts)?, corners: Some(corners) }
         }
         _ => return None,
     };
diff --git a/crates/eps/src/import/ai/read.rs b/crates/eps/src/import/ai/read.rs
index 60ccd43ca..f49c598dc 100644
--- a/crates/eps/src/import/ai/read.rs
+++ b/crates/eps/src/import/ai/read.rs
@@ -46,6 +46,10 @@
 //!   box is as large as the file has pixels; the matrix takes them into art space from the canvas
 //!   (y down, its centre the template box's), where they start at the point of art space's origin,
 //!   the first row the top one. Each is a linked image showing the preview until its file is found.
+//!   The dictionary after a placed PDF or `.ai` file has the page shown, from 1, in
+//!   `AI11 PlacedPDFPageIndex` and its box in `AI11 PlacedPDFCropTo` (0 Art, 1 Crop, 2 Trim, 3 Bleed,
+//!   4 Media, 5 Bounding Box): each is a placed document of that page and box, showing the preview
+//!   until its file is found. A value outside those leaves it a linked image.
 //!   The version 7 form (§16) has no `%AI5_BeginPlace`: `[matrix] llx lly urx ury (path)` and
 //!   `` ` ``, then `%%IncludeFile:` or the file between `%%BeginDocument:` and `%%EndDocument`,
 //!   then `~`; its box is the file's `%%BoundingBox`. Newer files have three more numbers before
@@ -112,7 +116,7 @@ use vectorcraft_color::{BlendMode, Paint};
 use vectorcraft_doc::cmyk::Inks;
 use vectorcraft_doc::{
     Appearance, AppearanceItem, Artboard, ColorMode, Dash, Document, FillLayer, ImageBlob, ImageObject, Knockout, LayerColor, LineCap, LineJoin,
-    LinkInfo, Node, NodeId, NodeKind, OpacityMask, PatternDef, StrokeLayer, Unit,
+    LinkInfo, Node, NodeId, NodeKind, OpacityMask, PageBox, PatternDef, StrokeLayer, Unit,
 };
 use vectorcraft_geom::{AnchorKind, FillRule, PathData};
 
@@ -139,10 +143,10 @@ pub use document::{
 };
 pub(crate) use document::{slot_frame, slot_of};
 pub(crate) use ops::read_art_style;
-pub use types::IMAGE_TOO_LARGE;
-use types::{BLEND_BUDGET, BrushArtColors, FLIP, Frame, GState, Graph, Kind, PatternHead, PendingEnvelope, Place, Raster, SymbolHead};
+use types::{BLEND_BUDGET, BrushArtColors, FLIP, Frame, GState, Graph, Kind, PatternHead, PendingEnvelope, Place, PlacedTail, Raster, SymbolHead};
 #[cfg(test)]
 pub use types::{GRAPH_PLAIN, GRAPH_UNENDED, LINKED_PLACEHOLDERS, NON_NATIVE_ART, NON_NATIVE_ART_UNREAD, VERSIONED_UNENDED};
+pub use types::{IMAGE_TOO_LARGE, PlacedPage};
 pub(super) use types::{blend_mode, blend_name};
 
 #[path = "legacy_text.rs"]
@@ -185,6 +189,8 @@ pub struct Structure {
     /// move, in its pixels, that places them there (the corner of the box they are written with,
     /// in place of the canvas point of art space's origin).
     pub placed_elsewhere: Vec<(NodeId, Affine)>,
+    /// The placed files that are pages of PDF or `.ai` files.
+    pub placed_pages: Vec<PlacedPage>,
     /// The live envelopes read from the editing data, by id, with the drawn art each took the place
     /// of: the importer puts that art back when the layers with the envelopes don't draw as the page.
     pub envelopes_drawn: Vec<(NodeId, Node)>,
@@ -438,6 +444,9 @@ struct Reader<'a> {
     image_link: Option<String>,
     /// The placed file being read (`%AI5_BeginPlace` … `~`).
     place: Option<Place>,
+    /// The placed files just read, until the dictionary after each: at most one for each depth of
+    /// frames, the innermost last.
+    placed_tails: Vec<PlacedTail>,
     /// The last object read is the last child of the innermost frame, and nothing started since.
     after_object: bool,
     /// The last object read is an image, and only the operators that end its raster (`XH`, `Xr`,
@@ -554,6 +563,8 @@ struct Reader<'a> {
     placeholders: Vec<Rect>,
     /// See [`Structure::placed_elsewhere`].
     placed_elsewhere: Vec<(NodeId, Affine)>,
+    /// See [`Structure::placed_pages`].
+    placed_pages: Vec<PlacedPage>,
     unread_elsewhere: Vec<(NodeId, Rect)>,
     /// CMYK samples converted, by value.
     cmyk_cache: HashMap<[u8; 4], [u8; 3]>,
@@ -732,6 +743,8 @@ impl<'a> Reader<'a> {
             restyled: vec![],
             placeholders: vec![],
             placed_elsewhere: vec![],
+            placed_pages: vec![],
+            placed_tails: vec![],
             unread_elsewhere: vec![],
             mesh: None,
             cmyk_cache: HashMap::new(),
diff --git a/crates/eps/src/import/ai/read/art.rs b/crates/eps/src/import/ai/read/art.rs
index bc7b88155..7f0b75823 100644
--- a/crates/eps/src/import/ai/read/art.rs
+++ b/crates/eps/src/import/ai/read/art.rs
@@ -2,13 +2,14 @@ use super::containers::close;
 use super::document::TEXT_SLOT;
 use super::types::{
     FLIP, Frame, IMAGE_TOO_LARGE, Kind, LINKED_PLACEHOLDERS, LINKED_PREVIEWS, MAX_PIXELS, MAX_PLACED_ELSEWHERE, MAX_POINTS, MAX_SIDE, NON_NATIVE_ART,
-    NON_NATIVE_ART_UNREAD, Place,
+    NON_NATIVE_ART_UNREAD, PLACED_CROP, PLACED_PAGE, Place, PlacedPage, PlacedTail,
 };
 use super::{
     Affine, AnchorKind, Appearance, AppearanceItem, Arc, BezPath, CANVAS_CENTRE, FillLayer, ImageBlob, ImageObject, Inks, Instance, LinkInfo, Node,
-    NodeId, NodeKind, Obj, OpacityMask, Paint, PathData, PathEl, Point, Reader, Rect, StrokeLayer, V, ps,
+    NodeId, NodeKind, Obj, OpacityMask, PageBox, Paint, PathData, PathEl, Point, Reader, Rect, StrokeLayer, V, ps,
 };
 use vectorcraft_doc::links::missing_placeholder;
+use vectorcraft_doc::placed_document::key_for;
 
 impl<'a> Reader<'a> {
     /// A text object (`/AI11Text`): an empty group standing for it, named after its story.
@@ -754,18 +755,59 @@ impl<'a> Reader<'a> {
         let bytes = Arc::new(png);
         let blob = ImageBlob { mime: "image/png".into(), bytes: bytes.clone(), proxy: Some(bytes) };
         let key = linked_key(&blob, &path);
+        let fresh = !self.doc.images.contains_key(&key);
         self.doc.images.entry(key.clone()).or_insert(blob);
         self.warn(LINKED_PREVIEWS);
+        let id = NodeId(self.doc.peek_next_id());
         if let Some(shift) = elsewhere
             && self.placed_elsewhere.len() < MAX_PLACED_ELSEWHERE
         {
-            self.placed_elsewhere.push((NodeId(self.doc.peek_next_id()), shift));
+            self.placed_elsewhere.push((id, shift));
         }
+        // One waits at each depth: a placed file in another's opacity mask doesn't take the place of the outer one.
+        // An outer one waiting shares its blob with this one now: it no longer has it alone.
+        let depth = self.frames.len();
+        self.placed_tails.retain(|t| t.depth < depth);
+        for t in self.placed_tails.iter_mut().filter(|t| t.key == key) {
+            t.fresh = false;
+        }
+        self.placed_tails.push(PlacedTail { id, key: key.clone(), size: (b.width(), b.height()), fresh, depth });
         let mut link = LinkInfo::new(path);
         link.relative = folder.and_then(|f| relative_path(&f, link.name()));
         self.add_image(ImageObject { key, width: w, height: h, xf, link: Some(link), placement: Default::default(), pixels: None }, hidden)
     }
 
+    /// The dictionary `o` after the placed file just read: with a page or a box in it, that file is
+    /// a page of a PDF or `.ai` file. Its image keeps the preview under a key of its own for that
+    /// page and box, so that it doesn't share one with an image of another page of the file.
+    pub(super) fn placed_page(&mut self, o: &Obj) {
+        // The dictionaries of art read inside the placed file's own (its opacity mask's) are not its.
+        let depth = self.frames.len();
+        self.placed_tails.retain(|t| t.depth <= depth);
+        if self.placed_tails.last().is_none_or(|t| t.depth != depth) {
+            return;
+        }
+        let Some(tail) = self.placed_tails.pop() else { return };
+        let (page, crop) = (o.get(PLACED_PAGE).map(|_| o.nums(PLACED_PAGE)), o.get(PLACED_CROP).map(|_| o.nums(PLACED_CROP)));
+        // A placed document's box runs from (0, 0) to a positive size: a box written backward stays a linked image.
+        if (page.is_none() && crop.is_none()) || !(tail.size.0 > 0.0 && tail.size.1 > 0.0) {
+            return;
+        }
+        // An entry that is there but not a number leaves a linked image, as an unknown number does.
+        let page = page.map_or(Some(1), |v| v.first().copied().and_then(placed_page_number));
+        let crop = crop.map_or(Some((false, PageBox::Crop)), |v| v.first().copied().and_then(placed_crop));
+        let (Some(page), Some((bounding, page_box))) = (page, crop) else { return };
+        let Some(NodeKind::Image(im)) = self.last_object().filter(|n| n.id == tail.id).map(|n| &mut n.kind) else { return };
+        let old = im.key.clone();
+        let key = key_for(&old, page, bounding, page_box);
+        im.key.clone_from(&key);
+        let blob = if tail.fresh { self.doc.images.remove(&old) } else { self.doc.images.get(&old).cloned() };
+        if let Some(blob) = blob {
+            self.doc.images.entry(key).or_insert(blob);
+        }
+        self.placed_pages.push(PlacedPage { id: tail.id, page, bounding, page_box, size: tail.size });
+    }
+
     pub(super) fn warn(&mut self, w: &str) {
         if !self.warnings.iter().any(|x| x == w) && self.warnings.len() < 64 {
             self.warnings.push(w.to_string());
@@ -867,6 +909,25 @@ pub(super) fn preview_png(data: &[u8]) -> Option<(Vec<u8>, u32, u32)> {
     Some((png, width, height))
 }
 
+/// The page a placed file's dictionary names: a whole number from 1.
+fn placed_page_number(v: f64) -> Option<u32> {
+    (v.fract() == 0.0 && v >= 1.0 && v <= f64::from(u32::MAX)).then_some(v as u32)
+}
+
+/// The box a placed file's dictionary names: whether the art's bounds are shown, and the box of
+/// the page otherwise.
+fn placed_crop(v: f64) -> Option<(bool, PageBox)> {
+    match v {
+        0.0 => Some((false, PageBox::Art)),
+        1.0 => Some((false, PageBox::Crop)),
+        2.0 => Some((false, PageBox::Trim)),
+        3.0 => Some((false, PageBox::Bleed)),
+        4.0 => Some((false, PageBox::Media)),
+        5.0 => Some((true, PageBox::Crop)),
+        _ => None,
+    }
+}
+
 /// A placed file's path relative to the document's folder (`/` separators): its relative `folder`
 /// (`src/`, `..\art`) followed by its file `name`; the name alone when the folder is empty (the
 /// document's own folder). `None` when the folder is absolute or holds control characters, or
diff --git a/crates/eps/src/import/ai/read/directives.rs b/crates/eps/src/import/ai/read/directives.rs
index 45f60916b..dfc55aa7a 100644
--- a/crates/eps/src/import/ai/read/directives.rs
+++ b/crates/eps/src/import/ai/read/directives.rs
@@ -121,7 +121,11 @@ impl<'a> Reader<'a> {
         }
         if m == "BeginArtStyles" {
             let section = self.section("EndArtStyles")?;
-            self.styles = crate::import::ai::style::art_styles(section);
+            // GUARDS: a definition's art takes the file's art styles and hands them back, so a
+            // section inside it would replace the file's own.
+            if self.subreader_depth == 0 {
+                self.styles = crate::import::ai::style::art_styles(section);
+            }
             return Ok(());
         }
         if m == "BeginArtStyleList" {
@@ -376,9 +380,11 @@ impl<'a> Reader<'a> {
         let mut sub = Reader::new(section);
         sub.subreader_depth = self.subreader_depth + 1;
         sub.pattern = Some(PatternHead::default());
-        // The gradients defined so far and the names given, lent (and those it defines kept).
+        // The gradients and art styles defined so far and the names given, lent (and the gradients
+        // it defines kept).
         sub.gradients = std::mem::take(&mut self.gradients);
         sub.global_names = std::mem::take(&mut self.global_names);
+        sub.styles = std::mem::take(&mut self.styles);
         sub.nodes = self.nodes;
         sub.template = self.template;
         self.lend_budgets(&mut sub);
@@ -387,6 +393,7 @@ impl<'a> Reader<'a> {
         self.nodes = sub.nodes;
         self.gradients = std::mem::take(&mut sub.gradients);
         self.global_names = std::mem::take(&mut sub.global_names);
+        self.styles = std::mem::take(&mut sub.styles);
         // Unread art in the definition, hidden or not, leaves the tile incomplete.
         let whole = read.is_ok()
             && sub.unsupported.is_empty()
@@ -406,6 +413,7 @@ impl<'a> Reader<'a> {
         sub.pattern = Some(PatternHead { taken: true, name: def.name.clone(), tile: Some(def.tile) });
         sub.gradients = std::mem::take(&mut self.gradients);
         sub.global_names = std::mem::take(&mut self.global_names);
+        sub.styles = std::mem::take(&mut self.styles);
         sub.nodes = self.nodes;
         sub.template = self.template;
         self.lend_budgets(&mut sub);
@@ -420,6 +428,7 @@ impl<'a> Reader<'a> {
         self.nodes = sub.nodes;
         self.gradients = std::mem::take(&mut sub.gradients);
         self.global_names = std::mem::take(&mut sub.global_names);
+        self.styles = std::mem::take(&mut sub.styles);
         let whole = read.is_ok()
             && sub.unsupported.is_empty()
             && sub.unknown.is_empty()
@@ -495,6 +504,20 @@ impl<'a> Reader<'a> {
             return;
         };
         let art: Vec<Arc<Node>> = frame.children.iter().map(|n| Arc::new(self.doc.reid(n))).collect();
+        // The objects of the art linked to graphic styles, by their ids in the document.
+        if !sub.style_links.is_empty() {
+            let mut ids = HashMap::new();
+            for (read, kept) in frame.children.iter().zip(&art) {
+                pair_ids(read, kept, &mut ids, 0);
+            }
+            for (id, style) in &sub.style_links {
+                if let Some(new) = ids.get(id)
+                    && self.style_links.len() < MAX_NODES
+                {
+                    self.style_links.push((*new, style.clone()));
+                }
+            }
+        }
         // Fills and the tables look the pattern up by its name in the file; the document has it by
         // the name it shows.
         let mut def = PatternDef::new(&self.global_names.define(Global::Pattern, &head.name), art);
@@ -730,8 +753,10 @@ impl<'a> Reader<'a> {
         // In a space of its own (y down), with no head to take.
         sub.pattern = Some(PatternHead { taken: true, ..PatternHead::default() });
         sub.subreader_depth = self.subreader_depth + 1;
-        // The gradients and patterns defined so far, and which patterns are in the version 7 form, lent.
+        // The gradients, art styles and patterns defined so far, and which patterns are in the
+        // version 7 form, lent.
         sub.gradients = std::mem::take(&mut self.gradients);
+        sub.styles = std::mem::take(&mut self.styles);
         sub.pattern_tiles = std::mem::take(&mut self.pattern_tiles);
         sub.v7_patterns = std::mem::take(&mut self.v7_patterns);
         sub.global_names = std::mem::take(&mut self.global_names);
@@ -742,6 +767,7 @@ impl<'a> Reader<'a> {
         self.take_back_budgets(&mut sub);
         self.nodes = sub.nodes;
         self.gradients = std::mem::take(&mut sub.gradients);
+        self.styles = std::mem::take(&mut sub.styles);
         self.pattern_tiles = std::mem::take(&mut sub.pattern_tiles);
         self.v7_patterns = std::mem::take(&mut sub.v7_patterns);
         self.global_names = std::mem::take(&mut sub.global_names);
diff --git a/crates/eps/src/import/ai/read/document.rs b/crates/eps/src/import/ai/read/document.rs
index 1cbadc044..55cca0a86 100644
--- a/crates/eps/src/import/ai/read/document.rs
+++ b/crates/eps/src/import/ai/read/document.rs
@@ -612,6 +612,7 @@ impl<'a> Reader<'a> {
             head.registration = Some(*r);
         }
         self.constraint_art(o);
+        self.placed_page(o);
         // A blend's key object or spine.
         if let Some(kind) = o.text("ShapeBlendPathType")
             && let Some(id) = self.last_object().map(|n| n.id)
@@ -819,12 +820,13 @@ impl<'a> Reader<'a> {
             let (paint, global, spot) = match e.cell {
                 Cell::Color { color, global, spot } => (Paint::solid(color), global, spot),
                 // A swatch named by its gradient or pattern takes the name that got in the document.
+                // A gradient swatch's own paint does not link to a swatch; art painted with the
+                // gradient links to it.
                 Cell::Gradient(g) => {
-                    let mut gp = vectorcraft_color::gradient::GradientPaint::new(self.gradients.get(&g)?.clone());
+                    let gp = vectorcraft_color::gradient::GradientPaint::new(self.gradients.get(&g)?.clone());
                     if e.name == g {
                         e.name = self.global_names.get(Global::Gradient, &g).to_string();
                     }
-                    gp.swatch = Some(e.name.clone());
                     (Paint::Gradient(Box::new(gp)), false, false)
                 }
                 Cell::Pattern(p) => {
@@ -1127,6 +1129,9 @@ impl<'a> Reader<'a> {
                 for symbol in &mut doc.symbols {
                     link_styles(std::slice::from_mut(&mut symbol.art), &links, &styles, 0);
                 }
+                for pattern in &mut doc.patterns {
+                    link_styles(&mut pattern.art, &links, &styles, 0);
+                }
             }
             doc.graphic_styles = styles.into();
         }
@@ -1183,6 +1188,7 @@ impl<'a> Reader<'a> {
             restyled: self.restyled,
             placeholders: self.placeholders,
             placed_elsewhere: self.placed_elsewhere,
+            placed_pages: self.placed_pages,
             envelopes_drawn: self.envelopes_drawn,
             warped_type: super::super::envelope::WarpedType {
                 looks: self.warped_type,
diff --git a/crates/eps/src/import/ai/read/types.rs b/crates/eps/src/import/ai/read/types.rs
index 8b9607d18..5fe93923a 100644
--- a/crates/eps/src/import/ai/read/types.rs
+++ b/crates/eps/src/import/ai/read/types.rs
@@ -1,4 +1,6 @@
-use super::{Affine, BlendMode, Dash, FillRule, HAIRLINE, Knockout, LayerColor, LineCap, LineJoin, Named, Node, Obj, Paint, Rect, V};
+use super::{
+    Affine, BlendMode, Dash, FillRule, HAIRLINE, Knockout, LayerColor, LineCap, LineJoin, Named, Node, NodeId, Obj, PageBox, Paint, Rect, V,
+};
 
 /// Deepest nesting of layers, groups and dictionaries.
 pub(super) const MAX_DEPTH: usize = 256;
@@ -310,6 +312,43 @@ pub(super) struct Place {
 /// The longest relative folder of a placed file read (bytes).
 pub(super) const MAX_PLACED_FOLDER: usize = 4096;
 
+/// The dictionary entry after a placed PDF or `.ai` file that holds the page shown (1-based).
+pub(super) const PLACED_PAGE: &str = "AI11 PlacedPDFPageIndex";
+/// The dictionary entry after a placed PDF or `.ai` file that holds the box it is cropped to.
+pub(super) const PLACED_CROP: &str = "AI11 PlacedPDFCropTo";
+
+/// The placed file just read, until the dictionary after it: it may say the file is a page of a
+/// PDF or `.ai` file.
+#[derive(Debug)]
+pub(super) struct PlacedTail {
+    /// Its linked image.
+    pub(super) id: NodeId,
+    /// Its image's key in the document's images.
+    pub(super) key: String,
+    /// The size of its box.
+    pub(super) size: (f64, f64),
+    /// Its image's blob was stored for it, not shared with an earlier image.
+    pub(super) fresh: bool,
+    /// The frames open when it was read: its dictionary closes at the same depth.
+    pub(super) depth: usize,
+}
+
+/// A placed file the dictionary after it says is a page of a PDF or `.ai` file. Its linked image
+/// becomes a placed document once the layers have been compared with the page.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct PlacedPage {
+    /// The linked image.
+    pub id: NodeId,
+    /// The page shown (1-based).
+    pub page: u32,
+    /// The art's bounds are shown, not `page_box`.
+    pub bounding: bool,
+    /// The box of the page shown.
+    pub page_box: PageBox,
+    /// The size of the placed file's box.
+    pub size: (f64, f64),
+}
+
 /// What the open result says of placed files: they show the preview the file keeps of them.
 pub(super) const LINKED_PREVIEWS: &str =
     "linked pictures show the low-resolution preview saved in the file until their files are found: relink them in the Links panel";
diff --git a/crates/eps/src/import/ai/style.rs b/crates/eps/src/import/ai/style.rs
index 9699e3ac6..04ddf27c1 100644
--- a/crates/eps/src/import/ai/style.rs
+++ b/crates/eps/src/import/ai/style.rs
@@ -160,8 +160,8 @@ pub(super) struct ArtStyle {
     pub plain: bool,
     /// It is one fill and one stroke at most, in solid colours or the object's own gradient, with
     /// no transparency or effects of their own, and only Drop Shadow, Inner Glow, Outer Glow,
-    /// Feather, Round Corners, Scribble, Convert to Shape, the Path effects (Offset Path, Outline Object, Outline Stroke)
-    /// and some Distort & Transform effects ([`any_object_takes`]) on the object
+    /// Feather, Round Corners, Scribble, Convert to Shape, the Path effects (Offset Path, Outline Object, Outline Stroke),
+    /// Bas Relief read from its settings block and some Distort & Transform effects ([`any_object_takes`]) on the object
     /// (and Pathfinder effects when it has no fills or strokes): what any object is read with. Type takes the other plain styles too (its drawn look
     /// can't be retyped); other objects keep their drawn look, which is the app's own rendering.
     pub simple: bool,
@@ -277,6 +277,8 @@ struct Filter {
     xy: Option<(usize, f32)>,
     /// `… isolate knockout … Xy`.
     xy_group: Option<(bool, Knockout)>,
+    /// Its settings block's bytes (`/Binary : /ASCII85Decode ,`), `Err` when it isn't read.
+    data: Option<Result<Vec<u8>, ()>>,
 }
 
 impl Default for Filter {
@@ -304,6 +306,7 @@ impl Default for Filter {
             plugin_object: None,
             xy: None,
             xy_group: None,
+            data: None,
         }
     }
 }
@@ -383,12 +386,18 @@ pub(super) fn art_styles(data: &[u8]) -> HashMap<String, ArtStyle> {
     let mut style_entry: Option<Kind> = None;
     // A name of a basic filter's that may be an entry's type, with the string that follows it.
     let mut other_entry: Option<Option<String>> = None;
+    // The last name was `/Binary`.
+    let mut binary = false;
     let mut lex = Lexer::new(data);
     while let Some(t) = lex.next_token() {
         if let (Some(a), Tok::Num(v)) = (array.as_mut(), &t.tok) {
             a.push(V::Num(*v));
             continue;
         }
+        let after_binary = binary;
+        if let Tok::Name(n) = &t.tok {
+            binary = *n == b"Binary";
+        }
         match t.tok {
             Tok::Num(v) => operands.push(V::Num(v)),
             Tok::Str(s) | Tok::Hex(s) => {
@@ -397,6 +406,11 @@ pub(super) fn art_styles(data: &[u8]) -> HashMap<String, ArtStyle> {
                 }
                 operands.push(V::Str(s));
             }
+            // A basic filter's settings block: its bytes are on the comment lines the lexer skips.
+            Tok::Name(b"ASCII85Decode") if after_binary && in_basic => {
+                keep_block(&mut lex, data.len(), filters.last_mut());
+                operands.clear();
+            }
             Tok::Name(n) => match n {
                 b"KnownStyle" => {
                     finish(name.take(), &mut filters);
@@ -520,6 +534,62 @@ pub(super) fn art_styles(data: &[u8]) -> HashMap<String, ArtStyle> {
     styles
 }
 
+/// Reads the settings block that `lex` (over `data_len` bytes) has just reached into `filter`'s
+/// `data`; a second block on one filter, or a block that isn't read, leaves it `Err`.
+fn keep_block(lex: &mut Lexer, data_len: usize, filter: Option<&mut Filter>) {
+    let block = binary_block(lex, data_len).ok_or(());
+    if let Some(f) = filter {
+        f.data = Some(if f.data.is_some() { Err(()) } else { block });
+    }
+}
+
+/// The bytes of the settings block whose `/Binary : /ASCII85Decode` `lex` (over `data_len` bytes)
+/// has just read: the rest of that line is its `,`, each line after it holds ASCII85 after a `%`
+/// until `~>`, and `; (data) ,` follows. `lex` is moved past the `~>` when the lines up to it are
+/// the block's and fit in [`adapter::MAX_ENCODED`] bytes, and past `; (data)` when they follow.
+/// `None` when the block is malformed or decodes to more than [`adapter::MAX_DECODED`] bytes.
+fn binary_block(lex: &mut Lexer, data_len: usize) -> Option<Vec<u8>> {
+    let from = lex.offset();
+    let text = lex.slice(from, from.saturating_add(adapter::MAX_ENCODED).min(data_len));
+    let mut lines = text.split(|b| matches!(b, b'\r' | b'\n'));
+    let first = lines.next()?;
+    if first.trim_ascii() != b"," {
+        return None;
+    }
+    // Where the line being read starts in `text`.
+    let mut at = first.len() + 1;
+    let mut encoded = vec![];
+    for line in lines {
+        let start = at;
+        at += line.len() + 1;
+        if line.is_empty() {
+            continue;
+        }
+        // A line that isn't the block's ends it unread, the lexer left before it.
+        let digits = line.strip_prefix(b"%")?;
+        if let Some(i) = super::super::lex::find(digits, b"~>") {
+            encoded.extend_from_slice(digits.get(..i + 2)?);
+            lex.seek(from + start + 1 + i + 2);
+            return block_data(lex, &encoded);
+        }
+        encoded.extend_from_slice(digits);
+    }
+    None
+}
+
+/// The bytes of a settings block's ASCII85 `encoded`, when `; (data)` follows it in `lex`. When it
+/// doesn't, `lex` is left before those tokens, so the next style's `/KnownStyle` is still read.
+fn block_data(lex: &mut Lexer, encoded: &[u8]) -> Option<Vec<u8>> {
+    let at = lex.offset();
+    let data = crate::ps::ascii85_decode_within(std::str::from_utf8(encoded).ok()?, adapter::MAX_DECODED)?;
+    let (close, key) = (lex.next_token().map(|t| t.tok), lex.next_token().map(|t| t.tok));
+    if close == Some(Tok::Word(b";")) && key == Some(Tok::Str(b"data".to_vec())) {
+        return Some(data);
+    }
+    lex.seek(at);
+    None
+}
+
 /// A paint operator of a fill's or stroke's style.
 fn paint_op(f: &mut Filter, op: &str, vals: &[V]) {
     let last = vals.iter().rev().find_map(V::num);
@@ -1068,8 +1138,14 @@ fn effect(f: &Filter, under: Under) -> Option<Effect> {
         TWIST => ("distort.twist", json!({"angle": real(f, "angle", 0.0, -3600.0..=3600.0)?})),
         ZIG_ZAG => ("distort.zigZag", zig_zag(f)?),
         GAUSSIAN => ("blur.gaussian", json!({"radius": param("blur").unwrap_or(5.0).clamp(0.0, 1000.0)})),
-        // Its settings are in a Photoshop plug-in's binary block: the effect's defaults stand in.
-        BAS_RELIEF => ("sketch.basRelief", json!({"detail": 13.0, "smoothness": 3.0, "lightDirection": "bottom"})),
+        BAS_RELIEF => (
+            "sketch.basRelief",
+            match &f.data {
+                // Without a settings block, the effect's defaults stand in.
+                None => json!({"detail": 13.0, "smoothness": 3.0, "lightDirection": "bottom"}),
+                Some(data) => adapter::bas_relief(&descriptor(f, data)?)?,
+            },
+        ),
         SHAPE_EFFECTS => return shape_effect(f),
         PATHFINDER => return pathfinder_effect(f),
         _ => return None,
@@ -1077,6 +1153,18 @@ fn effect(f: &Filter, under: Under) -> Option<Effect> {
     Some(Effect { id: id.into(), params, visible: f.visible })
 }
 
+/// The fields of filter `f`'s settings block `data`, when it was read and its `dataSize`, written
+/// as `/Int`, is its length.
+fn descriptor(f: &Filter, data: &Result<Vec<u8>, ()>) -> Option<Vec<(adapter::Key, adapter::Value)>> {
+    let data = data.as_ref().ok()?;
+    (f.kinds.get("dataSize") == Some(&Kind::Int)).then_some(())?;
+    let size = f.params.get("dataSize").copied()?;
+    if size != data.len() as f64 {
+        return None;
+    }
+    adapter::decode(data)
+}
+
 /// The Effect › Pathfinder effect of [`PATHFINDER_COMMANDS`] that an integer `Command` names, when
 /// every key of [`PATHFINDER_OPTIONS`] is there with its kind and value (Soft Mix's `Mix` from 0.01
 /// to 1, as its Mixing Rate in percent) and the only other key is the `DisplayString` text, each
@@ -1389,6 +1477,21 @@ fn any_object_takes(e: &Effect) -> bool {
     }
 }
 
+/// Does every Bas Relief filter in `filters` have a settings block, so that it reads from its
+/// settings and not from its defaults standing in?
+fn bas_relief_read(filters: &[Filter]) -> bool {
+    filters.iter().all(|f| f.name != BAS_RELIEF || f.data.is_some())
+}
+
+/// Is `e` read on the whole object: Bas Relief when `bas_relief` says its settings were read, and
+/// otherwise what [`any_object_takes`] says?
+fn object_takes(e: &Effect, bas_relief: bool) -> bool {
+    if e.id == "sketch.basRelief" {
+        return bas_relief;
+    }
+    any_object_takes(e)
+}
+
 /// Do Free Distort params `p`'s corners (top left, top right, bottom right, bottom left) make a
 /// parallelogram, so that the bilinear map is affine?
 fn affine(p: &serde_json::Value) -> bool {
@@ -1443,13 +1546,14 @@ fn style(filters: &[Filter]) -> ArtStyle {
         b.plain = false;
     }
     st.plain = b.plain;
+    let bas_relief = bas_relief_read(filters);
     let count = |stroke: bool| st.items.iter().filter(|i| matches!(i, StyleItem::Stroke { .. }) == stroke).count();
     st.simple = st.plain
         && count(true) <= 1
         && count(false) <= 1
         && st.items.iter().all(|i| matches!(i, StyleItem::Fill(_) | StyleItem::Stroke { .. } | StyleItem::Gradient { .. }))
         && st.looks.iter().all(|l| l.visible && l.opacity >= 1.0 && l.blend == BlendMode::Normal && l.effects.is_empty())
-        && st.effects.iter().all(any_object_takes)
+        && st.effects.iter().all(|e| object_takes(e, bas_relief))
         // An effect that moves the outline is drawn on its own: with others, their order and what
         // scales with it aren't kept.
         && (!st.moves_outline() || st.effects.len() == 1)
@@ -1458,5 +1562,6 @@ fn style(filters: &[Filter]) -> ArtStyle {
     st
 }
 
+mod adapter;
 #[cfg(test)]
 mod tests;
diff --git a/crates/eps/src/import/ai/style/adapter.rs b/crates/eps/src/import/ai/style/adapter.rs
new file mode 100644
index 000000000..c06122e56
--- /dev/null
+++ b/crates/eps/src/import/ai/style/adapter.rs
@@ -0,0 +1,179 @@
+//! The settings of a filter-gallery effect in an art style: a basic filter's `/Binary :
+//! /ASCII85Decode ,` block, whose comment lines hold the bytes until `~>`, then `; (data) ,` and the
+//! byte count `n /Int (dataSize) ,`. The bytes are a descriptor, all numbers big-endian:
+//!
+//! ```text
+//! version (u32, 1)
+//! field*      key (4 chars) marker (u32) …
+//!   marker 0:          type (4 chars: long, doub, bool) value (i32, f64 or one byte)
+//!   marker 0x2000:     an enumeration: type (4 chars) value (4 chars)
+//!   marker 0x80000000: an object: class (4 chars) length (u32) and that many bytes, a descriptor
+//! ```
+//!
+//! A filter-gallery effect's first field is `GEfk`, an enumeration of type `GEft` whose value is the
+//! effect's four-character code. The keys and the enumerations' values are the ones the Photoshop
+//! Actions Event Guide lists for Bas Relief, and `GEfk` and `GEft` are the filter gallery's in
+//! published scripting examples. Anything else (another marker or type, a field past the end, bytes after the last field, more
+//! than [`MAX_FIELDS`] fields or objects nested more than [`MAX_DEPTH`] deep) isn't read.
+
+use serde_json::{Value as Json, json};
+
+/// Most bytes a block's text is read from (its comment lines and `~>`).
+pub(super) const MAX_ENCODED: usize = 6 * 1024;
+/// Most bytes a block decodes to.
+pub(super) const MAX_DECODED: usize = 4 * 1024;
+/// Most fields read in one descriptor, nested ones included.
+const MAX_FIELDS: usize = 32;
+/// Most levels of objects in objects.
+const MAX_DEPTH: usize = 2;
+
+/// A field's value.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) enum Value {
+    Long(i32),
+    Doub(f64),
+    Bool(bool),
+    /// An enumeration's type and value.
+    Enum([u8; 4], [u8; 4]),
+    /// An object's class and fields.
+    Object([u8; 4], Vec<(Key, Value)>),
+}
+
+/// A field's key.
+pub(super) type Key = [u8; 4];
+
+/// The fields of descriptor `data`; `None` when it isn't one read here.
+pub(super) fn decode(data: &[u8]) -> Option<Vec<(Key, Value)>> {
+    let mut count = 0;
+    fields(data, 0, &mut count)
+}
+
+fn fields(data: &[u8], depth: usize, count: &mut usize) -> Option<Vec<(Key, Value)>> {
+    let mut r = Reader { data, at: 0 };
+    if r.u32()? != 1 {
+        return None;
+    }
+    let mut out = vec![];
+    while r.at < data.len() {
+        *count += 1;
+        if *count > MAX_FIELDS {
+            return None;
+        }
+        let key = r.four()?;
+        let value = match r.u32()? {
+            0 => match &r.four()? {
+                b"long" => Value::Long(i32::from_be_bytes(r.four()?)),
+                b"doub" => Value::Doub(f64::from_be_bytes(r.eight()?)).finite()?,
+                b"bool" => match r.take(1)? {
+                    [0] => Value::Bool(false),
+                    [1] => Value::Bool(true),
+                    _ => return None,
+                },
+                _ => return None,
+            },
+            0x2000 => Value::Enum(r.four()?, r.four()?),
+            0x8000_0000 if depth < MAX_DEPTH => {
+                let class = r.four()?;
+                let n = usize::try_from(r.u32()?).ok()?;
+                Value::Object(class, fields(r.take(n)?, depth + 1, count)?)
+            }
+            _ => return None,
+        };
+        out.push((key, value));
+    }
+    Some(out)
+}
+
+impl Value {
+    fn finite(self) -> Option<Self> {
+        match self {
+            Value::Doub(v) if !v.is_finite() => None,
+            v => Some(v),
+        }
+    }
+}
+
+struct Reader<'a> {
+    data: &'a [u8],
+    at: usize,
+}
+
+impl<'a> Reader<'a> {
+    fn take(&mut self, n: usize) -> Option<&'a [u8]> {
+        let end = self.at.checked_add(n)?;
+        let bytes = self.data.get(self.at..end)?;
+        self.at = end;
+        Some(bytes)
+    }
+
+    fn four(&mut self) -> Option<[u8; 4]> {
+        self.take(4)?.try_into().ok()
+    }
+
+    fn eight(&mut self) -> Option<[u8; 8]> {
+        self.take(8)?.try_into().ok()
+    }
+
+    fn u32(&mut self) -> Option<u32> {
+        Some(u32::from_be_bytes(self.four()?))
+    }
+}
+
+/// The fields of a filter-gallery effect `code`, its `GEfk` field taken off; `None` when that field
+/// names another effect.
+fn gallery<'a>(fields: &'a [(Key, Value)], code: &[u8; 4]) -> Option<&'a [(Key, Value)]> {
+    match fields.split_first() {
+        Some((([b'G', b'E', b'f', b'k'], Value::Enum(kind, value)), rest)) => (kind == b"GEft" && value == code).then_some(rest),
+        _ => Some(fields),
+    }
+}
+
+/// A whole number in `range`.
+fn long(v: &Value, range: std::ops::RangeInclusive<i32>) -> Option<f64> {
+    match v {
+        Value::Long(n) if range.contains(n) => Some(f64::from(*n)),
+        _ => None,
+    }
+}
+
+/// Sketch › Bas Relief's params (`sketch.basRelief`) from its fields: `Dtl ` (detail), `Smth`
+/// (smoothness) and `LghD` (the light's direction), each once; `None` when one is missing, out of
+/// range or not read here, or another field is there.
+pub(super) fn bas_relief(fields: &[(Key, Value)]) -> Option<Json> {
+    let (mut detail, mut smoothness, mut light) = (None, None, None);
+    for (key, value) in gallery(fields, b"BsRl")? {
+        let slot = match key {
+            b"Dtl " => &mut detail,
+            b"Smth" => &mut smoothness,
+            b"LghD" => &mut light,
+            _ => return None,
+        };
+        if slot.is_some() {
+            return None;
+        }
+        *slot = Some(match key {
+            b"LghD" => json!(light_direction(value)?),
+            _ => json!(long(value, 1..=15)?),
+        });
+    }
+    Some(json!({"detail": detail?, "smoothness": smoothness?, "lightDirection": light?}))
+}
+
+/// The light direction of a `LghD` enumeration's value (`typeLightDirection`).
+fn light_direction(v: &Value) -> Option<&'static str> {
+    let Value::Enum(kind, value) = v else { return None };
+    if kind != b"LghD" {
+        return None;
+    }
+    Some(match value {
+        b"LDBt" => "bottom",
+        b"LDBL" => "bottomLeft",
+        b"LDLf" => "left",
+        b"LDTL" => "topLeft",
+        b"LDTp" => "top",
+        b"LDTR" => "topRight",
+        b"LDRg" => "right",
+        b"LDBR" => "bottomRight",
+        _ => return None,
+    })
+}
diff --git a/crates/eps/src/import/ai/style/tests.rs b/crates/eps/src/import/ai/style/tests.rs
index da9a83ad7..0845ca0d9 100644
--- a/crates/eps/src/import/ai/style/tests.rs
+++ b/crates/eps/src/import/ai/style/tests.rs
@@ -1051,6 +1051,184 @@ fn a_hidden_fill_comes_in_hidden() {
     assert_eq!(st.looks.iter().map(|l| l.visible).collect::<Vec<_>>(), [false, true]);
 }
 
+/// A descriptor (version 1) of `fields`.
+fn descriptor(fields: &[Vec<u8>]) -> Vec<u8> {
+    [vec![0, 0, 0, 1], fields.concat()].concat()
+}
+
+fn long_field(key: &[u8; 4], v: i32) -> Vec<u8> {
+    [&key[..], &[0; 4], b"long", &v.to_be_bytes()].concat()
+}
+
+fn enum_field(key: &[u8; 4], kind: &[u8; 4], v: &[u8; 4]) -> Vec<u8> {
+    [&key[..], &0x2000u32.to_be_bytes(), kind, v].concat()
+}
+
+/// Bas Relief's fields: the filter-gallery code, `detail`, `smoothness` and the light direction `light`.
+fn relief_fields(detail: i32, smoothness: i32, light: &[u8; 4]) -> Vec<Vec<u8>> {
+    vec![enum_field(b"GEfk", b"GEft", b"BsRl"), long_field(b"Dtl ", detail), long_field(b"Smth", smoothness), enum_field(b"LghD", b"LghD", light)]
+}
+
+/// A settings block of `data`: the ASCII85 on comment lines, then `; (data) ,`.
+fn block(data: &[u8]) -> String {
+    let lines: String = crate::ps::ascii85(data).lines().map(|l| format!("%{l}\n")).collect();
+    format!("/Binary : /ASCII85Decode ,\n{lines}; (data) ,\n")
+}
+
+/// The style `name`: a black fill and Bas Relief on the object, whose dictionary holds `body`.
+fn relief_text(name: &str, body: &str) -> String {
+    let stack = compound("Stack Style Filter", &[fill("0 0 0 1 0 0 0 Xa"), basic("Conduit Filter", "")]);
+    let relief = basic("PSAdapter_plugin_BsRl", body);
+    format!("/KnownStyle :\n({name}) /Name ,\n/ActiveStyle :\n{}", compound("Chain Style Filter", &[stack, relief]))
+}
+
+/// The style of [`relief_text`].
+fn relief_style(body: &str) -> ArtStyle {
+    art_styles(relief_text("Relief", body).as_bytes()).remove("Relief").unwrap_or_default()
+}
+
+#[test]
+fn a_settings_block_without_its_end_leaves_the_next_style_alone() {
+    // GUARDS: the block's `~>` was looked for past its own lines, in the next style's block, which was skipped.
+    let data = descriptor(&relief_fields(8, 1, b"LDBt"));
+    let cut = format!("{}{} /Int (dataSize) ,\n", block(&data).replace("~>", ""), data.len());
+    let whole = format!("{}{} /Int (dataSize) ,\n", block(&data), data.len());
+    let styles = art_styles(format!("{}{}", relief_text("Cut", &cut), relief_text("Whole", &whole)).as_bytes());
+    assert!(styles["Cut"].effects.is_empty(), "{:?}", styles["Cut"]);
+    assert!(styles["Whole"].simple, "{:?}", styles["Whole"]);
+    assert_eq!(styles["Whole"].effects[0].params["detail"], json!(8.0));
+}
+
+#[test]
+fn a_settings_block_without_its_data_key_leaves_the_next_style_alone() {
+    // GUARDS: the tokens after the block's `;` were taken as its `(data)` key, the closing of its
+    // dictionary or the next style's `/KnownStyle` among them, and the next style was lost.
+    let data = descriptor(&relief_fields(8, 1, b"LDBt"));
+    let whole = format!("{}{} /Int (dataSize) ,\n", block(&data), data.len());
+    let keyless = block(&data).replace("(data) ,\n", "");
+    let next = relief_text("Whole", &whole);
+    // A style cut short right after its block's `;`, the next style's `/KnownStyle` following.
+    let short = relief_text("Cut", &keyless);
+    let short = short.get(..short.find("~>\n;").unwrap_or_default() + 4).unwrap_or_default();
+    for text in [
+        format!("{short}\n{next}"),
+        format!("{}{next}", relief_text("Cut", &keyless)),
+        format!("{}{next}", relief_text("Cut", &format!("{keyless}{} /Int (dataSize) ,\n", data.len()))),
+    ] {
+        let styles = art_styles(text.as_bytes());
+        assert!(styles.get("Whole").is_some_and(|s| s.simple), "{styles:?}");
+        assert_eq!(styles["Whole"].effects[0].params["detail"], json!(8.0));
+        assert!(!styles.get("Cut").is_some_and(|s| s.simple), "{styles:?}");
+    }
+}
+
+/// [`relief_style`] with the settings block of `data` and a `dataSize` of its length.
+fn relief_with(data: &[u8]) -> ArtStyle {
+    relief_style(&format!("{}300 /Int (PrevDres) ,\n{} /Int (dataSize) ,\n1 /Bool (go) ,\n", block(data), data.len()))
+}
+
+#[test]
+fn bas_relief_reads_its_settings_block() {
+    // GUARDS: the effect's defaults stood in for the settings, and an object other than type with it
+    // came in as its drawn look.
+    for (code, light) in [
+        (b"LDBt", "bottom"),
+        (b"LDBL", "bottomLeft"),
+        (b"LDLf", "left"),
+        (b"LDTL", "topLeft"),
+        (b"LDTp", "top"),
+        (b"LDTR", "topRight"),
+        (b"LDRg", "right"),
+        (b"LDBR", "bottomRight"),
+    ] {
+        let st = relief_with(&descriptor(&relief_fields(8, 1, code)));
+        assert!(st.plain && st.simple, "{st:?}");
+        let [e] = st.effects.as_slice() else { panic!("{st:?}") };
+        assert_eq!((e.id.as_str(), &e.params), ("sketch.basRelief", &json!({"detail": 8.0, "smoothness": 1.0, "lightDirection": light})));
+    }
+    // Without the filter-gallery code, and with the fields in another order.
+    let [_, detail, smoothness, light] = <[Vec<u8>; 4]>::try_from(relief_fields(15, 15, b"LDTp")).unwrap();
+    let st = relief_with(&descriptor(&[light, smoothness, detail]));
+    assert!(st.simple, "{st:?}");
+    assert_eq!(st.effects[0].params, json!({"detail": 15.0, "smoothness": 15.0, "lightDirection": "top"}));
+}
+
+#[test]
+fn bas_relief_without_a_settings_block_keeps_the_effects_defaults_on_type_only() {
+    let st = relief_style("300 /Int (PrevDres) ,\n");
+    assert!(st.plain && !st.simple, "{st:?}");
+    assert_eq!(st.effects[0].params, json!({"detail": 13.0, "smoothness": 3.0, "lightDirection": "bottom"}));
+}
+
+#[test]
+fn bas_relief_with_settings_not_read_here_keeps_the_drawn_look() {
+    let good = || relief_fields(8, 1, b"LDBt");
+    let with = |i: usize, field: Vec<u8>| {
+        let mut f = good();
+        f[i] = field;
+        descriptor(&f)
+    };
+    let cases: Vec<(&str, Vec<u8>)> = vec![
+        ("detail 0", with(1, long_field(b"Dtl ", 0))),
+        ("detail 16", with(1, long_field(b"Dtl ", 16))),
+        ("smoothness -1", with(2, long_field(b"Smth", -1))),
+        ("an unknown direction", with(3, enum_field(b"LghD", b"LghD", b"LDXx"))),
+        ("a direction of another type", with(3, enum_field(b"LghD", b"Dirc", b"LDBt"))),
+        ("a detail that isn't a whole number", with(1, [&b"Dtl "[..], &[0; 4], b"doub", &8.0f64.to_be_bytes()].concat())),
+        ("another effect's code", with(0, enum_field(b"GEfk", b"GEft", b"Crst"))),
+        ("an unknown key", [descriptor(&good()), long_field(b"Xtra", 1)].concat()),
+        ("a key twice", [descriptor(&good()), long_field(b"Dtl ", 8)].concat()),
+        ("a missing key", descriptor(&good()[..3])),
+        ("a byte after the last field", [descriptor(&good()), vec![0]].concat()),
+        ("a cut field", descriptor(&good()).split_last().unwrap().1.to_vec()),
+        ("version 2", [vec![0, 0, 0, 2], good().concat()].concat()),
+    ];
+    for (what, data) in cases {
+        let st = relief_with(&data);
+        assert!(!st.plain && !st.simple && st.effects.is_empty(), "{what}: {st:?}");
+    }
+    let data = descriptor(&good());
+    let encoded = block(&data);
+    for (what, body) in [
+        ("a wrong dataSize", format!("{encoded}{} /Int (dataSize) ,\n", data.len() + 1)),
+        ("no dataSize", encoded.clone()),
+        ("a dataSize of another kind", format!("{encoded}{} /Real (dataSize) ,\n", data.len())),
+        ("no ~>", format!("{}{} /Int (dataSize) ,\n", encoded.replace("~>", ""), data.len())),
+        ("a digit past u", format!("{}{} /Int (dataSize) ,\n", encoded.replacen("%", "%v", 2), data.len())),
+        ("a line without %", format!("{}{} /Int (dataSize) ,\n", encoded.replacen("\n%", "\n", 1), data.len())),
+        ("no (data) key", format!("{}{} /Int (dataSize) ,\n", encoded.replace("(data)", "(other)"), data.len())),
+        ("two blocks", format!("{encoded}{encoded}{} /Int (dataSize) ,\n", data.len())),
+    ] {
+        let st = relief_style(&body);
+        assert!(!st.plain && st.effects.is_empty(), "{what}: {st:?}");
+    }
+}
+
+#[test]
+fn settings_blocks_are_bounded() {
+    // More than the decoded limit, though its text is short (`z` is four zero bytes).
+    let zeros = format!("/Binary : /ASCII85Decode ,\n%{}~>\n; (data) ,\n4100 /Int (dataSize) ,\n", "z".repeat(1025));
+    assert!(relief_style(&zeros).effects.is_empty());
+    // An end further than the encoded limit.
+    let far = format!("/Binary : /ASCII85Decode ,\n{}%~>\n; (data) ,\n0 /Int (dataSize) ,\n", "%!!!!!\n".repeat(1000));
+    assert!(relief_style(&far).effects.is_empty());
+    // Objects nest two deep at most, and a descriptor holds 32 fields at most.
+    let object = |inner: Vec<u8>| [&b"Objc"[..], &0x8000_0000u32.to_be_bytes(), b"Clss", &(inner.len() as u32).to_be_bytes(), &inner].concat();
+    let two = descriptor(&[object(descriptor(&[object(descriptor(&[long_field(b"Valu", 1)]))]))]);
+    assert!(adapter::decode(&two).is_some());
+    let three = descriptor(&[object(descriptor(&[object(descriptor(&[object(descriptor(&[]))]))]))]);
+    assert!(adapter::decode(&three).is_none());
+    assert!(adapter::decode(&descriptor(&vec![long_field(b"Valu", 1); 32])).is_some());
+    assert!(adapter::decode(&descriptor(&vec![long_field(b"Valu", 1); 33])).is_none());
+    let long_object = [&b"Objc"[..], &0x8000_0000u32.to_be_bytes(), b"Clss", &u32::MAX.to_be_bytes()].concat();
+    assert!(adapter::decode(&descriptor(&[long_object])).is_none());
+    let nan = [&b"Valu"[..], &[0; 4], b"doub", &f64::NAN.to_be_bytes()].concat();
+    assert!(adapter::decode(&descriptor(&[nan])).is_none());
+    let flag = |b: u8| [&b"Valu"[..], &[0; 4], b"bool", &[b]].concat();
+    assert!(adapter::decode(&descriptor(&[flag(1)])).is_some());
+    assert!(adapter::decode(&descriptor(&[flag(2)])).is_none());
+}
+
 /// A Convert to Shape filter whose dictionary holds `keys`.
 fn shape(keys: &str) -> String {
     basic("Adobe Shape Effects", &format!("(Shape) /UnicodeString (DisplayString) ,\n{keys}"))
diff --git a/crates/eps/src/import/ai/tests.rs b/crates/eps/src/import/ai/tests.rs
index e227ec12b..5765fa6bf 100644
--- a/crates/eps/src/import/ai/tests.rs
+++ b/crates/eps/src/import/ai/tests.rs
@@ -906,6 +906,26 @@ fn a_color_named_as_a_palette_gradient_or_pattern_is_numbered() {
     assert_eq!(links, [Some("Brand 3".to_string()), Some("Brand 2".to_string())]);
 }
 
+/// A palette's gradient swatch holds its gradient without a link to a swatch, whether it is named
+/// by its gradient or has a name of its own, and the art filled with the gradient links to the
+/// swatch named by the gradient.
+#[test]
+fn a_palette_gradient_swatch_is_not_linked_to_itself() {
+    let gradient = "%AI5_BeginGradient: (Sky)\n(Sky) 0 2 Bd\n[\n%_1 0 50 0 Bs\n%_0 0 50 100 Bs\nBD\n%AI5_EndGradient\n";
+    let palette = "%AI5_BeginPalette\n0 0 Pb\nBb\n2 (Sky) 0 0 0 1 1 0 0 1 0 0 1 Bg\n0 BB\n(Sky)\nPc\n\
+                   Bb\n2 (Sky) 0 0 0 1 1 0 0 1 0 0 1 Bg\n0 BB\n(Brand)\nPc\nPB\n%AI5_EndPalette\n";
+    let filled = format!("Bb\n1 (Sky) 0 0 0 10 1 0 0 1 0 0 Bg\n{}f\n0 BB\n", rect_path(0.0, 0.0, 10.0, 10.0));
+    let doc = read_ok(&format!("{gradient}{palette}{}", layer(&filled))).doc;
+    for name in ["Sky", "Brand"] {
+        let sw = doc.swatch(name).unwrap_or_else(|| panic!("no {name} swatch"));
+        let Paint::Gradient(g) = &sw.paint else { panic!("{sw:?}") };
+        assert_eq!(g.swatch, None, "{name}'s own paint");
+        assert_eq!(g.geom, None);
+        assert_eq!(g.gradient.stops.len(), 2);
+    }
+    assert!(matches!(fill(&art(&doc)[0]), Paint::Gradient(g) if g.swatch.as_deref() == Some("Sky")));
+}
+
 /// A palette's pattern swatch named by its pattern takes the name the pattern is shown with.
 #[test]
 fn a_palette_pattern_swatch_takes_its_patterns_shown_name() {
@@ -3288,6 +3308,211 @@ fn placed_files_of_other_paths_keep_images_of_their_own() {
     assert_eq!(r.doc.images.len(), 2);
 }
 
+/// A placed file followed by the dictionary `numbers` (`value /Int (key)` lines, on `%_` lines).
+fn placed_with(numbers: &[(&str, &str)]) -> Structure {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let entries: String = numbers.iter().map(|(key, v)| format!("%_{v} /Int ({key}) ,\r")).collect();
+    let dictionary = format!("%_/ArtDictionary :\r{entries}%_;\r%_\r");
+    read(&placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), &dictionary)).unwrap()
+}
+
+#[test]
+fn a_placed_files_dictionary_names_the_page_and_box_it_shows() {
+    use vectorcraft_doc::PageBox;
+    const PAGE: &str = "AI11 PlacedPDFPageIndex";
+    const CROP: &str = "AI11 PlacedPDFCropTo";
+    for (crop, bounding, page_box) in [
+        ("0", false, PageBox::Art),
+        ("1", false, PageBox::Crop),
+        ("2", false, PageBox::Trim),
+        ("3", false, PageBox::Bleed),
+        ("4", false, PageBox::Media),
+        ("5", true, PageBox::Crop),
+    ] {
+        let r = placed_with(&[(PAGE, "3"), (CROP, crop)]);
+        let a = art(&r.doc);
+        let NodeKind::Image(im) = &a[0].kind else { panic!("{:?}", a[0].kind) };
+        assert_eq!(r.placed_pages.len(), 1, "{crop}");
+        let p = r.placed_pages[0];
+        assert_eq!((p.id, p.page, p.bounding, p.page_box, p.size), (a[0].id, 3, bounding, page_box, (4.0, 2.0)), "{crop}");
+        assert_eq!(r.doc.images.keys().collect::<Vec<_>>(), [&im.key], "{crop}: the preview is stored once, under the image's key");
+        assert!(r.doc.images[&im.key].is_proxy(), "{crop}");
+    }
+    // One entry alone: the first page, or the page's crop box.
+    let r = placed_with(&[(CROP, "4")]);
+    assert_eq!((r.placed_pages[0].page, r.placed_pages[0].page_box), (1, PageBox::Media));
+    let r = placed_with(&[(PAGE, "2")]);
+    assert_eq!((r.placed_pages[0].bounding, r.placed_pages[0].page_box), (false, PageBox::Crop));
+}
+
+#[test]
+fn a_placed_files_dictionary_it_cant_read_leaves_a_linked_image() {
+    const PAGE: &str = "AI11 PlacedPDFPageIndex";
+    const CROP: &str = "AI11 PlacedPDFCropTo";
+    let plain = placed_with(&[]);
+    let plain_key = {
+        let a = art(&plain.doc);
+        let NodeKind::Image(im) = &a[0].kind else { panic!("{:?}", a[0].kind) };
+        im.key.clone()
+    };
+    assert!(plain.placed_pages.is_empty());
+    for entries in [
+        vec![(PAGE, "0"), (CROP, "4")],
+        vec![(PAGE, "-1"), (CROP, "4")],
+        vec![(PAGE, "1.5"), (CROP, "4")],
+        vec![(PAGE, "1e30"), (CROP, "4")],
+        vec![(PAGE, "2"), (CROP, "6")],
+        vec![(PAGE, "2"), (CROP, "-1")],
+        vec![(PAGE, "2"), (CROP, "0.5")],
+        vec![(PAGE, "(2)"), (CROP, "4")],
+        vec![(PAGE, "2"), (CROP, "(4)")],
+        vec![(PAGE, "(2)")],
+    ] {
+        let r = placed_with(&entries);
+        assert!(r.placed_pages.is_empty(), "{entries:?}");
+        let a = art(&r.doc);
+        let NodeKind::Image(im) = &a[0].kind else { panic!("{entries:?}: {:?}", a[0].kind) };
+        assert_eq!((im.key.as_str(), im.link.as_ref().and_then(|l| l.page)), (plain_key.as_str(), None), "{entries:?}");
+    }
+}
+
+/// The dictionaries of the art in a placed file's opacity mask, read inside its own dictionary,
+/// don't speak for the placed file.
+#[test]
+fn a_placed_files_mask_art_leaves_its_page_to_the_placed_files_dictionary() {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let dictionary = "%_/ArtDictionary :\r%_/Mask :\r%_X=\r%_0 g\r%_0 0 m\r%_5 0 l\r%_5 -5 l\r%_f\r\
+                      %_/ArtDictionary :\r%_/XMLUID : (Inner) ; (AI10_ArtUID) ,\r%_;\r%_\r%_X+\r%_ (Art) ,\r%_; (AI9_Mask) ,\r\
+                      %_2 /Int (AI11 PlacedPDFPageIndex) ,\r%_4 /Int (AI11 PlacedPDFCropTo) ,\r%_;\r%_\r";
+    let r = read(&placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), dictionary)).unwrap();
+    let a = art(&r.doc);
+    assert_eq!(a.len(), 1, "{a:?}");
+    assert!(a[0].extras().mask.is_some(), "the mask is read");
+    assert_eq!(r.placed_pages.len(), 1);
+    assert_eq!((r.placed_pages[0].id, r.placed_pages[0].page_box), (a[0].id, vectorcraft_doc::PageBox::Media));
+}
+
+/// A placed file in a placed file's opacity mask, read before the outer file's dictionary closes,
+/// leaves the outer file's page to that dictionary.
+#[test]
+fn a_placed_file_in_a_placed_files_mask_leaves_the_outer_files_page() {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let mut inner =
+        b"%_%AI5_BeginPlace\r%_%%FileType: 1\r%_[5 0 0 -5 0 200] 10 20 14 22 4 4 0\r%_(/art/mask.pdf)`\r%_%AI26_BeginPlacedObjectPreview\r%_"
+            .to_vec();
+    inner.extend_from_slice(&preview);
+    inner.extend_from_slice(
+        b"\r%_%AI26_EndPlacedObjectPreview\r%_~\r%_%AI5_EndPlace\r%_/ArtDictionary :\r%_5 /Int (AI11 PlacedPDFPageIndex) ,\r%_;\r%_\r",
+    );
+    let mut dictionary = b"%_/ArtDictionary :\r%_/Mask :\r%_X=\r".to_vec();
+    dictionary.extend_from_slice(&inner);
+    dictionary
+        .extend_from_slice(b"%_X+\r%_ (Art) ,\r%_; (AI9_Mask) ,\r%_2 /Int (AI11 PlacedPDFPageIndex) ,\r%_4 /Int (AI11 PlacedPDFCropTo) ,\r%_;\r%_\r");
+    let data = placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), "@@DICT@@");
+    let at = data.windows(8).position(|x| x == b"@@DICT@@").unwrap();
+    let data = [&data[..at], &dictionary[..], &data[at + 8..]].concat();
+    let r = read(&data).unwrap();
+    let a = art(&r.doc);
+    assert_eq!(a.len(), 1, "{a:?}");
+    assert!(a[0].extras().mask.is_some(), "the mask is read");
+    let outer: Vec<_> = r.placed_pages.iter().filter(|p| p.id == a[0].id).collect();
+    assert_eq!(outer.len(), 1, "{:?}", r.placed_pages);
+    assert_eq!((outer[0].page, outer[0].page_box), (2, vectorcraft_doc::PageBox::Media));
+    assert!(r.placed_pages.iter().any(|p| p.id != a[0].id && p.page == 5), "the inner one names its own page: {:?}", r.placed_pages);
+}
+
+/// A placed file in a placed file's opacity mask that shows the same file with no page of its own
+/// keeps the preview they share when the outer one's dictionary names a page.
+#[test]
+fn a_placed_file_in_a_placed_files_mask_keeps_the_preview_they_share() {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let mut dictionary =
+        b"%_/ArtDictionary :\r%_/Mask :\r%_X=\r%_%AI5_BeginPlace\r%_%%FileType: 1\r%_[5 0 0 -5 0 200] 10 20 14 22 4 4 0\r%_(/art/flyer.pdf)`\r\
+          %_%AI26_BeginPlacedObjectPreview\r%_"
+            .to_vec();
+    dictionary.extend_from_slice(&preview);
+    dictionary.extend_from_slice(
+        b"\r%_%AI26_EndPlacedObjectPreview\r%_~\r%_%AI5_EndPlace\r%_X+\r%_ (Art) ,\r%_; (AI9_Mask) ,\r\
+          %_2 /Int (AI11 PlacedPDFPageIndex) ,\r%_;\r%_\r",
+    );
+    let data = placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), "@@DICT@@");
+    let at = data.windows(8).position(|x| x == b"@@DICT@@").unwrap();
+    let data = [&data[..at], &dictionary[..], &data[at + 8..]].concat();
+    let r = read(&data).unwrap();
+    let a = art(&r.doc);
+    assert_eq!(r.placed_pages.len(), 1, "{:?}", r.placed_pages);
+    let mask = a[0].extras().mask.clone().expect("the mask is read");
+    let mut keys = vec![];
+    mask.art.walk(&mut |n| {
+        if let NodeKind::Image(im) = &n.kind {
+            keys.push(im.key.clone());
+        }
+    });
+    let [inner] = &keys[..] else { panic!("{keys:?}") };
+    assert!(r.doc.images.contains_key(inner), "the mask's image keeps its preview");
+    let NodeKind::Image(outer) = &a[0].kind else { panic!("{:?}", a[0].kind) };
+    assert!(r.doc.images.contains_key(&outer.key) && outer.key != *inner);
+}
+
+#[test]
+fn a_placed_file_with_its_box_written_backward_stays_a_linked_image() {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let dictionary = "%_/ArtDictionary :\r%_2 /Int (AI11 PlacedPDFPageIndex) ,\r%_4 /Int (AI11 PlacedPDFCropTo) ,\r%_;\r%_\r";
+    let data = placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), dictionary);
+    let at = data.windows(11).position(|x| x == b"10 20 14 22").unwrap();
+    let data = [&data[..at], b"14 22 10 20", &data[at + 11..]].concat();
+    let r = read(&data).unwrap();
+    assert!(r.placed_pages.is_empty());
+    let a = art(&r.doc);
+    let NodeKind::Image(im) = &a[0].kind else { panic!("{:?}", a[0].kind) };
+    assert_eq!(im.link.as_ref().and_then(|l| l.page), None);
+}
+
+#[test]
+fn only_the_dictionary_right_after_a_placed_file_names_its_page() {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let dictionary = "%_/ArtDictionary :\r%_2 /Int (AI11 PlacedPDFPageIndex) ,\r%_4 /Int (AI11 PlacedPDFCropTo) ,\r%_;\r%_\r";
+    // After another object: that object's dictionary. Art with such a dictionary stays art.
+    let after = format!("0 g\r0 0 m\r5 0 l\r5 5 l\rf\r{dictionary}");
+    let r = read(&placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), &after)).unwrap();
+    assert!(r.placed_pages.is_empty());
+    assert_eq!(art(&r.doc).len(), 2);
+    // A second dictionary after the first: the first one spoke for the placed file.
+    let after = format!("%_/ArtDictionary :\r%_(Photo) /String (AIArtName) ,\r%_;\r%_\r{dictionary}");
+    let r = read(&placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), &after)).unwrap();
+    assert!(r.placed_pages.is_empty());
+    // Without a placed file before it, nothing happens.
+    let r = read(stream(&layer(&format!("0 g\r0 0 m\r5 0 l\r5 5 l\rf\r{dictionary}"))).as_bytes()).ok();
+    assert!(r.is_none_or(|r| r.placed_pages.is_empty()));
+}
+
+/// Two pages of a file with the same preview don't share a key: reading one page's file in would
+/// change the other's image.
+#[test]
+fn placed_pages_of_one_file_keep_images_of_their_own() {
+    let preview = [&b"2 1 12 32 17 "[..], &[255, 255, 0, 0, 128, 0, 64, 0, 9, 9, 9, 9]].concat();
+    let one =
+        placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), "%_/ArtDictionary :\r%_1 /Int (AI11 PlacedPDFPageIndex) ,\r%_;\r%_\r");
+    let two =
+        placed(true, "[5 0 0 -5 0 200]", "/art/flyer.pdf", Some(&preview), "%_/ArtDictionary :\r%_2 /Int (AI11 PlacedPDFPageIndex) ,\r%_;\r%_\r");
+    let find = |d: &[u8], w: &[u8]| d.windows(w.len()).position(|x| x == w).unwrap();
+    let body = two[find(&two, b"%AI5_BeginPlace")..find(&two, b"LB\n%AI5_EndLayer")].to_vec();
+    let mut both = one.clone();
+    let at = find(&both, b"LB\n%AI5_EndLayer");
+    both.splice(at..at, body);
+    let r = read(&both).unwrap();
+    assert_eq!(r.placed_pages.len(), 2);
+    let keys: Vec<String> = art(&r.doc)
+        .iter()
+        .map(|n| match &n.kind {
+            NodeKind::Image(im) => im.key.clone(),
+            k => panic!("{k:?}"),
+        })
+        .collect();
+    assert_ne!(keys[0], keys[1]);
+    assert!(keys.iter().all(|k| r.doc.images.contains_key(k)) && r.doc.images.len() == 2, "{keys:?}");
+}
+
 #[test]
 fn placed_files_are_linked_images_showing_their_preview() {
     // A 2×1 preview (premultiplied ARGB, a padded row) of a file of 4×2 pixels.
@@ -5572,6 +5797,74 @@ fn a_symbol_defined_before_the_art_styles_reads_its_styled_objects() {
     assert!(!r.warnings.iter().any(|w| w.contains("drawn look")), "{:?}", r.warnings);
 }
 
+/// `node` is the red square of [`styled_square`] read as itself with [`ART_STYLES`]' `Blue`: a blue
+/// fill and a drop shadow, not the look it draws.
+fn assert_blue_square(node: &Node) {
+    assert!(matches!(node.kind, NodeKind::Path { .. }), "the object, not its look: {node:#?}");
+    assert_eq!(fill(node).color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+    let effects: Vec<_> = node.appearance.effects.iter().map(|e| e.id.as_str()).collect();
+    assert_eq!(effects, ["stylize.dropShadow"]);
+}
+
+/// An object in a pattern's art with an art style the file defines comes in as itself, as in a
+/// symbol's art, whichever section comes first.
+#[test]
+fn an_object_in_a_patterns_art_with_a_style_this_reads_comes_in_as_itself() {
+    let pattern = format!("%AI3_BeginPattern: (P)\n(P) 0 0 10 10\n0 A\n0 Xw\n{}E\n%AI3_EndPattern\n", styled_square("Blue"));
+    for body in [format!("{ART_STYLES}{pattern}{}", layer("")), format!("{pattern}{ART_STYLES}{}", layer(""))] {
+        let r = read_ok(&body);
+        let def = r.doc.pattern("P").unwrap_or_else(|| panic!("{:?} {:?}", r.unread, r.warnings));
+        let [square] = def.art.as_slice() else { panic!("{:#?}", def.art) };
+        assert_blue_square(square);
+        assert!(!r.warnings.iter().any(|w| w.contains("drawn look")), "{:?}", r.warnings);
+    }
+}
+
+/// The same in a pattern defined in the version 7 form: a layer's tile string holding the object.
+#[test]
+fn an_object_in_a_version_7_patterns_tile_with_a_style_this_reads_comes_in_as_itself() {
+    let tile = styled_square("Blue").replace('\n', "\r");
+    let layers = format!("(0 O 0 R 0 0 0 1 k 0 0 0 1 K) @\n(\r{tile}) &\n");
+    let s = pattern_read7(&format!("{ART_STYLES}{}", pattern7("Grid", &layers)), &pattern_layer7("Art", ""));
+    let def = s.doc.pattern("Grid").unwrap_or_else(|| panic!("{:?} {:?}", s.unread, s.warnings));
+    let [square] = def.art.as_slice() else { panic!("{:#?}", def.art) };
+    assert_blue_square(square);
+}
+
+/// An object in a brush's art with an art style the file defines comes in as itself, and the brush
+/// that uses the art is kept.
+#[test]
+fn an_object_in_a_brushs_art_with_a_style_this_reads_comes_in_as_itself() {
+    let section = format!("%AI8_BeginBrushPattern\n(Dot art)\n0 A\n{}%AI8_EndBrushPattern\n", styled_square("Blue"));
+    let r = read_ok(&format!("{section}{ART_STYLES}{}{}", plugin_object(SCATTER, "Spray", SPRAY), layer("")));
+    let lib = vectorcraft_brush::library(&r.doc);
+    let spray = lib.iter().find(|b| b.name == "Spray").unwrap_or_else(|| panic!("{:?}", r.warnings));
+    assert!(matches!(spray.kind, vectorcraft_brush::BrushKind::Scatter(_)), "{:?}", spray.kind);
+    let art = spray.art();
+    let [square] = art.as_slice() else { panic!("{art:#?}") };
+    assert_blue_square(square);
+    assert!(!r.warnings.iter().any(|w| w.contains("drawn look")), "{:?}", r.warnings);
+}
+
+/// An art styles section inside a symbol's, a pattern's or a brush's art is skipped: the file's own
+/// art styles still style the layers' objects read after the definition.
+#[test]
+fn art_styles_inside_a_definition_leave_the_files_art_styles_alone() {
+    let nested = format!("%AI9_BeginArtStyles\n{}%AI9_EndArtStyles\n", fill_style("Other", "0 0 0 0 1 0 0 Xa\n"));
+    let square = styled_square("Blue");
+    let definitions = [
+        symbols(&symbol("Tag", &format!("{nested}{square}"), 1)),
+        format!("%AI3_BeginPattern: (P)\n(P) 0 0 10 10\n0 A\n0 Xw\n{nested}{square}E\n%AI3_EndPattern\n"),
+        format!("%AI8_BeginBrushPattern\n(Dot art)\n0 A\n{nested}{square}%AI8_EndBrushPattern\n"),
+    ];
+    for definition in definitions {
+        let r = read_ok(&format!("{ART_STYLES}{definition}{}", layer(&square)));
+        let a = art(&r.doc);
+        let [object] = a.as_slice() else { panic!("{definition}: {a:#?}") };
+        assert_blue_square(object);
+    }
+}
+
 /// An art style named `name` (its bytes as written) that fills with colour `xa` (`c m y k r g b Xa`).
 fn fill_style(name: &str, xa: &str) -> String {
     fill_style_with(name, xa, "")
@@ -5739,6 +6032,31 @@ fn an_object_in_a_symbols_art_with_a_listed_style_is_linked() {
     assert_eq!(art.extras().graphic_style, Some(1), "{art:#?}");
 }
 
+#[test]
+fn an_object_in_a_patterns_art_with_a_listed_style_is_linked() {
+    let defs = styles_and_list(&[fill_style("Blue", "0 0 0 0 0 0 1 Xa\n")], &["Blue"]);
+    let pattern = format!("%AI3_BeginPattern: (P)\n(P) 0 0 10 10\n0 A\n0 Xw\n{}E\n%AI3_EndPattern\n", styled_square("Blue"));
+    let r = read_ok(&format!("{defs}{pattern}{}", layer("")));
+    assert_eq!(style_names(&r.doc), [("Blue".to_string(), 1)]);
+    let def = r.doc.pattern("P").unwrap_or_else(|| panic!("{:?}", r.warnings));
+    let [square] = def.art.as_slice() else { panic!("{:#?}", def.art) };
+    assert_eq!(fill(square).color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+    assert_eq!(square.extras().graphic_style, Some(1), "{square:#?}");
+}
+
+#[test]
+fn an_object_in_a_version_7_patterns_tile_with_a_listed_style_is_linked() {
+    let defs = styles_and_list(&[fill_style("Blue", "0 0 0 0 0 0 1 Xa\n")], &["Blue"]);
+    let tile = styled_square("Blue").replace('\n', "\r");
+    let layers = format!("(0 O 0 R 0 0 0 1 k 0 0 0 1 K) @\n(\r{tile}) &\n");
+    let s = pattern_read7(&format!("{defs}{}", pattern7("Grid", &layers)), &pattern_layer7("Art", ""));
+    assert_eq!(style_names(&s.doc), [("Blue".to_string(), 1)]);
+    let def = s.doc.pattern("Grid").unwrap_or_else(|| panic!("{:?}", s.warnings));
+    let [square] = def.art.as_slice() else { panic!("{:#?}", def.art) };
+    assert_eq!(fill(square).color(), Some(Color::rgb(0.0, 0.0, 1.0)));
+    assert_eq!(square.extras().graphic_style, Some(1), "{square:#?}");
+}
+
 #[test]
 fn without_a_style_list_the_default_graphic_styles_stay() {
     let defaults = style_names(&Document::new(1.0, 1.0));
@@ -5900,6 +6218,51 @@ fn a_path_with_a_pathfinder_effect_keeps_its_drawn_look() {
     assert_eq!(effects, 0);
 }
 
+#[test]
+fn an_object_with_bas_relief_comes_in_with_its_settings() {
+    // GUARDS: Bas Relief's settings block wasn't read, so the object came in as its drawn look.
+    let settings: Vec<u8> = [
+        &[0, 0, 0, 1][..],
+        b"Dtl ",
+        &[0; 4],
+        b"long",
+        &5i32.to_be_bytes(),
+        b"Smth",
+        &[0; 4],
+        b"long",
+        &9i32.to_be_bytes(),
+        b"LghD",
+        &0x2000u32.to_be_bytes(),
+        b"LghD",
+        b"LDTR",
+    ]
+    .concat();
+    let lines: String = crate::ps::ascii85(&settings).lines().map(|l| format!("%{l}\n")).collect();
+    let style = format!(
+        "%AI9_BeginArtStyles\n\
+        /KnownStyle :\n(Carved) /Name ,\n/ActiveStyle :\n/CompoundFilter :\n(Chain Style Filter) 0 0 /Filter ,\n1 /Visible ,\n\
+        /CompoundFilter :\n(Stack Style Filter) 0 0 /Filter ,\n1 /Visible ,\n\
+        /BasicFilter :\n(Fill Style Filter) 0 0 /Filter ,\n1 /Visible ,\n/Dictionary : /NotRecorded ,\n/FillStyle : 0 O\n0 0 0 0 0 0 1 Xa\n0 1 Xd\n/Def ;\n (FillStyle) ,\n; /Dict ;\n /Part ,\n\
+        /BasicFilter :\n(Conduit Filter) 0 0 /Filter ,\n1 /Visible ,\n;\n /Part ,\n;\n /Part ,\n\
+        /BasicFilter :\n(PSAdapter_plugin_BsRl) 1 0 /Filter ,\n1 /Visible ,\n/Dictionary : /NotRecorded ,\n/Binary : /ASCII85Decode ,\n{lines}; (data) ,\n\
+        {} /Int (dataSize) ,\n; /Dict ;\n /Part ,\n;\n\
+        %AI9_EndArtStyles\n",
+        settings.len()
+    );
+    let hidden_rect = rect_path(0.0, 0.0, 10.0, 10.0).replace('\n', "\n%_");
+    let art_ = format!("0 Ae\nu\n{RED}{}f\nU\n%_0 0 0 1 k\n%_{hidden_rect}f\n1 (Carved) XW\n", rect_path(0.0, 0.0, 10.0, 10.0));
+    let r = read_ok(&format!("{style}{}", layer(&art_)));
+    let a = art(&r.doc);
+    assert_eq!(a.len(), 1);
+    assert!(matches!(a[0].kind, NodeKind::Path { .. }), "the object, not its look");
+    let [relief] = a[0].appearance.effects.as_slice() else { panic!("{:#?}", a[0].appearance) };
+    assert_eq!(
+        (relief.id.as_str(), &relief.params),
+        ("sketch.basRelief", &serde_json::json!({"detail": 5.0, "smoothness": 9.0, "lightDirection": "topRight"}))
+    );
+    assert!(!r.warnings.iter().any(|w| w.contains("drawn look")), "{:?}", r.warnings);
+}
+
 #[test]
 fn an_object_with_convert_to_shape_comes_in_as_itself_with_the_effect_live() {
     // GUARDS: `Adobe Shape Effects` wasn't read, so the object came in as its drawn look.
@@ -6581,16 +6944,21 @@ fn a_top_object_envelope_opens_live_with_its_outline() {
     bp.curve_to((120.0, 80.0), (80.0, 80.0), (40.0, 80.0));
     bp.curve_to((40.0, 60.0), (40.0, 40.0), (40.0, 20.0));
     bp.close_path();
-    let want = EnvelopeKind::TopObject { path: vectorcraft_geom::PathData::from_bezpath(&bp) };
+    let want = EnvelopeKind::TopObject { path: vectorcraft_geom::PathData::from_bezpath(&bp), corners: None };
     let r = read_ok(&layer(&envelope_of(&shape, ENVELOPE_KEYS, &envelope_content(), 3, &drawn_content(&want))));
     let a = art(&r.doc);
     assert_eq!(a.len(), 1, "{a:#?}");
     let (content, kind, ..) = live_envelope(&a[0]);
-    let EnvelopeKind::TopObject { path } = kind else { panic!("{kind:?}") };
+    let EnvelopeKind::TopObject { path, corners } = kind else { panic!("{kind:?}") };
     let anchors: Vec<Point> = path.subpaths.iter().flat_map(|s| s.anchors.iter().map(|a| a.p)).collect();
     for p in [(40.0, 20.0), (100.0, 5.0), (160.0, 20.0), (160.0, 80.0), (40.0, 80.0)] {
         assert!(anchors.iter().any(|q| (*q - Point::from(p)).hypot() < 1e-6), "{p:?} not in {anchors:?}");
     }
+    // The mesh's four corners are kept as the outline's corners.
+    let corners = corners.expect("the saved corners");
+    let at: Vec<Point> = corners.iter().map(|i| anchors[*i as usize]).collect();
+    let want_corners = [(40.0, 20.0), (160.0, 20.0), (160.0, 80.0), (40.0, 80.0)].map(Point::from);
+    assert!(at.iter().zip(want_corners).all(|(p, q)| (*p - q).hypot() < 1e-6), "{at:?}");
     // The curve through the anchor: its handles there run level.
     let mid = path.subpaths.iter().flat_map(|s| s.anchors.iter()).find(|a| (a.p - Point::new(100.0, 5.0)).hypot() < 1e-6).unwrap();
     assert!((mid.h_in.y - 5.0).abs() < 1e-6 && (mid.h_out.y - 5.0).abs() < 1e-6, "{mid:?}");
@@ -6822,7 +7190,7 @@ fn an_envelope_whose_contents_are_edited_opens_live_in_edit_contents() {
     bp.curve_to((120.0, 80.0), (80.0, 80.0), (40.0, 80.0));
     bp.curve_to((40.0, 60.0), (40.0, 40.0), (40.0, 20.0));
     bp.close_path();
-    let want = EnvelopeKind::TopObject { path: vectorcraft_geom::PathData::from_bezpath(&bp) };
+    let want = EnvelopeKind::TopObject { path: vectorcraft_geom::PathData::from_bezpath(&bp), corners: None };
     let keys = ENVELOPE_KEYS.replace("0 /Bool (AIDeformEditModeKey)", "1 /Bool (AIDeformEditModeKey)");
     let body = envelope_parts(&envelope_content(), &keys, &format!("0 g\n{mesh}"), 3, &drawn_content(&want));
     let r = read_ok(&layer(&body));
diff --git a/crates/eps/src/import/ate.rs b/crates/eps/src/import/ate.rs
index bb96b3d27..eae8bc138 100644
--- a/crates/eps/src/import/ate.rs
+++ b/crates/eps/src/import/ate.rs
@@ -424,6 +424,9 @@ struct Style {
     caps: u8,
     /// Key 35 at 3: Tate-chu-yoko, the characters set across the column as one block.
     tate_chu_yoko: bool,
+    /// Key 35 at 1 (Standard): Standard Vertical Roman Alignment, half-width characters upright in
+    /// a column. Any other value, or no key in the run, its character style or the defaults, is off.
+    standard_vertical_roman: bool,
 }
 
 /// The text document of an editing copy.
@@ -664,6 +667,7 @@ impl Texts {
             stroke_width: num("63").filter(|v| *v >= 0.0 && *v < 1e4).unwrap_or(1.0),
             caps: num("12").filter(|v| *v == 1.0 || *v == 2.0).map_or(0, |v| v as u8),
             tate_chu_yoko: num("35") == Some(3.0),
+            standard_vertical_roman: num("35") == Some(1.0),
         }
     }
 }
@@ -1206,6 +1210,7 @@ fn char_style(s: &Style, scale: f64, leading: Option<f64>) -> CharStyle {
         // At the default Small Caps size of Document Setup: the file's own isn't read.
         small_caps: (s.caps == 1).then(|| vectorcraft_doc::DocSetup::default().small_caps_size),
         tate_chu_yoko: s.tate_chu_yoko,
+        standard_vertical_roman: s.standard_vertical_roman,
         ..CharStyle::default()
     }
 }
@@ -1328,6 +1333,35 @@ mod tests {
         }
     }
 
+    /// Key 35 of a character style at 1 (Standard) is Standard Vertical Roman Alignment, from the
+    /// run, its character style or the document's defaults; at 2 (rotated), 3 (Tate-chu-yoko), a
+    /// value that isn't one of those numbers, or with no key anywhere it is off.
+    #[test]
+    fn baseline_direction_one_is_standard_vertical_roman_alignment() {
+        let texts = |defaults: &[u8]| Texts {
+            stories: vec![],
+            fonts: vec![],
+            defaults: read(defaults).unwrap(),
+            para_defaults: Val::Dict(BTreeMap::new()),
+            char_sheets: vec![read(b"/0 ([Normal Character Style]) /6 << >>").unwrap(), read(b"/0 (Rotated) /6 << /35 2 >>").unwrap()],
+            para_sheets: vec![],
+            frames: vec![],
+        };
+        let roman = |defaults: &[u8], run: &[u8]| texts(defaults).style(Some(&read(run).unwrap())).standard_vertical_roman;
+        assert!(roman(b"/35 1", b"/6 << >>"), "the document's defaults");
+        assert!(roman(b"/35 2", b"/6 << /35 1 >>"), "the run's own");
+        assert!(!roman(b"/35 1", b"/6 << /35 2 >>"), "the run's own rotated");
+        assert!(!roman(b"/35 1", b"/5 1 /6 << >>"), "its character style's");
+        assert!(roman(b"/35 2", b"/5 1 /6 << /35 1 >>"), "the run's own wins over its style");
+        assert!(!roman(b"/0 0", b"/6 << >>"), "no key: off");
+        for other in
+            [&b"/6 << /35 3 >>"[..], b"/6 << /35 1.5 >>", b"/6 << /35 (1) >>", b"/6 << /35 -1 >>", b"/6 << /35 true >>", b"/6 << /35 [ 1 ] >>"]
+        {
+            assert!(!roman(b"/0 0", other), "{}", String::from_utf8_lossy(other));
+        }
+        assert!(texts(b"/35 3").style(None).tate_chu_yoko && !texts(b"/35 3").style(None).standard_vertical_roman);
+    }
+
     /// A right-to-left paragraph is laid out right to left even when it has no right-to-left
     /// letters (a dimension's label " 120.5 mm " reads "mm 120.5"); a left-to-right one, or one
     /// that doesn't say, goes by its letters.
@@ -1597,6 +1631,7 @@ mod tests {
                     stroke_width: 1.0,
                     caps: 0,
                     tate_chu_yoko: false,
+                    standard_vertical_roman: false,
                 },
             )],
             path_spacing: 0.0,
diff --git a/crates/eps/src/import/native/build.rs b/crates/eps/src/import/native/build.rs
index bdb99e94c..7e6dd4cfc 100644
--- a/crates/eps/src/import/native/build.rs
+++ b/crates/eps/src/import/native/build.rs
@@ -9,6 +9,7 @@ use super::slots::{
 use super::{
     Affine, Arc, BTreeSet, Document, Node, NodeId, NodeKind, PathData, Rect, Scaling, Story, Structure, Texts, Unit, VariableKind, Vec2, ai,
 };
+use vectorcraft_doc::PlacedDocument;
 
 /// Which box of the editing copy is the page.
 #[derive(Clone, Copy)]
@@ -203,6 +204,7 @@ pub(super) fn build_from(
         restyled,
         placeholders,
         placed_elsewhere,
+        placed_pages,
         envelopes_drawn,
         styles_read,
         canvas_scale,
@@ -491,6 +493,7 @@ pub(super) fn build_from(
     }
     doc.limit_depth_noting(&mut notes);
     bind_variables(&mut doc, &bindings, bindings_skipped, &xml_ids, &filled, &mut notes);
+    placed_documents(&mut doc, &placed_pages);
     if small.is_some() {
         scale_document(&mut doc, unit, styles_read);
         relayout_wrapped(&mut doc);
@@ -498,6 +501,56 @@ pub(super) fn build_from(
     Ok((doc, notes))
 }
 
+/// The linked images of `pages` that are still in `doc`, opacity-mask art included, as placed
+/// documents of their page and box, over the same place, each showing the same preview until its
+/// file is read. An image bound to an image variable stays a linked image, the object an image
+/// variable binds.
+fn placed_documents(doc: &mut Document, pages: &[ai::PlacedPage]) {
+    if pages.is_empty() {
+        return;
+    }
+    let vars = &doc.variables;
+    let image_bound = |id: &NodeId| {
+        vars.bindings.get(id).is_some_and(|names| names.iter().any(|v| vars.variable(v).is_some_and(|v| v.kind == VariableKind::Image)))
+    };
+    let pages: std::collections::HashMap<NodeId, ai::PlacedPage> = pages.iter().filter(|p| !image_bound(&p.id)).map(|p| (p.id, *p)).collect();
+    for layer in &mut doc.layers {
+        to_placed_documents(Arc::make_mut(layer), &pages);
+    }
+}
+
+/// [`placed_documents`] in `n` and everything in it.
+fn to_placed_documents(n: &mut Node, pages: &std::collections::HashMap<NodeId, ai::PlacedPage>) {
+    // A box too small to take the image's pixels to (its transform not finite) keeps the linked image.
+    if let Some(page) = pages.get(&n.id)
+        && let NodeKind::Image(im) = &n.kind
+        && let Some(link) = &im.link
+        && let (width, height) = page.size
+        && let xf = im.xf * Affine::scale_non_uniform(f64::from(im.width) / width, f64::from(im.height) / height)
+        && xf.as_coeffs().iter().all(|v| v.is_finite())
+        && xf.determinant().abs() > 1e-12
+    {
+        let link = vectorcraft_doc::LinkInfo { page: Some(page.page), ..link.clone() };
+        let placed = PlacedDocument {
+            link,
+            key: im.key.clone(),
+            bounding: page.bounding,
+            page_box: page.page_box,
+            width,
+            height,
+            xf,
+            placement: im.placement,
+        };
+        n.kind = NodeKind::PlacedDocument(Box::new(placed));
+    }
+    if let Some(m) = n.extras_if_any().and_then(|e| e.mask.as_mut()) {
+        to_placed_documents(Arc::make_mut(&mut m.art), pages);
+    }
+    for c in n.children_mut().into_iter().flatten() {
+        to_placed_documents(Arc::make_mut(c), pages);
+    }
+}
+
 /// Bind the objects of `doc` to the variables of its library that `bindings` binds them to, each
 /// object named by its XML id (`ids`: the object read with that id, or what `filled` made of a text
 /// object's slot: for a visibility variable every object that took the slot's place, for a text
diff --git a/crates/eps/src/import/tests_illustrator.rs b/crates/eps/src/import/tests_illustrator.rs
index b896063aa..70363dfaf 100644
--- a/crates/eps/src/import/tests_illustrator.rs
+++ b/crates/eps/src/import/tests_illustrator.rs
@@ -444,7 +444,7 @@ fn a_version_7_palette_keeps_its_swatches_without_names() {
     let spot = d.swatch("Spot A").unwrap();
     assert!(spot.spot && spot.global, "{spot:?}");
     assert!(d.swatches.iter().filter(|s| s.name != "Spot A").all(|s| !s.spot && !s.global));
-    assert!(matches!(&d.swatch("B&W").unwrap().paint, Paint::Gradient(g) if g.swatch.as_deref() == Some("B&W")));
+    assert!(matches!(&d.swatch("B&W").unwrap().paint, Paint::Gradient(g) if g.swatch.is_none()));
     assert_eq!(d.swatch("Gray K=0").unwrap().paint.color(), Some(Color::gray(0.0)), "1 g is white");
 }
 
@@ -481,8 +481,8 @@ fn gradient_names_are_shown_up_to_their_newline() {
         let names: Vec<&str> = d.swatches.iter().map(|s| s.name.as_str()).collect();
         let expected: Vec<&str> = ["[None]"].into_iter().chain((!own.is_empty()).then_some("Sky")).chain([first, second]).collect();
         assert_eq!(names, expected, "{:?}", r.warnings);
-        assert_eq!(first_stop(&d.swatch(first).unwrap().paint), (Some(first.into()), Some(Color::gray(0.0))));
-        assert_eq!(first_stop(&d.swatch(second).unwrap().paint), (Some(second.into()), Some(Color::gray(0.5))));
+        assert_eq!(first_stop(&d.swatch(first).unwrap().paint), (None, Some(Color::gray(0.0))));
+        assert_eq!(first_stop(&d.swatch(second).unwrap().paint), (None, Some(Color::gray(0.5))));
         let art = d.layers[0].children().unwrap();
         let fills: Vec<_> = art.iter().map(|n| first_stop(&n.appearance.fill().unwrap().paint)).collect();
         assert_eq!(fills, [(Some(second.into()), Some(Color::gray(0.5))), (Some(first.into()), Some(Color::gray(0.0)))]);
diff --git a/crates/eps/src/import/tests_native.rs b/crates/eps/src/import/tests_native.rs
index a2d6ec2af..32c4ff796 100644
--- a/crates/eps/src/import/tests_native.rs
+++ b/crates/eps/src/import/tests_native.rs
@@ -1331,6 +1331,22 @@ fn an_ai_file_that_comes_in_as_its_pdf_part_keeps_the_swatches_of_its_palette()
     assert!(d.swatch("Red ink").is_some_and(|s| s.spot));
 }
 
+/// A `.ai` gradient library (a palette of gradient swatches and no layers) gets the palette's
+/// gradient swatches, each holding its gradient without a link to a swatch.
+#[test]
+fn an_ai_file_without_layers_keeps_the_gradients_of_its_palette_unlinked() {
+    let sky = "%AI5_BeginGradient: (Sky)\n(Sky) 0 2 Bd\n[\n%_1 0 50 0 Bs\n%_0 0 50 100 Bs\nBD\n%AI5_EndGradient\n";
+    let palette = "%AI5_BeginPalette\n0 0 Pb\nBb\n2 (Sky) 0 0 0 1 1 0 0 1 0 0 1 Bg\n0 BB\n(Sky)\nPc\nPB\n%AI5_EndPalette\n";
+    let art = native(&format!("{sky}{palette}"));
+    let (d, warnings, read) = crate::layered_ai(&private(&art), pdf_part(10.0, 86.0), vec![], false, true, 1.0);
+    assert!(!read, "{warnings:?}");
+    let swatches: Vec<&str> = d.swatches.iter().map(|s| s.name.as_str()).collect();
+    assert_eq!(swatches, ["[None]", "Sky"], "{warnings:?}");
+    let Some(vectorcraft_color::Paint::Gradient(g)) = d.swatch("Sky").map(|s| &s.paint) else { panic!("{:?}", d.swatch("Sky")) };
+    assert_eq!(g.swatch, None, "the swatch's own paint");
+    assert_eq!(g.gradient.stops.len(), 2);
+}
+
 /// A `.ai` pattern library (a palette of pattern swatches and no layers) whose PDF part defines no
 /// pattern gets the patterns its editing data defines with the palette's pattern swatches.
 #[test]
@@ -2828,6 +2844,32 @@ fn a_tate_chu_yoko_run_is_marked() {
     assert_eq!(marked, [("§".to_string(), false), ("12".to_string(), true), ("§".to_string(), false)]);
 }
 
+#[test]
+fn a_standard_baseline_run_keeps_standard_vertical_roman_alignment() {
+    // Three runs over "ab12": "ab" with key 35 at 1 (Standard), "1" at 2 (rotated), "2" without it.
+    // Horizontal type keeps the mark too.
+    for vertical in [true, false] {
+        let doc = text_document(&[("ab12\r", 0, (8200.0, 8180.0), (0.0, 0.0), 0.0)]);
+        let doc = if vertical { vertical_text_document(&doc, 0.0) } else { doc };
+        let run = |n: u32, own: &str| {
+            format!(
+                "<< /0 << /0 << /0 () /5 0 /6 << /0 0 /1 14.0 {own}/53 << /99 /CAITextPaint /0 << /0 2 /1 [ 1.0 0.0 1.0 0.0 0.0 ] >> >> >> >> >> /1 {n} >>"
+            )
+        };
+        let one = run(5, "");
+        assert!(doc.contains(&one));
+        let doc = doc.replacen(&one, &format!("{} {} {}", run(2, "/35 1 "), run(1, "/35 2 "), run(2, "")), 1);
+        let art = native_with_text(&(layer("Back", true, &square(10, 10)) + &layer("Spare", false, &text_object(0))), &doc);
+        let r = import(&eps(&page_square(10, 10), &art)).unwrap();
+        let texts = text_of(&r.document.layers[1]);
+        assert_eq!(texts.len(), 1, "{:?}", r.warnings);
+        assert_eq!(texts[0].vertical, vertical);
+        let marked: Vec<(String, bool, bool)> =
+            texts[0].runs.iter().map(|r| (r.text.clone(), r.style.standard_vertical_roman, r.style.tate_chu_yoko)).collect();
+        assert_eq!(marked, [("ab".to_string(), true, false), ("1".to_string(), false, false), ("2".to_string(), false, false)], "{vertical}");
+    }
+}
+
 #[test]
 fn orientation_and_tate_chu_yoko_values_it_cant_use_are_ignored() {
     for bad in ["(2)", "2.5", "1e300", "-2", "1", "true", "[ 2 ]"] {
@@ -2840,6 +2882,8 @@ fn orientation_and_tate_chu_yoko_values_it_cant_use_are_ignored() {
         assert_eq!(texts.len(), 1, "{bad}: {:?}", r.warnings);
         assert!(!texts[0].vertical, "{bad}");
         assert!(texts[0].runs.iter().all(|r| !r.style.tate_chu_yoko), "{bad}");
+        // Key 35 at 1 is Standard Vertical Roman Alignment; the other values leave it off.
+        assert!(texts[0].runs.iter().all(|r| r.style.standard_vertical_roman == (bad == "1")), "{bad}");
     }
 }
 
@@ -5329,6 +5373,103 @@ fn a_placed_file_at_its_boxs_corner_matches_the_page() {
     assert!([b.x0 - 30.0, b.y0 - 30.0, b.x1 - 70.0, b.y1 - 70.0].iter().all(|v| v.abs() < 0.01), "on the page's square: {b:?}");
 }
 
+/// A placed file of [`a_placed_file_at_its_boxs_corner_matches_the_page`] whose dictionary names
+/// page 2 and its media box: `%_` lines when `hidden` (art inside another object's dictionary).
+fn placed_page_two(hidden: bool) -> String {
+    let lines = [
+        "%AI5_BeginPlace".to_string(),
+        "%%FileType: 1".into(),
+        "[1 0 0 -1 -7970 8070] 8000 8000 8040 8040 4 4 0".into(),
+        "(/files/pages.pdf)`".into(),
+        "%AI26_BeginPlacedObjectPreview".into(),
+        format!("2 2 8 32 17 {}", "\x7f\0\0\0".repeat(4)),
+        "%AI26_EndPlacedObjectPreview".into(),
+        "~".into(),
+        "%AI5_EndPlace".into(),
+    ];
+    let hide = if hidden { "%_" } else { "" };
+    let place: String = lines.iter().map(|l| format!("{hide}{l}\n")).collect();
+    format!(
+        "{place}%_/ArtDictionary :\n%_/XMLUID : (pages) ; (AI10_ArtUID) ,\n%_2 /Int (AI11 PlacedPDFPageIndex) ,\n%_4 /Int (AI11 PlacedPDFCropTo) ,\n%_;\n%_\n"
+    )
+}
+
+/// The placed document of `n`, with its bounds.
+fn placed_document(n: &Node) -> (&vectorcraft_doc::PlacedDocument, vectorcraft_geom::Rect) {
+    let NodeKind::PlacedDocument(p) = &n.kind else { panic!("{:?}", n.kind) };
+    (p, n.geometric_bounds().unwrap())
+}
+
+/// A placed PDF page comes in as a placed document of its page and box, where its linked image
+/// would have gone: at its box's corner when that is where the layers draw as the page does.
+#[test]
+fn a_placed_pdf_page_is_a_placed_document_where_its_image_would_be() {
+    let data = native(&layer("Jig", true, &placed_page_two(false))).replace("%AI5_NumLayers", "%AI3_TemplateBox: 100 50 100 50\n%AI5_NumLayers");
+    let mut page = Document::new(100.0, 100.0);
+    let id = page.alloc_id();
+    let path = vectorcraft_geom::shapes::rectangle(vectorcraft_geom::Rect::new(30.0, 30.0, 70.0, 70.0));
+    let grey = vectorcraft_doc::FillLayer::new(vectorcraft_color::Paint::solid(vectorcraft_color::Color::gray(0.5)));
+    let n = Node::path(id, path, vectorcraft_doc::Appearance { items: vec![vectorcraft_doc::AppearanceItem::Fill(grey)], ..Default::default() });
+    let l = page.layers[0].id;
+    page.insert(Some(l), 0, n).unwrap();
+    let (d, w, read) = crate::layered_ai(&private(&data), page, vec![], false, false, 1.0);
+    assert!(read, "{w:?}");
+    let (p, b) = placed_document(&d.layers[0].children().unwrap()[0]);
+    assert_eq!((p.link.path.as_str(), p.link.page, p.page_box, p.bounding), ("/files/pages.pdf", Some(2), vectorcraft_doc::PageBox::Media, false));
+    assert_eq!((p.width, p.height), (40.0, 40.0));
+    assert!([b.x0 - 30.0, b.y0 - 30.0, b.x1 - 70.0, b.y1 - 70.0].iter().all(|v| v.abs() < 0.01), "on the page's square: {b:?}");
+    assert!(d.images[&p.key].is_proxy(), "the preview until the file is read");
+}
+
+/// A placed PDF page in an object's opacity mask is a placed document there too.
+#[test]
+fn a_placed_pdf_page_in_an_opacity_mask_is_a_placed_document() {
+    let mask = format!("%_/ArtDictionary :\n%_/Mask :\n%_X=\n{}%_X+\n%_ (Art) ,\n%_; (AI9_Mask) ,\n%_;\n%_\n", placed_page_two(true));
+    let data = native(&layer("Masked", true, &format!("{}\n{mask}", square(10, 10))));
+    let (d, notes) = crate::ai_alone(&private(&data)).unwrap();
+    let square = &d.layers[0].children().unwrap()[0];
+    let mask = square.extras().mask.clone().unwrap_or_else(|| panic!("{notes:?}"));
+    let art = if let NodeKind::Group { children, .. } = &mask.art.kind { children[0].clone() } else { mask.art.clone() };
+    let (p, _) = placed_document(&art);
+    assert_eq!((p.link.page, p.page_box), (Some(2), vectorcraft_doc::PageBox::Media));
+}
+
+/// A placed PDF page whose box is too small for a finite placement stays a linked image.
+#[test]
+fn a_placed_pdf_page_too_small_to_place_stays_a_linked_image() {
+    let place = placed_page_two(false).replace("[1 0 0 -1 -7970 8070] 8000 8000 8040 8040", "[1e308 0 0 -1 0 200] 0 0 1e-309 2");
+    let data = native(&layer("Jig", true, &place));
+    let (d, notes) = crate::ai_alone(&private(&data)).unwrap();
+    let mut kinds = vec![];
+    d.walk(|n| match &n.kind {
+        NodeKind::Image(im) => kinds.push(("image", im.xf.as_coeffs().iter().all(|v| v.is_finite()))),
+        NodeKind::PlacedDocument(p) => kinds.push(("placed", p.xf.as_coeffs().iter().all(|v| v.is_finite()))),
+        _ => {}
+    });
+    assert_eq!(kinds, [("image", true)], "{notes:?}");
+}
+
+/// A placed PDF page bound to an image variable stays a linked image, the object an image variable
+/// binds, so the binding is kept.
+#[test]
+fn a_placed_pdf_page_bound_to_an_image_variable_stays_a_linked_image() {
+    use vectorcraft_testkit::ai::{XmlValue, variable_library_data, xml_element, xml_node};
+    let declared = vec![xml_node(
+        1,
+        "variable",
+        XmlValue::Str(""),
+        &[("trait", XmlValue::Str("fileref")), ("varName", XmlValue::Unicode("v_file")), ("docRef", XmlValue::Raw("/XMLUIDREF : (pages) ;"))],
+        &[],
+    )];
+    let set = xml_element("variableSet", &[("locked", "none")], &[xml_element("variables", &[], &declared)]);
+    let library = variable_library_data(&xml_element("variableSets", &[], &[set]));
+    let data = native(&(library + &layer("Jig", true, &placed_page_two(false))));
+    let (d, notes) = crate::ai_alone(&private(&data)).unwrap();
+    let n = &d.layers[0].children().unwrap()[0];
+    assert!(matches!(&n.kind, NodeKind::Image(im) if im.link.as_ref().is_some_and(|l| l.page.is_none())), "{:?} {notes:?}", n.kind);
+    assert_eq!(d.variables.objects_of("v_file"), [n.id], "{notes:?}");
+}
+
 #[test]
 fn a_small_placed_file_goes_where_it_draws_closer_to_the_page() {
     // A 2 × 2 placed file (a small logo on a large page) whose box corner the matrix takes to
diff --git a/crates/eps/src/legacy_ai.rs b/crates/eps/src/legacy_ai.rs
index 412961802..de2c9b384 100644
--- a/crates/eps/src/legacy_ai.rs
+++ b/crates/eps/src/legacy_ai.rs
@@ -66,7 +66,7 @@ use vectorcraft_color::cms::Cms;
 use vectorcraft_color::{BlendMode, Color, Gradient, GradientKind, GradientPaint, Paint};
 use vectorcraft_doc::{
     AppearanceItem, AreaOptions, CharPosition, CharStyle, Document, FillLayer, ImageBlob, Justify, LAYER_COLORS, LayerColor, Node, NodeKind,
-    ParaDirection, ParaStyle, PathEffect, StrokeLayer, TextKind, TextObject,
+    ParaDirection, ParaStyle, PathAlign, PathEffect, StrokeLayer, TextKind, TextObject,
 };
 use vectorcraft_effects::stroke;
 use vectorcraft_geom::{Affine, BezPath, FillRule, PathData, Rect, Shape, SubPath, Vec2};
@@ -96,7 +96,7 @@ const HEX_LINE: usize = 60;
 pub const SUBLAYERS: &str = "sublayers are written as groups in their top-level layer (legacy .ai files have no sublayers)";
 pub const TYPE: &str = "type a legacy .ai can't hold as text (characters outside Windows Latin-1, vertical type, ruby, inline graphics, gradient or pattern fills) is written as outlines";
 pub const ROTATED_TYPE: &str = "type with rotated characters is written as outlines, which keep the rotation, and is no longer editable text (legacy .ai text can't rotate characters)";
-pub const TYPE_ATTRIBUTES: &str = "type attributes legacy .ai files don't have (underline, strikethrough, small caps, superscript and subscript, OpenType features, Variable Font settings, area type options, type on a path effects, space after paragraphs, tabs, bulleted and numbered lists) are left out";
+pub const TYPE_ATTRIBUTES: &str = "type attributes legacy .ai files don't have (underline, strikethrough, manual kerning, optical kerning, small caps, superscript and subscript, OpenType features, Variable Font settings, optical margin alignment, System Layout, fractional widths off, area type options, type on a path's effect, alignment and spacing, an end bracket short of the path's end, subpaths after the first in an area type frame or a type path, space after paragraphs, tabs, bulleted and numbered lists) are left out";
 pub const HIDDEN: &str = "hidden objects are left out (hidden layers are kept, hidden)";
 pub const HIDDEN_LAYER: &str = "hidden objects are moved to a hidden layer above their own (legacy .ai files can hide only layers)";
 pub const HIDDEN_SHOWN: &str = "hidden objects are written visible (legacy .ai files can hide only layers)";
diff --git a/crates/eps/src/legacy_ai/encoding.rs b/crates/eps/src/legacy_ai/encoding.rs
index ee8de7c16..c2346cbb9 100644
--- a/crates/eps/src/legacy_ai/encoding.rs
+++ b/crates/eps/src/legacy_ai/encoding.rs
@@ -1,7 +1,7 @@
 use super::writer::Writer;
 use super::{
-    Affine, AreaOptions, BezPath, CharPosition, CharStyle, Gradient, GradientKind, Paint, ParaStyle, PathEffect, StrokeLayer, TextKind, TextObject,
-    Write, latin, ps, stroke,
+    Affine, AreaOptions, BezPath, CharPosition, CharStyle, Gradient, GradientKind, Paint, ParaStyle, PathAlign, PathEffect, StrokeLayer, TextKind,
+    TextObject, Write, latin, ps, stroke,
 };
 
 /// A gradient definition: `%AI5_BeginGradient: (name)`, `(name) type stops Bd`, `[`, the stops
@@ -114,6 +114,8 @@ pub(super) fn lost_attributes(t: &TextObject) -> bool {
     let run_lost = |s: &CharStyle| {
         s.underline
             || s.strikethrough
+            || s.kerning.is_some_and(|k| k != 0.0)
+            || s.optical_kerning
             || s.small_caps.is_some()
             || s.position != CharPosition::Normal
             || !s.features.is_empty()
@@ -122,8 +124,28 @@ pub(super) fn lost_attributes(t: &TextObject) -> bool {
     let para_lost = |p: &ParaStyle| p.space_after != 0.0 || !p.tabs.is_empty() || p.list.is_some();
     t.runs.iter().any(|r| run_lost(&r.style))
         || t.paragraph_styles().iter().any(para_lost)
+        || t.optical_margin
+        || t.system_layout
+        || !t.fractional_widths
         || (matches!(t.kind, TextKind::Area { .. }) && t.area != AreaOptions::default())
-        || (matches!(t.kind, TextKind::OnPath { .. }) && (t.path_effect != PathEffect::default() || t.path_spacing != 0.0))
+        || (matches!(t.kind, TextKind::OnPath { .. })
+            && (t.path_effect != PathEffect::default() || t.path_align != PathAlign::default() || t.path_spacing != 0.0 || end_bracket(t)))
+        || several_paths(&t.kind)
+}
+
+/// Does type on a path `t` end before its path does (an open path's end, or once around a
+/// closed path)? A legacy `.ai` text path holds where the type starts and no end (§15).
+fn end_bracket(t: &TextObject) -> bool {
+    let (TextKind::OnPath { path, .. }, Some((start, end))) = (&t.kind, t.kind.path_span()) else { return false };
+    let reach = if path.is_closed() { end - start } else { end };
+    reach < 1.0 - 1e-9
+}
+
+/// Has the frame of area type, or the path of type on a path, `kind` more than one subpath with
+/// anchors? A legacy `.ai` text object is written with the first one only.
+fn several_paths(kind: &TextKind) -> bool {
+    let (TextKind::Area { frame: path } | TextKind::OnPath { path, .. }) = kind else { return false };
+    path.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).count() > 1
 }
 
 /// The font type in style `st` is set in: its PostScript name, whether it's TrueType, and its
diff --git a/crates/eps/src/legacy_ai/tests.rs b/crates/eps/src/legacy_ai/tests.rs
index 851228ea6..b34c127a7 100644
--- a/crates/eps/src/legacy_ai/tests.rs
+++ b/crates/eps/src/legacy_ai/tests.rs
@@ -1105,6 +1105,85 @@ fn variable_font_settings_are_warned_as_left_out() {
     assert!(String::from_utf8(out.bytes).unwrap().contains("(H\\351llo \\2005\\r) Tx\n"), "still written as text");
 }
 
+/// A legacy `.ai` text path holds the path and where the type starts on it, and no Align to Path
+/// or end bracket: type on a path with either is written as text, with the warning that they are
+/// left out. An end bracket at the end of an open path, or once around a closed one, is kept. A
+/// path with a second subpath is written with its first one only, with the same warning.
+#[test]
+fn type_on_a_path_alignment_and_end_bracket_are_warned_as_left_out() {
+    use vectorcraft_doc::{PathAlign, TextKind, TextObject};
+    let along = |closed: bool| {
+        let pts = [(150.0, 150.0).into(), (250.0, 150.0).into(), (250.0, 190.0).into()];
+        PathData::new(vec![vectorcraft_geom::SubPath::polyline(&pts, closed)])
+    };
+    let warned = |edit: &dyn Fn(&mut TextObject)| {
+        let mut doc = Document::new(300.0, 200.0);
+        let layer = doc.layers[0].id;
+        let mut t = TextObject::point(vectorcraft_geom::Point::ZERO, "Along", style(12.0, Paint::solid(Color::BLACK)));
+        t.kind = TextKind::OnPath { path: along(false), start: 0.25, end: None };
+        t.xf = Affine::IDENTITY;
+        edit(&mut t);
+        let n = Node::new(doc.alloc_id(), NodeKind::Text(Box::new(t)));
+        doc.insert(Some(layer), usize::MAX, n).unwrap();
+        let out = write(&doc);
+        assert!(String::from_utf8(out.bytes).unwrap().contains("(Along) Tx\n"), "still written as text");
+        out.warnings.iter().any(|w| w == TYPE_ATTRIBUTES)
+    };
+    assert!(!warned(&|_| {}));
+    for align in [PathAlign::Ascender, PathAlign::Descender, PathAlign::Center] {
+        assert!(warned(&|t| t.path_align = align), "{align:?}");
+    }
+    assert!(warned(&|t| t.kind = TextKind::OnPath { path: along(false), start: 0.25, end: Some(0.6) }));
+    assert!(warned(&|t| t.kind = TextKind::OnPath { path: along(true), start: 0.25, end: Some(0.9) }));
+    assert!(!warned(&|t| t.kind = TextKind::OnPath { path: along(false), start: 0.25, end: Some(1.0) }));
+    assert!(!warned(&|t| t.kind = TextKind::OnPath { path: along(true), start: 0.1, end: Some(0.1) }));
+    assert!(!warned(&|t| t.kind = TextKind::OnPath { path: along(true), start: 0.7, end: None }));
+    // A closed path's span that wraps past the path's start and stops short of a full turn.
+    assert!(warned(&|t| t.kind = TextKind::OnPath { path: along(true), start: 0.7, end: Some(0.5) }));
+    // An open path's end bracket before its start bracket.
+    assert!(warned(&|t| t.kind = TextKind::OnPath { path: along(false), start: 0.5, end: Some(0.3) }));
+    let two = |first_closed: bool| {
+        let mut path = along(first_closed);
+        let pts = [(150.0, 100.0).into(), (250.0, 100.0).into()];
+        path.subpaths.push(vectorcraft_geom::SubPath::polyline(&pts, false));
+        path
+    };
+    assert!(warned(&|t| t.kind = TextKind::OnPath { path: two(true), start: 0.25, end: None }));
+    assert!(warned(&|t| t.kind = TextKind::OnPath { path: two(false), start: 0.25, end: None }));
+}
+
+/// Kerning other than Auto or 0, optical kerning, Optical Margin Alignment, System Layout,
+/// fractional widths off and an area type frame with a second subpath are not held by a legacy
+/// `.ai` text object: type with any of them is written as text, with the warning that they are
+/// left out.
+#[test]
+fn kerning_margins_widths_and_extra_frames_are_warned_as_left_out() {
+    use vectorcraft_doc::{TextKind, TextObject};
+    let warned = |edit: &dyn Fn(&mut TextObject)| {
+        let mut doc = typed();
+        let id = texts(&doc)[0].0.id;
+        if let Some(NodeKind::Text(t)) = doc.node_mut(id).map(|n| &mut n.kind) {
+            edit(t);
+        }
+        let out = write(&doc);
+        assert!(String::from_utf8(out.bytes).unwrap().contains(") Tx\n"), "still written as text");
+        out.warnings.iter().any(|w| w == TYPE_ATTRIBUTES)
+    };
+    assert!(!warned(&|_| {}));
+    assert!(!warned(&|t| t.runs[0].style.kerning = Some(0.0)));
+    assert!(warned(&|t| t.runs[0].style.kerning = Some(50.0)));
+    assert!(warned(&|t| t.runs[0].style.optical_kerning = true));
+    assert!(warned(&|t| t.optical_margin = true));
+    assert!(warned(&|t| t.system_layout = true));
+    assert!(warned(&|t| t.fractional_widths = false));
+    let square = |x: f64| {
+        let pts = [(x, 10.0).into(), (x + 80.0, 10.0).into(), (x + 80.0, 90.0).into(), (x, 90.0).into()];
+        vectorcraft_geom::SubPath::polyline(&pts, true)
+    };
+    assert!(!warned(&|t| t.kind = TextKind::Area { frame: PathData::new(vec![square(10.0)]) }));
+    assert!(warned(&|t| t.kind = TextKind::Area { frame: PathData::new(vec![square(10.0), square(120.0)]) }));
+}
+
 /// Type whose font size measures the cap height is written at the em size it is drawn at, with
 /// no warning: 14 pt measuring a 0.7 em cap height reads back as 20 pt type.
 #[test]
diff --git a/crates/format/src/lib.rs b/crates/format/src/lib.rs
index f82cd4eb1..b3aa7eab7 100644
--- a/crates/format/src/lib.rs
+++ b/crates/format/src/lib.rs
@@ -45,11 +45,13 @@ mod stream;
 mod unpack;
 
 use std::collections::{BTreeMap, HashSet};
+use std::fmt;
 use std::io::Write;
 use std::sync::Arc;
 
 use craft_vectorcraft_format::{Contents, Head, Image, ReadError, Tail};
-use serde::Serialize;
+use serde::de::{DeserializeSeed, IgnoredAny, MapAccess, SeqAccess, Visitor};
+use serde::{Deserializer, Serialize};
 use vectorcraft_doc::{Document, ImageBlob};
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -146,6 +148,9 @@ pub struct SaveOptions {
     pub profiles: BTreeMap<String, Vec<u8>>,
     /// Create PDF-Compatible File: a PDF of the document to carry.
     pub pdf: Option<Vec<u8>>,
+    /// The application's PDF save preference, retained even when there are no artboards to draw.
+    /// `None` omits this metadata, preserving the lower-level writer's existing output.
+    pub pdf_compatible: Option<bool>,
     /// Decimal places to round path anchors and handles to ([`Document::round_geometry`]), at
     /// most [`MAX_PRECISION`] (a larger value rounds to that many); `None` writes them exactly.
     pub precision: Option<u8>,
@@ -164,6 +169,7 @@ impl Default for SaveOptions {
             include_linked: false,
             profiles: BTreeMap::new(),
             pdf: None,
+            pdf_compatible: None,
             precision: None,
         }
     }
@@ -327,6 +333,9 @@ pub fn save_to(doc: &Document, o: &SaveOptions, w: impl Write) -> Result<(), For
     env.field(&mut out, "format", &if o.version < 3 { LEGACY_EXTENSION } else { EXTENSION })?;
     env.field(&mut out, "version", &o.version)?;
     env.field(&mut out, "generator", &format!("VectorCraft {}", env!("CARGO_PKG_VERSION")))?;
+    if let Some(compatible) = o.pdf_compatible {
+        env.field(&mut out, "pdfCompatible", &compatible)?;
+    }
     if let Some(png) = &o.preview {
         env.field(&mut out, "preview", &Image::inline("image/png", png))?;
     }
@@ -470,6 +479,9 @@ pub struct FileInfo {
     pub version: u32,
     /// Written under the project's former name (`"format": "drawcraft"`).
     pub legacy: bool,
+    /// The saved `pdfCompatible` preference, or the presence of a non-null `pdf` member in
+    /// files without a boolean preference. The PDF payload is not read or validated.
+    pub pdf_compatible: bool,
 }
 
 impl FileInfo {
@@ -511,7 +523,8 @@ fn load_file_within(bytes: &[u8], max_nodes: usize, max_values: usize) -> Result
         ReadError::Envelope(e) => e.into(),
         e => FormatError::NotVectorcraft(e.to_string()),
     })?;
-    let info = FileInfo { version: f.version, legacy: f.format == LEGACY_EXTENSION };
+    let pdf_compatible = pdf_member(file.json()).map_err(|e| FormatError::NotVectorcraft(e.to_string()))?;
+    let info = FileInfo { version: f.version, legacy: f.format == LEGACY_EXTENSION, pdf_compatible };
     // A version 1 document saved before VectorCraft 0.21.0, or for an app before it (an older file
     // version): its Twist angles turned the other way. The app that wrote it is read from the JSON
     // before the data after it is taken; the walk's depth is bounded by the JSON reader's nesting
@@ -602,6 +615,92 @@ fn load_file_within(bytes: &[u8], max_nodes: usize, max_values: usize) -> Result
     Ok(NativeFile { doc, depth_notes, info, profiles })
 }
 
+/// The saved PDF preference, falling back to the presence of its payload without retaining or
+/// decoding it. The array form has neither member. Repeated members use their last value.
+fn pdf_member(json: &[u8]) -> Result<bool, serde_json::Error> {
+    struct PdfMember;
+    impl<'de> Visitor<'de> for PdfMember {
+        type Value = bool;
+
+        fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+            f.write_str("a native file envelope")
+        }
+
+        fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<bool, A::Error> {
+            let mut present = false;
+            let mut preference = None;
+            while let Some(key) = map.next_key::<String>()? {
+                match key.as_str() {
+                    "pdfCompatible" => preference = map.next_value_seed(Preference)?,
+                    "pdf" => present = map.next_value::<Option<IgnoredAny>>()?.is_some(),
+                    _ => {
+                        map.next_value::<IgnoredAny>()?;
+                    }
+                }
+            }
+            Ok(preference.unwrap_or(present))
+        }
+
+        fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> Result<bool, A::Error> {
+            while seq.next_element::<IgnoredAny>()?.is_some() {}
+            Ok(false)
+        }
+    }
+    serde_json::Deserializer::from_slice(json).deserialize_any(PdfMember)
+}
+
+/// A `pdfCompatible` value: `Some` for a boolean, `None` for null or any other value, which is
+/// skipped without being kept, as an unknown member is.
+struct Preference;
+
+impl<'de> DeserializeSeed<'de> for Preference {
+    type Value = Option<bool>;
+
+    fn deserialize<D: Deserializer<'de>>(self, d: D) -> Result<Option<bool>, D::Error> {
+        d.deserialize_any(self)
+    }
+}
+
+impl<'de> Visitor<'de> for Preference {
+    type Value = Option<bool>;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str("any value")
+    }
+
+    fn visit_bool<E>(self, v: bool) -> Result<Option<bool>, E> {
+        Ok(Some(v))
+    }
+
+    fn visit_i64<E>(self, _: i64) -> Result<Option<bool>, E> {
+        Ok(None)
+    }
+
+    fn visit_u64<E>(self, _: u64) -> Result<Option<bool>, E> {
+        Ok(None)
+    }
+
+    fn visit_f64<E>(self, _: f64) -> Result<Option<bool>, E> {
+        Ok(None)
+    }
+
+    fn visit_str<E>(self, _: &str) -> Result<Option<bool>, E> {
+        Ok(None)
+    }
+
+    fn visit_unit<E>(self) -> Result<Option<bool>, E> {
+        Ok(None)
+    }
+
+    fn visit_seq<A: SeqAccess<'de>>(self, seq: A) -> Result<Option<bool>, A::Error> {
+        IgnoredAny.visit_seq(seq).map(|_| None)
+    }
+
+    fn visit_map<A: MapAccess<'de>>(self, map: A) -> Result<Option<bool>, A::Error> {
+        IgnoredAny.visit_map(map).map(|_| None)
+    }
+}
+
 /// The file's first `generator` member, the app that wrote it (`None`: it has none, it is not a
 /// string, or the file is not an object of members). The other members, and any further
 /// `generator`, are skipped without being kept, as reading the file skips them.
@@ -671,17 +770,59 @@ mod tests {
         assert!(load(br#"{"format":"other","version":1,"document":{}}"#).is_err());
     }
 
+    #[test]
+    fn file_info_keeps_pdf_presence_without_reading_its_payload() {
+        let d = Document::new(10.0, 10.0);
+        for version in [3, 4] {
+            for compress in [false, true] {
+                for present in [false, true] {
+                    let options = SaveOptions { version, compress, pdf: present.then(|| vec![7; 128 * 1024]), ..SaveOptions::default() };
+                    let bytes = save_with(&d, &options).unwrap();
+                    assert_eq!(load_info(&bytes).unwrap().1.pdf_compatible, present);
+                }
+            }
+        }
+        let mut value: serde_json::Value = serde_json::from_slice(&save(&d, false)).unwrap();
+        let array = serde_json::json!([EXTENSION, VERSION, value["document"], value["images"], {}]);
+        assert!(!load_info(&serde_json::to_vec(&array).unwrap()).unwrap().1.pdf_compatible);
+        value["pdf"] = serde_json::json!({"mime":"application/pdf", "data":"not base64"});
+        assert!(load_info(&serde_json::to_vec(&value).unwrap()).unwrap().1.pdf_compatible);
+        value["pdf"] = serde_json::Value::Null;
+        value["unrecognized"] = serde_json::json!({"pdf":{"data":"nested"}});
+        assert!(!load_info(&serde_json::to_vec(&value).unwrap()).unwrap().1.pdf_compatible);
+        // A preference that is not a boolean is skipped like an unknown member: the file opens,
+        // and the presence of the PDF decides.
+        for odd in [serde_json::json!(1), serde_json::json!("yes"), serde_json::json!([true]), serde_json::json!({"on": true})] {
+            for (pdf, present) in [(serde_json::Value::Null, false), (serde_json::json!({"mime":"application/pdf"}), true)] {
+                value["pdf"] = pdf;
+                value["pdfCompatible"] = odd.clone();
+                assert_eq!(load_info(&serde_json::to_vec(&value).unwrap()).unwrap().1.pdf_compatible, present, "{odd}");
+            }
+        }
+    }
+
+    #[test]
+    fn file_info_keeps_the_pdf_preference_without_artboards() {
+        let mut d = Document::new(10.0, 10.0);
+        d.artboards.clear();
+        for compatible in [false, true] {
+            let bytes = save_with(&d, &SaveOptions { pdf_compatible: Some(compatible), ..SaveOptions::default() }).unwrap();
+            assert_eq!(load_info(&bytes).unwrap().1.pdf_compatible, compatible);
+            assert!(pdf_content(&bytes).is_none());
+        }
+    }
+
     #[test]
     fn file_info_tells_old_files() {
         let d = Document::new(10.0, 10.0);
         let current = save(&d, false);
-        assert_eq!(load_info(&current).unwrap().1, FileInfo { version: VERSION, legacy: false });
+        assert_eq!(load_info(&current).unwrap().1, FileInfo { version: VERSION, legacy: false, pdf_compatible: false });
         assert!(!load_info(&current).unwrap().1.is_old());
         let text = String::from_utf8(current).unwrap();
         let legacy = text.replacen("\"format\":\"vectorcraft\"", "\"format\":\"drawcraft\"", 1);
         assert!(load_info(legacy.as_bytes()).unwrap().1.is_old());
         let v1 = text.replacen(&format!("\"version\":{VERSION}"), "\"version\":1", 1);
-        assert_eq!(load_info(v1.as_bytes()).unwrap().1, FileInfo { version: 1, legacy: false });
+        assert_eq!(load_info(v1.as_bytes()).unwrap().1, FileInfo { version: 1, legacy: false, pdf_compatible: false });
         assert!(load_info(v1.as_bytes()).unwrap().1.is_old());
     }
 
diff --git a/crates/format/tests/it/save_options.rs b/crates/format/tests/it/save_options.rs
index 3cd163ed1..515efbf94 100644
--- a/crates/format/tests/it/save_options.rs
+++ b/crates/format/tests/it/save_options.rs
@@ -291,7 +291,7 @@ fn precision_rounds_the_paths_objects_keep_besides_their_own() {
     d.insert(Some(layer), 1, Node::new(id, NodeKind::Blend { children: keys, spec: Box::new(blend) })).unwrap();
     let envelope = NodeKind::Envelope {
         content: vec![Arc::new(precise_path(&mut d, 1.0, 1.0))],
-        kind: Box::new(EnvelopeKind::TopObject { path: path() }),
+        kind: Box::new(EnvelopeKind::TopObject { path: path(), corners: None }),
         fidelity: 50.0,
         editing: false,
         options: Default::default(),
diff --git a/crates/js/Cargo.toml b/crates/js/Cargo.toml
index 0108b50d9..4cb1e62c2 100644
--- a/crates/js/Cargo.toml
+++ b/crates/js/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vectorcraft-js"
-description = "JavaScript for scripts: an ECMAScript 5.1 lexer and parser to a syntax tree with source positions"
+description = "JavaScript for scripts: an ECMAScript 5.1 parser, and an interpreter with a garbage-collected heap and execution limits"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs
new file mode 100644
index 000000000..3eda7b6a6
--- /dev/null
+++ b/crates/js/src/builtins.rs
@@ -0,0 +1,352 @@
+//! The built-in objects the interpreter itself needs (ECMA-262 5.1 section 15): `Object` and the
+//! basic methods of `Object.prototype`, `Function` with `Function.prototype.call`, `apply` and
+//! `toString`, `eval`, the error constructors and `Error.prototype.toString`, and the prototypes
+//! primitive values look properties up on. The rest of the standard library is not here yet.
+
+use std::rc::Rc;
+
+use crate::bytecode::{CodeKind, Source};
+use crate::compiler::{CompileFail, compile_constructed_function};
+use crate::heap::{Class, Func, HIDDEN, NativeFn, NativeKind, ObjId, Object, Prop, key, string_bytes};
+use crate::interp::{Abrupt, ErrorType, Interp, JsResult};
+use crate::value::{Str, Value};
+
+fn alloc(interp: &mut Interp, class: Class, proto: Option<ObjId>) -> ObjId {
+    interp.heap.alloc_object(Object::new(class, proto))
+}
+
+/// A built-in function object.
+fn native(interp: &mut Interp, name: &'static str, f: NativeFn, length: u32, kind: NativeKind, constructor: bool) -> JsResult<ObjId> {
+    let proto = interp.intrinsics.function_proto;
+    let o = alloc(interp, Class::Function(Func::Native { f, kind, constructor, name }), Some(proto));
+    interp.define(o, key("length"), Prop::Data { value: Value::Number(f64::from(length)), flags: 0 })?;
+    Ok(o)
+}
+
+fn method(interp: &mut Interp, on: ObjId, name: &'static str, f: NativeFn, length: u32) -> JsResult<()> {
+    let m = native(interp, name, f, length, NativeKind::Plain, false)?;
+    interp.define(on, key(name), Prop::Data { value: Value::Object(m), flags: HIDDEN })
+}
+
+fn data(interp: &mut Interp, on: ObjId, name: &str, value: Value, flags: u8) -> JsResult<()> {
+    interp.define(on, key(name), Prop::Data { value, flags })
+}
+
+/// Links a constructor and its prototype and makes the constructor a global.
+fn constructor(interp: &mut Interp, name: &'static str, ctor: ObjId, proto: ObjId) -> JsResult<()> {
+    data(interp, ctor, "prototype", Value::Object(proto), 0)?;
+    data(interp, proto, "constructor", Value::Object(ctor), HIDDEN)?;
+    let global = interp.global;
+    data(interp, global, name, Value::Object(ctor), HIDDEN)
+}
+
+/// Creates the built-ins and the global object's properties.
+pub(crate) fn install(interp: &mut Interp) {
+    if let Err(e) = try_install(interp) {
+        // Installing touches only objects it has just made, so this does not happen; a realm
+        // that somehow lacks a built-in reports it when a script uses it.
+        let _ = e;
+    }
+}
+
+fn try_install(interp: &mut Interp) -> JsResult<()> {
+    let object_proto = alloc(interp, Class::Ordinary, None);
+    interp.intrinsics.object_proto = object_proto;
+    let function_proto = alloc(
+        interp,
+        Class::Function(Func::Native { f: function_proto_call, kind: NativeKind::Plain, constructor: false, name: "" }),
+        Some(object_proto),
+    );
+    interp.intrinsics.function_proto = function_proto;
+    data(interp, function_proto, "length", Value::Number(0.0), 0)?;
+    let global = interp.global;
+    if let Some(g) = interp.heap.object_mut(global) {
+        g.proto = Some(object_proto);
+    }
+    interp.intrinsics.array_proto = alloc(interp, Class::Array { length: 0, length_writable: true }, Some(object_proto));
+    interp.intrinsics.string_proto = alloc(interp, Class::String(Str::from("")), Some(object_proto));
+    interp.intrinsics.number_proto = alloc(interp, Class::Number, Some(object_proto));
+    interp.intrinsics.boolean_proto = alloc(interp, Class::Boolean, Some(object_proto));
+    interp.intrinsics.regexp_proto = alloc(interp, Class::Ordinary, Some(object_proto));
+    let thrower = native(interp, "", throw_type_error, 0, NativeKind::Plain, false)?;
+    if let Some(t) = interp.heap.object_mut(thrower) {
+        t.extensible = false;
+    }
+    interp.intrinsics.throw_type_error = thrower;
+
+    data(interp, global, "NaN", Value::Number(f64::NAN), 0)?;
+    data(interp, global, "Infinity", Value::Number(f64::INFINITY), 0)?;
+    data(interp, global, "undefined", Value::Undefined, 0)?;
+    let eval = native(interp, "eval", eval, 1, NativeKind::Eval, false)?;
+    interp.intrinsics.eval = eval;
+    data(interp, global, "eval", Value::Object(eval), HIDDEN)?;
+
+    let object = native(interp, "Object", object_ctor, 1, NativeKind::Plain, true)?;
+    constructor(interp, "Object", object, object_proto)?;
+    method(interp, object_proto, "toString", object_to_string, 0)?;
+    method(interp, object_proto, "toLocaleString", object_to_locale_string, 0)?;
+    method(interp, object_proto, "valueOf", object_value_of, 0)?;
+    method(interp, object_proto, "hasOwnProperty", has_own_property, 1)?;
+    method(interp, object_proto, "isPrototypeOf", is_prototype_of, 1)?;
+    method(interp, object_proto, "propertyIsEnumerable", property_is_enumerable, 1)?;
+
+    let function = native(interp, "Function", function_ctor, 1, NativeKind::Plain, true)?;
+    constructor(interp, "Function", function, function_proto)?;
+    let call = native(interp, "call", unreachable_native, 1, NativeKind::Call, false)?;
+    data(interp, function_proto, "call", Value::Object(call), HIDDEN)?;
+    let apply = native(interp, "apply", unreachable_native, 2, NativeKind::Apply, false)?;
+    data(interp, function_proto, "apply", Value::Object(apply), HIDDEN)?;
+    method(interp, function_proto, "toString", function_to_string, 0)?;
+
+    install_errors(interp, object_proto)
+}
+
+fn install_errors(interp: &mut Interp, object_proto: ObjId) -> JsResult<()> {
+    let kinds: [(&'static str, NativeFn); 7] = [
+        ("Error", error_ctor),
+        ("EvalError", eval_error_ctor),
+        ("RangeError", range_error_ctor),
+        ("ReferenceError", reference_error_ctor),
+        ("SyntaxError", syntax_error_ctor),
+        ("TypeError", type_error_ctor),
+        ("URIError", uri_error_ctor),
+    ];
+    let mut error_proto = object_proto;
+    for (i, (name, f)) in kinds.into_iter().enumerate() {
+        // Error.prototype and each NativeError prototype are Error objects (sections 15.11.4 and
+        // 15.11.7.7).
+        let proto = alloc(interp, Class::Error, Some(if i == 0 { object_proto } else { error_proto }));
+        if i == 0 {
+            error_proto = proto;
+            method(interp, proto, "toString", error_to_string, 0)?;
+        }
+        if let Some(slot) = interp.intrinsics.error_protos.get_mut(i) {
+            *slot = proto;
+        }
+        data(interp, proto, "name", Value::str(name), HIDDEN)?;
+        data(interp, proto, "message", Value::str(""), HIDDEN)?;
+        let ctor = native(interp, name, f, 1, NativeKind::Plain, true)?;
+        constructor(interp, name, ctor, proto)?;
+    }
+    Ok(())
+}
+
+fn arg(args: &[Value], i: usize) -> Value {
+    args.get(i).cloned().unwrap_or(Value::Undefined)
+}
+
+fn unreachable_native(_: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    Err(Abrupt::Internal("call or apply reached its native body".into()))
+}
+
+fn throw_type_error(interp: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    Err(interp.type_error("'caller', 'callee' and 'arguments' cannot be used on strict mode functions"))
+}
+
+fn function_proto_call(_: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    Ok(Value::Undefined)
+}
+
+// ---- Object ----
+
+/// `Object(value)` and `new Object(value)` (sections 15.2.1 and 15.2.2).
+fn object_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let v = arg(args, 0);
+    if v.is_nullish() {
+        return Ok(Value::Object(interp.new_object()));
+    }
+    interp.to_object(&v).map(Value::Object)
+}
+
+/// `Object.prototype.toString` (section 15.2.4.2).
+fn object_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let class = match &this {
+        Value::Undefined => "Undefined",
+        Value::Null => "Null",
+        _ => {
+            let o = interp.to_object(&this)?;
+            interp.heap.object(o).map_or("Object", |o| o.class.name())
+        }
+    };
+    Ok(Value::str(&format!("[object {class}]")))
+}
+
+fn object_to_locale_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let o = interp.to_object(&this)?;
+    let f = interp.get_from(o, &key("toString"), &this)?;
+    if !interp.is_callable(&f) {
+        return Err(interp.type_error("toString is not a function"));
+    }
+    interp.call(&f, &this, &[])
+}
+
+fn object_value_of(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    interp.to_object(&this).map(Value::Object)
+}
+
+fn has_own_property(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let k = interp.to_key(&arg(args, 0))?;
+    let o = interp.to_object(&this)?;
+    Ok(Value::Bool(interp.get_own_property(o, &k)?.is_some()))
+}
+
+fn is_prototype_of(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let Value::Object(mut v) = arg(args, 0) else { return Ok(Value::Bool(false)) };
+    let o = interp.to_object(&this)?;
+    while let Some(p) = interp.heap.object(v).and_then(|v| v.proto) {
+        if p == o {
+            return Ok(Value::Bool(true));
+        }
+        v = p;
+        interp.use_fuel()?;
+    }
+    Ok(Value::Bool(false))
+}
+
+fn property_is_enumerable(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let k = interp.to_key(&arg(args, 0))?;
+    let o = interp.to_object(&this)?;
+    Ok(Value::Bool(interp.get_own_property(o, &k)?.is_some_and(|p| p.enumerable())))
+}
+
+// ---- Function ----
+
+/// `Function(p1, …, body)` and `new Function(…)` (section 15.3.2.1): the source is read as
+/// `(function anonymous(p1,…\n) {\nbody\n})` and must be exactly that one function.
+fn function_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    const HEAD: &str = "(function anonymous(";
+    const MID: &str = "\n) {\n";
+    const TAIL: &str = "\n})";
+    let mut parts = Vec::with_capacity(args.len());
+    for a in args {
+        parts.push(interp.to_str(a)?);
+    }
+    let body = parts.pop().unwrap_or_else(|| Str::from(""));
+    // The length is checked against the source limit before any argument is flattened or copied.
+    let total = parts
+        .iter()
+        .map(Str::len)
+        .chain([parts.len().saturating_sub(1), HEAD.len() + MID.len() + TAIL.len(), body.len()])
+        .fold(0usize, usize::saturating_add);
+    interp.check_source_units(total).map_err(|e| interp.compile_error_to_abrupt(e))?;
+    let mut units = Vec::with_capacity(total);
+    units.extend(HEAD.encode_utf16());
+    for (i, p) in parts.iter().enumerate() {
+        if i > 0 {
+            units.push(u16::from(b','));
+        }
+        units.extend_from_slice(&p.flat());
+    }
+    units.extend(MID.encode_utf16());
+    units.extend_from_slice(&body.flat());
+    units.extend(TAIL.encode_utf16());
+    interp.source_units = interp.source_units.saturating_add(units.len());
+    let remaining = interp.options.max_source_units.saturating_sub(interp.source_units.saturating_sub(units.len()));
+    let options = crate::Options { strict: false, max_source_units: remaining, ..interp.options.clone() };
+    let program = match crate::parse_utf16(&units, &options) {
+        Ok(p) => p,
+        Err(e) => return Err(interp.throw(ErrorType::Syntax, &e.message)),
+    };
+    let source = Rc::new(Source { lines: program.lines.clone(), text: units.into() });
+    let code = match compile_constructed_function(&program, &source) {
+        Ok(Some(code)) => code,
+        Ok(None) => return Err(interp.throw(ErrorType::Syntax, "the parameters or body do not form one function")),
+        Err(CompileFail::Syntax(e)) => return Err(interp.throw(ErrorType::Syntax, &e.message)),
+        Err(CompileFail::Internal(m)) => return Err(Abrupt::Internal(m)),
+    };
+    interp.charge_code(&code, 0)?;
+    let env = interp.global_env;
+    interp.make_closure(code, env).map(Value::Object)
+}
+
+/// `Function.prototype.toString` (section 15.3.4.2): a function's source text, or a stand-in
+/// for a built-in.
+fn function_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let func = this.as_object().and_then(|o| interp.heap.object(o)).and_then(|o| match &o.class {
+        Class::Function(f) => Some(f.clone()),
+        _ => None,
+    });
+    let text = match func {
+        Some(Func::Closure { code, .. }) => {
+            let (start, end) = (code.span.0 as usize, code.span.1 as usize);
+            let units = code.source.text.get(start..end).unwrap_or_default();
+            let bytes = string_bytes(units.len());
+            interp.reserve_heap(bytes)?;
+            interp.heap.bytes = interp.heap.bytes.saturating_add(bytes);
+            return Ok(Value::String(Str::from_units(units.to_vec())));
+        }
+        Some(Func::Native { name, .. }) => format!("function {name}() {{ [native code] }}"),
+        Some(Func::Host { name, .. }) => format!("function {name}() {{ [native code] }}"),
+        None => return Err(interp.type_error("Function.prototype.toString was called on a value that is not a function")),
+    };
+    Ok(Value::str(&text))
+}
+
+/// The global `eval` called indirectly (section 15.1.2.1.1): global code in the global
+/// environment.
+fn eval(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let x = arg(args, 0);
+    let Value::String(s) = &x else { return Ok(x) };
+    interp.check_source_units(s.len()).map_err(|e| interp.compile_error_to_abrupt(e))?;
+    let units = s.flat();
+    let code = interp.compile_source(&units, false, CodeKind::Eval).map_err(|e| interp.compile_error_to_abrupt(e))?;
+    interp.run_global(code, true)
+}
+
+// ---- errors ----
+
+fn make_error(interp: &mut Interp, t: ErrorType, args: &[Value]) -> JsResult<Value> {
+    let message = arg(args, 0);
+    let text = if matches!(message, Value::Undefined) { None } else { Some(interp.to_str(&message)?) };
+    let o = interp.error_object(t, "");
+    if let Some(text) = text {
+        interp.define(o, key("message"), Prop::Data { value: Value::String(text), flags: HIDDEN })?;
+    }
+    Ok(Value::Object(o))
+}
+
+fn error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Error, args)
+}
+
+fn eval_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Eval, args)
+}
+
+fn range_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Range, args)
+}
+
+fn reference_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Reference, args)
+}
+
+fn syntax_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Syntax, args)
+}
+
+fn type_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Type, args)
+}
+
+fn uri_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Uri, args)
+}
+
+/// `Error.prototype.toString` (section 15.11.4.4).
+fn error_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let Value::Object(o) = this else { return Err(interp.type_error("Error.prototype.toString was called on a value that is not an object")) };
+    let name = interp.get_from(o, &key("name"), &this)?;
+    let name = if matches!(name, Value::Undefined) { Str::from("Error") } else { interp.to_str(&name)? };
+    let message = interp.get_from(o, &key("message"), &this)?;
+    let message = if matches!(message, Value::Undefined) { Str::from("") } else { interp.to_str(&message)? };
+    if name.len() == 0 {
+        return Ok(Value::String(message));
+    }
+    if message.len() == 0 {
+        return Ok(Value::String(name));
+    }
+    let sep = Str::from(": ");
+    let head = interp.concat(&name, &sep)?;
+    interp.concat(&head, &message).map(Value::String)
+}
diff --git a/crates/js/src/bytecode.rs b/crates/js/src/bytecode.rs
new file mode 100644
index 000000000..b23d9a525
--- /dev/null
+++ b/crates/js/src/bytecode.rs
@@ -0,0 +1,362 @@
+//! Bytecode: the instructions a function, a script or eval code compiles to, and the verifier
+//! that checks them before they run.
+//!
+//! The interpreter is a stack machine. Each instruction takes its operands from the top of the
+//! frame's operand stack and pushes its result there; jumps name an instruction index. The
+//! verifier walks every path through the code and checks that each jump target, exception handler
+//! and `finally` dispatch target is an instruction, that each constant, name and function index is
+//! in its table, that the stack never goes below the frame's base, that every path reaching an
+//! instruction arrives with the same stack depth, and that no path runs past the last
+//! instruction. Code that fails is reported as an internal error and never runs.
+
+use std::rc::Rc;
+
+use crate::LineTable;
+use crate::ast::BinaryOp;
+use crate::heap::Key;
+use crate::value::Str;
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Op {
+    Undefined,
+    Null,
+    True,
+    False,
+    /// Pushes `numbers[i]`.
+    Number(u32),
+    /// Pushes `strings[i]`.
+    String(u32),
+    This,
+    Pop,
+    /// Removes the `n` values under the top one.
+    PopUnder(u32),
+    Dup,
+    /// `a b` → `a b a b`.
+    Dup2,
+    Swap,
+    /// `a b c` → `b c a`.
+    Rot3,
+    /// Pushes the value of the variable `names[i]`.
+    GetVar(u32),
+    /// Pushes the value of the variable and the `this` a call to it gets.
+    GetVarThis(u32),
+    /// `value` → `value`, assigned to the variable.
+    SetVar(u32),
+    /// Pushes the base of the reference to the variable `names[i]`, resolved before the
+    /// right-hand side of an assignment runs.
+    RefVar(u32),
+    /// `base` → `value`: the variable's value read through the resolved base.
+    GetRef(u32),
+    /// `base value` → `value`, assigned to the variable through the resolved base.
+    PutRef(u32),
+    TypeofVar(u32),
+    DeleteVar(u32),
+    IncVar {
+        name: u32,
+        prefix: bool,
+        dec: bool,
+    },
+    /// `object` → `object.name`.
+    GetMember(u32),
+    /// `object` → `object.name object`.
+    GetMemberThis(u32),
+    /// `object value` → `value`.
+    SetMember(u32),
+    DeleteMember(u32),
+    IncMember {
+        name: u32,
+        prefix: bool,
+        dec: bool,
+    },
+    /// `object key` → `object name`: checks that the object can have properties and turns the key
+    /// into a property name, before the right-hand side of an assignment runs.
+    ToKey,
+    /// `object` → `object`: throws a `TypeError` when it is `undefined` or `null`, before the
+    /// right-hand side of an assignment to one of its properties runs.
+    CheckObject,
+    /// `object key` → `object[key]`.
+    GetIndex,
+    /// `object key` → `object[key] object`.
+    GetIndexThis,
+    /// `object key value` → `value`.
+    SetIndex,
+    DeleteIndex,
+    IncIndex {
+        prefix: bool,
+        dec: bool,
+    },
+    /// `function this arg…` → result.
+    Call(u32),
+    /// Like `Call`, but a direct eval when the function is the global `eval`.
+    CallEval(u32),
+    /// `function arg…` → the new object.
+    New(u32),
+    Binary(BinaryOp),
+    Neg,
+    Plus,
+    BitNot,
+    Not,
+    Typeof,
+    ToNumber,
+    Jump(u32),
+    /// Pops the top value and jumps when it is falsy.
+    JumpIfFalse(u32),
+    JumpIfTrue(u32),
+    /// Jumps, keeping the top value, when it is falsy; otherwise pops it.
+    JumpIfFalseKeep(u32),
+    JumpIfTrueKeep(u32),
+    Return,
+    /// Returns the value of the last expression statement (script and eval code).
+    ReturnCompletion,
+    Throw,
+    /// Throws a `ReferenceError` with the message `strings[i]` (an assignment to something that
+    /// cannot be assigned to).
+    ThrowReferenceError(u32),
+    /// Ends a `finally` block: `value kind` on the stack say how it was entered. Kind 0 (normal)
+    /// pops both and goes on, kind 1 throws the value, and kind `2 + k` jumps to entry `k` of
+    /// `finally_tables[i]` with the value left on the stack.
+    EndFinally(u32),
+    NewObject,
+    NewArray,
+    /// `array value` → `array`, the value appended.
+    ArrayPush,
+    /// `array` → `array`, one longer.
+    ArrayHole,
+    /// `object value` → `object`.
+    InitProp(u32),
+    /// `object function` → `object`.
+    InitGetter(u32),
+    InitSetter(u32),
+    /// Pushes a new function made from `functions[i]` and the current environment.
+    Closure(u32),
+    /// Pushes a new regular expression object for `regexps[i]`.
+    RegExp(u32),
+    /// `object` → nothing: enters a `with` statement's environment.
+    PushWith,
+    /// `exception` → nothing: enters a catch clause's environment, binding `names[i]`.
+    PushCatch(u32),
+    PopEnv,
+    /// `object` → `iterator`.
+    ForInStart,
+    /// `iterator` → `iterator name`, or jumps with `iterator` when the names are used up.
+    ForInNext(u32),
+    /// Pops the value of an expression statement into the completion value.
+    SetCompletion,
+    /// Pushes the completion value, which a `finally` block in script and eval code keeps and
+    /// sets back with `SetCompletion` when it ends normally.
+    GetCompletion,
+}
+
+/// What code is: a function body, a script, or eval code.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CodeKind {
+    Function,
+    Global,
+    Eval,
+}
+
+/// A range of instructions an exception thrown in jumps out of: to `target`, with the operand
+/// stack cut back to `depth` values and the environments to `env_depth`, and the exception pushed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Handler {
+    pub(crate) start: u32,
+    pub(crate) end: u32,
+    pub(crate) target: u32,
+    pub(crate) depth: u32,
+    pub(crate) env_depth: u32,
+}
+
+/// The source a piece of code came from, for error positions and `Function.prototype.toString`.
+#[derive(Debug)]
+pub(crate) struct Source {
+    pub(crate) lines: LineTable,
+    pub(crate) text: Rc<[u16]>,
+}
+
+#[derive(Debug)]
+pub(crate) struct Code {
+    pub(crate) ops: Vec<Op>,
+    /// The source offset each instruction comes from.
+    pub(crate) positions: Vec<u32>,
+    pub(crate) numbers: Vec<f64>,
+    pub(crate) strings: Vec<Str>,
+    pub(crate) names: Vec<Key>,
+    pub(crate) functions: Vec<Rc<Code>>,
+    pub(crate) regexps: Vec<(Str, Str)>,
+    pub(crate) handlers: Vec<Handler>,
+    pub(crate) finally_tables: Vec<Vec<u32>>,
+    /// The most values the code keeps on the operand stack, set by the verifier.
+    pub(crate) max_stack: u32,
+    pub(crate) strict: bool,
+    /// A function expression's own name, bound inside it.
+    pub(crate) self_name: Option<Key>,
+    pub(crate) params: Vec<Key>,
+    pub(crate) vars: Vec<Key>,
+    /// Function declarations to instantiate on entry: their names and indices in `functions`.
+    pub(crate) fun_decls: Vec<(Key, u32)>,
+    /// The body refers to `arguments` or calls `eval`.
+    pub(crate) uses_arguments: bool,
+    pub(crate) source: Rc<Source>,
+    /// Where the function's text starts and ends in the source.
+    pub(crate) span: (u32, u32),
+}
+
+impl Code {
+    /// The innermost handler around instruction `pc`.
+    pub(crate) fn handler(&self, pc: usize) -> Option<Handler> {
+        self.handlers.iter().copied().find(|h| (h.start as usize) <= pc && pc < h.end as usize)
+    }
+
+    /// The line and column of instruction `pc`.
+    pub(crate) fn line_column(&self, pc: usize) -> (u32, u32) {
+        let offset = self.positions.get(pc).copied().unwrap_or(self.span.0);
+        self.source.lines.line_column(offset)
+    }
+}
+
+/// What an instruction does to the stack on each way out of it.
+struct Effect {
+    pops: u32,
+    /// Values pushed when it goes on to the next instruction; `None` when it never does.
+    next: Option<u32>,
+    /// Instruction indices it may jump to, each with the values it pushes on that path.
+    jumps: Vec<(u32, u32)>,
+}
+
+/// The values an instruction pops, and pushes when it goes on to the next instruction (0 for one
+/// that never does), for the compiler's count of the stack depth.
+pub(crate) fn fallthrough_effect(op: Op) -> (u32, u32) {
+    match op {
+        Op::EndFinally(_) => (2, 0),
+        _ => effect(op, &[]).map_or((0, 0), |fx| (fx.pops, fx.next.unwrap_or(0))),
+    }
+}
+
+fn effect(op: Op, finally_tables: &[Vec<u32>]) -> Result<Effect, String> {
+    let e = |pops, pushes| Effect { pops, next: Some(pushes), jumps: Vec::new() };
+    let end = |pops| Effect { pops, next: None, jumps: Vec::new() };
+    Ok(match op {
+        Op::Undefined | Op::Null | Op::True | Op::False | Op::Number(_) | Op::String(_) | Op::This => e(0, 1),
+        Op::GetVar(_) | Op::TypeofVar(_) | Op::DeleteVar(_) | Op::IncVar { .. } | Op::RefVar(_) => e(0, 1),
+        Op::GetRef(_) => e(1, 1),
+        Op::PutRef(_) => e(2, 1),
+        Op::NewObject | Op::NewArray | Op::Closure(_) | Op::RegExp(_) | Op::GetCompletion => e(0, 1),
+        Op::Pop | Op::PushWith | Op::PushCatch(_) | Op::SetCompletion => e(1, 0),
+        Op::PopUnder(n) => e(n.checked_add(1).ok_or("operand too large")?, 1),
+        Op::Dup => e(1, 2),
+        Op::Dup2 => e(2, 4),
+        Op::Swap | Op::ToKey => e(2, 2),
+        Op::Rot3 => e(3, 3),
+        Op::GetVarThis(_) => e(0, 2),
+        Op::SetVar(_) | Op::GetMember(_) | Op::DeleteMember(_) | Op::IncMember { .. } => e(1, 1),
+        Op::Neg | Op::Plus | Op::BitNot | Op::Not | Op::Typeof | Op::ToNumber | Op::ArrayHole | Op::ForInStart | Op::CheckObject => e(1, 1),
+        Op::GetMemberThis(_) => e(1, 2),
+        Op::SetMember(_) | Op::GetIndex | Op::DeleteIndex | Op::IncIndex { .. } | Op::Binary(_) => e(2, 1),
+        Op::ArrayPush | Op::InitProp(_) | Op::InitGetter(_) | Op::InitSetter(_) => e(2, 1),
+        Op::GetIndexThis => e(2, 2),
+        Op::SetIndex => e(3, 1),
+        Op::Call(n) | Op::CallEval(n) => e(n.checked_add(2).ok_or("operand too large")?, 1),
+        Op::New(n) => e(n.checked_add(1).ok_or("operand too large")?, 1),
+        Op::PopEnv => e(0, 0),
+        Op::Jump(t) => Effect { pops: 0, next: None, jumps: vec![(t, 0)] },
+        Op::JumpIfFalse(t) | Op::JumpIfTrue(t) => Effect { pops: 1, next: Some(0), jumps: vec![(t, 0)] },
+        Op::JumpIfFalseKeep(t) | Op::JumpIfTrueKeep(t) => Effect { pops: 1, next: Some(0), jumps: vec![(t, 1)] },
+        Op::Return | Op::Throw => end(1),
+        Op::ReturnCompletion | Op::ThrowReferenceError(_) => end(0),
+        Op::EndFinally(t) => {
+            let table = finally_tables.get(t as usize).ok_or_else(|| format!("finally table {t} out of range"))?;
+            Effect { pops: 2, next: Some(0), jumps: table.iter().map(|&target| (target, 1)).collect() }
+        }
+        Op::ForInNext(t) => Effect { pops: 1, next: Some(2), jumps: vec![(t, 1)] },
+    })
+}
+
+/// Checks the constant, name, function and regular expression indices an instruction uses.
+fn check_indices(op: Op, code: &Code) -> Result<(), String> {
+    let check = |i: u32, len: usize, what: &str| if (i as usize) < len { Ok(()) } else { Err(format!("{what} {i} out of range")) };
+    match op {
+        Op::Number(i) => check(i, code.numbers.len(), "number"),
+        Op::String(i) | Op::ThrowReferenceError(i) => check(i, code.strings.len(), "string"),
+        Op::GetVar(i)
+        | Op::GetVarThis(i)
+        | Op::SetVar(i)
+        | Op::RefVar(i)
+        | Op::GetRef(i)
+        | Op::PutRef(i)
+        | Op::TypeofVar(i)
+        | Op::DeleteVar(i)
+        | Op::IncVar { name: i, .. }
+        | Op::GetMember(i)
+        | Op::GetMemberThis(i)
+        | Op::SetMember(i)
+        | Op::DeleteMember(i)
+        | Op::IncMember { name: i, .. }
+        | Op::InitProp(i)
+        | Op::InitGetter(i)
+        | Op::InitSetter(i)
+        | Op::PushCatch(i) => check(i, code.names.len(), "name"),
+        Op::Closure(i) => check(i, code.functions.len(), "function"),
+        Op::RegExp(i) => check(i, code.regexps.len(), "regular expression"),
+        _ => Ok(()),
+    }
+}
+
+/// Verifies `code` (not the functions inside it, which are verified when they are compiled) and
+/// returns the most values it keeps on the stack.
+pub(crate) fn verify(code: &Code) -> Result<u32, String> {
+    let len = code.ops.len();
+    if len == 0 {
+        return Err("no instructions".into());
+    }
+    if code.positions.len() != len {
+        return Err("the position table does not match the instructions".into());
+    }
+    for (name, _) in &code.fun_decls {
+        if name.is_empty() {
+            return Err("a function declaration without a name".into());
+        }
+    }
+    if code.fun_decls.iter().any(|(_, i)| *i as usize >= code.functions.len()) {
+        return Err("function declaration index out of range".into());
+    }
+    let mut depth: Vec<Option<u32>> = vec![None; len];
+    let mut work: Vec<(u32, u32)> = vec![(0, 0)];
+    for h in &code.handlers {
+        if h.start > h.end || h.end as usize > len {
+            return Err(format!("handler range {}..{} out of range", h.start, h.end));
+        }
+        work.push((h.target, h.depth.checked_add(1).ok_or("handler depth too large")?));
+    }
+    let mut max = 0;
+    while let Some((pc, d)) = work.pop() {
+        let slot = depth.get_mut(pc as usize).ok_or_else(|| format!("jump to {pc}, past the end"))?;
+        match *slot {
+            Some(seen) if seen == d => continue,
+            Some(seen) => return Err(format!("instruction {pc} reached with stack depths {seen} and {d}")),
+            None => *slot = Some(d),
+        }
+        max = max.max(d);
+        let op = code.ops.get(pc as usize).copied().ok_or("instruction out of range")?;
+        check_indices(op, code)?;
+        let fx = effect(op, &code.finally_tables)?;
+        let base = d.checked_sub(fx.pops).ok_or_else(|| format!("instruction {pc} ({op:?}) pops below the stack"))?;
+        if let Some(pushes) = fx.next {
+            if pc as usize + 1 >= len {
+                return Err("the code runs past its last instruction".into());
+            }
+            work.push((pc + 1, base + pushes));
+        }
+        for (target, pushes) in fx.jumps {
+            work.push((target, base + pushes));
+        }
+    }
+    for h in &code.handlers {
+        if let Some(Some(d)) = depth.get(h.start as usize)
+            && *d < h.depth
+            && h.start < h.end
+        {
+            return Err(format!("handler at {} expects {} values but its range starts with {d}", h.target, h.depth));
+        }
+    }
+    Ok(max)
+}
diff --git a/crates/js/src/chars.rs b/crates/js/src/chars.rs
index 75c0b92aa..eb61fe763 100644
--- a/crates/js/src/chars.rs
+++ b/crates/js/src/chars.rs
@@ -58,6 +58,39 @@ pub fn hex_value(c: u32) -> Option<u32> {
     }
 }
 
+/// The value of the digit values `digits` in `radix` (8 or 16), rounded once to the nearest number
+/// with ties to even (sections 7.8.3 and 9.3.1), or `None` when there are no digits. Digits are
+/// kept exactly in a `u128` while they fit; past that, each later digit counts only for its
+/// position and for whether any of the dropped bits is set.
+pub fn radix_value(digits: impl IntoIterator<Item = u32>, radix: u32) -> Option<f64> {
+    let bits = radix.trailing_zeros();
+    let mut kept: u128 = 0;
+    let mut dropped_bits: u32 = 0;
+    let mut sticky = false;
+    let mut any = false;
+    for d in digits {
+        any = true;
+        if kept.leading_zeros() >= bits {
+            kept = kept << bits | u128::from(d);
+        } else {
+            dropped_bits = dropped_bits.saturating_add(bits);
+            sticky |= d != 0;
+        }
+    }
+    if !any {
+        return None;
+    }
+    // `kept` holds at least 125 bits once a digit is dropped, so its lowest bit lies below the
+    // rounding bit and stands in for every dropped bit.
+    let mut value = (kept | u128::from(sticky)) as f64;
+    while dropped_bits > 0 && value.is_finite() {
+        let step = dropped_bits.min(64);
+        value *= (1_u128 << step) as f64;
+        dropped_bits -= step;
+    }
+    Some(value)
+}
+
 pub fn is_decimal_digit(c: u32) -> bool {
     (0x30..=0x39).contains(&c)
 }
diff --git a/crates/js/src/compiler.rs b/crates/js/src/compiler.rs
new file mode 100644
index 000000000..ae470be44
--- /dev/null
+++ b/crates/js/src/compiler.rs
@@ -0,0 +1,1260 @@
+//! The compiler: a syntax tree to bytecode, one [`Code`] per function, script or eval code.
+//!
+//! Variables are looked up by name at run time through the environment chain, as ECMA-262 5.1
+//! section 10 describes, so `with` and direct `eval` need no special analysis. Declarations are
+//! hoisted: each code lists its `var` names and function declarations, and the interpreter binds
+//! them when the code is entered (section 10.5).
+//!
+//! The compiler counts the operand stack depth as it emits, so `break`, `continue` and `return`
+//! know how many values to drop. A jump out of a `try` with a `finally` block goes through the
+//! block: it pushes a completion (a value and a kind number) and jumps to the block, whose
+//! `EndFinally` instruction goes on with the jump afterwards. Long left-nested runs of binary
+//! operators and member accesses, right-nested assignment chains, prefix operators, `else if`
+//! chains and labels are compiled with loops; every other kind of nesting is counted, and code
+//! nested deeper than [`MAX_DEPTH`] gives a `SyntaxError` instead of exhausting the stack.
+
+use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
+
+use crate::ast::{
+    AssignOp, Ast, BinaryOp, Expr, ExprId, ForInTarget, ForInit, FunctionId, FunctionKind, LogicalOp, PropertyValue, Stmt, StmtId, UnaryOp, UpdateOp,
+    VarDecl,
+};
+use crate::bytecode::{Code, CodeKind, Handler, Op, Source, fallthrough_effect, verify};
+use crate::error::{SyntaxError, TOO_DEEP};
+use crate::heap::Key;
+use crate::value::Str;
+
+/// How deeply the compiler may recurse: past the parser's default nesting limit, and shallow
+/// enough for a 1 MiB stack.
+pub(crate) const MAX_DEPTH: u32 = 600;
+
+/// Why code could not be compiled.
+#[derive(Debug)]
+pub(crate) enum CompileFail {
+    Syntax(SyntaxError),
+    /// The compiler made code the verifier rejects.
+    Internal(String),
+}
+
+type CResult<T> = Result<T, CompileFail>;
+
+fn internal<T>(message: impl Into<String>) -> CResult<T> {
+    Err(CompileFail::Internal(message.into()))
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Label(usize);
+
+/// Where `break`, `continue` and `return` go.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Exit {
+    /// To the end of the jump context at this index.
+    Break(usize),
+    /// To the continue point of the loop at this index.
+    Continue(usize),
+    Return,
+}
+
+enum Ctx {
+    /// A loop, a `switch` or a labeled statement.
+    Jump { labels: Vec<String>, is_loop: bool, plain_break: bool, brk: Label, cont: Option<Label>, depth: u32, env_depth: u32 },
+    /// The protected part (and catch clause) of a `try` with a `finally` block.
+    Finally { try_depth: u32, env_depth: u32, entry: Label, exits: Vec<Exit> },
+}
+
+struct FnCompiler<'a> {
+    ast: &'a Ast,
+    source: &'a Rc<Source>,
+    kind: CodeKind,
+    strict: bool,
+    ops: Vec<Op>,
+    positions: Vec<u32>,
+    pos: u32,
+    numbers: Vec<f64>,
+    number_index: HashMap<u64, u32>,
+    strings: Vec<Str>,
+    string_index: HashMap<Vec<u16>, u32>,
+    names: Vec<Key>,
+    name_index: HashMap<Key, u32>,
+    functions: Vec<Rc<Code>>,
+    regexps: Vec<(Str, Str)>,
+    handlers: Vec<(u32, u32, Label, u32, u32)>,
+    finally_tables: Vec<Vec<Label>>,
+    labels: Vec<Option<u32>>,
+    patches: Vec<(usize, Label)>,
+    depth: u32,
+    env_depth: u32,
+    contexts: Vec<Ctx>,
+    uses_arguments: bool,
+    recursion: u32,
+}
+
+/// The `var` names and function declarations a body hoists.
+#[derive(Default)]
+struct Hoisted {
+    vars: Vec<Key>,
+    fun_decls: Vec<(Key, u32)>,
+}
+
+fn key_of(name: &str) -> Key {
+    crate::heap::key(name)
+}
+
+impl<'a> FnCompiler<'a> {
+    fn new(ast: &'a Ast, source: &'a Rc<Source>, kind: CodeKind, strict: bool, recursion: u32) -> Self {
+        Self {
+            ast,
+            source,
+            kind,
+            strict,
+            ops: Vec::new(),
+            positions: Vec::new(),
+            pos: 0,
+            numbers: Vec::new(),
+            number_index: HashMap::new(),
+            strings: Vec::new(),
+            string_index: HashMap::new(),
+            names: Vec::new(),
+            name_index: HashMap::new(),
+            functions: Vec::new(),
+            regexps: Vec::new(),
+            handlers: Vec::new(),
+            finally_tables: Vec::new(),
+            labels: Vec::new(),
+            patches: Vec::new(),
+            depth: 0,
+            env_depth: 0,
+            contexts: Vec::new(),
+            uses_arguments: false,
+            recursion,
+        }
+    }
+
+    // ---- emitting ----
+
+    fn emit(&mut self, op: Op) {
+        let (pops, pushes) = fallthrough_effect(op);
+        self.depth = self.depth.saturating_sub(pops) + pushes;
+        self.ops.push(op);
+        self.positions.push(self.pos);
+    }
+
+    fn new_label(&mut self) -> Label {
+        self.labels.push(None);
+        Label(self.labels.len() - 1)
+    }
+
+    fn bind(&mut self, label: Label) {
+        if let Some(slot) = self.labels.get_mut(label.0) {
+            *slot = Some(u32::try_from(self.ops.len()).unwrap_or(u32::MAX));
+        }
+    }
+
+    /// Emits a jump instruction (`make` builds it from its target) to `label`, patched when the
+    /// code is finished.
+    fn jump(&mut self, make: fn(u32) -> Op, label: Label) {
+        self.patches.push((self.ops.len(), label));
+        self.emit(make(0));
+    }
+
+    fn at(&mut self, offset: u32) {
+        self.pos = offset;
+    }
+
+    fn number(&mut self, n: f64) -> u32 {
+        if let Some(&i) = self.number_index.get(&n.to_bits()) {
+            return i;
+        }
+        let i = u32::try_from(self.numbers.len()).unwrap_or(u32::MAX);
+        self.numbers.push(n);
+        self.number_index.insert(n.to_bits(), i);
+        i
+    }
+
+    fn string(&mut self, units: &[u16]) -> u32 {
+        if let Some(&i) = self.string_index.get(units) {
+            return i;
+        }
+        let i = u32::try_from(self.strings.len()).unwrap_or(u32::MAX);
+        self.strings.push(Str::from_units(units.to_vec()));
+        self.string_index.insert(units.to_vec(), i);
+        i
+    }
+
+    fn name_key(&mut self, key: Key) -> u32 {
+        if let Some(&i) = self.name_index.get(&key) {
+            return i;
+        }
+        let i = u32::try_from(self.names.len()).unwrap_or(u32::MAX);
+        self.names.push(key.clone());
+        self.name_index.insert(key, i);
+        i
+    }
+
+    /// The index of a variable name, noting a use of `arguments`.
+    fn var_name(&mut self, name: &str) -> u32 {
+        if name == "arguments" {
+            self.uses_arguments = true;
+        }
+        self.name_key(key_of(name))
+    }
+
+    fn push_number(&mut self, n: f64) {
+        let i = self.number(n);
+        self.emit(Op::Number(i));
+    }
+
+    fn enter(&mut self) -> CResult<()> {
+        self.recursion += 1;
+        if self.recursion > MAX_DEPTH {
+            let (line, column) = self.source.lines.line_column(self.pos);
+            return Err(CompileFail::Syntax(SyntaxError { message: TOO_DEEP.into(), line, column, offset: self.pos }));
+        }
+        Ok(())
+    }
+
+    fn leave(&mut self) {
+        self.recursion -= 1;
+    }
+
+    // ---- declarations ----
+
+    /// Collects the `var` names and function declarations of a body, outside nested functions,
+    /// in source order, and compiles the functions.
+    fn hoist(&mut self, body: &[StmtId]) -> CResult<Hoisted> {
+        let mut out = Hoisted::default();
+        let mut seen = HashSet::new();
+        let mut work: Vec<StmtId> = body.iter().rev().copied().collect();
+        let mut add_var = |out: &mut Hoisted, d: &VarDecl| {
+            let k = key_of(&d.name.name);
+            if seen.insert(k.clone()) {
+                out.vars.push(k);
+            }
+        };
+        while let Some(id) = work.pop() {
+            let Some(stmt) = self.ast.stmt(id) else { return internal("statement out of range") };
+            match stmt {
+                Stmt::Var(decls) => decls.iter().for_each(|d| add_var(&mut out, d)),
+                Stmt::FunctionDecl(fid) => {
+                    let Some(name) = self.ast.function(*fid).and_then(|f| f.name.as_ref()) else {
+                        return internal("function declaration without a name");
+                    };
+                    let k = key_of(&name.name);
+                    let i = self.function(*fid)?;
+                    out.fun_decls.push((k, i));
+                }
+                Stmt::Block(list) => work.extend(list.iter().rev()),
+                Stmt::If { consequent, alternate, .. } => {
+                    work.extend(alternate.iter());
+                    work.push(*consequent);
+                }
+                Stmt::DoWhile { body, .. } | Stmt::While { body, .. } | Stmt::With { body, .. } | Stmt::Labeled { body, .. } => work.push(*body),
+                Stmt::For { init, body, .. } => {
+                    work.push(*body);
+                    if let Some(ForInit::Var(decls)) = init {
+                        decls.iter().for_each(|d| add_var(&mut out, d));
+                    }
+                }
+                Stmt::ForIn { target, body, .. } => {
+                    work.push(*body);
+                    if let ForInTarget::Var(d) = target {
+                        add_var(&mut out, d);
+                    }
+                }
+                Stmt::Switch { cases, .. } => {
+                    for case in cases.iter().rev() {
+                        work.extend(case.body.iter().rev());
+                    }
+                }
+                Stmt::Try { block, handler, finalizer } => {
+                    if let Some(f) = finalizer {
+                        work.extend(f.iter().rev());
+                    }
+                    if let Some(h) = handler {
+                        work.extend(h.body.iter().rev());
+                    }
+                    work.extend(block.iter().rev());
+                }
+                Stmt::Expr(_) | Stmt::Empty | Stmt::Continue(_) | Stmt::Break(_) | Stmt::Return(_) | Stmt::Throw(_) | Stmt::Debugger => {}
+            }
+        }
+        Ok(out)
+    }
+
+    /// Compiles a nested function and returns its index in the function table.
+    fn function(&mut self, fid: FunctionId) -> CResult<u32> {
+        let code = compile_function(self.ast, fid, self.source, self.recursion, true)?;
+        self.functions.push(code);
+        Ok(u32::try_from(self.functions.len() - 1).unwrap_or(u32::MAX))
+    }
+
+    // ---- statements ----
+
+    fn stmts(&mut self, list: &[StmtId]) -> CResult<()> {
+        for &s in list {
+            self.stmt(s)?;
+        }
+        Ok(())
+    }
+
+    fn stmt(&mut self, id: StmtId) -> CResult<()> {
+        self.enter()?;
+        let saved = self.depth;
+        let r = self.stmt_inner(id);
+        self.depth = saved;
+        self.leave();
+        r
+    }
+
+    fn stmt_inner(&mut self, id: StmtId) -> CResult<()> {
+        let Some(stmt) = self.ast.stmt(id) else { return internal("statement out of range") };
+        self.at(self.ast.stmt_span(id).start);
+        match stmt {
+            Stmt::Var(decls) => self.var_decls(decls),
+            Stmt::FunctionDecl(_) | Stmt::Empty | Stmt::Debugger => Ok(()),
+            Stmt::Expr(e) => {
+                self.expr(*e)?;
+                self.emit(if self.kind == CodeKind::Function { Op::Pop } else { Op::SetCompletion });
+                Ok(())
+            }
+            Stmt::Block(list) => self.stmts(list),
+            Stmt::If { .. } => self.if_chain(id),
+            Stmt::DoWhile { .. } | Stmt::While { .. } | Stmt::For { .. } | Stmt::ForIn { .. } => self.loop_stmt(id, Vec::new()),
+            Stmt::Continue(label) => self.jump_stmt(label.as_ref().map(|l| l.name.as_str()), true),
+            Stmt::Break(label) => self.jump_stmt(label.as_ref().map(|l| l.name.as_str()), false),
+            Stmt::Return(value) => {
+                match value {
+                    Some(e) => self.expr(*e)?,
+                    None => self.emit(Op::Undefined),
+                }
+                self.emit_exit(Exit::Return)
+            }
+            Stmt::With { object, body } => {
+                self.expr(*object)?;
+                self.emit(Op::PushWith);
+                self.env_depth += 1;
+                self.stmt(*body)?;
+                self.emit(Op::PopEnv);
+                self.env_depth -= 1;
+                Ok(())
+            }
+            Stmt::Switch { .. } => self.switch_stmt(id, Vec::new()),
+            Stmt::Labeled { .. } => self.labeled(id),
+            Stmt::Throw(e) => {
+                self.expr(*e)?;
+                self.at(self.ast.stmt_span(id).start);
+                self.emit(Op::Throw);
+                Ok(())
+            }
+            Stmt::Try { block, handler, finalizer } => self.try_stmt(block, handler.as_ref(), finalizer.as_deref()),
+        }
+    }
+
+    fn var_decls(&mut self, decls: &[VarDecl]) -> CResult<()> {
+        for d in decls {
+            if let Some(init) = d.init {
+                self.expr(init)?;
+                self.at(d.name.span.start);
+                let n = self.var_name(&d.name.name);
+                self.emit(Op::SetVar(n));
+                self.emit(Op::Pop);
+            }
+        }
+        Ok(())
+    }
+
+    fn if_chain(&mut self, id: StmtId) -> CResult<()> {
+        let saved = self.depth;
+        let end = self.new_label();
+        let mut cur = id;
+        while let Some(Stmt::If { test, consequent, alternate }) = self.ast.stmt(cur) {
+            self.at(self.ast.stmt_span(cur).start);
+            self.expr(*test)?;
+            let otherwise = self.new_label();
+            self.jump(Op::JumpIfFalse, otherwise);
+            self.stmt(*consequent)?;
+            let Some(alt) = *alternate else {
+                self.bind(otherwise);
+                break;
+            };
+            self.jump(Op::Jump, end);
+            self.bind(otherwise);
+            self.depth = saved;
+            if matches!(self.ast.stmt(alt), Some(Stmt::If { .. })) {
+                cur = alt;
+            } else {
+                self.stmt(alt)?;
+                break;
+            }
+        }
+        self.bind(end);
+        Ok(())
+    }
+
+    fn labeled(&mut self, id: StmtId) -> CResult<()> {
+        let mut labels = Vec::new();
+        let mut cur = id;
+        while let Some(Stmt::Labeled { label, body }) = self.ast.stmt(cur) {
+            labels.push(label.name.clone());
+            cur = *body;
+        }
+        match self.ast.stmt(cur) {
+            Some(Stmt::DoWhile { .. } | Stmt::While { .. } | Stmt::For { .. } | Stmt::ForIn { .. }) => self.loop_stmt(cur, labels),
+            Some(Stmt::Switch { .. }) => self.switch_stmt(cur, labels),
+            _ => {
+                let brk = self.new_label();
+                self.push_jump_ctx(labels, false, false, brk, None);
+                self.stmt(cur)?;
+                self.contexts.pop();
+                self.bind(brk);
+                Ok(())
+            }
+        }
+    }
+
+    fn push_jump_ctx(&mut self, labels: Vec<String>, is_loop: bool, plain_break: bool, brk: Label, cont: Option<Label>) {
+        self.contexts.push(Ctx::Jump { labels, is_loop, plain_break, brk, cont, depth: self.depth, env_depth: self.env_depth });
+    }
+
+    /// Compiles a loop body inside its jump context.
+    fn loop_body(&mut self, body: StmtId, labels: Vec<String>, brk: Label, cont: Label) -> CResult<()> {
+        self.push_jump_ctx(labels, true, true, brk, Some(cont));
+        let r = self.stmt(body);
+        self.contexts.pop();
+        r
+    }
+
+    fn loop_stmt(&mut self, id: StmtId, labels: Vec<String>) -> CResult<()> {
+        let brk = self.new_label();
+        let cont = self.new_label();
+        match self.ast.stmt(id) {
+            Some(Stmt::While { test, body }) => {
+                self.bind(cont);
+                self.expr(*test)?;
+                self.jump(Op::JumpIfFalse, brk);
+                self.loop_body(*body, labels, brk, cont)?;
+                self.jump(Op::Jump, cont);
+            }
+            Some(Stmt::DoWhile { body, test }) => {
+                let top = self.new_label();
+                self.bind(top);
+                self.loop_body(*body, labels, brk, cont)?;
+                self.bind(cont);
+                self.expr(*test)?;
+                self.jump(Op::JumpIfTrue, top);
+            }
+            Some(Stmt::For { init, test, update, body }) => {
+                match init {
+                    Some(ForInit::Var(decls)) => self.var_decls(decls)?,
+                    Some(ForInit::Expr(e)) => {
+                        self.expr(*e)?;
+                        self.emit(Op::Pop);
+                    }
+                    None => {}
+                }
+                let head = self.new_label();
+                self.bind(head);
+                if let Some(t) = test {
+                    self.expr(*t)?;
+                    self.jump(Op::JumpIfFalse, brk);
+                }
+                self.loop_body(*body, labels, brk, cont)?;
+                self.bind(cont);
+                if let Some(u) = update {
+                    self.expr(*u)?;
+                    self.emit(Op::Pop);
+                }
+                self.jump(Op::Jump, head);
+            }
+            Some(Stmt::ForIn { target, object, body }) => return self.for_in(target, *object, *body, labels),
+            _ => return internal("not a loop"),
+        }
+        self.bind(brk);
+        Ok(())
+    }
+
+    fn for_in(&mut self, target: &ForInTarget, object: ExprId, body: StmtId, labels: Vec<String>) -> CResult<()> {
+        if let ForInTarget::Var(d) = target {
+            self.var_decls(std::slice::from_ref(d))?;
+        }
+        self.expr(object)?;
+        self.emit(Op::ForInStart);
+        let iter_depth = self.depth;
+        let head = self.new_label();
+        let brk = self.new_label();
+        self.bind(head);
+        self.jump(Op::ForInNext, brk);
+        match target {
+            ForInTarget::Var(d) => {
+                let n = self.var_name(&d.name.name);
+                self.emit(Op::SetVar(n));
+            }
+            ForInTarget::Expr(e) => self.store_key_to(*e)?,
+        }
+        self.emit(Op::Pop);
+        self.loop_body(body, labels, brk, head)?;
+        self.jump(Op::Jump, head);
+        self.bind(brk);
+        self.depth = iter_depth;
+        self.emit(Op::Pop);
+        Ok(())
+    }
+
+    /// Assigns the name on top of the stack to a `for-in` target expression, leaving it on top.
+    fn store_key_to(&mut self, target: ExprId) -> CResult<()> {
+        let target = self.ast.unparenthesized(target);
+        self.at(self.ast.expr_span(target).start);
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::SetVar(n));
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                self.emit(Op::Swap);
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::SetMember(n));
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::ToKey);
+                self.emit(Op::Rot3);
+                self.emit(Op::SetIndex);
+            }
+            _ => {
+                self.expr(target)?;
+                self.emit(Op::Pop);
+                self.throw_invalid_target();
+            }
+        }
+        Ok(())
+    }
+
+    fn throw_invalid_target(&mut self) {
+        let s = self.string(&"invalid assignment target".encode_utf16().collect::<Vec<u16>>());
+        let depth = self.depth;
+        self.emit(Op::ThrowReferenceError(s));
+        self.depth = depth;
+    }
+
+    fn switch_stmt(&mut self, id: StmtId, labels: Vec<String>) -> CResult<()> {
+        let Some(Stmt::Switch { discriminant, cases }) = self.ast.stmt(id) else { return internal("not a switch") };
+        self.expr(*discriminant)?;
+        let d = self.depth;
+        let brk = self.new_label();
+        let case_labels: Vec<Label> = cases.iter().map(|_| self.new_label()).collect();
+        for (case, &label) in cases.iter().zip(&case_labels) {
+            if let Some(test) = case.test {
+                self.emit(Op::Dup);
+                self.expr(test)?;
+                self.at(case.span.start);
+                self.emit(Op::Binary(BinaryOp::StrictEq));
+                self.jump(Op::JumpIfTrue, label);
+            }
+        }
+        match cases.iter().position(|c| c.test.is_none()).and_then(|i| case_labels.get(i)) {
+            Some(&default) => self.jump(Op::Jump, default),
+            None => self.jump(Op::Jump, brk),
+        }
+        self.push_jump_ctx(labels, false, true, brk, None);
+        for (case, &label) in cases.iter().zip(&case_labels) {
+            self.bind(label);
+            self.depth = d;
+            self.stmts(&case.body)?;
+        }
+        self.contexts.pop();
+        self.bind(brk);
+        self.depth = d;
+        self.emit(Op::Pop);
+        Ok(())
+    }
+
+    fn jump_stmt(&mut self, label: Option<&str>, is_continue: bool) -> CResult<()> {
+        let target = self.contexts.iter().enumerate().rev().find_map(|(i, c)| match c {
+            Ctx::Jump { labels, is_loop, plain_break, .. } => {
+                let hit = match label {
+                    Some(l) => labels.iter().any(|x| x == l) && (!is_continue || *is_loop),
+                    None if is_continue => *is_loop,
+                    None => *plain_break,
+                };
+                hit.then_some(i)
+            }
+            Ctx::Finally { .. } => None,
+        });
+        match target {
+            Some(i) => self.emit_exit(if is_continue { Exit::Continue(i) } else { Exit::Break(i) }),
+            None => internal("break or continue without a target"),
+        }
+    }
+
+    /// Emits a jump out to `exit`, dropping the values and environments in between and going
+    /// through each `finally` block on the way.
+    fn emit_exit(&mut self, exit: Exit) -> CResult<()> {
+        let (saved, saved_env) = (self.depth, self.env_depth);
+        let mut i = self.contexts.len();
+        loop {
+            let Some(next) = i.checked_sub(1) else {
+                if exit != Exit::Return {
+                    return internal("jump target not found");
+                }
+                self.emit(Op::Return);
+                break;
+            };
+            i = next;
+            match self.contexts.get(i) {
+                Some(&Ctx::Jump { brk, cont, depth, env_depth, .. }) => {
+                    let label = match exit {
+                        Exit::Break(t) if t == i => Some(brk),
+                        Exit::Continue(t) if t == i => cont,
+                        _ => None,
+                    };
+                    if let Some(label) = label {
+                        self.unwind_to(depth, env_depth)?;
+                        self.jump(Op::Jump, label);
+                        break;
+                    }
+                }
+                Some(&Ctx::Finally { try_depth, env_depth, entry, .. }) => {
+                    self.route_through_finally(i, exit, try_depth, env_depth, entry)?;
+                    break;
+                }
+                None => return internal("context out of range"),
+            }
+        }
+        self.depth = saved;
+        self.env_depth = saved_env;
+        Ok(())
+    }
+
+    fn route_through_finally(&mut self, ctx: usize, exit: Exit, try_depth: u32, env_depth: u32, entry: Label) -> CResult<()> {
+        let Some(Ctx::Finally { exits, .. }) = self.contexts.get_mut(ctx) else { return internal("not a finally context") };
+        let k = match exits.iter().position(|e| *e == exit) {
+            Some(k) => k,
+            None => {
+                exits.push(exit);
+                exits.len() - 1
+            }
+        };
+        if exit == Exit::Return {
+            let Some(under) = self.depth.checked_sub(1 + try_depth) else { return internal("stack below a try block") };
+            if under > 0 {
+                self.emit(Op::PopUnder(under));
+            }
+            self.pop_envs(env_depth)?;
+        } else {
+            self.unwind_to(try_depth, env_depth)?;
+            self.emit(Op::Undefined);
+        }
+        self.push_number((k + 2) as f64);
+        self.jump(Op::Jump, entry);
+        Ok(())
+    }
+
+    fn unwind_to(&mut self, depth: u32, env_depth: u32) -> CResult<()> {
+        if self.depth < depth {
+            return internal("jump to a deeper stack");
+        }
+        while self.depth > depth {
+            self.emit(Op::Pop);
+        }
+        self.pop_envs(env_depth)
+    }
+
+    fn pop_envs(&mut self, env_depth: u32) -> CResult<()> {
+        if self.env_depth < env_depth {
+            return internal("jump into an environment");
+        }
+        for _ in env_depth..self.env_depth {
+            self.ops.push(Op::PopEnv);
+            self.positions.push(self.pos);
+        }
+        Ok(())
+    }
+
+    fn try_stmt(&mut self, block: &[StmtId], handler: Option<&crate::ast::CatchClause>, finalizer: Option<&[StmtId]>) -> CResult<()> {
+        let try_depth = self.depth;
+        let env_depth = self.env_depth;
+        let fin_entry = self.new_label();
+        if finalizer.is_some() {
+            self.contexts.push(Ctx::Finally { try_depth, env_depth, entry: fin_entry, exits: Vec::new() });
+        }
+        let start = self.pc();
+        self.stmts(block)?;
+        if let Some(h) = handler {
+            let after = self.new_label();
+            let catch = self.new_label();
+            self.jump(Op::Jump, after);
+            let end = self.pc();
+            self.handlers.push((start, end, catch, try_depth, env_depth));
+            self.bind(catch);
+            self.depth = try_depth + 1;
+            self.at(h.param.span.start);
+            let n = self.var_name(&h.param.name);
+            self.emit(Op::PushCatch(n));
+            self.env_depth += 1;
+            self.stmts(&h.body)?;
+            self.emit(Op::PopEnv);
+            self.env_depth -= 1;
+            self.bind(after);
+        }
+        let Some(fin) = finalizer else { return Ok(()) };
+        let protected_end = self.pc();
+        let Some(Ctx::Finally { exits, .. }) = self.contexts.pop() else { return internal("finally context missing") };
+        let after = self.new_label();
+        let stub = self.new_label();
+        self.handlers.push((start, protected_end, stub, try_depth, env_depth));
+        self.emit(Op::Undefined);
+        self.push_number(0.0);
+        self.bind(fin_entry);
+        // In script and eval code the finally block keeps the completion value of the try or
+        // catch block when it ends normally (ECMA-262 5.1 section 12.14).
+        let keeps_completion = self.kind != CodeKind::Function;
+        if keeps_completion {
+            self.emit(Op::GetCompletion);
+        }
+        self.stmts(fin)?;
+        if keeps_completion {
+            self.emit(Op::SetCompletion);
+        }
+        let dispatch: Vec<Label> = exits.iter().map(|_| self.new_label()).collect();
+        let table = u32::try_from(self.finally_tables.len()).unwrap_or(u32::MAX);
+        self.finally_tables.push(dispatch.clone());
+        self.emit(Op::EndFinally(table));
+        self.jump(Op::Jump, after);
+        self.bind(stub);
+        self.depth = try_depth + 1;
+        self.push_number(1.0);
+        self.jump(Op::Jump, fin_entry);
+        for (exit, label) in exits.into_iter().zip(dispatch) {
+            self.bind(label);
+            self.depth = try_depth + 1;
+            if exit != Exit::Return {
+                self.emit(Op::Pop);
+            }
+            self.emit_exit(exit)?;
+        }
+        self.bind(after);
+        self.depth = try_depth;
+        Ok(())
+    }
+
+    fn pc(&self) -> u32 {
+        u32::try_from(self.ops.len()).unwrap_or(u32::MAX)
+    }
+
+    // ---- expressions ----
+
+    fn expr(&mut self, id: ExprId) -> CResult<()> {
+        self.enter()?;
+        let r = self.expr_inner(self.ast.unparenthesized(id));
+        self.leave();
+        r
+    }
+
+    fn expr_inner(&mut self, id: ExprId) -> CResult<()> {
+        let Some(e) = self.ast.expr(id) else { return internal("expression out of range") };
+        self.at(self.ast.expr_span(id).start);
+        match e {
+            Expr::This => self.emit(Op::This),
+            Expr::Ident(name) => {
+                let n = self.var_name(name);
+                self.emit(Op::GetVar(n));
+            }
+            Expr::Null => self.emit(Op::Null),
+            Expr::Bool(b) => self.emit(if *b { Op::True } else { Op::False }),
+            Expr::Number(n) => self.push_number(*n),
+            Expr::String(s) => {
+                let i = self.string(s);
+                self.emit(Op::String(i));
+            }
+            Expr::RegExp { pattern, flags } => {
+                self.regexps.push((Str::from_units(pattern.clone()), Str::from(flags.as_str())));
+                let i = u32::try_from(self.regexps.len() - 1).unwrap_or(u32::MAX);
+                self.emit(Op::RegExp(i));
+            }
+            Expr::Array(elements) => {
+                self.emit(Op::NewArray);
+                for el in elements {
+                    match el {
+                        Some(e) => {
+                            self.expr(*e)?;
+                            self.emit(Op::ArrayPush);
+                        }
+                        None => self.emit(Op::ArrayHole),
+                    }
+                }
+            }
+            Expr::Object(props) => self.object_literal(props)?,
+            Expr::Function(fid) => {
+                let i = self.function(*fid)?;
+                self.emit(Op::Closure(i));
+            }
+            Expr::Member { .. } | Expr::Index { .. } | Expr::Call { .. } => self.chain(id)?,
+            Expr::New { callee, args } => {
+                self.expr(*callee)?;
+                self.args(args)?;
+                self.at(self.ast.expr_span(id).start);
+                self.emit(Op::New(len_u32(args.len())));
+            }
+            Expr::Update { op, prefix, target } => self.update(*op, *prefix, *target)?,
+            Expr::Unary { .. } => self.unary(id)?,
+            Expr::Binary { .. } | Expr::Logical { .. } => self.binary_chain(id)?,
+            Expr::Conditional { test, consequent, alternate } => {
+                self.expr(*test)?;
+                let d = self.depth;
+                let otherwise = self.new_label();
+                let end = self.new_label();
+                self.jump(Op::JumpIfFalse, otherwise);
+                self.expr(*consequent)?;
+                self.jump(Op::Jump, end);
+                self.bind(otherwise);
+                self.depth = d.saturating_sub(1);
+                self.expr(*alternate)?;
+                self.bind(end);
+            }
+            Expr::Assign { .. } => self.assign_chain(id)?,
+            Expr::Sequence(list) => {
+                for (i, e) in list.iter().enumerate() {
+                    if i > 0 {
+                        self.emit(Op::Pop);
+                    }
+                    self.expr(*e)?;
+                }
+                if list.is_empty() {
+                    self.emit(Op::Undefined);
+                }
+            }
+            Expr::Paren(inner) => self.expr(*inner)?,
+        }
+        Ok(())
+    }
+
+    fn args(&mut self, args: &[ExprId]) -> CResult<()> {
+        for a in args {
+            self.expr(*a)?;
+        }
+        Ok(())
+    }
+
+    fn object_literal(&mut self, props: &[crate::ast::Property]) -> CResult<()> {
+        self.emit(Op::NewObject);
+        for p in props {
+            let n = self.name_key(p.key.to_utf16().into());
+            match &p.value {
+                PropertyValue::Init(e) => {
+                    self.expr(*e)?;
+                    self.emit(Op::InitProp(n));
+                }
+                PropertyValue::Get(f) => {
+                    let i = self.function(*f)?;
+                    self.emit(Op::Closure(i));
+                    self.emit(Op::InitGetter(n));
+                }
+                PropertyValue::Set(f) => {
+                    let i = self.function(*f)?;
+                    self.emit(Op::Closure(i));
+                    self.emit(Op::InitSetter(n));
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// A run of member accesses and calls (`a.b[c](d).e`), compiled from the innermost object out
+    /// with a loop.
+    fn chain(&mut self, id: ExprId) -> CResult<()> {
+        let mut suffixes = Vec::new();
+        let mut cur = id;
+        loop {
+            match self.ast.expr(cur) {
+                Some(Expr::Member { object, .. } | Expr::Index { object, .. }) => {
+                    suffixes.push(cur);
+                    cur = self.ast.unparenthesized(*object);
+                }
+                Some(Expr::Call { callee, .. }) => {
+                    suffixes.push(cur);
+                    cur = self.ast.unparenthesized(*callee);
+                }
+                _ => break,
+            }
+        }
+        let is_call = |c: &Self, e: Option<&ExprId>| e.is_some_and(|&e| matches!(c.ast.expr(e), Some(Expr::Call { .. })));
+        let first_is_call = is_call(self, suffixes.last());
+        let mut base_has_this = false;
+        let mut eval_call = false;
+        match self.ast.expr(cur) {
+            Some(Expr::Ident(name)) if first_is_call => {
+                self.at(self.ast.expr_span(cur).start);
+                let n = self.var_name(name);
+                self.emit(Op::GetVarThis(n));
+                base_has_this = true;
+                eval_call = name == "eval";
+            }
+            _ => self.expr(cur)?,
+        }
+        let count = suffixes.len();
+        for j in (0..count).rev() {
+            let Some(&s) = suffixes.get(j) else { return internal("suffix out of range") };
+            let next_is_call = j > 0 && is_call(self, suffixes.get(j - 1));
+            let span = self.ast.expr_span(s);
+            match self.ast.expr(s) {
+                Some(Expr::Member { property, .. }) => {
+                    self.at(span.start);
+                    let n = self.name_key(key_of(&property.name));
+                    self.emit(if next_is_call { Op::GetMemberThis(n) } else { Op::GetMember(n) });
+                }
+                Some(Expr::Index { index, .. }) => {
+                    self.expr(*index)?;
+                    self.at(span.start);
+                    self.emit(if next_is_call { Op::GetIndexThis } else { Op::GetIndex });
+                }
+                Some(Expr::Call { args, .. }) => {
+                    let innermost = j + 1 == count;
+                    let has_this = if innermost {
+                        base_has_this
+                    } else {
+                        matches!(suffixes.get(j + 1).and_then(|&e| self.ast.expr(e)), Some(Expr::Member { .. } | Expr::Index { .. }))
+                    };
+                    if !has_this {
+                        self.emit(Op::Undefined);
+                    }
+                    self.args(args)?;
+                    self.at(span.start);
+                    let n = len_u32(args.len());
+                    if innermost && eval_call {
+                        self.uses_arguments = true;
+                        self.emit(Op::CallEval(n));
+                    } else {
+                        self.emit(Op::Call(n));
+                    }
+                }
+                _ => return internal("not a member or call"),
+            }
+        }
+        Ok(())
+    }
+
+    fn unary(&mut self, id: ExprId) -> CResult<()> {
+        let mut ops = Vec::new();
+        let mut cur = id;
+        while let Some(Expr::Unary { op, arg }) = self.ast.expr(cur) {
+            if matches!(op, UnaryOp::Delete | UnaryOp::Typeof) {
+                break;
+            }
+            ops.push(*op);
+            cur = self.ast.unparenthesized(*arg);
+        }
+        match self.ast.expr(cur) {
+            Some(Expr::Unary { op: UnaryOp::Typeof, arg }) => self.typeof_expr(*arg)?,
+            Some(Expr::Unary { op: UnaryOp::Delete, arg }) => self.delete_expr(*arg)?,
+            _ => self.expr(cur)?,
+        }
+        self.at(self.ast.expr_span(id).start);
+        for op in ops.into_iter().rev() {
+            match op {
+                UnaryOp::Plus => self.emit(Op::Plus),
+                UnaryOp::Minus => self.emit(Op::Neg),
+                UnaryOp::BitNot => self.emit(Op::BitNot),
+                UnaryOp::Not => self.emit(Op::Not),
+                UnaryOp::Void => {
+                    self.emit(Op::Pop);
+                    self.emit(Op::Undefined);
+                }
+                UnaryOp::Delete | UnaryOp::Typeof => return internal("unexpected operator"),
+            }
+        }
+        Ok(())
+    }
+
+    fn typeof_expr(&mut self, arg: ExprId) -> CResult<()> {
+        let arg = self.ast.unparenthesized(arg);
+        if let Some(Expr::Ident(name)) = self.ast.expr(arg) {
+            let n = self.var_name(name);
+            self.emit(Op::TypeofVar(n));
+        } else {
+            self.expr(arg)?;
+            self.emit(Op::Typeof);
+        }
+        Ok(())
+    }
+
+    fn delete_expr(&mut self, arg: ExprId) -> CResult<()> {
+        let arg = self.ast.unparenthesized(arg);
+        match self.ast.expr(arg) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::DeleteVar(n));
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::DeleteMember(n));
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::DeleteIndex);
+            }
+            _ => {
+                self.expr(arg)?;
+                self.emit(Op::Pop);
+                self.emit(Op::True);
+            }
+        }
+        Ok(())
+    }
+
+    /// A run of binary and logical operators nested on the left (`a + b + c`), compiled with a
+    /// loop.
+    fn binary_chain(&mut self, id: ExprId) -> CResult<()> {
+        enum Step {
+            Binary(BinaryOp),
+            Logical(LogicalOp),
+        }
+        let mut spine = Vec::new();
+        let mut cur = id;
+        loop {
+            match self.ast.expr(cur) {
+                Some(Expr::Binary { op, left, right }) => {
+                    spine.push((Step::Binary(*op), *right, cur));
+                    cur = self.ast.unparenthesized(*left);
+                }
+                Some(Expr::Logical { op, left, right }) => {
+                    spine.push((Step::Logical(*op), *right, cur));
+                    cur = self.ast.unparenthesized(*left);
+                }
+                _ => break,
+            }
+        }
+        self.expr(cur)?;
+        for (step, right, node) in spine.into_iter().rev() {
+            match step {
+                Step::Binary(op) => {
+                    self.expr(right)?;
+                    self.at(self.ast.expr_span(node).start);
+                    self.emit(Op::Binary(op));
+                }
+                Step::Logical(op) => {
+                    let end = self.new_label();
+                    self.jump(if op == LogicalOp::And { Op::JumpIfFalseKeep } else { Op::JumpIfTrueKeep }, end);
+                    self.expr(right)?;
+                    self.bind(end);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// A chain of assignments nested on the right (`a = b.c = d[e] = 1`), compiled with a loop:
+    /// each target's object and key first, from the left, then the value, then the stores from
+    /// the right.
+    fn assign_chain(&mut self, id: ExprId) -> CResult<()> {
+        let mut chain: Vec<(AssignOp, ExprId, ExprId)> = Vec::new();
+        let mut cur = id;
+        while let Some(Expr::Assign { op, target, value }) = self.ast.expr(cur) {
+            chain.push((*op, self.ast.unparenthesized(*target), cur));
+            cur = self.ast.unparenthesized(*value);
+        }
+        for &(op, target, node) in &chain {
+            self.at(self.ast.expr_span(node).start);
+            self.assign_target(op, target)?;
+        }
+        self.expr(cur)?;
+        for &(op, target, node) in chain.iter().rev() {
+            self.at(self.ast.expr_span(node).start);
+            if let Some(b) = op {
+                self.emit(Op::Binary(b));
+            }
+            self.store(target)?;
+        }
+        Ok(())
+    }
+
+    /// Pushes what an assignment to `target` needs before its value: the object and key, and the
+    /// current value for a compound assignment.
+    fn assign_target(&mut self, op: AssignOp, target: ExprId) -> CResult<()> {
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::RefVar(n));
+                if op.is_some() {
+                    self.emit(Op::Dup);
+                    self.emit(Op::GetRef(n));
+                }
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                if op.is_some() {
+                    self.emit(Op::Dup);
+                    let n = self.name_key(key_of(&property.name));
+                    self.emit(Op::GetMember(n));
+                } else {
+                    self.emit(Op::CheckObject);
+                }
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::ToKey);
+                if op.is_some() {
+                    self.emit(Op::Dup2);
+                    self.emit(Op::GetIndex);
+                }
+            }
+            _ => {
+                self.expr(target)?;
+                if op.is_none() {
+                    self.emit(Op::Pop);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn store(&mut self, target: ExprId) -> CResult<()> {
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::PutRef(n));
+            }
+            Some(Expr::Member { property, .. }) => {
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::SetMember(n));
+            }
+            Some(Expr::Index { .. }) => self.emit(Op::SetIndex),
+            _ => self.throw_invalid_target(),
+        }
+        Ok(())
+    }
+
+    fn update(&mut self, op: UpdateOp, prefix: bool, target: ExprId) -> CResult<()> {
+        let target = self.ast.unparenthesized(target);
+        let dec = op == UpdateOp::Decrement;
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::IncVar { name: n, prefix, dec });
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::IncMember { name: n, prefix, dec });
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::IncIndex { prefix, dec });
+            }
+            _ => {
+                self.expr(target)?;
+                self.emit(Op::ToNumber);
+                self.throw_invalid_target();
+            }
+        }
+        Ok(())
+    }
+
+    // ---- finishing ----
+
+    fn finish(mut self, hoisted: Hoisted, meta: Meta) -> CResult<Rc<Code>> {
+        let resolve = |labels: &[Option<u32>], l: Label| labels.get(l.0).copied().flatten();
+        for &(i, label) in &self.patches {
+            let Some(target) = resolve(&self.labels, label) else { return internal("jump to an unplaced label") };
+            match self.ops.get_mut(i) {
+                Some(Op::Jump(t) | Op::JumpIfFalse(t) | Op::JumpIfTrue(t) | Op::JumpIfFalseKeep(t) | Op::JumpIfTrueKeep(t) | Op::ForInNext(t)) => {
+                    *t = target
+                }
+                _ => return internal("patching an instruction that is not a jump"),
+            }
+        }
+        let mut handlers = Vec::new();
+        for &(start, end, label, depth, env_depth) in &self.handlers {
+            let Some(target) = resolve(&self.labels, label) else { return internal("handler at an unplaced label") };
+            handlers.push(Handler { start, end, target, depth, env_depth });
+        }
+        let mut finally_tables = Vec::new();
+        for table in &self.finally_tables {
+            let resolved: Option<Vec<u32>> = table.iter().map(|&l| resolve(&self.labels, l)).collect();
+            let Some(resolved) = resolved else { return internal("finally exit at an unplaced label") };
+            finally_tables.push(resolved);
+        }
+        let mut code = Code {
+            ops: std::mem::take(&mut self.ops),
+            positions: std::mem::take(&mut self.positions),
+            numbers: std::mem::take(&mut self.numbers),
+            strings: std::mem::take(&mut self.strings),
+            names: std::mem::take(&mut self.names),
+            functions: std::mem::take(&mut self.functions),
+            regexps: std::mem::take(&mut self.regexps),
+            handlers,
+            finally_tables,
+            max_stack: 0,
+            strict: self.strict,
+            self_name: meta.self_name,
+            params: meta.params,
+            vars: hoisted.vars,
+            fun_decls: hoisted.fun_decls,
+            uses_arguments: self.uses_arguments,
+            source: self.source.clone(),
+            span: meta.span,
+        };
+        code.max_stack = verify(&code).map_err(CompileFail::Internal)?;
+        Ok(Rc::new(code))
+    }
+}
+
+/// What a code knows about the function it is, if it is one.
+#[derive(Default)]
+struct Meta {
+    self_name: Option<Key>,
+    params: Vec<Key>,
+    span: (u32, u32),
+}
+
+fn len_u32(n: usize) -> u32 {
+    u32::try_from(n).unwrap_or(u32::MAX)
+}
+
+/// Compiles function `fid` of `ast`. With `bind_name`, a function expression's name is bound
+/// inside it.
+pub(crate) fn compile_function(ast: &Ast, fid: FunctionId, source: &Rc<Source>, recursion: u32, bind_name: bool) -> CResult<Rc<Code>> {
+    let Some(f) = ast.function(fid) else { return internal("function out of range") };
+    let mut c = FnCompiler::new(ast, source, CodeKind::Function, f.strict, recursion);
+    c.at(f.span.start);
+    c.enter()?;
+    let hoisted = c.hoist(&f.body)?;
+    c.stmts(&f.body)?;
+    c.at(f.span.end.saturating_sub(1));
+    c.emit(Op::Undefined);
+    c.emit(Op::Return);
+    let name = f.name.as_ref().map(|n| key_of(&n.name));
+    let meta = Meta {
+        self_name: if bind_name && f.kind == FunctionKind::Expression { name } else { None },
+        params: f.params.iter().map(|p| key_of(&p.name)).collect(),
+        span: (f.span.start, f.span.end),
+    };
+    c.finish(hoisted, meta)
+}
+
+/// Compiles a script (`kind` [`CodeKind::Global`]) or eval code ([`CodeKind::Eval`]).
+pub(crate) fn compile_program(program: &crate::Program, source: &Rc<Source>, kind: CodeKind) -> CResult<Rc<Code>> {
+    let mut c = FnCompiler::new(&program.ast, source, kind, program.strict, 0);
+    let hoisted = c.hoist(&program.body)?;
+    c.stmts(&program.body)?;
+    c.emit(Op::ReturnCompletion);
+    let end = u32::try_from(source.text.len()).unwrap_or(u32::MAX);
+    c.finish(hoisted, Meta { span: (0, end), ..Meta::default() })
+}
+
+/// The function of a `Function` constructor's source, `(function anonymous(…) {…})`: the program
+/// must be that one parenthesized function expression and nothing else. The name `anonymous` is
+/// not bound inside the function (section 15.3.2.1).
+pub(crate) fn compile_constructed_function(program: &crate::Program, source: &Rc<Source>) -> CResult<Option<Rc<Code>>> {
+    let [stmt] = program.body.as_slice() else { return Ok(None) };
+    let Some(Stmt::Expr(e)) = program.ast.stmt(*stmt) else { return Ok(None) };
+    let Some(Expr::Paren(inner)) = program.ast.expr(*e) else { return Ok(None) };
+    let Some(Expr::Function(fid)) = program.ast.expr(*inner) else { return Ok(None) };
+    compile_function(&program.ast, *fid, source, 0, false).map(Some)
+}
diff --git a/crates/js/src/heap.rs b/crates/js/src/heap.rs
new file mode 100644
index 000000000..82268f489
--- /dev/null
+++ b/crates/js/src/heap.rs
@@ -0,0 +1,594 @@
+//! The heap: objects and environments in one arena, referred to by index, and a mark-sweep
+//! collector over it.
+//!
+//! A cell is either free or holds an [`Object`] or an [`Env`]. The collector marks every cell
+//! reachable from the roots the interpreter passes in, with a worklist rather than recursion, and
+//! frees the rest; freed indices are reused by later allocations. Cycles between objects are freed
+//! like anything else that is unreachable. [`Heap::bytes`] is an estimate of the memory the heap
+//! holds, strings reachable from it included; the interpreter compares it with its heap limit.
+
+use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
+
+use crate::bytecode::{Code, Handler, Op};
+use crate::value::{Str, Value};
+
+/// A property name: its UTF-16 code units.
+pub(crate) type Key = Rc<[u16]>;
+
+pub(crate) fn key(s: &str) -> Key {
+    s.encode_utf16().collect::<Vec<u16>>().into()
+}
+
+/// An object's index in the heap.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub(crate) struct ObjId(pub(crate) u32);
+
+/// An environment's index in the heap.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub(crate) struct EnvId(pub(crate) u32);
+
+/// A map from property names to values that keeps insertion order (the order `for-in` lists own
+/// properties in). Small maps are searched in order; larger ones keep a hash index.
+#[derive(Clone, Debug)]
+pub(crate) struct PropMap<T> {
+    entries: Vec<Option<(Key, T)>>,
+    index: Option<HashMap<Key, usize>>,
+    live: usize,
+}
+
+/// Maps with more entries than this keep a hash index.
+const INDEX_AFTER: usize = 8;
+
+impl<T> Default for PropMap<T> {
+    fn default() -> Self {
+        Self { entries: Vec::new(), index: None, live: 0 }
+    }
+}
+
+impl<T> PropMap<T> {
+    fn position(&self, k: &[u16]) -> Option<usize> {
+        match &self.index {
+            Some(index) => index.get(k).copied(),
+            None => self.entries.iter().position(|e| e.as_ref().is_some_and(|(ek, _)| &**ek == k)),
+        }
+    }
+
+    pub(crate) fn get(&self, k: &[u16]) -> Option<&T> {
+        let i = self.position(k)?;
+        self.entries.get(i)?.as_ref().map(|(_, v)| v)
+    }
+
+    pub(crate) fn get_mut(&mut self, k: &[u16]) -> Option<&mut T> {
+        let i = self.position(k)?;
+        self.entries.get_mut(i)?.as_mut().map(|(_, v)| v)
+    }
+
+    pub(crate) fn contains(&self, k: &[u16]) -> bool {
+        self.position(k).is_some()
+    }
+
+    /// Sets the value under `k`, keeping its place when it is there already.
+    pub(crate) fn insert(&mut self, k: Key, v: T) {
+        if let Some(slot) = self.get_mut(&k) {
+            *slot = v;
+            return;
+        }
+        let i = self.entries.len();
+        if let Some(index) = &mut self.index {
+            index.insert(k.clone(), i);
+        }
+        self.entries.push(Some((k, v)));
+        self.live += 1;
+        if self.index.is_none() && self.entries.len() > INDEX_AFTER {
+            self.rebuild_index();
+        }
+    }
+
+    pub(crate) fn remove(&mut self, k: &[u16]) -> Option<T> {
+        let i = self.position(k)?;
+        let (_, v) = self.entries.get_mut(i)?.take()?;
+        if let Some(index) = &mut self.index {
+            index.remove(k);
+        }
+        self.live -= 1;
+        if self.entries.len() > 2 * INDEX_AFTER && self.live * 2 < self.entries.len() {
+            self.entries.retain(Option::is_some);
+            self.rebuild_index();
+        }
+        Some(v)
+    }
+
+    fn rebuild_index(&mut self) {
+        if self.entries.len() <= INDEX_AFTER {
+            self.index = None;
+            return;
+        }
+        let index = self.entries.iter().enumerate().filter_map(|(i, e)| e.as_ref().map(|(k, _)| (k.clone(), i))).collect();
+        self.index = Some(index);
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        self.live
+    }
+
+    pub(crate) fn iter(&self) -> impl Iterator<Item = (&Key, &T)> {
+        self.entries.iter().filter_map(|e| e.as_ref().map(|(k, v)| (k, v)))
+    }
+
+    pub(crate) fn keys(&self) -> Vec<Key> {
+        self.iter().map(|(k, _)| k.clone()).collect()
+    }
+}
+
+pub(crate) const WRITABLE: u8 = 1;
+pub(crate) const ENUMERABLE: u8 = 2;
+pub(crate) const CONFIGURABLE: u8 = 4;
+/// Writable, enumerable and configurable: a property made by assignment.
+pub(crate) const OPEN: u8 = WRITABLE | ENUMERABLE | CONFIGURABLE;
+/// Writable and configurable but not enumerable: the built-in methods.
+pub(crate) const HIDDEN: u8 = WRITABLE | CONFIGURABLE;
+
+/// A property (section 8.6.1).
+#[derive(Clone, Debug)]
+pub(crate) enum Prop {
+    Data { value: Value, flags: u8 },
+    Accessor { get: Option<ObjId>, set: Option<ObjId>, flags: u8 },
+}
+
+impl Prop {
+    pub(crate) fn flags(&self) -> u8 {
+        match self {
+            Prop::Data { flags, .. } | Prop::Accessor { flags, .. } => *flags,
+        }
+    }
+
+    pub(crate) fn enumerable(&self) -> bool {
+        self.flags() & ENUMERABLE != 0
+    }
+
+    pub(crate) fn configurable(&self) -> bool {
+        self.flags() & CONFIGURABLE != 0
+    }
+}
+
+/// A built-in function implemented in Rust: `(interp, this, arguments, called with new)`.
+pub(crate) type NativeFn = fn(&mut crate::interp::Interp, Value, &[Value], bool) -> Result<Value, crate::interp::Abrupt>;
+
+/// A function the embedding defines.
+pub(crate) type HostFn = dyn Fn(&[crate::JsValue]) -> Result<crate::JsValue, String>;
+
+/// The built-ins the interpreter treats specially when it calls them.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum NativeKind {
+    Plain,
+    /// `Function.prototype.call`.
+    Call,
+    /// `Function.prototype.apply`.
+    Apply,
+    /// The global `eval`: a call to it by that name is a direct eval.
+    Eval,
+}
+
+#[derive(Clone)]
+pub(crate) enum Func {
+    Closure { code: Rc<Code>, env: EnvId },
+    Native { f: NativeFn, kind: NativeKind, constructor: bool, name: &'static str },
+    Host { f: Rc<HostFn>, name: Rc<str> },
+}
+
+/// A sloppy mode `arguments` object's link to its function's parameters (section 10.6): index
+/// `i` reads and writes the binding `names[i]` while that is `Some`.
+#[derive(Clone, Debug)]
+pub(crate) struct ArgMap {
+    pub(crate) env: EnvId,
+    pub(crate) names: Vec<Option<Key>>,
+}
+
+/// A `for-in` loop's state: the names listed when it started, and the object they came from.
+#[derive(Clone, Debug)]
+pub(crate) struct ForIn {
+    pub(crate) keys: Vec<Key>,
+    pub(crate) pos: usize,
+    pub(crate) object: Option<ObjId>,
+}
+
+/// What kind of object it is, with the internal state that kind has.
+#[derive(Clone)]
+pub(crate) enum Class {
+    Ordinary,
+    Array {
+        length: u32,
+        length_writable: bool,
+    },
+    Function(Func),
+    Error,
+    Arguments(Box<ArgMap>),
+    /// A `Boolean` object made by ToObject.
+    Boolean,
+    /// A `Number` object made by ToObject.
+    Number,
+    String(Str),
+    RegExp,
+    ForIn(Box<ForIn>),
+}
+
+impl Class {
+    /// The `[[Class]]` name `Object.prototype.toString` reports.
+    pub(crate) fn name(&self) -> &'static str {
+        match self {
+            Class::Ordinary | Class::ForIn(_) => "Object",
+            Class::Array { .. } => "Array",
+            Class::Function(_) => "Function",
+            Class::Error => "Error",
+            Class::Arguments(_) => "Arguments",
+            Class::Boolean => "Boolean",
+            Class::Number => "Number",
+            Class::String(_) => "String",
+            Class::RegExp => "RegExp",
+        }
+    }
+}
+
+pub(crate) struct Object {
+    pub(crate) class: Class,
+    pub(crate) proto: Option<ObjId>,
+    pub(crate) extensible: bool,
+    pub(crate) props: PropMap<Prop>,
+}
+
+impl Object {
+    pub(crate) fn new(class: Class, proto: Option<ObjId>) -> Self {
+        Self { class, proto, extensible: true, props: PropMap::default() }
+    }
+}
+
+/// A binding in a declarative environment.
+#[derive(Clone, Debug)]
+pub(crate) struct Binding {
+    pub(crate) value: Value,
+    pub(crate) mutable: bool,
+    pub(crate) deletable: bool,
+}
+
+/// An environment record (section 10.2.1) with its outer environment.
+pub(crate) enum Env {
+    Decl {
+        bindings: PropMap<Binding>,
+        outer: Option<EnvId>,
+    },
+    /// The global object, or a `with` statement's object (`with_this`: calls to its functions get
+    /// it as `this`).
+    Obj {
+        object: ObjId,
+        with_this: bool,
+        outer: Option<EnvId>,
+    },
+}
+
+impl Env {
+    pub(crate) fn outer(&self) -> Option<EnvId> {
+        match self {
+            Env::Decl { outer, .. } | Env::Obj { outer, .. } => *outer,
+        }
+    }
+}
+
+enum Cell {
+    Free,
+    Object(Box<Object>),
+    Env(Box<Env>),
+}
+
+/// The estimated bytes of a property or a binding entry. A collection adds its name's code units
+/// separately, counting a buffer that several names or strings share once.
+pub(crate) const PROP_BYTES: usize = 64;
+/// The estimated bytes of an object without its properties.
+pub(crate) const OBJECT_BYTES: usize = 96;
+/// The estimated bytes of an environment without its bindings.
+pub(crate) const ENV_BYTES: usize = 64;
+/// The estimated bytes of a rope node.
+pub(crate) const ROPE_BYTES: usize = 48;
+/// The estimated bytes of a piece of code without its instructions, tables and strings.
+const CODE_BYTES: usize = 384;
+
+pub(crate) fn string_bytes(len: usize) -> usize {
+    32 + 2 * len
+}
+
+#[derive(Default)]
+pub(crate) struct Heap {
+    cells: Vec<Cell>,
+    free: Vec<u32>,
+    /// An estimate of the bytes the heap holds: the live total from the last collection plus what
+    /// was allocated since.
+    pub(crate) bytes: usize,
+    /// How many collections have run.
+    pub(crate) collections: usize,
+}
+
+impl Heap {
+    fn alloc(&mut self, cell: Cell, bytes: usize) -> u32 {
+        self.bytes += bytes;
+        if let Some(i) = self.free.pop()
+            && let Some(slot) = self.cells.get_mut(i as usize)
+        {
+            *slot = cell;
+            return i;
+        }
+        self.cells.push(cell);
+        u32::try_from(self.cells.len() - 1).unwrap_or(u32::MAX)
+    }
+
+    pub(crate) fn alloc_object(&mut self, object: Object) -> ObjId {
+        let bytes = OBJECT_BYTES + PROP_BYTES * object.props.len();
+        ObjId(self.alloc(Cell::Object(Box::new(object)), bytes))
+    }
+
+    pub(crate) fn alloc_env(&mut self, env: Env) -> EnvId {
+        let bytes = ENV_BYTES + if let Env::Decl { bindings, .. } = &env { PROP_BYTES * bindings.len() } else { 0 };
+        EnvId(self.alloc(Cell::Env(Box::new(env)), bytes))
+    }
+
+    pub(crate) fn object(&self, id: ObjId) -> Option<&Object> {
+        match self.cells.get(id.0 as usize) {
+            Some(Cell::Object(o)) => Some(o),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn object_mut(&mut self, id: ObjId) -> Option<&mut Object> {
+        match self.cells.get_mut(id.0 as usize) {
+            Some(Cell::Object(o)) => Some(o),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn env(&self, id: EnvId) -> Option<&Env> {
+        match self.cells.get(id.0 as usize) {
+            Some(Cell::Env(e)) => Some(e),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn env_mut(&mut self, id: EnvId) -> Option<&mut Env> {
+        match self.cells.get_mut(id.0 as usize) {
+            Some(Cell::Env(e)) => Some(e),
+            _ => None,
+        }
+    }
+
+    /// Live cells, for tests.
+    #[cfg(test)]
+    pub(crate) fn live_cells(&self) -> usize {
+        self.cells.iter().filter(|c| !matches!(c, Cell::Free)).count()
+    }
+
+    /// Marks everything reachable from `roots` and frees the rest. Afterwards [`Heap::bytes`] is
+    /// the estimated size of what is left, strings reachable from it included.
+    pub(crate) fn collect(&mut self, roots: &Roots<'_>) {
+        let mut marks = vec![false; self.cells.len()];
+        let mut work: Vec<u32> = Vec::new();
+        let mut strings = StringSizes::default();
+        let mut live = 0usize;
+        for v in &roots.values {
+            mark_value(v, &mut work, &mut strings);
+        }
+        work.extend(roots.objects.iter().map(|o| o.0));
+        work.extend(roots.envs.iter().map(|e| e.0));
+        for code in &roots.codes {
+            mark_code(code, &mut strings);
+        }
+        while let Some(i) = work.pop() {
+            let Some(mark) = marks.get_mut(i as usize) else { continue };
+            if *mark {
+                continue;
+            }
+            *mark = true;
+            match self.cells.get(i as usize) {
+                Some(Cell::Object(o)) => live += trace_object(o, &mut work, &mut strings),
+                Some(Cell::Env(e)) => live += trace_env(e, &mut work, &mut strings),
+                _ => {}
+            }
+        }
+        for (i, (cell, marked)) in self.cells.iter_mut().zip(&marks).enumerate() {
+            if !marked && !matches!(cell, Cell::Free) {
+                *cell = Cell::Free;
+                self.free.push(u32::try_from(i).unwrap_or(u32::MAX));
+            }
+        }
+        self.bytes = live + strings.bytes;
+        self.collections += 1;
+    }
+}
+
+/// What the collector starts from.
+#[derive(Default)]
+pub(crate) struct Roots<'a> {
+    pub(crate) values: Vec<&'a Value>,
+    pub(crate) objects: Vec<ObjId>,
+    pub(crate) envs: Vec<EnvId>,
+    pub(crate) codes: Vec<&'a Code>,
+}
+
+/// Sums the sizes of the strings and property names reached, counting each node and each
+/// code-unit buffer once.
+#[derive(Default)]
+struct StringSizes {
+    seen: HashSet<usize>,
+    bytes: usize,
+}
+
+impl StringSizes {
+    fn add(&mut self, s: &Str) {
+        let mut stack = vec![s.clone()];
+        while let Some(s) = stack.pop() {
+            if !self.seen.insert(s.node_addr()) {
+                continue;
+            }
+            match s.halves() {
+                Some((l, r)) => {
+                    self.bytes += ROPE_BYTES;
+                    stack.push(l);
+                    stack.push(r);
+                }
+                None => {
+                    if s.buffer_addr().is_none_or(|a| self.seen.insert(a)) {
+                        self.bytes += string_bytes(s.len());
+                    }
+                }
+            }
+        }
+    }
+
+    /// Adds a property or binding name, unless a string or another name shares its buffer.
+    fn add_key(&mut self, k: &Key) {
+        if self.seen.insert(Rc::as_ptr(k) as *const () as usize) {
+            self.bytes += string_bytes(k.len());
+        }
+    }
+}
+
+fn mark_value(v: &Value, work: &mut Vec<u32>, strings: &mut StringSizes) {
+    match v {
+        Value::Object(o) => work.push(o.0),
+        Value::String(s) => strings.add(s),
+        _ => {}
+    }
+}
+
+/// The estimated bytes of `code` with the functions nested in it and its source text, for
+/// charging code made at run time to the heap before anything refers to it.
+pub(crate) fn code_bytes(code: &Code) -> usize {
+    let mut sizes = StringSizes::default();
+    mark_code(code, &mut sizes);
+    sizes.bytes
+}
+
+/// Adds the estimated size of `code` and the functions nested in it, counting each piece of code,
+/// each source text and each string once however many closures share them.
+fn mark_code(code: &Code, strings: &mut StringSizes) {
+    let mut stack = vec![code];
+    while let Some(code) = stack.pop() {
+        if !strings.seen.insert(code as *const Code as usize) {
+            continue;
+        }
+        if strings.seen.insert(Rc::as_ptr(&code.source) as usize) {
+            strings.bytes += code.source.lines.heap_bytes();
+            // The text can share its buffer with the string eval was given.
+            if strings.seen.insert(Rc::as_ptr(&code.source.text) as *const () as usize) {
+                strings.bytes += string_bytes(code.source.text.len());
+            }
+        }
+        let handles = code.strings.len()
+            + 2 * code.regexps.len()
+            + code.names.len()
+            + code.functions.len()
+            + code.params.len()
+            + code.vars.len()
+            + 2 * code.fun_decls.len();
+        let tables = code.finally_tables.iter().map(|t| 24 + 4 * t.len()).sum::<usize>();
+        strings.bytes += CODE_BYTES
+            + size_of::<Op>() * code.ops.len()
+            + 4 * code.positions.len()
+            + 8 * code.numbers.len()
+            + size_of::<Handler>() * code.handlers.len()
+            + 16 * handles
+            + tables;
+        for s in &code.strings {
+            strings.add(s);
+        }
+        for (pattern, flags) in &code.regexps {
+            strings.add(pattern);
+            strings.add(flags);
+        }
+        let keys = code.names.iter().chain(&code.params).chain(&code.vars).chain(code.fun_decls.iter().map(|(k, _)| k));
+        for k in keys.chain(&code.self_name) {
+            strings.add_key(k);
+        }
+        stack.extend(code.functions.iter().map(|f| &**f));
+    }
+}
+
+fn trace_object(o: &Object, work: &mut Vec<u32>, strings: &mut StringSizes) -> usize {
+    if let Some(p) = o.proto {
+        work.push(p.0);
+    }
+    for (k, prop) in o.props.iter() {
+        strings.add_key(k);
+        match prop {
+            Prop::Data { value, .. } => mark_value(value, work, strings),
+            Prop::Accessor { get, set, .. } => work.extend(get.iter().chain(set.iter()).map(|f| f.0)),
+        }
+    }
+    match &o.class {
+        Class::Function(Func::Closure { env, code }) => {
+            work.push(env.0);
+            mark_code(code, strings);
+        }
+        Class::Arguments(map) => work.push(map.env.0),
+        Class::String(s) => strings.add(s),
+        Class::ForIn(state) => {
+            work.extend(state.object.iter().map(|o| o.0));
+            strings.bytes += state.keys.iter().map(|k| string_bytes(k.len())).sum::<usize>();
+        }
+        _ => {}
+    }
+    OBJECT_BYTES + PROP_BYTES * o.props.len()
+}
+
+fn trace_env(e: &Env, work: &mut Vec<u32>, strings: &mut StringSizes) -> usize {
+    match e {
+        Env::Decl { bindings, outer } => {
+            work.extend(outer.iter().map(|o| o.0));
+            for (k, b) in bindings.iter() {
+                strings.add_key(k);
+                mark_value(&b.value, work, strings);
+            }
+            ENV_BYTES + PROP_BYTES * bindings.len()
+        }
+        Env::Obj { object, outer, .. } => {
+            work.push(object.0);
+            work.extend(outer.iter().map(|o| o.0));
+            ENV_BYTES
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Class, Heap, OBJECT_BYTES, Object, PROP_BYTES, Prop, PropMap, Roots, key, string_bytes};
+    use crate::value::{Str, Value};
+
+    #[test]
+    fn a_collection_counts_a_name_and_a_value_that_share_a_buffer_once() {
+        let mut heap = Heap::default();
+        let name = key(&"n".repeat(1000));
+        let mut object = Object::new(Class::Ordinary, None);
+        object.props.insert(name.clone(), Prop::Data { value: Value::String(Str::from_rc(name.clone())), flags: 0 });
+        object.props.insert(key("other"), Prop::Data { value: Value::Undefined, flags: 0 });
+        let id = heap.alloc_object(object);
+        heap.collect(&Roots { objects: vec![id], ..Roots::default() });
+        assert_eq!(heap.bytes, OBJECT_BYTES + 2 * PROP_BYTES + string_bytes(1000) + string_bytes(5));
+    }
+
+    #[test]
+    fn prop_maps_keep_insertion_order_through_removals_and_growth() {
+        let mut m = PropMap::default();
+        for i in 0..40 {
+            m.insert(key(&format!("k{i}")), i);
+        }
+        for i in (0..40).step_by(2) {
+            assert_eq!(m.remove(&key(&format!("k{i}"))), Some(i));
+        }
+        m.insert(key("k1"), 100);
+        m.insert(key("new"), 7);
+        let keys: Vec<String> = m.iter().map(|(k, _)| String::from_utf16_lossy(k)).collect();
+        let mut want: Vec<String> = (1..40).step_by(2).map(|i| format!("k{i}")).collect();
+        want.push("new".into());
+        assert_eq!(keys, want);
+        assert_eq!(m.get(&key("k1")), Some(&100));
+        assert_eq!(m.len(), 21);
+        assert!(!m.contains(&key("k0")));
+    }
+}
diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs
new file mode 100644
index 000000000..9d16046d0
--- /dev/null
+++ b/crates/js/src/interp.rs
@@ -0,0 +1,2244 @@
+//! The interpreter: runs bytecode on an explicit stack of frames.
+//!
+//! A call to a function written in JavaScript pushes a frame and goes on in the same loop, so
+//! JavaScript recursion uses the heap, not the Rust stack. The loop runs again inside a Rust call
+//! only where the language needs a function's result in the middle of an operation (a getter or
+//! setter, `valueOf` and `toString` during a conversion, indirect `eval`); those nested runs are
+//! counted against [`crate::Limits::reentry`].
+//!
+//! Before each instruction the interpreter takes one unit of fuel, checks the interrupt flag and,
+//! when the heap has grown past its threshold, collects garbage. Running out of fuel, the heap
+//! limit, the frame limit, the re-entry limit and the interrupt flag each end the run with an
+//! [`Abrupt::Limit`] that unwinds every frame without running catch or finally blocks.
+//!
+//! Collection runs only between instructions. An operation that may run JavaScript in the middle
+//! keeps its operands on the operand stack until it is done, so everything it holds is reachable
+//! from the roots when a nested run collects.
+
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use crate::ast::BinaryOp;
+use crate::bytecode::{Code, CodeKind, Op, Source};
+use crate::compiler::{CompileFail, compile_program};
+use crate::heap::{
+    ArgMap, Binding, CONFIGURABLE, Class, ENUMERABLE, ENV_BYTES, Env, EnvId, ForIn, Func, HIDDEN, Heap, Key, NativeKind, OBJECT_BYTES, OPEN, ObjId,
+    Object, PROP_BYTES, Prop, PropMap, ROPE_BYTES, Roots, WRITABLE, code_bytes, key, string_bytes,
+};
+use crate::value::{Str, Value, array_index, index_key, number_to_str, string_to_number, to_int32, to_uint32};
+use crate::{LimitKind, Limits, Options};
+
+/// How an operation ended other than normally.
+#[derive(Debug)]
+pub(crate) enum Abrupt {
+    /// A JavaScript exception: `try` and `catch` can handle it.
+    Throw(Value),
+    /// A limit was reached; nothing handles it.
+    Limit(LimitKind),
+    /// The interpreter found itself in a state it never makes (a bug); nothing handles it.
+    Internal(String),
+}
+
+pub(crate) type JsResult<T> = Result<T, Abrupt>;
+
+fn internal<T>(message: &str) -> JsResult<T> {
+    Err(Abrupt::Internal(message.into()))
+}
+
+/// The kinds of error object the engine throws.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ErrorType {
+    Error,
+    Eval,
+    Range,
+    Reference,
+    Syntax,
+    Type,
+    Uri,
+}
+
+/// The objects the interpreter itself refers to.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Intrinsics {
+    pub(crate) object_proto: ObjId,
+    pub(crate) function_proto: ObjId,
+    pub(crate) array_proto: ObjId,
+    pub(crate) string_proto: ObjId,
+    pub(crate) number_proto: ObjId,
+    pub(crate) boolean_proto: ObjId,
+    pub(crate) regexp_proto: ObjId,
+    pub(crate) error_protos: [ObjId; 7],
+    pub(crate) eval: ObjId,
+    pub(crate) throw_type_error: ObjId,
+}
+
+impl Intrinsics {
+    fn placeholder() -> Self {
+        let o = ObjId(0);
+        Self {
+            object_proto: o,
+            function_proto: o,
+            array_proto: o,
+            string_proto: o,
+            number_proto: o,
+            boolean_proto: o,
+            regexp_proto: o,
+            error_protos: [o; 7],
+            eval: o,
+            throw_type_error: o,
+        }
+    }
+
+    pub(crate) fn error_proto(&self, t: ErrorType) -> ObjId {
+        let i = match t {
+            ErrorType::Error => 0,
+            ErrorType::Eval => 1,
+            ErrorType::Range => 2,
+            ErrorType::Reference => 3,
+            ErrorType::Syntax => 4,
+            ErrorType::Type => 5,
+            ErrorType::Uri => 6,
+        };
+        self.error_protos.get(i).copied().unwrap_or(self.object_proto)
+    }
+
+    fn all(&self) -> Vec<ObjId> {
+        let mut v = vec![
+            self.object_proto,
+            self.function_proto,
+            self.array_proto,
+            self.string_proto,
+            self.number_proto,
+            self.boolean_proto,
+            self.regexp_proto,
+            self.eval,
+            self.throw_type_error,
+        ];
+        v.extend(self.error_protos);
+        v
+    }
+}
+
+pub(crate) struct Frame {
+    pub(crate) code: Rc<Code>,
+    pub(crate) pc: usize,
+    /// Where this frame's operands start on the operand stack.
+    base: usize,
+    env: EnvId,
+    var_env: EnvId,
+    /// `with` and catch environments entered and not yet left.
+    env_depth: u32,
+    this: Value,
+    callee: Option<ObjId>,
+    /// The object `new` made, returned unless the function returns an object.
+    construct: Option<ObjId>,
+    completion: Value,
+    /// Returning from this frame returns from the Rust call that pushed it.
+    boundary: bool,
+}
+
+/// Where the exception being thrown was raised: the code and the instruction.
+type ThrowSite = (Rc<Code>, usize);
+
+pub(crate) struct Interp {
+    pub(crate) heap: Heap,
+    pub(crate) stack: Vec<Value>,
+    pub(crate) frames: Vec<Frame>,
+    /// Values native code holds while it may run JavaScript.
+    pub(crate) temp_roots: Vec<Value>,
+    pub(crate) global: ObjId,
+    pub(crate) global_env: EnvId,
+    pub(crate) intrinsics: Intrinsics,
+    pub(crate) limits: Limits,
+    pub(crate) options: Options,
+    pub(crate) fuel: u64,
+    pub(crate) interrupt: Arc<AtomicBool>,
+    pub(crate) reentry: usize,
+    gc_threshold: usize,
+    /// UTF-16 code units of source parsed in this run, for [`Options::max_source_units`].
+    pub(crate) source_units: usize,
+    pub(crate) throw_site: Option<ThrowSite>,
+    /// The last exception a run did not catch.
+    pub(crate) last_thrown: Value,
+}
+
+/// The least heap size a collection waits for.
+const MIN_GC_BYTES: usize = 1 << 20;
+
+/// The most arguments `Function.prototype.apply` passes.
+pub(crate) const MAX_APPLY_ARGS: usize = 1 << 16;
+
+/// The estimated bytes of a name's entries in the list and the set `for-in` builds.
+const KEY_ENTRY_BYTES: usize = 32;
+
+/// The estimated bytes of the index names `0` to `len - 1` while `for-in` lists them.
+fn index_keys_bytes(len: usize) -> usize {
+    let mut total = 0usize;
+    let (mut lo, mut hi, mut digits) = (0usize, 10usize, 1usize);
+    while lo < len {
+        let count = hi.min(len) - lo;
+        total = total.saturating_add(count.saturating_mul(string_bytes(digits) + KEY_ENTRY_BYTES));
+        lo = hi;
+        hi = hi.saturating_mul(10);
+        digits += 1;
+    }
+    total
+}
+
+/// The estimated bytes of a binding or property named by `len` code units.
+fn binding_bytes(len: usize) -> usize {
+    PROP_BYTES + string_bytes(len)
+}
+
+/// At least the bytes that a function object made from `code` adds to the heap: the function,
+/// its prototype object, their properties and the environment holding a function expression's
+/// own name.
+fn closure_bytes(code: &Code) -> usize {
+    let props = if code.strict { 5 } else { 3 };
+    let named = code.self_name.as_ref().map_or(0, |n| ENV_BYTES + binding_bytes(n.len()));
+    2 * OBJECT_BYTES + props * binding_bytes("constructor".len()) + named
+}
+
+/// At least the bytes that declaration binding instantiation (section 10.5) adds to the heap for
+/// the function declarations and variables of `code`.
+fn declaration_bytes(code: &Code) -> usize {
+    let funs = code.fun_decls.iter().fold(0usize, |total, (name, fi)| {
+        let closure = code.functions.get(*fi as usize).map_or(0, |f| closure_bytes(f));
+        total.saturating_add(binding_bytes(name.len()) + closure)
+    });
+    code.vars.iter().fold(funs, |total, v| total.saturating_add(binding_bytes(v.len())))
+}
+
+/// A call to a function written in JavaScript, ready to enter.
+struct Entry {
+    callee: ObjId,
+    code: Rc<Code>,
+    env: EnvId,
+    this: Value,
+    args: Vec<Value>,
+}
+
+/// What a call resolved to.
+enum Prepared {
+    Closure(Entry),
+    Done(Value),
+}
+
+/// A variable found in the environment chain.
+enum Resolved {
+    Decl(EnvId),
+    Obj { object: ObjId, with_this: bool },
+    Unresolved,
+}
+
+/// A reference base as an operand: a declarative environment's index as a number, a binding
+/// object as itself, and an unresolvable reference as `undefined`. The environment stays
+/// reachable through the frame's environment chain while the operand is on the stack.
+fn resolved_to_value(r: &Resolved) -> Value {
+    match r {
+        Resolved::Decl(e) => Value::Number(f64::from(e.0)),
+        Resolved::Obj { object, .. } => Value::Object(*object),
+        Resolved::Unresolved => Value::Undefined,
+    }
+}
+
+fn value_to_resolved(v: &Value) -> JsResult<Resolved> {
+    match v {
+        #[allow(clippy::cast_possible_truncation, clippy::cast_sign_loss)]
+        Value::Number(n) if *n >= 0.0 && *n <= f64::from(u32::MAX) && n.fract() == 0.0 => Ok(Resolved::Decl(EnvId(*n as u32))),
+        Value::Object(object) => Ok(Resolved::Obj { object: *object, with_this: false }),
+        Value::Undefined => Ok(Resolved::Unresolved),
+        _ => internal("not a reference base"),
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Hint {
+    Default,
+    Number,
+    String,
+}
+
+fn is(k: &[u16], s: &str) -> bool {
+    k.len() == s.len() && k.iter().zip(s.bytes()).all(|(&a, b)| a == u16::from(b))
+}
+
+impl Interp {
+    pub(crate) fn new(options: Options, limits: Limits) -> Self {
+        let mut heap = Heap::default();
+        let global = heap.alloc_object(Object::new(Class::Ordinary, None));
+        let global_env = heap.alloc_env(Env::Obj { object: global, with_this: false, outer: None });
+        let mut interp = Self {
+            heap,
+            stack: Vec::new(),
+            frames: Vec::new(),
+            temp_roots: Vec::new(),
+            global,
+            global_env,
+            intrinsics: Intrinsics::placeholder(),
+            fuel: limits.fuel,
+            limits,
+            options,
+            interrupt: Arc::new(AtomicBool::new(false)),
+            reentry: 0,
+            gc_threshold: MIN_GC_BYTES,
+            source_units: 0,
+            throw_site: None,
+            last_thrown: Value::Undefined,
+        };
+        crate::builtins::install(&mut interp);
+        interp.gc_threshold = interp.next_threshold();
+        interp
+    }
+
+    fn next_threshold(&self) -> usize {
+        (self.heap.bytes.saturating_mul(2)).max(MIN_GC_BYTES).min(self.limits.heap_bytes)
+    }
+
+    /// Recomputes when the next collection runs, after the limits change.
+    pub(crate) fn reset_gc_threshold(&mut self) {
+        self.gc_threshold = self.next_threshold();
+    }
+
+    // ---- errors ----
+
+    pub(crate) fn error_object(&mut self, t: ErrorType, message: &str) -> ObjId {
+        let proto = self.intrinsics.error_proto(t);
+        let mut o = Object::new(Class::Error, Some(proto));
+        if !message.is_empty() {
+            o.props.insert(key("message"), Prop::Data { value: Value::str(message), flags: HIDDEN });
+        }
+        self.heap.alloc_object(o)
+    }
+
+    pub(crate) fn throw(&mut self, t: ErrorType, message: &str) -> Abrupt {
+        Abrupt::Throw(Value::Object(self.error_object(t, message)))
+    }
+
+    pub(crate) fn type_error(&mut self, message: &str) -> Abrupt {
+        self.throw(ErrorType::Type, message)
+    }
+
+    // ---- the operand stack ----
+
+    fn push(&mut self, v: Value) -> JsResult<()> {
+        self.stack.push(v);
+        Ok(())
+    }
+
+    fn frame(&self) -> JsResult<&Frame> {
+        self.frames.last().ok_or_else(|| Abrupt::Internal("no frame".into()))
+    }
+
+    fn frame_mut(&mut self) -> JsResult<&mut Frame> {
+        self.frames.last_mut().ok_or_else(|| Abrupt::Internal("no frame".into()))
+    }
+
+    fn base(&self) -> usize {
+        self.frames.last().map_or(0, |f| f.base)
+    }
+
+    fn pop(&mut self) -> JsResult<Value> {
+        if self.stack.len() <= self.base() {
+            return internal("operand stack underflow");
+        }
+        self.stack.pop().ok_or_else(|| Abrupt::Internal("operand stack underflow".into()))
+    }
+
+    /// The value `n` places below the top (0 is the top).
+    fn peek(&self, n: usize) -> JsResult<Value> {
+        let len = self.stack.len();
+        match len.checked_sub(n + 1).filter(|&i| i >= self.base()) {
+            Some(i) => self.stack.get(i).cloned().ok_or_else(|| Abrupt::Internal("operand stack underflow".into())),
+            None => internal("operand stack underflow"),
+        }
+    }
+
+    fn drop_n(&mut self, n: usize) -> JsResult<()> {
+        let len = self.stack.len();
+        match len.checked_sub(n).filter(|&i| i >= self.base()) {
+            Some(i) => {
+                self.stack.truncate(i);
+                Ok(())
+            }
+            None => internal("operand stack underflow"),
+        }
+    }
+
+    /// Replaces the top `n` values with `v`.
+    fn replace(&mut self, n: usize, v: Value) -> JsResult<()> {
+        self.drop_n(n)?;
+        self.push(v)
+    }
+
+    // ---- running ----
+
+    /// Takes a unit of fuel and checks the interrupt flag.
+    pub(crate) fn use_fuel(&mut self) -> JsResult<()> {
+        if self.fuel == 0 {
+            return Err(Abrupt::Limit(LimitKind::Fuel));
+        }
+        self.fuel -= 1;
+        if self.interrupt.load(Ordering::Relaxed) {
+            return Err(Abrupt::Limit(LimitKind::Interrupted));
+        }
+        Ok(())
+    }
+
+    fn tick(&mut self) -> JsResult<()> {
+        self.use_fuel()?;
+        if self.heap.bytes > self.gc_threshold {
+            self.collect_garbage();
+            if self.heap.bytes > self.limits.heap_bytes {
+                return Err(Abrupt::Limit(LimitKind::Heap));
+            }
+            self.gc_threshold = self.next_threshold();
+        }
+        Ok(())
+    }
+
+    /// Ends the run with the heap limit when `bytes` more would not fit in it after a
+    /// collection. Everything the caller still needs must be reachable from the roots.
+    pub(crate) fn reserve_heap(&mut self, bytes: usize) -> JsResult<()> {
+        if self.heap.bytes.saturating_add(bytes) <= self.limits.heap_bytes {
+            return Ok(());
+        }
+        self.collect_garbage();
+        self.gc_threshold = self.next_threshold();
+        if self.heap.bytes.saturating_add(bytes) > self.limits.heap_bytes {
+            return Err(Abrupt::Limit(LimitKind::Heap));
+        }
+        Ok(())
+    }
+
+    /// Charges code compiled at run time to the heap, reserving its estimated size and `extra`
+    /// more first. The code is not reachable from the roots yet, so a collection here leaves it
+    /// out of the live total and the charge adds it.
+    pub(crate) fn charge_code(&mut self, code: &Code, extra: usize) -> JsResult<()> {
+        let bytes = code_bytes(code);
+        self.reserve_heap(bytes.saturating_add(extra))?;
+        self.heap.bytes = self.heap.bytes.saturating_add(bytes);
+        Ok(())
+    }
+
+    pub(crate) fn collect_garbage(&mut self) {
+        let mut roots = Roots::default();
+        roots.values.extend(self.stack.iter());
+        roots.values.extend(self.temp_roots.iter());
+        roots.values.push(&self.last_thrown);
+        for f in &self.frames {
+            roots.values.push(&f.this);
+            roots.values.push(&f.completion);
+            roots.objects.extend(f.callee.iter().chain(f.construct.iter()));
+            roots.envs.push(f.env);
+            roots.envs.push(f.var_env);
+            roots.codes.push(&f.code);
+        }
+        roots.objects.push(self.global);
+        roots.objects.extend(self.intrinsics.all());
+        roots.envs.push(self.global_env);
+        self.heap.collect(&roots);
+    }
+
+    /// Runs frames until the boundary frame on top returns, and returns its value.
+    pub(crate) fn execute(&mut self) -> JsResult<Value> {
+        loop {
+            match self.step() {
+                Ok(Some(v)) => return Ok(v),
+                Ok(None) => {}
+                Err(Abrupt::Throw(v)) => self.unwind(v)?,
+                Err(other) => {
+                    self.note_site();
+                    self.abort_to_boundary();
+                    return Err(other);
+                }
+            }
+        }
+    }
+
+    fn step(&mut self) -> JsResult<Option<Value>> {
+        self.tick()?;
+        let frame = self.frame_mut()?;
+        let Some(&op) = frame.code.ops.get(frame.pc) else { return internal("ran past the end of the code") };
+        frame.pc += 1;
+        match op {
+            Op::Return => {
+                let v = self.pop()?;
+                self.return_value(v)
+            }
+            Op::ReturnCompletion => {
+                let v = self.frame()?.completion.clone();
+                self.return_value(v)
+            }
+            _ => self.exec(op).map(|()| None),
+        }
+    }
+
+    fn note_site(&mut self) {
+        if self.throw_site.is_none()
+            && let Some(f) = self.frames.last()
+        {
+            self.throw_site = Some((f.code.clone(), f.pc.saturating_sub(1)));
+        }
+    }
+
+    /// Finds the handler for an exception: in the top frame, or in the frames below it up to the
+    /// boundary frame. Returns the exception when no handler takes it before the boundary frame.
+    fn unwind(&mut self, v: Value) -> JsResult<()> {
+        self.note_site();
+        loop {
+            let Some(frame) = self.frames.last_mut() else { return Err(Abrupt::Throw(v)) };
+            if let Some(h) = frame.code.handler(frame.pc.saturating_sub(1)) {
+                let target_len = frame.base + h.depth as usize;
+                while frame.env_depth > h.env_depth {
+                    let outer = self.heap.env(frame.env).and_then(Env::outer);
+                    let Some(outer) = outer else { return internal("environment chain ended early") };
+                    frame.env = outer;
+                    frame.env_depth -= 1;
+                }
+                frame.pc = h.target as usize;
+                if self.stack.len() < target_len {
+                    return internal("handler stack deeper than the stack");
+                }
+                self.stack.truncate(target_len);
+                self.stack.push(v);
+                self.throw_site = None;
+                return Ok(());
+            }
+            let Some(frame) = self.frames.pop() else { return Err(Abrupt::Throw(v)) };
+            self.stack.truncate(frame.base);
+            if frame.boundary {
+                return Err(Abrupt::Throw(v));
+            }
+        }
+    }
+
+    fn abort_to_boundary(&mut self) {
+        while let Some(frame) = self.frames.pop() {
+            self.stack.truncate(frame.base);
+            if frame.boundary {
+                break;
+            }
+        }
+    }
+
+    fn return_value(&mut self, v: Value) -> JsResult<Option<Value>> {
+        let Some(frame) = self.frames.pop() else { return internal("return without a frame") };
+        self.stack.truncate(frame.base);
+        let v = match frame.construct {
+            Some(o) if !matches!(v, Value::Object(_)) => Value::Object(o),
+            _ => v,
+        };
+        if frame.boundary {
+            return Ok(Some(v));
+        }
+        self.push(v)?;
+        Ok(None)
+    }
+
+    fn jump_to(&mut self, target: u32) -> JsResult<()> {
+        self.frame_mut()?.pc = target as usize;
+        Ok(())
+    }
+
+    fn name(&self, i: u32) -> JsResult<Key> {
+        self.frame()?.code.names.get(i as usize).cloned().ok_or_else(|| Abrupt::Internal("name out of range".into()))
+    }
+
+    fn strict(&self) -> bool {
+        self.frames.last().is_some_and(|f| f.code.strict)
+    }
+
+    fn exec(&mut self, op: Op) -> JsResult<()> {
+        match op {
+            Op::Undefined => self.push(Value::Undefined),
+            Op::Null => self.push(Value::Null),
+            Op::True => self.push(Value::Bool(true)),
+            Op::False => self.push(Value::Bool(false)),
+            Op::Number(i) => {
+                let n = self.frame()?.code.numbers.get(i as usize).copied();
+                self.push(Value::Number(n.unwrap_or(f64::NAN)))
+            }
+            Op::String(i) => {
+                let s = self.frame()?.code.strings.get(i as usize).cloned();
+                self.push(s.map_or(Value::Undefined, Value::String))
+            }
+            Op::This => {
+                let this = self.frame()?.this.clone();
+                self.push(this)
+            }
+            Op::Pop => self.pop().map(drop),
+            Op::PopUnder(n) => self.op_pop_under(n),
+            Op::Dup => self.op_dup(1),
+            Op::Dup2 => self.op_dup(2),
+            Op::Swap => self.op_swap(),
+            Op::Rot3 => self.op_rot3(),
+            Op::GetVar(n) => self.op_get_var(n, false),
+            Op::GetVarThis(n) => self.op_get_var(n, true),
+            Op::SetVar(n) => self.op_set_var(n),
+            Op::RefVar(n) => self.op_ref_var(n),
+            Op::GetRef(n) => self.op_get_ref(n),
+            Op::PutRef(n) => self.op_put_ref(n),
+            Op::TypeofVar(n) => self.op_typeof_var(n),
+            Op::DeleteVar(n) => self.op_delete_var(n),
+            Op::IncVar { name, prefix, dec } => self.op_inc_var(name, prefix, dec),
+            Op::GetMember(n) => self.op_get_member(n, false),
+            Op::GetMemberThis(n) => self.op_get_member(n, true),
+            Op::SetMember(n) => self.op_set_member(n),
+            Op::DeleteMember(n) => self.op_delete_member(n),
+            Op::IncMember { name, prefix, dec } => self.op_inc_member(name, prefix, dec),
+            Op::ToKey => self.op_to_key(),
+            Op::CheckObject => self.op_check_object(),
+            Op::GetIndex => self.op_get_index(false),
+            Op::GetIndexThis => self.op_get_index(true),
+            Op::SetIndex => self.op_set_index(),
+            Op::DeleteIndex => self.op_delete_index(),
+            Op::IncIndex { prefix, dec } => self.op_inc_index(prefix, dec),
+            Op::Call(n) => self.op_call(n, false),
+            Op::CallEval(n) => self.op_call(n, true),
+            Op::New(n) => self.op_new(n),
+            Op::Binary(b) => self.op_binary(b),
+            Op::Neg | Op::Plus | Op::BitNot | Op::Not | Op::Typeof | Op::ToNumber => self.op_unary(op),
+            Op::Jump(t) => self.jump_to(t),
+            Op::JumpIfFalse(t) | Op::JumpIfTrue(t) => self.op_branch(t, matches!(op, Op::JumpIfTrue(_)), false),
+            Op::JumpIfFalseKeep(t) | Op::JumpIfTrueKeep(t) => self.op_branch(t, matches!(op, Op::JumpIfTrueKeep(_)), true),
+            Op::Throw => Err(Abrupt::Throw(self.pop()?)),
+            Op::ThrowReferenceError(i) => self.op_throw_reference_error(i),
+            Op::EndFinally(t) => self.op_end_finally(t),
+            Op::NewObject => self.op_new_object(),
+            Op::NewArray => self.op_new_array(),
+            Op::ArrayPush => self.op_array_push(true),
+            Op::ArrayHole => self.op_array_push(false),
+            Op::InitProp(n) => self.op_init_prop(n),
+            Op::InitGetter(n) => self.op_init_accessor(n, true),
+            Op::InitSetter(n) => self.op_init_accessor(n, false),
+            Op::Closure(i) => self.op_closure(i),
+            Op::RegExp(i) => self.op_regexp(i),
+            Op::PushWith => self.op_push_with(),
+            Op::PushCatch(n) => self.op_push_catch(n),
+            Op::PopEnv => self.op_pop_env(),
+            Op::ForInStart => self.op_for_in_start(),
+            Op::ForInNext(t) => self.op_for_in_next(t),
+            Op::SetCompletion => {
+                let v = self.pop()?;
+                self.frame_mut()?.completion = v;
+                Ok(())
+            }
+            Op::GetCompletion => {
+                let v = self.frame()?.completion.clone();
+                self.push(v)
+            }
+            Op::Return | Op::ReturnCompletion => internal("return reached the dispatcher"),
+        }
+    }
+
+    // ---- stack operations ----
+
+    fn op_pop_under(&mut self, n: u32) -> JsResult<()> {
+        let top = self.pop()?;
+        self.drop_n(n as usize)?;
+        self.push(top)
+    }
+
+    fn op_dup(&mut self, n: usize) -> JsResult<()> {
+        for _ in 0..n {
+            let v = self.peek(n - 1)?;
+            self.push(v)?;
+        }
+        Ok(())
+    }
+
+    fn op_swap(&mut self) -> JsResult<()> {
+        let b = self.pop()?;
+        let a = self.pop()?;
+        self.push(b)?;
+        self.push(a)
+    }
+
+    fn op_rot3(&mut self) -> JsResult<()> {
+        let c = self.pop()?;
+        let b = self.pop()?;
+        let a = self.pop()?;
+        self.push(b)?;
+        self.push(c)?;
+        self.push(a)
+    }
+
+    fn op_branch(&mut self, target: u32, when: bool, keep: bool) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let jump = v.truthy() == when;
+        if !(keep && jump) {
+            self.pop()?;
+        }
+        if jump { self.jump_to(target) } else { Ok(()) }
+    }
+
+    fn op_throw_reference_error(&mut self, i: u32) -> JsResult<()> {
+        let message = self.frame()?.code.strings.get(i as usize).map(Str::to_rust_string).unwrap_or_default();
+        Err(self.throw(ErrorType::Reference, &message))
+    }
+
+    fn op_end_finally(&mut self, table: u32) -> JsResult<()> {
+        let Value::Number(kind) = self.pop()? else { return internal("finally kind is not a number") };
+        if kind == 0.0 {
+            return self.pop().map(drop);
+        }
+        if kind == 1.0 {
+            return Err(Abrupt::Throw(self.pop()?));
+        }
+        let k = (kind - 2.0) as usize;
+        let target = self.frame()?.code.finally_tables.get(table as usize).and_then(|t| t.get(k)).copied();
+        match target {
+            Some(t) => self.jump_to(t),
+            None => internal("finally exit out of range"),
+        }
+    }
+
+    // ---- variables ----
+
+    fn resolve(&self, name: &[u16]) -> JsResult<Resolved> {
+        let mut cur = Some(self.frame()?.env);
+        while let Some(e) = cur {
+            match self.heap.env(e) {
+                Some(Env::Decl { bindings, outer }) => {
+                    if bindings.contains(name) {
+                        return Ok(Resolved::Decl(e));
+                    }
+                    cur = *outer;
+                }
+                Some(Env::Obj { object, with_this, outer }) => {
+                    if self.has_property(*object, name)? {
+                        return Ok(Resolved::Obj { object: *object, with_this: *with_this });
+                    }
+                    cur = *outer;
+                }
+                None => return internal("environment out of range"),
+            }
+        }
+        Ok(Resolved::Unresolved)
+    }
+
+    fn binding_value(&self, env: EnvId, name: &[u16]) -> JsResult<Value> {
+        match self.heap.env(env) {
+            Some(Env::Decl { bindings, .. }) => Ok(bindings.get(name).map_or(Value::Undefined, |b| b.value.clone())),
+            _ => internal("not a declarative environment"),
+        }
+    }
+
+    fn not_defined(&mut self, name: &[u16]) -> Abrupt {
+        let message = format!("{} is not defined", String::from_utf16_lossy(name));
+        self.throw(ErrorType::Reference, &message)
+    }
+
+    fn get_var(&mut self, name: &Key) -> JsResult<(Value, Value)> {
+        let r = self.resolve(name)?;
+        self.get_resolved(r, name)
+    }
+
+    /// GetValue of a reference whose base was resolved earlier (section 8.7.1).
+    fn get_resolved(&mut self, r: Resolved, name: &Key) -> JsResult<(Value, Value)> {
+        match r {
+            Resolved::Decl(e) => Ok((self.binding_value(e, name)?, Value::Undefined)),
+            Resolved::Obj { object, with_this } => {
+                let v = self.get_from(object, name, &Value::Object(object))?;
+                Ok((v, if with_this { Value::Object(object) } else { Value::Undefined }))
+            }
+            Resolved::Unresolved => Err(self.not_defined(name)),
+        }
+    }
+
+    fn set_var(&mut self, name: &Key, v: Value) -> JsResult<()> {
+        let r = self.resolve(name)?;
+        self.set_resolved(r, name, v)
+    }
+
+    /// PutValue of a reference whose base was resolved earlier (section 8.7.2).
+    fn set_resolved(&mut self, r: Resolved, name: &Key, v: Value) -> JsResult<()> {
+        let strict = self.strict();
+        match r {
+            Resolved::Decl(e) => {
+                let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(e) else { return internal("not a declarative environment") };
+                match bindings.get_mut(name) {
+                    Some(b) if b.mutable => {
+                        b.value = v;
+                        Ok(())
+                    }
+                    _ if strict => Err(self.type_error("assignment to a constant binding")),
+                    _ => Ok(()),
+                }
+            }
+            Resolved::Obj { object, .. } => self.put(object, name.clone(), v, strict),
+            Resolved::Unresolved if strict => Err(self.not_defined(name)),
+            Resolved::Unresolved => {
+                let global = self.global;
+                self.put(global, name.clone(), v, false)
+            }
+        }
+    }
+
+    fn op_get_var(&mut self, n: u32, with_this: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let (v, this) = self.get_var(&name)?;
+        self.push(v)?;
+        if with_this { self.push(this) } else { Ok(()) }
+    }
+
+    fn op_set_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.peek(0)?;
+        self.set_var(&name, v)
+    }
+
+    fn op_typeof_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = match self.resolve(&name)? {
+            Resolved::Unresolved => Value::Undefined,
+            _ => self.get_var(&name)?.0,
+        };
+        let t = self.type_of(&v);
+        self.push(Value::str(t))
+    }
+
+    fn op_delete_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let result = match self.resolve(&name)? {
+            Resolved::Unresolved => true,
+            Resolved::Decl(e) => match self.heap.env_mut(e) {
+                Some(Env::Decl { bindings, .. }) => {
+                    if bindings.get(&name).is_some_and(|b| b.deletable) {
+                        bindings.remove(&name);
+                        true
+                    } else {
+                        false
+                    }
+                }
+                _ => return internal("not a declarative environment"),
+            },
+            Resolved::Obj { object, .. } => self.delete(object, &name, false)?,
+        };
+        self.push(Value::Bool(result))
+    }
+
+    fn op_inc_var(&mut self, n: u32, prefix: bool, dec: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let r = self.resolve(&name)?;
+        let base = resolved_to_value(&r);
+        let (v, _) = self.get_resolved(r, &name)?;
+        // The base stays on the stack, where the collector sees it, while ToNumber runs script.
+        self.push(base)?;
+        let old = self.to_number(&v)?;
+        let base = self.pop()?;
+        let new = if dec { old - 1.0 } else { old + 1.0 };
+        self.set_resolved(value_to_resolved(&base)?, &name, Value::Number(new))?;
+        self.push(Value::Number(if prefix { new } else { old }))
+    }
+
+    /// Resolves a variable before the right-hand side of an assignment runs, and pushes the
+    /// reference's base.
+    fn op_ref_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let r = self.resolve(&name)?;
+        self.push(resolved_to_value(&r))
+    }
+
+    /// Replaces the reference base on top of the stack with the variable's value.
+    fn op_get_ref(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let (v, _) = self.get_resolved(value_to_resolved(&base)?, &name)?;
+        self.pop()?;
+        self.push(v)
+    }
+
+    /// Stores the value on top of the stack through the reference base under it, and leaves the
+    /// value.
+    fn op_put_ref(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.set_resolved(value_to_resolved(&base)?, &name, v)?;
+        let v = self.pop()?;
+        self.pop()?;
+        self.push(v)
+    }
+
+    // ---- properties ----
+
+    fn object(&self, id: ObjId) -> JsResult<&Object> {
+        self.heap.object(id).ok_or_else(|| Abrupt::Internal("object out of range".into()))
+    }
+
+    fn object_mut(&mut self, id: ObjId) -> JsResult<&mut Object> {
+        self.heap.object_mut(id).ok_or_else(|| Abrupt::Internal("object out of range".into()))
+    }
+
+    /// [[GetOwnProperty]] (section 8.12.1, with the special cases of arrays, strings and
+    /// arguments objects).
+    pub(crate) fn get_own_property(&self, id: ObjId, k: &[u16]) -> JsResult<Option<Prop>> {
+        let o = self.object(id)?;
+        match &o.class {
+            Class::Array { length, length_writable } if is(k, "length") => {
+                return Ok(Some(Prop::Data { value: Value::Number(f64::from(*length)), flags: if *length_writable { WRITABLE } else { 0 } }));
+            }
+            Class::String(s) => {
+                if is(k, "length") {
+                    return Ok(Some(Prop::Data { value: Value::Number(s.len() as f64), flags: 0 }));
+                }
+                if let Some(i) = array_index(k)
+                    && (i as usize) < s.len()
+                {
+                    let unit = s.flat().get(i as usize).copied().unwrap_or(0);
+                    return Ok(Some(Prop::Data { value: Value::String(Str::from_units(vec![unit])), flags: ENUMERABLE }));
+                }
+            }
+            Class::Arguments(map) => {
+                if let Some(name) = array_index(k).and_then(|i| map.names.get(i as usize)).and_then(Option::as_ref)
+                    && let Some(Prop::Data { flags, .. }) = o.props.get(k)
+                {
+                    let flags = *flags;
+                    return Ok(Some(Prop::Data { value: self.binding_value(map.env, name)?, flags }));
+                }
+            }
+            _ => {}
+        }
+        Ok(o.props.get(k).cloned())
+    }
+
+    /// [[GetProperty]]: the property found on the object or its prototype chain.
+    pub(crate) fn find_property(&self, id: ObjId, k: &[u16]) -> JsResult<Option<Prop>> {
+        let mut cur = Some(id);
+        let mut steps = 0usize;
+        while let Some(o) = cur {
+            if let Some(p) = self.get_own_property(o, k)? {
+                return Ok(Some(p));
+            }
+            cur = self.object(o)?.proto;
+            steps += 1;
+            if steps > 1_000_000 {
+                return internal("prototype chain too long");
+            }
+        }
+        Ok(None)
+    }
+
+    pub(crate) fn has_property(&self, id: ObjId, k: &[u16]) -> JsResult<bool> {
+        Ok(self.find_property(id, k)?.is_some())
+    }
+
+    /// [[Get]] starting at `start`, with `receiver` as `this` for a getter.
+    pub(crate) fn get_from(&mut self, start: ObjId, k: &[u16], receiver: &Value) -> JsResult<Value> {
+        match self.find_property(start, k)? {
+            None | Some(Prop::Accessor { get: None, .. }) => Ok(Value::Undefined),
+            Some(Prop::Data { value, .. }) => Ok(value),
+            Some(Prop::Accessor { get: Some(g), .. }) => self.call(&Value::Object(g), receiver, &[]),
+        }
+    }
+
+    /// The prototype a primitive's properties are looked up on.
+    fn primitive_proto(&mut self, v: &Value, k: &[u16]) -> JsResult<ObjId> {
+        match v {
+            Value::Object(o) => Ok(*o),
+            Value::String(_) => Ok(self.intrinsics.string_proto),
+            Value::Number(_) => Ok(self.intrinsics.number_proto),
+            Value::Bool(_) => Ok(self.intrinsics.boolean_proto),
+            Value::Undefined | Value::Null => {
+                let message = format!(
+                    "cannot read property '{}' of {}",
+                    String::from_utf16_lossy(k),
+                    if matches!(v, Value::Null) { "null" } else { "undefined" }
+                );
+                Err(self.type_error(&message))
+            }
+        }
+    }
+
+    /// `base[k]` for any value (GetValue, section 8.7.1).
+    pub(crate) fn get_value(&mut self, base: &Value, k: &[u16]) -> JsResult<Value> {
+        if let Value::String(s) = base {
+            if is(k, "length") {
+                return Ok(Value::Number(s.len() as f64));
+            }
+            if let Some(i) = array_index(k)
+                && (i as usize) < s.len()
+            {
+                let unit = s.flat().get(i as usize).copied().unwrap_or(0);
+                return Ok(Value::String(Str::from_units(vec![unit])));
+            }
+        }
+        let start = self.primitive_proto(base, k)?;
+        self.get_from(start, k, base)
+    }
+
+    /// Adds or replaces an own property directly, keeping the heap estimate.
+    pub(crate) fn define(&mut self, id: ObjId, k: Key, prop: Prop) -> JsResult<()> {
+        let o = self.object_mut(id)?;
+        let new = !o.props.contains(&k);
+        if let Class::Array { length, .. } = &mut o.class
+            && let Some(i) = array_index(&k)
+            && i >= *length
+        {
+            *length = i + 1;
+        }
+        let name_len = k.len();
+        o.props.insert(k, prop);
+        if new {
+            self.heap.bytes += PROP_BYTES + string_bytes(name_len);
+        }
+        Ok(())
+    }
+
+    fn reject(&mut self, throw: bool, k: &[u16], why: &str) -> JsResult<()> {
+        if throw {
+            let message = format!("cannot assign to property '{}': {why}", String::from_utf16_lossy(k));
+            return Err(self.type_error(&message));
+        }
+        Ok(())
+    }
+
+    /// [[Put]] (section 8.12.5).
+    pub(crate) fn put(&mut self, id: ObjId, k: Key, v: Value, throw: bool) -> JsResult<()> {
+        match self.get_own_property(id, &k)? {
+            Some(Prop::Data { flags, .. }) => {
+                if flags & WRITABLE == 0 {
+                    return self.reject(throw, &k, "it is read-only");
+                }
+                return self.write_own(id, k, v, throw);
+            }
+            Some(Prop::Accessor { set: Some(s), .. }) => return self.call(&Value::Object(s), &Value::Object(id), &[v]).map(drop),
+            Some(Prop::Accessor { set: None, .. }) => return self.reject(throw, &k, "it has only a getter"),
+            None => {}
+        }
+        let proto = self.object(id)?.proto;
+        match proto.map(|p| self.find_property(p, &k)).transpose()?.flatten() {
+            Some(Prop::Accessor { set: Some(s), .. }) => return self.call(&Value::Object(s), &Value::Object(id), &[v]).map(drop),
+            Some(Prop::Accessor { set: None, .. }) => return self.reject(throw, &k, "it has only a getter"),
+            Some(Prop::Data { flags, .. }) if flags & WRITABLE == 0 => return self.reject(throw, &k, "it is read-only"),
+            _ => {}
+        }
+        let o = self.object(id)?;
+        if !o.extensible {
+            return self.reject(throw, &k, "the object is not extensible");
+        }
+        if let Class::Array { length, length_writable: false } = o.class
+            && array_index(&k).is_some_and(|i| i >= length)
+        {
+            return self.reject(throw, &k, "the array's length is read-only");
+        }
+        self.define(id, k, Prop::Data { value: v, flags: OPEN })
+    }
+
+    /// Sets the value of an existing writable own data property.
+    fn write_own(&mut self, id: ObjId, k: Key, v: Value, throw: bool) -> JsResult<()> {
+        let o = self.object(id)?;
+        match &o.class {
+            Class::Array { .. } if is(&k, "length") => return self.set_array_length(id, &v, throw),
+            Class::Arguments(map) => {
+                if let Some(name) = array_index(&k).and_then(|i| map.names.get(i as usize)).and_then(Option::as_ref) {
+                    let (env, name) = (map.env, name.clone());
+                    if let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(env)
+                        && let Some(b) = bindings.get_mut(&name)
+                    {
+                        b.value = v.clone();
+                    }
+                }
+            }
+            _ => {}
+        }
+        match self.object_mut(id)?.props.get_mut(&k) {
+            Some(Prop::Data { value, .. }) => {
+                *value = v;
+                Ok(())
+            }
+            _ => internal("own data property vanished"),
+        }
+    }
+
+    /// Assigning to an array's `length` (section 15.4.5.1).
+    fn set_array_length(&mut self, id: ObjId, v: &Value, throw: bool) -> JsResult<()> {
+        let n = self.to_number(v)?;
+        let new = to_uint32(n);
+        if f64::from(new) != n {
+            return Err(self.throw(ErrorType::Range, "invalid array length"));
+        }
+        let o = self.object(id)?;
+        let Class::Array { length: old, length_writable } = o.class else { return internal("not an array") };
+        if !length_writable {
+            return self.reject(throw, &key("length"), "it is read-only");
+        }
+        if new < old {
+            // Shrinking visits every property: each takes fuel before anything is removed.
+            for _ in 0..o.props.len() {
+                self.use_fuel()?;
+            }
+        }
+        let o = self.object_mut(id)?;
+        let Class::Array { length, .. } = &mut o.class else { return internal("not an array") };
+        *length = new;
+        if new < old {
+            let doomed: Vec<Key> = o.props.keys().into_iter().filter(|k| array_index(k).is_some_and(|i| i >= new)).collect();
+            for k in doomed {
+                o.props.remove(&k);
+            }
+        }
+        Ok(())
+    }
+
+    /// [[Delete]] (section 8.12.7).
+    pub(crate) fn delete(&mut self, id: ObjId, k: &[u16], throw: bool) -> JsResult<bool> {
+        match self.get_own_property(id, k)? {
+            None => Ok(true),
+            Some(p) if p.configurable() => {
+                let o = self.object_mut(id)?;
+                o.props.remove(k);
+                if let Class::Arguments(map) = &mut o.class
+                    && let Some(slot) = array_index(k).and_then(|i| map.names.get_mut(i as usize))
+                {
+                    *slot = None;
+                }
+                Ok(true)
+            }
+            Some(_) if throw => {
+                let message = format!("cannot delete property '{}'", String::from_utf16_lossy(k));
+                Err(self.type_error(&message))
+            }
+            Some(_) => Ok(false),
+        }
+    }
+
+    /// PutValue on a property reference (section 8.7.2), whose base may be a primitive.
+    fn put_value(&mut self, base: &Value, k: Key, v: Value) -> JsResult<()> {
+        let strict = self.strict();
+        match base {
+            Value::Object(o) => self.put(*o, k, v, strict),
+            Value::Undefined | Value::Null => {
+                let message = format!(
+                    "cannot set property '{}' of {}",
+                    String::from_utf16_lossy(&k),
+                    if matches!(base, Value::Null) { "null" } else { "undefined" }
+                );
+                Err(self.type_error(&message))
+            }
+            _ => {
+                let proto = self.primitive_proto(base, &k)?;
+                let own = matches!(base, Value::String(s) if is(&k, "length") || array_index(&k).is_some_and(|i| (i as usize) < s.len()));
+                if !own && let Some(Prop::Accessor { set: Some(s), .. }) = self.find_property(proto, &k)? {
+                    return self.call(&Value::Object(s), base, &[v]).map(drop);
+                }
+                self.reject(strict, &k, "the value is a primitive")
+            }
+        }
+    }
+
+    fn op_get_member(&mut self, n: u32, with_this: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let v = self.get_value(&base, &name)?;
+        self.replace(1, v)?;
+        if with_this { self.push(base) } else { Ok(()) }
+    }
+
+    fn op_set_member(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.put_value(&base, name, v.clone())?;
+        self.replace(2, v)
+    }
+
+    fn check_coercible(&mut self, base: &Value, k: &[u16]) -> JsResult<()> {
+        if base.is_nullish() {
+            self.primitive_proto(base, k)?;
+        }
+        Ok(())
+    }
+
+    fn op_check_object(&mut self) -> JsResult<()> {
+        let base = self.peek(0)?;
+        self.check_coercible(&base, &[])
+    }
+
+    fn op_to_key(&mut self) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        self.replace(1, Value::String(Str::from_rc(name)))
+    }
+
+    fn op_get_index(&mut self, with_this: bool) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        let v = self.get_value(&base, &name)?;
+        self.replace(2, v)?;
+        if with_this { self.push(base) } else { Ok(()) }
+    }
+
+    fn op_set_index(&mut self) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let k = self.peek(1)?;
+        let base = self.peek(2)?;
+        let name = self.to_key(&k)?;
+        self.put_value(&base, name, v.clone())?;
+        self.replace(3, v)
+    }
+
+    fn op_delete_member(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let o = self.to_object(&base)?;
+        let strict = self.strict();
+        let r = self.delete(o, &name, strict)?;
+        self.replace(1, Value::Bool(r))
+    }
+
+    fn op_delete_index(&mut self) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        let o = self.to_object(&base)?;
+        let strict = self.strict();
+        let r = self.delete(o, &name, strict)?;
+        self.replace(2, Value::Bool(r))
+    }
+
+    fn inc_property(&mut self, base: &Value, name: Key, prefix: bool, dec: bool) -> JsResult<Value> {
+        let v = self.get_value(base, &name)?;
+        let old = self.to_number(&v)?;
+        let new = if dec { old - 1.0 } else { old + 1.0 };
+        self.put_value(base, name, Value::Number(new))?;
+        Ok(Value::Number(if prefix { new } else { old }))
+    }
+
+    fn op_inc_member(&mut self, n: u32, prefix: bool, dec: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let r = self.inc_property(&base, name, prefix, dec)?;
+        self.replace(1, r)
+    }
+
+    fn op_inc_index(&mut self, prefix: bool, dec: bool) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        let r = self.inc_property(&base, name, prefix, dec)?;
+        self.replace(2, r)
+    }
+
+    // ---- object literals and functions ----
+
+    fn op_new_object(&mut self) -> JsResult<()> {
+        let o = self.new_object();
+        self.push(Value::Object(o))
+    }
+
+    pub(crate) fn new_object(&mut self) -> ObjId {
+        let proto = self.intrinsics.object_proto;
+        self.heap.alloc_object(Object::new(Class::Ordinary, Some(proto)))
+    }
+
+    fn op_new_array(&mut self) -> JsResult<()> {
+        let proto = self.intrinsics.array_proto;
+        let a = self.heap.alloc_object(Object::new(Class::Array { length: 0, length_writable: true }, Some(proto)));
+        self.push(Value::Object(a))
+    }
+
+    fn op_array_push(&mut self, with_value: bool) -> JsResult<()> {
+        let v = if with_value { Some(self.pop()?) } else { None };
+        let Value::Object(a) = self.peek(0)? else { return internal("array literal is not an object") };
+        let o = self.object_mut(a)?;
+        let Class::Array { length, .. } = &mut o.class else { return internal("array literal is not an array") };
+        let i = *length;
+        if i == u32::MAX - 1 {
+            return Err(self.throw(ErrorType::Range, "array literal too long"));
+        }
+        *length = i + 1;
+        match v {
+            Some(v) => self.define(a, index_key(i), Prop::Data { value: v, flags: OPEN }),
+            None => Ok(()),
+        }
+    }
+
+    fn op_init_prop(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.pop()?;
+        let Value::Object(o) = self.peek(0)? else { return internal("object literal is not an object") };
+        self.define(o, name, Prop::Data { value: v, flags: OPEN })
+    }
+
+    fn op_init_accessor(&mut self, n: u32, getter: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let Value::Object(f) = self.pop()? else { return internal("accessor is not a function") };
+        let Value::Object(o) = self.peek(0)? else { return internal("object literal is not an object") };
+        let (mut get, mut set) = match self.object(o)?.props.get(&name) {
+            Some(Prop::Accessor { get, set, .. }) => (*get, *set),
+            _ => (None, None),
+        };
+        if getter {
+            get = Some(f);
+        } else {
+            set = Some(f);
+        }
+        self.define(o, name, Prop::Accessor { get, set, flags: ENUMERABLE | CONFIGURABLE })
+    }
+
+    fn op_closure(&mut self, i: u32) -> JsResult<()> {
+        let frame = self.frame()?;
+        let env = frame.env;
+        let Some(code) = frame.code.functions.get(i as usize).cloned() else { return internal("function out of range") };
+        let f = self.make_closure(code, env)?;
+        self.push(Value::Object(f))
+    }
+
+    /// A function object for `code` closing over `env` (section 13.2).
+    pub(crate) fn make_closure(&mut self, code: Rc<Code>, env: EnvId) -> JsResult<ObjId> {
+        let env = match &code.self_name {
+            Some(_) => self.heap.alloc_env(Env::Decl { bindings: PropMap::default(), outer: Some(env) }),
+            None => env,
+        };
+        let proto = self.intrinsics.function_proto;
+        let params = code.params.len();
+        let strict = code.strict;
+        let self_name = code.self_name.clone();
+        let f = self.heap.alloc_object(Object::new(Class::Function(Func::Closure { code, env }), Some(proto)));
+        self.define(f, key("length"), Prop::Data { value: Value::Number(params as f64), flags: 0 })?;
+        let p = self.new_object();
+        self.define(p, key("constructor"), Prop::Data { value: Value::Object(f), flags: HIDDEN })?;
+        self.define(f, key("prototype"), Prop::Data { value: Value::Object(p), flags: WRITABLE })?;
+        if strict {
+            let thrower = Some(self.intrinsics.throw_type_error);
+            for name in ["caller", "arguments"] {
+                self.define(f, key(name), Prop::Accessor { get: thrower, set: thrower, flags: 0 })?;
+            }
+        }
+        if let Some(name) = self_name {
+            self.env_insert(env, name, Binding { value: Value::Object(f), mutable: false, deletable: false })?;
+        }
+        Ok(f)
+    }
+
+    fn env_insert(&mut self, env: EnvId, name: Key, b: Binding) -> JsResult<()> {
+        let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(env) else { return internal("not a declarative environment") };
+        let new = !bindings.contains(&name);
+        let name_len = name.len();
+        bindings.insert(name, b);
+        if new {
+            self.heap.bytes += PROP_BYTES + string_bytes(name_len);
+        }
+        Ok(())
+    }
+
+    fn op_regexp(&mut self, i: u32) -> JsResult<()> {
+        let Some((source, flags)) = self.frame()?.code.regexps.get(i as usize).cloned() else { return internal("regular expression out of range") };
+        let proto = self.intrinsics.regexp_proto;
+        let r = self.heap.alloc_object(Object::new(Class::RegExp, Some(proto)));
+        let flag_units = flags.flat();
+        let has = |c: u8| flag_units.contains(&u16::from(c));
+        let (g, i_, m) = (has(b'g'), has(b'i'), has(b'm'));
+        self.define(r, key("source"), Prop::Data { value: Value::String(source), flags: 0 })?;
+        self.define(r, key("global"), Prop::Data { value: Value::Bool(g), flags: 0 })?;
+        self.define(r, key("ignoreCase"), Prop::Data { value: Value::Bool(i_), flags: 0 })?;
+        self.define(r, key("multiline"), Prop::Data { value: Value::Bool(m), flags: 0 })?;
+        self.define(r, key("lastIndex"), Prop::Data { value: Value::Number(0.0), flags: WRITABLE })?;
+        self.push(Value::Object(r))
+    }
+
+    // ---- environments ----
+
+    fn op_push_with(&mut self) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let object = self.to_object(&v)?;
+        self.pop()?;
+        let outer = self.frame()?.env;
+        let env = self.heap.alloc_env(Env::Obj { object, with_this: true, outer: Some(outer) });
+        let frame = self.frame_mut()?;
+        frame.env = env;
+        frame.env_depth += 1;
+        Ok(())
+    }
+
+    fn op_push_catch(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.pop()?;
+        let outer = self.frame()?.env;
+        let mut bindings = PropMap::default();
+        let name_bytes = string_bytes(name.len());
+        bindings.insert(name, Binding { value: v, mutable: true, deletable: false });
+        let env = self.heap.alloc_env(Env::Decl { bindings, outer: Some(outer) });
+        self.heap.bytes += name_bytes;
+        let frame = self.frame_mut()?;
+        frame.env = env;
+        frame.env_depth += 1;
+        Ok(())
+    }
+
+    fn op_pop_env(&mut self) -> JsResult<()> {
+        let env = self.frame()?.env;
+        let Some(outer) = self.heap.env(env).and_then(Env::outer) else { return internal("left the outermost environment") };
+        let frame = self.frame_mut()?;
+        if frame.env_depth == 0 {
+            return internal("left more environments than were entered");
+        }
+        frame.env = outer;
+        frame.env_depth -= 1;
+        Ok(())
+    }
+
+    // ---- for-in ----
+
+    /// The names `for-in` visits (section 12.6.4): the enumerable properties of the object and
+    /// its prototypes, own properties in the order they were added, each name once, and none
+    /// that an object nearer the start of the chain has (enumerable or not).
+    ///
+    /// For a String object, the heap budget for all its index names is checked before any is
+    /// built. Each index name and each property visited takes a unit of fuel.
+    fn enumerable_keys(&mut self, id: ObjId) -> JsResult<Vec<Key>> {
+        let mut seen = std::collections::HashSet::new();
+        let mut out = Vec::new();
+        let mut cur = Some(id);
+        while let Some(o) = cur {
+            let obj = self.object(o)?;
+            let string_len = if let Class::String(s) = &obj.class { Some(s.len()) } else { None };
+            let is_array = matches!(obj.class, Class::Array { .. });
+            if let Some(len) = string_len {
+                self.reserve_heap(index_keys_bytes(len))?;
+                for i in 0..len {
+                    self.use_fuel()?;
+                    let k = index_key(u32::try_from(i).unwrap_or(u32::MAX));
+                    if seen.insert(k.clone()) {
+                        out.push(k);
+                    }
+                }
+                seen.insert(key("length"));
+            }
+            if is_array {
+                seen.insert(key("length"));
+            }
+            for _ in 0..self.object(o)?.props.len() {
+                self.use_fuel()?;
+            }
+            let obj = self.object(o)?;
+            for (k, p) in obj.props.iter() {
+                if seen.insert(k.clone()) && p.enumerable() {
+                    out.push(k.clone());
+                }
+            }
+            cur = obj.proto;
+        }
+        Ok(out)
+    }
+
+    fn op_for_in_start(&mut self) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let (keys, object) = if v.is_nullish() {
+            (Vec::new(), None)
+        } else {
+            let o = self.to_object(&v)?;
+            // A wrapper made by ToObject is not on the stack; a collection while the names are
+            // listed or their bytes reserved must not free it.
+            let saved = self.temp_roots.len();
+            self.temp_roots.push(Value::Object(o));
+            let keys = self.enumerable_keys(o).and_then(|keys| {
+                let bytes = keys.iter().map(|k| string_bytes(k.len())).sum::<usize>();
+                self.reserve_heap(bytes)?;
+                self.heap.bytes = self.heap.bytes.saturating_add(bytes);
+                Ok(keys)
+            });
+            self.temp_roots.truncate(saved);
+            (keys?, Some(o))
+        };
+        let iter = self.heap.alloc_object(Object::new(Class::ForIn(Box::new(ForIn { keys, pos: 0, object })), None));
+        self.replace(1, Value::Object(iter))
+    }
+
+    fn op_for_in_next(&mut self, target: u32) -> JsResult<()> {
+        let Value::Object(iter) = self.peek(0)? else { return internal("for-in iterator is not an object") };
+        loop {
+            let Class::ForIn(state) = &mut self.object_mut(iter)?.class else { return internal("not a for-in iterator") };
+            let Some(k) = state.keys.get(state.pos).cloned() else { return self.jump_to(target) };
+            state.pos += 1;
+            let object = state.object;
+            if let Some(o) = object
+                && self.has_property(o, &k)?
+            {
+                return self.push(Value::String(Str::from_rc(k)));
+            }
+        }
+    }
+
+    // ---- calls ----
+
+    pub(crate) fn is_callable(&self, v: &Value) -> bool {
+        v.as_object().and_then(|o| self.heap.object(o)).is_some_and(|o| matches!(o.class, Class::Function(_)))
+    }
+
+    fn func_of(&self, v: &Value) -> Option<Func> {
+        match &self.heap.object(v.as_object()?)?.class {
+            Class::Function(f) => Some(f.clone()),
+            _ => None,
+        }
+    }
+
+    /// Resolves `call` and `apply` and runs native and host functions; a function written in
+    /// JavaScript comes back to be entered by the caller.
+    fn prepare_call(&mut self, mut f: Value, mut this: Value, mut args: Vec<Value>) -> JsResult<Prepared> {
+        loop {
+            let Some(func) = self.func_of(&f) else { return Err(self.type_error("the value is not a function")) };
+            match func {
+                Func::Closure { code, env } => {
+                    let callee = f.as_object().ok_or_else(|| Abrupt::Internal("callee is not an object".into()))?;
+                    return Ok(Prepared::Closure(Entry { callee, code, env, this, args }));
+                }
+                Func::Native { kind: NativeKind::Call, .. } => {
+                    self.use_fuel()?;
+                    f = this;
+                    this = if args.is_empty() { Value::Undefined } else { args.remove(0) };
+                }
+                Func::Native { kind: NativeKind::Apply, .. } => {
+                    self.use_fuel()?;
+                    if !self.is_callable(&this) {
+                        return Err(self.type_error("apply was called on a value that is not a function"));
+                    }
+                    let list = args.get(1).cloned().unwrap_or(Value::Undefined);
+                    f = this;
+                    this = args.first().cloned().unwrap_or(Value::Undefined);
+                    args = self.list_from_array_like(&list)?;
+                }
+                Func::Native { f: native, .. } => {
+                    // A list from `apply` is not on the operand stack, and a native function can run
+                    // JavaScript that collects, so the arguments stay rooted for the call.
+                    let mark = self.temp_roots.len();
+                    self.temp_roots.push(this.clone());
+                    self.temp_roots.extend(args.iter().cloned());
+                    let r = native(self, this, &args, false);
+                    self.temp_roots.truncate(mark);
+                    return Ok(Prepared::Done(r?));
+                }
+                Func::Host { f: host, .. } => {
+                    let js_args: Vec<crate::JsValue> = args.iter().map(|v| self.to_js_value(v)).collect();
+                    return match host(&js_args) {
+                        Ok(v) => Ok(Prepared::Done(self.from_js_value(v)?)),
+                        Err(message) => {
+                            let bytes = string_bytes(message.encode_utf16().count());
+                            self.reserve_heap(bytes)?;
+                            self.heap.bytes += bytes;
+                            Err(self.throw(ErrorType::Error, &message))
+                        }
+                    };
+                }
+            }
+        }
+    }
+
+    /// The elements of an array-like `apply` argument (section 15.3.4.3).
+    fn list_from_array_like(&mut self, list: &Value) -> JsResult<Vec<Value>> {
+        let Value::Object(o) = list else {
+            if list.is_nullish() {
+                return Ok(Vec::new());
+            }
+            return Err(self.type_error("the argument list is not an object"));
+        };
+        let len = self.get_from(*o, &key("length"), list)?;
+        let n = to_uint32(self.to_number(&len)?) as usize;
+        if n > MAX_APPLY_ARGS {
+            return Err(self.throw(ErrorType::Range, "too many arguments"));
+        }
+        let saved = self.temp_roots.len();
+        let mut out = Vec::with_capacity(n);
+        for i in 0..n {
+            // Each element read takes fuel, so a long array-like list stays within the run's limits.
+            match self.use_fuel().and_then(|()| self.get_from(*o, &index_key(u32::try_from(i).unwrap_or(u32::MAX)), list)) {
+                Ok(v) => {
+                    self.temp_roots.push(v.clone());
+                    out.push(v);
+                }
+                Err(e) => {
+                    self.temp_roots.truncate(saved);
+                    return Err(e);
+                }
+            }
+        }
+        self.temp_roots.truncate(saved);
+        Ok(out)
+    }
+
+    fn op_call(&mut self, argc: u32, eval: bool) -> JsResult<()> {
+        let n = argc as usize;
+        let start =
+            self.stack.len().checked_sub(n + 2).filter(|&s| s >= self.base()).ok_or_else(|| Abrupt::Internal("call below the stack".into()))?;
+        let f = self.stack.get(start).cloned().unwrap_or(Value::Undefined);
+        let this = self.stack.get(start + 1).cloned().unwrap_or(Value::Undefined);
+        let args: Vec<Value> = self.stack.get(start + 2..).map(<[Value]>::to_vec).unwrap_or_default();
+        if eval && f.as_object() == Some(self.intrinsics.eval) {
+            return self.direct_eval(start, args);
+        }
+        match self.prepare_call(f, this, args)? {
+            Prepared::Done(v) => {
+                self.stack.truncate(start);
+                self.push(v)
+            }
+            Prepared::Closure(entry) => {
+                self.stack.truncate(start);
+                self.enter_function(entry, None, false)
+            }
+        }
+    }
+
+    fn op_new(&mut self, argc: u32) -> JsResult<()> {
+        let n = argc as usize;
+        let start =
+            self.stack.len().checked_sub(n + 1).filter(|&s| s >= self.base()).ok_or_else(|| Abrupt::Internal("new below the stack".into()))?;
+        let f = self.stack.get(start).cloned().unwrap_or(Value::Undefined);
+        let args: Vec<Value> = self.stack.get(start + 1..).map(<[Value]>::to_vec).unwrap_or_default();
+        match self.func_of(&f) {
+            Some(Func::Closure { code, env }) => {
+                let Some(callee) = f.as_object() else { return internal("callee is not an object") };
+                let proto = match self.get_from(callee, &key("prototype"), &f)? {
+                    Value::Object(p) => p,
+                    _ => self.intrinsics.object_proto,
+                };
+                let obj = self.heap.alloc_object(Object::new(Class::Ordinary, Some(proto)));
+                self.stack.truncate(start);
+                self.enter_function(Entry { callee, code, env, this: Value::Object(obj), args }, Some(obj), false)
+            }
+            Some(Func::Native { f: native, constructor: true, .. }) => {
+                let v = native(self, Value::Undefined, &args, true)?;
+                self.stack.truncate(start);
+                self.push(v)
+            }
+            _ => Err(self.type_error("the value is not a constructor")),
+        }
+    }
+
+    /// Pushes a frame for a call to a function written in JavaScript, its operands already off
+    /// the stack.
+    fn enter_function(&mut self, entry: Entry, construct: Option<ObjId>, boundary: bool) -> JsResult<()> {
+        let Entry { callee, code, env, this, args } = entry;
+        if self.frames.len() >= self.limits.frames {
+            return Err(Abrupt::Limit(LimitKind::Frames));
+        }
+        let params = code.params.iter().fold(0usize, |total, p| total.saturating_add(binding_bytes(p.len())));
+        let arguments =
+            if code.uses_arguments { OBJECT_BYTES.saturating_add(args.len().saturating_add(4).saturating_mul(binding_bytes(10))) } else { 0 };
+        let need = declaration_bytes(&code).saturating_add(ENV_BYTES).saturating_add(params).saturating_add(arguments);
+        if self.heap.bytes.saturating_add(need) > self.limits.heap_bytes {
+            let mark = self.temp_roots.len();
+            self.temp_roots.push(Value::Object(callee));
+            self.temp_roots.push(this.clone());
+            self.temp_roots.extend(construct.map(Value::Object));
+            self.temp_roots.extend(args.iter().cloned());
+            let reserved = self.reserve_heap(need);
+            self.temp_roots.truncate(mark);
+            reserved?;
+        }
+        let this = if code.strict {
+            this
+        } else {
+            match this {
+                Value::Undefined | Value::Null => Value::Object(self.global),
+                Value::Object(_) => this,
+                prim => Value::Object(self.to_object(&prim)?),
+            }
+        };
+        let fenv = self.instantiate_function(&code, env, &args, callee)?;
+        let base = self.stack.len();
+        self.frames.push(Frame {
+            code,
+            pc: 0,
+            base,
+            env: fenv,
+            var_env: fenv,
+            env_depth: 0,
+            this,
+            callee: Some(callee),
+            construct,
+            completion: Value::Undefined,
+            boundary,
+        });
+        Ok(())
+    }
+
+    /// Declaration binding instantiation for function code (section 10.5). Each parameter and
+    /// declaration takes a unit of fuel.
+    fn instantiate_function(&mut self, code: &Rc<Code>, outer: EnvId, args: &[Value], callee: ObjId) -> JsResult<EnvId> {
+        let mut bindings = PropMap::default();
+        for (i, p) in code.params.iter().enumerate() {
+            self.use_fuel()?;
+            bindings.insert(p.clone(), Binding { value: args.get(i).cloned().unwrap_or(Value::Undefined), mutable: true, deletable: false });
+        }
+        let name_bytes = bindings.iter().map(|(k, _)| string_bytes(k.len())).sum::<usize>();
+        let env = self.heap.alloc_env(Env::Decl { bindings, outer: Some(outer) });
+        self.heap.bytes += name_bytes;
+        for (name, fi) in &code.fun_decls {
+            self.use_fuel()?;
+            let Some(fcode) = code.functions.get(*fi as usize).cloned() else { return internal("function out of range") };
+            let f = self.make_closure(fcode, env)?;
+            self.env_insert(env, name.clone(), Binding { value: Value::Object(f), mutable: true, deletable: false })?;
+        }
+        let has = |interp: &Self, name: &[u16]| matches!(interp.heap.env(env), Some(Env::Decl { bindings, .. }) if bindings.contains(name));
+        if code.uses_arguments && !has(self, &key("arguments")) {
+            let a = self.create_arguments(code, env, args, callee)?;
+            self.env_insert(env, key("arguments"), Binding { value: Value::Object(a), mutable: !code.strict, deletable: false })?;
+        }
+        for v in &code.vars {
+            self.use_fuel()?;
+            if !has(self, v) {
+                self.env_insert(env, v.clone(), Binding { value: Value::Undefined, mutable: true, deletable: false })?;
+            }
+        }
+        Ok(env)
+    }
+
+    /// The `arguments` object (section 10.6).
+    fn create_arguments(&mut self, code: &Code, env: EnvId, args: &[Value], callee: ObjId) -> JsResult<ObjId> {
+        let mut names = vec![None; args.len()];
+        if !code.strict {
+            let mut mapped = std::collections::HashSet::new();
+            for (i, p) in code.params.iter().enumerate().take(args.len()).rev() {
+                if mapped.insert(p.clone())
+                    && let Some(slot) = names.get_mut(i)
+                {
+                    *slot = Some(p.clone());
+                }
+            }
+        }
+        let proto = self.intrinsics.object_proto;
+        let a = self.heap.alloc_object(Object::new(Class::Arguments(Box::new(ArgMap { env, names })), Some(proto)));
+        for (i, v) in args.iter().enumerate() {
+            self.define(a, index_key(u32::try_from(i).unwrap_or(u32::MAX)), Prop::Data { value: v.clone(), flags: OPEN })?;
+        }
+        self.define(a, key("length"), Prop::Data { value: Value::Number(args.len() as f64), flags: HIDDEN })?;
+        if code.strict {
+            let thrower = Some(self.intrinsics.throw_type_error);
+            for name in ["callee", "caller"] {
+                self.define(a, key(name), Prop::Accessor { get: thrower, set: thrower, flags: 0 })?;
+            }
+        } else {
+            self.define(a, key("callee"), Prop::Data { value: Value::Object(callee), flags: HIDDEN })?;
+        }
+        Ok(a)
+    }
+
+    /// Calls `f` from Rust and returns its result, running the loop again for a function written
+    /// in JavaScript.
+    pub(crate) fn call(&mut self, f: &Value, this: &Value, args: &[Value]) -> JsResult<Value> {
+        if self.reentry >= self.limits.reentry {
+            return Err(Abrupt::Limit(LimitKind::Reentry));
+        }
+        let saved = self.stack.len();
+        self.stack.push(f.clone());
+        self.stack.push(this.clone());
+        self.stack.extend(args.iter().cloned());
+        self.reentry += 1;
+        let r = self.call_rooted(f.clone(), this.clone(), args.to_vec(), saved);
+        self.reentry -= 1;
+        self.stack.truncate(saved);
+        r
+    }
+
+    fn call_rooted(&mut self, f: Value, this: Value, args: Vec<Value>, saved: usize) -> JsResult<Value> {
+        match self.prepare_call(f, this, args)? {
+            Prepared::Done(v) => Ok(v),
+            Prepared::Closure(entry) => {
+                self.stack.truncate(saved);
+                self.enter_function(entry, None, true)?;
+                self.execute()
+            }
+        }
+    }
+
+    // ---- eval and scripts ----
+
+    /// The options for source parsed next in this run: [`Options::max_source_units`] is what
+    /// the run may still parse.
+    fn remaining_source_options(&self) -> Options {
+        Options { max_source_units: self.options.max_source_units.saturating_sub(self.source_units), ..self.options.clone() }
+    }
+
+    /// Checks that `units` more code units of source fit in what this run may still parse,
+    /// before the source is flattened or encoded.
+    pub(crate) fn check_source_units(&self, units: usize) -> Result<(), CompileError> {
+        crate::check_length(units, &self.remaining_source_options()).map_err(CompileError::Syntax)
+    }
+
+    /// Encodes `text` as UTF-16 for parsing, after checking that it fits in what this run may
+    /// still parse.
+    pub(crate) fn encode_source(&self, text: &str) -> Result<Vec<u16>, CompileError> {
+        crate::to_utf16(text, &self.remaining_source_options()).map_err(CompileError::Syntax)
+    }
+
+    /// Parses and compiles source for eval code or a script, counting it against the source
+    /// limit.
+    pub(crate) fn compile_source(&mut self, units: &[u16], strict: bool, kind: CodeKind) -> Result<Rc<Code>, CompileError> {
+        self.source_units = self.source_units.saturating_add(units.len());
+        let remaining = self.options.max_source_units.saturating_sub(self.source_units.saturating_sub(units.len()));
+        let options = Options { strict, max_source_units: remaining, ..self.options.clone() };
+        let program = crate::parse_utf16(units, &options).map_err(CompileError::Syntax)?;
+        let source = Rc::new(Source { lines: program.lines.clone(), text: units.into() });
+        compile_program(&program, &source, kind).map_err(|e| match e {
+            CompileFail::Syntax(s) => CompileError::Syntax(s),
+            CompileFail::Internal(m) => CompileError::Internal(m),
+        })
+    }
+
+    /// Turns a compile failure inside a running script into what it throws.
+    pub(crate) fn compile_error_to_abrupt(&mut self, e: CompileError) -> Abrupt {
+        match e {
+            CompileError::Syntax(s) => self.throw(ErrorType::Syntax, &s.message),
+            CompileError::Internal(m) => Abrupt::Internal(m),
+        }
+    }
+
+    fn direct_eval(&mut self, start: usize, args: Vec<Value>) -> JsResult<()> {
+        let x = args.into_iter().next().unwrap_or(Value::Undefined);
+        let Value::String(s) = &x else {
+            self.stack.truncate(start);
+            return self.push(x);
+        };
+        let strict = self.strict();
+        self.check_source_units(s.len()).map_err(|e| self.compile_error_to_abrupt(e))?;
+        let units = s.flat();
+        let code = self.compile_source(&units, strict, CodeKind::Eval).map_err(|e| self.compile_error_to_abrupt(e))?;
+        self.charge_code(&code, declaration_bytes(&code).saturating_add(ENV_BYTES))?;
+        let frame = self.frame()?;
+        let (caller_env, caller_var_env, this) = (frame.env, frame.var_env, frame.this.clone());
+        let (env, var_env) = if code.strict {
+            let e = self.heap.alloc_env(Env::Decl { bindings: PropMap::default(), outer: Some(caller_env) });
+            (e, e)
+        } else {
+            (caller_env, caller_var_env)
+        };
+        self.stack.truncate(start);
+        self.instantiate_global(&code, var_env, true)?;
+        self.push_code_frame(code, env, var_env, this, false)
+    }
+
+    /// Indirect eval and scripts: runs `code` in the global environment and returns its
+    /// completion value.
+    pub(crate) fn run_global(&mut self, code: Rc<Code>, is_eval: bool) -> JsResult<Value> {
+        // Indirect eval runs inside an operation and counts against the re-entry limit; the
+        // script a realm runs does not.
+        let nested = usize::from(is_eval);
+        if is_eval && self.reentry >= self.limits.reentry {
+            return Err(Abrupt::Limit(LimitKind::Reentry));
+        }
+        self.charge_code(&code, declaration_bytes(&code).saturating_add(ENV_BYTES))?;
+        let (env, global) = (self.global_env, self.global);
+        let (env, var_env) = if code.strict && is_eval {
+            let e = self.heap.alloc_env(Env::Decl { bindings: PropMap::default(), outer: Some(env) });
+            (e, e)
+        } else {
+            (env, env)
+        };
+        self.instantiate_global(&code, var_env, is_eval)?;
+        self.push_code_frame(code, env, var_env, Value::Object(global), true)?;
+        self.reentry += nested;
+        let r = self.execute();
+        self.reentry -= nested;
+        r
+    }
+
+    fn push_code_frame(&mut self, code: Rc<Code>, env: EnvId, var_env: EnvId, this: Value, boundary: bool) -> JsResult<()> {
+        if self.frames.len() >= self.limits.frames {
+            return Err(Abrupt::Limit(LimitKind::Frames));
+        }
+        let base = self.stack.len();
+        self.frames.push(Frame {
+            code,
+            pc: 0,
+            base,
+            env,
+            var_env,
+            env_depth: 0,
+            this,
+            callee: None,
+            construct: None,
+            completion: Value::Undefined,
+            boundary,
+        });
+        Ok(())
+    }
+
+    /// Declaration binding instantiation for global and eval code (section 10.5). The caller has
+    /// reserved [`declaration_bytes`] of `code`; each declaration takes a unit of fuel.
+    fn instantiate_global(&mut self, code: &Rc<Code>, var_env: EnvId, is_eval: bool) -> JsResult<()> {
+        let configurable = if is_eval { CONFIGURABLE } else { 0 };
+        for (name, fi) in &code.fun_decls {
+            self.use_fuel()?;
+            let Some(fcode) = code.functions.get(*fi as usize).cloned() else { return internal("function out of range") };
+            let f = self.make_closure(fcode, var_env)?;
+            self.declare(var_env, name, Some(Value::Object(f)), configurable)?;
+        }
+        for v in &code.vars {
+            self.use_fuel()?;
+            self.declare(var_env, v, None, configurable)?;
+        }
+        Ok(())
+    }
+
+    /// Declares `name` in a variable environment, with `value` for a function declaration.
+    fn declare(&mut self, env: EnvId, name: &Key, value: Option<Value>, configurable: u8) -> JsResult<()> {
+        match self.heap.env(env) {
+            Some(Env::Decl { bindings, .. }) => {
+                let exists = bindings.contains(name);
+                match value {
+                    Some(v) => self.env_insert(env, name.clone(), Binding { value: v, mutable: true, deletable: configurable != 0 }),
+                    None if !exists => {
+                        self.env_insert(env, name.clone(), Binding { value: Value::Undefined, mutable: true, deletable: configurable != 0 })
+                    }
+                    None => Ok(()),
+                }
+            }
+            Some(Env::Obj { object, .. }) => {
+                let object = *object;
+                let declared = self.has_property(object, name)?;
+                let flags = WRITABLE | ENUMERABLE | configurable;
+                match value {
+                    None if declared => Ok(()),
+                    None => self.define(object, name.clone(), Prop::Data { value: Value::Undefined, flags }),
+                    Some(v) => {
+                        let existing = self.find_property(object, name)?;
+                        match existing {
+                            None => self.define(object, name.clone(), Prop::Data { value: v, flags }),
+                            Some(p) if p.configurable() => self.define(object, name.clone(), Prop::Data { value: v, flags }),
+                            Some(Prop::Data { flags: f, .. }) if f & (WRITABLE | ENUMERABLE) == WRITABLE | ENUMERABLE => {
+                                self.put(object, name.clone(), v, true)
+                            }
+                            Some(_) => {
+                                let message = format!("cannot declare function {}", String::from_utf16_lossy(name));
+                                Err(self.type_error(&message))
+                            }
+                        }
+                    }
+                }
+            }
+            None => internal("environment out of range"),
+        }
+    }
+
+    // ---- conversions ----
+
+    pub(crate) fn type_of(&self, v: &Value) -> &'static str {
+        match v {
+            Value::Undefined => "undefined",
+            Value::Null => "object",
+            Value::Bool(_) => "boolean",
+            Value::Number(_) => "number",
+            Value::String(_) => "string",
+            Value::Object(_) if self.is_callable(v) => "function",
+            Value::Object(_) => "object",
+        }
+    }
+
+    /// ToPrimitive (section 9.1) through [[DefaultValue]] (section 8.12.8).
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_primitive(&mut self, v: &Value, hint: Hint) -> JsResult<Value> {
+        let Value::Object(o) = v else { return Ok(v.clone()) };
+        let order = if hint == Hint::String { ["toString", "valueOf"] } else { ["valueOf", "toString"] };
+        for name in order {
+            let f = self.get_from(*o, &key(name), v)?;
+            if self.is_callable(&f) {
+                let r = self.call(&f, v, &[])?;
+                if !matches!(r, Value::Object(_)) {
+                    return Ok(r);
+                }
+            }
+        }
+        Err(self.type_error("cannot convert the object to a primitive value"))
+    }
+
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_number(&mut self, v: &Value) -> JsResult<f64> {
+        Ok(match v {
+            Value::Undefined => f64::NAN,
+            Value::Null => 0.0,
+            Value::Bool(b) => f64::from(u8::from(*b)),
+            Value::Number(n) => *n,
+            Value::String(s) => string_to_number(&s.flat()),
+            Value::Object(_) => {
+                let p = self.to_primitive(v, Hint::Number)?;
+                return self.to_number(&p);
+            }
+        })
+    }
+
+    /// ToString applied to a primitive.
+    pub(crate) fn primitive_to_str(&mut self, v: &Value) -> Str {
+        match v {
+            Value::Undefined => Str::from("undefined"),
+            Value::Null => Str::from("null"),
+            Value::Bool(b) => Str::from(if *b { "true" } else { "false" }),
+            Value::Number(n) => {
+                let s = number_to_str(*n);
+                self.heap.bytes += string_bytes(s.len());
+                s
+            }
+            Value::String(s) => s.clone(),
+            Value::Object(_) => Str::from("[object]"),
+        }
+    }
+
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_str(&mut self, v: &Value) -> JsResult<Str> {
+        let p = self.to_primitive(v, Hint::String)?;
+        Ok(self.primitive_to_str(&p))
+    }
+
+    /// A property name from a value (ToString, with a short way for array indices).
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_key(&mut self, v: &Value) -> JsResult<Key> {
+        match v {
+            Value::String(s) => {
+                let rope = s.is_rope();
+                let flat = s.flat();
+                if rope {
+                    self.heap.bytes += string_bytes(flat.len());
+                }
+                Ok(flat)
+            }
+            Value::Number(n) if *n >= 0.0 && *n < 4_294_967_295.0 && n.fract() == 0.0 => Ok(index_key(*n as u32)),
+            _ => Ok(self.to_str(v)?.flat()),
+        }
+    }
+
+    /// ToObject (section 9.9).
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_object(&mut self, v: &Value) -> JsResult<ObjId> {
+        let (class, proto) = match v {
+            Value::Object(o) => return Ok(*o),
+            Value::Undefined | Value::Null => return Err(self.type_error("cannot convert undefined or null to an object")),
+            Value::Bool(_) => (Class::Boolean, self.intrinsics.boolean_proto),
+            Value::Number(_) => (Class::Number, self.intrinsics.number_proto),
+            Value::String(s) => (Class::String(s.clone()), self.intrinsics.string_proto),
+        };
+        Ok(self.heap.alloc_object(Object::new(class, Some(proto))))
+    }
+
+    /// Concatenates two strings, ending the run with the heap limit when the result could not
+    /// be flattened within it.
+    pub(crate) fn concat(&mut self, a: &Str, b: &Str) -> JsResult<Str> {
+        let len = a.len() + b.len();
+        if len > self.limits.heap_bytes / 4 {
+            return Err(Abrupt::Limit(LimitKind::Heap));
+        }
+        self.heap.bytes += ROPE_BYTES;
+        Ok(Str::concat(a, b))
+    }
+
+    // ---- operators ----
+
+    fn op_unary(&mut self, op: Op) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let r = match op {
+            Op::Neg => Value::Number(-self.to_number(&v)?),
+            Op::Plus | Op::ToNumber => Value::Number(self.to_number(&v)?),
+            Op::BitNot => Value::Number(f64::from(!to_int32(self.to_number(&v)?))),
+            Op::Not => Value::Bool(!v.truthy()),
+            Op::Typeof => Value::str(self.type_of(&v)),
+            _ => return internal("not a unary operator"),
+        };
+        self.replace(1, r)
+    }
+
+    fn op_binary(&mut self, op: BinaryOp) -> JsResult<()> {
+        let b = self.peek(0)?;
+        let a = self.peek(1)?;
+        let r = self.binary(op, &a, &b)?;
+        self.replace(2, r)
+    }
+
+    pub(crate) fn binary(&mut self, op: BinaryOp, a: &Value, b: &Value) -> JsResult<Value> {
+        let num = |interp: &mut Self, f: fn(f64, f64) -> f64| -> JsResult<Value> {
+            let x = interp.to_number(a)?;
+            let y = interp.to_number(b)?;
+            Ok(Value::Number(f(x, y)))
+        };
+        let int = |interp: &mut Self, f: fn(i32, i32) -> i32| -> JsResult<Value> {
+            let x = to_int32(interp.to_number(a)?);
+            let y = to_int32(interp.to_number(b)?);
+            Ok(Value::Number(f64::from(f(x, y))))
+        };
+        match op {
+            BinaryOp::Add => self.add(a, b),
+            BinaryOp::Sub => num(self, |x, y| x - y),
+            BinaryOp::Mul => num(self, |x, y| x * y),
+            BinaryOp::Div => num(self, |x, y| x / y),
+            BinaryOp::Mod => num(self, |x, y| x % y),
+            BinaryOp::Shl => int(self, |x, y| x.wrapping_shl((y & 31) as u32)),
+            BinaryOp::Shr => int(self, |x, y| x >> (y & 31)),
+            BinaryOp::UShr => {
+                let x = to_uint32(self.to_number(a)?);
+                let y = to_uint32(self.to_number(b)?);
+                Ok(Value::Number(f64::from(x >> (y & 31))))
+            }
+            BinaryOp::BitAnd => int(self, |x, y| x & y),
+            BinaryOp::BitOr => int(self, |x, y| x | y),
+            BinaryOp::BitXor => int(self, |x, y| x ^ y),
+            BinaryOp::Lt => Ok(Value::Bool(self.less_than(a, b, true)? == Some(true))),
+            BinaryOp::Gt => Ok(Value::Bool(self.less_than(b, a, false)? == Some(true))),
+            BinaryOp::LtEq => Ok(Value::Bool(self.less_than(b, a, false)? == Some(false))),
+            BinaryOp::GtEq => Ok(Value::Bool(self.less_than(a, b, true)? == Some(false))),
+            BinaryOp::Eq => Ok(Value::Bool(self.loose_eq(a, b)?)),
+            BinaryOp::NotEq => Ok(Value::Bool(!self.loose_eq(a, b)?)),
+            BinaryOp::StrictEq => Ok(Value::Bool(strict_eq(a, b))),
+            BinaryOp::StrictNotEq => Ok(Value::Bool(!strict_eq(a, b))),
+            BinaryOp::Instanceof => self.instance_of(a, b).map(Value::Bool),
+            BinaryOp::In => {
+                let Value::Object(o) = b else { return Err(self.type_error("the right side of 'in' is not an object")) };
+                let k = self.to_key(a)?;
+                self.has_property(*o, &k).map(Value::Bool)
+            }
+        }
+    }
+
+    /// The addition operator (section 11.6.1).
+    fn add(&mut self, a: &Value, b: &Value) -> JsResult<Value> {
+        if let (Value::Number(x), Value::Number(y)) = (a, b) {
+            return Ok(Value::Number(x + y));
+        }
+        let pa = self.to_primitive(a, Hint::Default)?;
+        let pb = self.to_primitive(b, Hint::Default)?;
+        if matches!(pa, Value::String(_)) || matches!(pb, Value::String(_)) {
+            let sa = self.primitive_to_str(&pa);
+            let sb = self.primitive_to_str(&pb);
+            return self.concat(&sa, &sb).map(Value::String);
+        }
+        Ok(Value::Number(self.to_number(&pa)? + self.to_number(&pb)?))
+    }
+
+    /// The abstract relational comparison `x < y` (section 11.8.5): `None` when either side is
+    /// NaN.
+    fn less_than(&mut self, x: &Value, y: &Value, left_first: bool) -> JsResult<Option<bool>> {
+        let (px, py) = if left_first {
+            let px = self.to_primitive(x, Hint::Number)?;
+            (px, self.to_primitive(y, Hint::Number)?)
+        } else {
+            let py = self.to_primitive(y, Hint::Number)?;
+            (self.to_primitive(x, Hint::Number)?, py)
+        };
+        if let (Value::String(a), Value::String(b)) = (&px, &py) {
+            return Ok(Some(*a.flat() < *b.flat()));
+        }
+        let nx = self.to_number(&px)?;
+        let ny = self.to_number(&py)?;
+        if nx.is_nan() || ny.is_nan() {
+            return Ok(None);
+        }
+        Ok(Some(nx < ny))
+    }
+
+    /// The abstract equality comparison (section 11.9.3).
+    fn loose_eq(&mut self, a: &Value, b: &Value) -> JsResult<bool> {
+        let (mut x, mut y) = (a.clone(), b.clone());
+        loop {
+            match (&x, &y) {
+                (Value::Undefined | Value::Null, Value::Undefined | Value::Null) => return Ok(true),
+                (Value::Number(_), Value::Number(_))
+                | (Value::String(_), Value::String(_))
+                | (Value::Bool(_), Value::Bool(_))
+                | (Value::Object(_), Value::Object(_)) => return Ok(strict_eq(&x, &y)),
+                (Value::Number(n), Value::String(s)) | (Value::String(s), Value::Number(n)) => return Ok(*n == string_to_number(&s.flat())),
+                (Value::Bool(v), _) => x = Value::Number(f64::from(u8::from(*v))),
+                (_, Value::Bool(v)) => y = Value::Number(f64::from(u8::from(*v))),
+                (Value::Number(_) | Value::String(_), Value::Object(_)) => y = self.to_primitive(&y, Hint::Default)?,
+                (Value::Object(_), Value::Number(_) | Value::String(_)) => x = self.to_primitive(&x, Hint::Default)?,
+                _ => return Ok(false),
+            }
+        }
+    }
+
+    /// `instanceof` (sections 11.8.6 and 15.3.5.3).
+    fn instance_of(&mut self, v: &Value, f: &Value) -> JsResult<bool> {
+        if !self.is_callable(f) {
+            return Err(self.type_error("the right side of 'instanceof' is not a function"));
+        }
+        let Some(fid) = f.as_object() else { return Ok(false) };
+        let Value::Object(mut o) = v.clone() else { return Ok(false) };
+        let Value::Object(proto) = self.get_from(fid, &key("prototype"), f)? else {
+            return Err(self.type_error("the function's prototype is not an object"));
+        };
+        let mut steps = 0usize;
+        while let Some(p) = self.object(o)?.proto {
+            if p == proto {
+                return Ok(true);
+            }
+            o = p;
+            steps += 1;
+            if steps > 1_000_000 {
+                return internal("prototype chain too long");
+            }
+        }
+        Ok(false)
+    }
+
+    // ---- host values ----
+
+    pub(crate) fn to_js_value(&self, v: &Value) -> crate::JsValue {
+        match v {
+            Value::Undefined => crate::JsValue::Undefined,
+            Value::Null => crate::JsValue::Null,
+            Value::Bool(b) => crate::JsValue::Bool(*b),
+            Value::Number(n) => crate::JsValue::Number(*n),
+            Value::String(s) => crate::JsValue::String(s.to_rust_string()),
+            Value::Object(o) => crate::JsValue::Object(self.heap.object(*o).map_or("Object", |o| o.class.name()).to_string()),
+        }
+    }
+
+    /// A host value as a JavaScript value. A string is charged to the heap, and one that does not
+    /// fit in it ends the run with the heap limit. Everything the caller still needs must be
+    /// reachable from the roots.
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn from_js_value(&mut self, v: crate::JsValue) -> JsResult<Value> {
+        Ok(match v {
+            crate::JsValue::Undefined => Value::Undefined,
+            crate::JsValue::Null => Value::Null,
+            crate::JsValue::Bool(b) => Value::Bool(b),
+            crate::JsValue::Number(n) => Value::Number(n),
+            crate::JsValue::String(s) => {
+                let bytes = string_bytes(s.encode_utf16().count());
+                self.reserve_heap(bytes)?;
+                self.heap.bytes += bytes;
+                Value::str(&s)
+            }
+            crate::JsValue::Object(_) => Value::Object(self.new_object()),
+        })
+    }
+
+    /// A description of a thrown value that runs no JavaScript: `Name: message` for an error,
+    /// the text of a primitive.
+    pub(crate) fn describe(&mut self, v: &Value) -> String {
+        let Value::Object(o) = v else { return self.primitive_to_str(v).to_rust_string() };
+        let data = |interp: &Self, k: &str| match interp.find_property(*o, &key(k)) {
+            Ok(Some(Prop::Data { value: Value::String(s), .. })) => Some(s.to_rust_string()),
+            _ => None,
+        };
+        match (data(self, "name"), data(self, "message")) {
+            (Some(n), Some(m)) if !m.is_empty() => format!("{n}: {m}"),
+            (Some(n), _) => n,
+            (None, Some(m)) => m,
+            (None, None) => format!("[object {}]", self.heap.object(*o).map_or("Object", |o| o.class.name())),
+        }
+    }
+}
+
+/// A compile failure, before it becomes an exception or a run error.
+pub(crate) enum CompileError {
+    Syntax(crate::SyntaxError),
+    Internal(String),
+}
+
+/// The strict equality comparison (section 11.9.6).
+pub(crate) fn strict_eq(a: &Value, b: &Value) -> bool {
+    match (a, b) {
+        (Value::Undefined, Value::Undefined) | (Value::Null, Value::Null) => true,
+        (Value::Number(x), Value::Number(y)) => x == y,
+        (Value::String(x), Value::String(y)) => x == y,
+        (Value::Bool(x), Value::Bool(y)) => x == y,
+        (Value::Object(x), Value::Object(y)) => x == y,
+        _ => false,
+    }
+}
diff --git a/crates/js/src/interp_tests.rs b/crates/js/src/interp_tests.rs
new file mode 100644
index 000000000..03d9e6639
--- /dev/null
+++ b/crates/js/src/interp_tests.rs
@@ -0,0 +1,852 @@
+use std::rc::Rc;
+
+use proptest::prelude::*;
+
+use crate::bytecode::{Code, Handler, Op, Source, verify};
+use crate::{JsValue, LimitKind, Limits, Options, Realm, RunError, RunErrorKind};
+
+fn run(src: &str) -> JsValue {
+    match Realm::new().run(src) {
+        Ok(v) => v,
+        Err(e) => panic!("{src}\n{e:?}"),
+    }
+}
+
+fn num(src: &str) -> f64 {
+    match run(src) {
+        JsValue::Number(n) => n,
+        other => panic!("{src}: {other:?}"),
+    }
+}
+
+fn string(src: &str) -> String {
+    match run(src) {
+        JsValue::String(s) => s,
+        other => panic!("{src}: {other:?}"),
+    }
+}
+
+fn truth(src: &str) {
+    assert_eq!(run(src), JsValue::Bool(true), "{src}");
+}
+
+fn fail(src: &str) -> RunError {
+    match Realm::new().run(src) {
+        Ok(v) => panic!("{src} completed with {v:?}"),
+        Err(e) => e,
+    }
+}
+
+fn small(limits: Limits) -> Realm {
+    Realm::with_options(Options::default(), limits)
+}
+
+// ---- language ----
+
+#[test]
+fn assignments_resolve_the_variable_before_the_right_hand_side() {
+    // Section 11.13.1: the reference is resolved first, so a binding the right-hand side adds
+    // does not catch the assignment.
+    truth("var x = 0; var scope = {}; with (scope) { x = (scope.x = 2, 1); } scope.x === 2 && x === 1");
+    truth("var x = 0; var scope = {}; with (scope) { x += (scope.x = 2, 1); } scope.x === 2 && x === 1");
+    truth("var x = 5; function f() { var r = (x = (eval('var x;'), 1)); return [x, r]; } var a = f(); a[0] === undefined && a[1] === 1 && x === 1");
+    // Section 11.3.1: the operand's reference is resolved before ToNumber runs.
+    truth(
+        "var x = 0; var scope = {x: {valueOf: function(){ delete scope.x; return 2; }}}; \
+         with (scope) { x++; } scope.x === 3 && x === 0",
+    );
+}
+
+#[test]
+fn arithmetic_comparison_and_conversions() {
+    assert_eq!(num("1 + 2 * 3 - 4 / 2"), 5.0);
+    assert_eq!(num("7 % 3 + (-7 % 3)"), 0.0);
+    assert_eq!(string("'a' + 1 + 2"), "a12");
+    assert_eq!(num("1 + 2 + '3' - 0"), 33.0);
+    assert_eq!(num("(1 << 31) >> 31"), -1.0);
+    assert_eq!(num("-1 >>> 28"), 15.0);
+    assert_eq!(num("~5 ^ 3 | 8 & 12"), -7.0);
+    truth("'10' == 10 && null == undefined && !(null == 0) && '' == 0 && '1e1' == 10");
+    truth("NaN !== NaN && 0 === -0 && 1/-0 === -Infinity");
+    truth("'b' > 'a' && 'B' < 'a' && !(NaN < 1) && !(NaN >= 1) && 2 >= 2 && '10' < '9' && 10 > '9'");
+    truth(
+        "typeof 1 === 'number' && typeof 'x' === 'string' && typeof null === 'object' && typeof undefined_name === 'undefined' && typeof function(){} === 'function'",
+    );
+    truth("({valueOf: function(){ return 4; }}) * 2 === 8 && ({toString: function(){ return 'x'; }}) + 'y' === 'xy'");
+    truth("+'0x10' === 16 && +' 12 ' === 12 && isNaNish(+'1x'); function isNaNish(n) { return n !== n; }");
+}
+
+#[test]
+fn variables_functions_and_closures() {
+    assert_eq!(num("var x = 1; function f() { return x + 1; } f()"), 2.0);
+    assert_eq!(num("function counter() { var n = 0; return function() { return ++n; }; } var c = counter(); c(); c(); c()"), 3.0);
+    assert_eq!(num("f(); function f() { return 5; }"), 5.0);
+    assert_eq!(num("var g = function fact(n) { return n <= 1 ? 1 : n * fact(n - 1); }; g(10)"), 3_628_800.0);
+    assert_eq!(num("function f(a, b) { return arguments.length * 10 + (b === undefined ? 1 : 0); } f(1)"), 11.0);
+    assert_eq!(num("function f(a) { arguments[0] = 9; return a; } f(1)"), 9.0);
+    assert_eq!(num("function f(a) { 'use strict'; arguments[0] = 9; return a; } f(1)"), 1.0);
+    assert_eq!(num("function f(a) { a = 4; return arguments[0]; } f(1)"), 4.0);
+    truth("var o = { m: function() { return this; } }; o.m() === o");
+    truth("function f() { return this; } f() === this");
+    truth("function f() { 'use strict'; return this; } f() === undefined");
+    assert_eq!(num("function P(x) { this.x = x; } P.prototype.get = function() { return this.x; }; new P(7).get()"), 7.0);
+    truth("function P() { return {a: 1}; } new P().a === 1 && new P() instanceof Object");
+    truth("function P() {} var p = new P(); p instanceof P && p.constructor === P && P.prototype.isPrototypeOf(p)");
+    assert_eq!(num("(function(a, b, c) {}).length"), 3.0);
+}
+
+#[test]
+fn call_and_apply_set_this_and_arguments() {
+    assert_eq!(num("function f(a, b) { return this.k + a + b; } f.call({k: 1}, 2, 3)"), 6.0);
+    assert_eq!(num("function f(a, b) { return this.k + a + b; } f.apply({k: 1}, [2, 3])"), 6.0);
+    assert_eq!(num("function f() { return arguments.length; } f.apply(null, undefined)"), 0.0);
+    assert_eq!(num("Function.prototype.call.call(function(a) { return a; }, null, 8)"), 8.0);
+    let e = fail("Function.prototype.call.call(1)");
+    assert_eq!(e.kind, RunErrorKind::Thrown);
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+}
+
+#[test]
+fn objects_arrays_and_accessors() {
+    assert_eq!(num("var o = {a: 1, 'b': 2, 3: 4}; o.a + o['b'] + o[3]"), 7.0);
+    assert_eq!(num("var a = [1, , 3]; a.length"), 3.0);
+    assert_eq!(num("var a = []; a[5] = 1; a.length"), 6.0);
+    assert_eq!(num("var a = [1, 2, 3, 4]; a.length = 1; a[2] === undefined ? a.length : -1"), 1.0);
+    assert_eq!(num("var o = { get x() { return this.y * 2; }, set x(v) { this.y = v; }, y: 1 }; o.x = 5; o.x"), 10.0);
+    truth("var o = {a: 1}; delete o.a && !('a' in o) && o.a === undefined");
+    truth("'length' in [] && !delete [].length");
+    truth("'abc'.length === 3 && 'abc'[1] === 'b' && 'abc'.x === undefined");
+    truth("var o = {}; o.hasOwnProperty('x') === false && ({x: 1}).hasOwnProperty('x')");
+    truth("Object.prototype.toString.call([]) === '[object Array]' && Object.prototype.toString.call(null) === '[object Null]'");
+    // Error.prototype and each NativeError prototype are Error objects (sections 15.11.4 and 15.11.7.7).
+    truth(
+        "var s = Object.prototype.toString, all = [Error, EvalError, RangeError, ReferenceError, SyntaxError, TypeError, URIError], ok = true;\
+         for (var i = 0; i < all.length; i++) ok = ok && s.call(all[i].prototype) === '[object Error]'; ok",
+    );
+    let e = fail("var a = []; a.length = -1");
+    assert!(e.message.starts_with("RangeError"), "{}", e.message);
+    let e = fail("'use strict'; var o = { get x() { return 1; } }; o.x = 2;");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    let e = fail("null.x");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+}
+
+#[test]
+fn for_in_lists_own_properties_in_insertion_order_then_inherited_ones() {
+    assert_eq!(
+        string("function P() { this.z = 1; this.a = 2; } P.prototype.m = 3; P.prototype.a = 9; var s = ''; for (var k in new P()) s += k; s"),
+        "zam"
+    );
+    assert_eq!(string("var o = {a: 1, b: 2, c: 3}, s = ''; for (var k in o) { delete o.b; s += k; } s"), "ac");
+    assert_eq!(string("var s = ''; for (var k in 'xyz') s += k; s"), "012");
+    assert_eq!(num("var n = 0; for (var k in null) n++; for (k in undefined) n++; n"), 0.0);
+    assert_eq!(string("var o = {p: 1}, t = {}, s = ''; for (t.k in o) s += t.k; s"), "p");
+    assert_eq!(string("var a = ['x', 'y'], s = ''; for (var i in a) s += i + a[i]; s"), "0x1y");
+}
+
+#[test]
+fn control_flow_with_labels_switch_and_finally() {
+    assert_eq!(
+        num(
+            "var n = 0; outer: for (var i = 0; i < 5; i++) { for (var j = 0; j < 5; j++) { if (j == 2) continue outer; if (i == 3) break outer; n++; } } n"
+        ),
+        6.0
+    );
+    assert_eq!(num("var r = 0; switch (3) { case 1: r = 1; case 3: r += 3; case 4: r += 4; break; default: r = 100; } r"), 7.0);
+    assert_eq!(num("var r = 0; switch ('z') { case 'a': r = 1; break; default: r = 2; case 'b': r += 10; } r"), 12.0);
+    assert_eq!(num("var log = 0; function f() { try { return 1; } finally { log = 5; } } f() + log"), 6.0);
+    assert_eq!(num("function f() { try { return 1; } finally { return 2; } } f()"), 2.0);
+    assert_eq!(num("var n = 0; for (var i = 0; i < 3; i++) { try { if (i == 1) continue; n += 10; } finally { n += 1; } } n"), 23.0);
+    assert_eq!(num("var n = 0; while (true) { try { try { break; } finally { n += 1; } } finally { n += 10; } } n"), 11.0);
+    assert_eq!(num("var n = 0; try { throw 3; } catch (e) { n = e; } finally { n *= 2; } n"), 6.0);
+    assert_eq!(num("var n = 0; try { try { throw 1; } finally { n = 7; } } catch (e) { n += e; } n"), 8.0);
+    assert_eq!(num("function f() { for (var k in {a: 1}) { try { return 4; } finally { } } } f()"), 4.0);
+    assert_eq!(num("var x = 0; lbl: { x = 1; break lbl; x = 2; } x"), 1.0);
+    assert_eq!(num("var i = 0; do { i++; } while (i < 10); i"), 10.0);
+    assert_eq!(num("var e = 1; try { throw 2; } catch (e) { e = 3; } e"), 1.0);
+    assert_eq!(num("function f() { var r = 0; with ({a: 1}) { try { return a; } finally { r = 1; } } } f()"), 1.0);
+}
+
+#[test]
+fn a_finally_block_keeps_the_completion_value_unless_it_ends_abruptly() {
+    // Section 12.14: a finally block that ends normally leaves the try or catch block's value.
+    let cases = [
+        ("try { 1; } finally { 2; }", 1.0),
+        ("try { throw 0; } catch (e) { 1; } finally { 2; }", 1.0),
+        ("eval('try { 1; } finally { 2; }')", 1.0),
+        ("try { try { 1; } finally { 2; } } finally { 3; }", 1.0),
+        ("do { try { 1; } finally { 2; break; } } while (false)", 2.0),
+        ("do { try { 1; } finally { 2; continue; } } while (false)", 2.0),
+    ];
+    let wrong: Vec<(&str, f64, f64)> = cases.iter().map(|&(src, want)| (src, want, num(src))).filter(|&(_, want, got)| want != got).collect();
+    assert!(wrong.is_empty(), "{wrong:?}");
+}
+
+#[test]
+fn with_eval_and_new_function() {
+    assert_eq!(num("var o = {a: 2}; with (o) { a = 3; } o.a"), 3.0);
+    truth("var o = {f: function() { return this; }}; with (o) { f() === o }");
+    assert_eq!(num("var x = 1; function f() { var x = 2; return eval('x'); } f()"), 2.0);
+    assert_eq!(num("var x = 1; function f() { var x = 2; return (0, eval)('x'); } f()"), 1.0);
+    assert_eq!(num("function f() { eval('var y = 4'); return y; } f()"), 4.0);
+    truth("function f() { 'use strict'; eval('var y = 4'); return typeof y; } f() === 'undefined'");
+    assert_eq!(num("eval('1; 2; if (false) {}')"), 2.0);
+    assert_eq!(num("new Function('a', 'b', 'return a * b;')(6, 7)"), 42.0);
+    assert_eq!(num("Function('return 3')()"), 3.0);
+    assert_eq!(num("var anonymous = 42; Function('return anonymous')()"), 42.0);
+    let e = fail("new Function('a){}; (function(', 'return 1')");
+    assert!(e.message.starts_with("SyntaxError"), "{}", e.message);
+    let e = fail("new Function('}); (function() {')");
+    assert!(e.message.starts_with("SyntaxError"), "{}", e.message);
+    let e = fail("eval('var = 1')");
+    assert!(e.message.starts_with("SyntaxError"), "{}", e.message);
+    truth("try { eval('a b') } catch (e) { e instanceof SyntaxError }");
+    assert_eq!(string("(function f(a) { return a; }).toString()"), "function f(a) { return a; }");
+}
+
+#[test]
+fn strict_mode_assignments_and_errors() {
+    let e = fail("'use strict'; undeclared = 1;");
+    assert!(e.message.starts_with("ReferenceError"), "{}", e.message);
+    assert_eq!(num("undeclared = 1; undeclared"), 1.0);
+    let e = fail("'use strict'; (function f() { f = 1; })()");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    assert_eq!(num("var g = function f() { f = 1; return typeof f === 'function' ? 1 : 0; }; g()"), 1.0);
+    let e = fail("'use strict'; NaN = 1;");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    let e = fail("'use strict'; (function() {}).caller");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    truth("var o = {}; try { o.x.y; false } catch (e) { e instanceof TypeError && e.constructor === TypeError }");
+    truth(
+        "try { nope; } catch (e) { e instanceof ReferenceError && e.name === 'ReferenceError' && String_(e) === 'ReferenceError: nope is not defined' } function String_(v) { return '' + v; }",
+    );
+    truth(
+        "new Error('m').message === 'm' && Error('m') instanceof Error && new TypeError().message === '' && new RangeError('r').toString() === 'RangeError: r'",
+    );
+}
+
+#[test]
+fn errors_carry_line_and_column() {
+    let e = fail("var a = 1;\nvar b = 2;\n  nope();");
+    assert_eq!((e.kind, e.line, e.column), (RunErrorKind::Thrown, 3, 3));
+    assert_eq!(e.message, "ReferenceError: nope is not defined");
+    let e = fail("function f() {\n  throw new TypeError('bad');\n}\nf();");
+    assert_eq!((e.line, e.column), (2, 3));
+    assert_eq!(e.message, "TypeError: bad");
+    let e = fail("var x = ;");
+    assert_eq!((e.kind, e.line), (RunErrorKind::Syntax, 1));
+    let e = fail("throw 42");
+    assert_eq!(e.message, "42");
+}
+
+#[test]
+fn host_functions_receive_arguments_and_return_values() {
+    let mut realm = Realm::new();
+    realm.define_function("add", |args| match args {
+        [JsValue::Number(a), JsValue::Number(b)] => Ok(JsValue::Number(a + b)),
+        _ => Err("add takes two numbers".into()),
+    });
+    assert_eq!(realm.run("add(2, 3)"), Ok(JsValue::Number(5.0)));
+    let e = realm.run("add('x')").unwrap_err();
+    assert_eq!(e.message, "Error: add takes two numbers");
+    assert_eq!(realm.run("try { add(); } catch (e) { e.message }"), Ok(JsValue::String("add takes two numbers".into())));
+    assert_eq!(realm.run("var kept = 1; 'next'"), Ok(JsValue::String("next".into())));
+    assert_eq!(realm.run("kept"), Ok(JsValue::Number(1.0)), "a realm keeps its globals between runs");
+}
+
+// ---- limits ----
+
+fn limit(realm: &mut Realm, src: &str) -> LimitKind {
+    match realm.run(src) {
+        Err(RunError { kind: RunErrorKind::Limit(k), .. }) => k,
+        other => panic!("{src}: {other:?}"),
+    }
+}
+
+fn with_big(limits: Limits) -> Realm {
+    let mut realm = small(limits);
+    realm.define_function("big", |args| match args {
+        [JsValue::Number(n)] => Ok(JsValue::String("x".repeat(*n as usize))),
+        _ => Err("big takes a length".into()),
+    });
+    realm.define_function("fail", |args| match args {
+        [JsValue::Number(n)] => Err("x".repeat(*n as usize)),
+        _ => Err("fail takes a length".into()),
+    });
+    realm
+}
+
+#[test]
+fn error_messages_from_host_functions_count_toward_the_heap() {
+    let limits = Limits { heap_bytes: 1 << 20, fuel: 100_000, ..Limits::default() };
+    let mut realm = with_big(limits.clone());
+    assert_eq!(realm.run("try { fail(1000); } catch (e) { e.message.length }"), Ok(JsValue::Number(1000.0)));
+    assert_eq!(limit(&mut with_big(limits.clone()), "try { fail(1000000); } catch (e) {}"), LimitKind::Heap);
+    assert_eq!(limit(&mut with_big(limits), "var a = []; for (var i = 0; ; i++) try { fail(100000); } catch (e) { a[i] = e; }"), LimitKind::Heap);
+}
+
+#[test]
+fn names_from_source_count_toward_the_heap_when_they_are_bound() {
+    // Without a collection in between, the estimate grows by at least each new name's code units:
+    // a global variable (an object property), a binding made by direct eval, and a parameter of a
+    // function made by the Function constructor.
+    // Each case runs in a new realm, so the charges for the code itself do not add up to a
+    // collection.
+    let name = "n".repeat(50_000);
+    let cases = [
+        format!("var {name} = 1;"),
+        format!("(function () {{ eval('var {name}2 = 1; {name}2'); }})();"),
+        format!("Function('{name}3', 'return {name}3')(1);"),
+    ];
+    let mut short = Vec::new();
+    for (i, src) in cases.iter().enumerate() {
+        let mut realm = small(Limits::default());
+        let collections = realm.interp().heap.collections;
+        let before = realm.interp().heap.bytes;
+        realm.run(src).unwrap();
+        assert_eq!(realm.interp().heap.collections, collections, "a collection ran in case {i}");
+        let grown = realm.interp().heap.bytes - before;
+        if grown < crate::heap::string_bytes(50_000) {
+            short.push((i, grown));
+        }
+    }
+    assert!(short.is_empty(), "cases that grew by less than the name: {short:?}");
+}
+
+#[test]
+fn strings_from_host_functions_count_toward_the_heap() {
+    let limits = Limits { heap_bytes: 1 << 20, fuel: 100_000, ..Limits::default() };
+    let mut realm = with_big(limits.clone());
+    assert_eq!(realm.run("big(1000).length"), Ok(JsValue::Number(1000.0)));
+    assert_eq!(realm.run("var a = []; for (var i = 0; i < 4; i++) a[i] = big(50000); a[3].length"), Ok(JsValue::Number(50000.0)));
+    assert_eq!(limit(&mut with_big(limits.clone()), "var a = []; for (var i = 0; ; i++) a[i] = big(100000);"), LimitKind::Heap);
+    assert_eq!(limit(&mut with_big(limits), "big(1000000).length"), LimitKind::Heap);
+}
+
+#[test]
+fn functions_kept_across_runs_count_their_code_toward_the_heap() {
+    // Each run keeps a function whose source holds a 64 Ki-unit comment, and drops the string the
+    // source was made from. The kept code fills the heap after a few runs.
+    let limits = Limits { heap_bytes: 1 << 20, ..Limits::default() };
+    let mut realm = small(limits);
+    assert_eq!(realm.run("var keep = []; keep.length"), Ok(JsValue::Number(0.0)));
+    let step = "var s = 'x'; for (var i = 0; i < 16; i++) s += s; keep[keep.length] = Function('/*' + s + '*/'); s = null; keep.length";
+    let mut ended = None;
+    for run in 1..=20 {
+        match realm.run(step) {
+            Ok(v) => assert_eq!(v, JsValue::Number(f64::from(run))),
+            Err(RunError { kind: RunErrorKind::Limit(k), .. }) => {
+                ended = Some((run, k));
+                break;
+            }
+            Err(e) => panic!("run {run}: {e:?}"),
+        }
+    }
+    let Some((run, kind)) = ended else { panic!("20 kept functions fit in a 1 MiB heap") };
+    assert_eq!(kind, LimitKind::Heap);
+    assert!(run > 2, "the heap filled on run {run}");
+}
+
+#[test]
+fn function_source_text_counts_toward_the_heap() {
+    let limits = Limits { heap_bytes: 1 << 20, ..Limits::default() };
+    let comment = "x".repeat(300_000);
+    let src = format!("var f = function () {{ /*{comment}*/ }}; f.toString().length");
+    assert_eq!(limit(&mut small(limits.clone()), &src), LimitKind::Heap);
+    let mut realm = small(limits);
+    assert_eq!(realm.run("(function f(a) { return a; }).toString()"), Ok(JsValue::String("function f(a) { return a; }".into())));
+}
+
+#[test]
+fn for_in_names_take_fuel_and_heap_under_later_limits() {
+    // The first run, under the default limits, builds an object with many properties. Later runs
+    // with smaller limits list its names only within their own fuel and heap.
+    let mut realm = small(Limits::default());
+    assert_eq!(realm.run("var o = {}; for (var i = 0; i < 100000; i++) o['k' + i] = i; o.k99999"), Ok(JsValue::Number(99999.0)));
+    realm.set_limits(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "for (var k in o) break;"), LimitKind::Fuel);
+    realm.set_limits(Limits::default());
+    assert_eq!(realm.run("var n = 0; for (var k in o) n++; n"), Ok(JsValue::Number(100_000.0)));
+    realm.interp().collect_garbage();
+    let live = realm.interp().heap.bytes;
+    // The list of names takes more than 3 MB (at least 32 + 2 * 2 bytes each), so 1 MiB more than
+    // the live heap holds the object but not the list.
+    let heap_bytes = live + (1 << 20);
+    realm.set_limits(Limits { heap_bytes, ..Limits::default() });
+    assert_eq!(realm.run("o.k0"), Ok(JsValue::Number(0.0)));
+    assert_eq!(limit(&mut realm, "for (var k in o) break;"), LimitKind::Heap);
+    // The run ends before the list is made, so the estimate stays within the limit.
+    assert!(realm.interp().heap.bytes <= heap_bytes, "{} > {heap_bytes}", realm.interp().heap.bytes);
+}
+
+#[test]
+fn shrinking_an_array_takes_fuel_for_each_property() {
+    let mut realm = small(Limits::default());
+    assert_eq!(realm.run("var a = []; for (var i = 0; i < 100000; i++) a[i] = i; a.length"), Ok(JsValue::Number(100_000.0)));
+    realm.set_limits(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "a.length = 0;"), LimitKind::Fuel);
+    realm.set_limits(Limits::default());
+    // The run stopped before anything was removed.
+    assert_eq!(realm.run("a.length + a[99999]"), Ok(JsValue::Number(199_999.0)));
+    assert_eq!(realm.run("a.length = 1; a.length + a[0] + (99999 in a ? 1 : 0)"), Ok(JsValue::Number(1.0)));
+}
+
+#[test]
+fn apply_takes_fuel_for_each_argument_it_reads() {
+    let mut realm = small(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "(function () {}).apply(null, {length: 65536});"), LimitKind::Fuel);
+    assert_eq!(realm.run("(function () { return arguments.length; }).apply(null, {length: 100})"), Ok(JsValue::Number(100.0)));
+}
+
+#[test]
+fn declarations_check_the_heap_before_they_are_bound() {
+    // Each script declares more than fits in the heap. The run ends with the heap limit before
+    // the bindings are made, so the estimate never goes past the limit.
+    // Short names keep the source strings well inside the heap while the bindings are not.
+    let limits = Limits { heap_bytes: 2 << 20, ..Limits::default() };
+    let short = |mut i: usize| {
+        let mut name = String::from("_");
+        loop {
+            name.push(char::from(b'a' + (i % 26) as u8));
+            i /= 26;
+            if i == 0 {
+                return name;
+            }
+        }
+    };
+    let vars = (0..40_000).map(short).collect::<Vec<_>>().join(",");
+    let funs = (0..20_000).map(|i| format!("function f{i}() {{}}")).collect::<String>();
+    let cases = [
+        format!("var {vars};"),
+        funs.clone(),
+        format!("(function () {{ eval('var {vars};'); }})();"),
+        format!("(function () {{ eval('{funs}'); }})();"),
+        format!("(0, eval)('\"use strict\"; var {vars};');"),
+        format!("Function('var {vars};')();"),
+        format!("Function('{funs}')();"),
+    ];
+    let mut wrong = Vec::new();
+    for (i, src) in cases.iter().enumerate() {
+        let mut realm = small(limits.clone());
+        let r = realm.run(src).map_err(|e| e.kind);
+        let bytes = realm.interp().heap.bytes;
+        if r != Err(RunErrorKind::Limit(LimitKind::Heap)) || bytes > limits.heap_bytes {
+            wrong.push((i, r, bytes));
+        }
+    }
+    assert!(wrong.is_empty(), "cases that bound past the limit: {wrong:?}");
+    let few = (0..1000).map(|i| format!("b{i}")).collect::<Vec<_>>().join(",");
+    let mut realm = small(limits);
+    assert_eq!(realm.run(&format!("var {few}; b999 = 1; Function('var {few}; return 2')() + b999")), Ok(JsValue::Number(3.0)));
+}
+
+#[test]
+fn declarations_take_fuel() {
+    let vars = (0..10_000).map(|i| format!("a{i}")).collect::<Vec<_>>().join(",");
+    let mut realm = small(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, &format!("var {vars};")), LimitKind::Fuel);
+    assert_eq!(limit(&mut realm, &format!("Function('var {vars};')();")), LimitKind::Fuel);
+}
+
+#[test]
+fn a_lower_heap_limit_applies_to_what_is_already_live() {
+    // A heap already past the new limit ends the next run.
+    let mut realm = small(Limits::default());
+    realm.run("var keep = []; for (var i = 0; i < 100000; i++) keep[i] = {i: i};").unwrap();
+    realm.set_limits(Limits { heap_bytes: 1 << 20, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "for (var j = 0; j < 1000; j++) ({j: j});"), LimitKind::Heap);
+    realm.set_limits(Limits::default());
+    realm.run("keep = null;").unwrap();
+    realm.set_limits(Limits { heap_bytes: 1 << 20, ..Limits::default() });
+    assert_eq!(realm.run("for (var j = 0; j < 1000; j++) ({j: j}); j"), Ok(JsValue::Number(1000.0)));
+    // A heap below the new limit cannot grow past it: the next collection runs by the new limit,
+    // not by when it would have run under the old, higher one.
+    let mut realm = small(Limits::default());
+    realm.run("var keep = []; for (var i = 0; i < 100000; i++) keep[i] = {i: i};").unwrap();
+    let live = realm.collect_garbage();
+    realm.set_limits(Limits { heap_bytes: live + (1 << 20), ..Limits::default() });
+    assert_eq!(limit(&mut realm, "var more = []; for (var j = 0; j < 20000; j++) more[j] = {j: j};"), LimitKind::Heap);
+}
+
+#[test]
+fn apply_keeps_its_arguments_alive_while_a_native_function_runs() {
+    // The first argument's toString makes 20,000 objects, more than a 1 MiB heap holds, so a
+    // collection runs before it returns. The second argument is reachable only from the list
+    // that apply read from the array-like object.
+    let mut realm = small(Limits { heap_bytes: 1 << 20, ..Limits::default() });
+    let src = "var list = {length: 2, \
+        get 0() { return {toString: function () { for (var i = 0; i < 20000; i++) ({i: i}); return 'a'; }}; }, \
+        get 1() { return {toString: function () { return 'return a * 2'; }}; }}; \
+        Function.apply(null, list)(21)";
+    assert_eq!(realm.run(src), Ok(JsValue::Number(42.0)));
+}
+
+#[test]
+fn to_number_skips_the_white_space_the_lexer_skips() {
+    let mut realm = small(Limits::default());
+    assert_eq!(realm.run("var n = +'\\u180E'; n !== n"), Ok(JsValue::Bool(true)), "U+180E is not white space");
+    assert_eq!(realm.run("var m = +'\\u180E1'; m !== m"), Ok(JsValue::Bool(true)));
+    assert_eq!(realm.run("+' \\t\\n\\u2028\\u3000\\uFEFF 1 \\u00A0'"), Ok(JsValue::Number(1.0)));
+    assert_eq!(realm.run("+'   1 '"), Ok(JsValue::Number(1.0)));
+}
+
+#[test]
+fn an_infinite_loop_ends_with_the_fuel_limit() {
+    let mut realm = small(Limits { fuel: 100_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "for (;;) {}"), LimitKind::Fuel);
+    assert_eq!(limit(&mut realm, "while (true) { try { for (;;) {} } catch (e) {} }"), LimitKind::Fuel);
+    assert_eq!(limit(&mut realm, "var n = 0; try { for (;;) {} } finally { n = 1; } "), LimitKind::Fuel);
+    assert_eq!(
+        limit(&mut realm, "function f() { try { for (;;) {} } finally { for (;;) {} } } while (true) { try { f(); } catch (e) {} }"),
+        LimitKind::Fuel
+    );
+    assert_eq!(realm.run("n"), Ok(JsValue::Number(0.0)), "the finally block did not run");
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)), "each run gets fresh fuel");
+}
+
+#[test]
+fn deep_recursion_ends_with_the_frame_limit_on_a_small_stack() {
+    let handle = std::thread::Builder::new()
+        .stack_size(256 << 10)
+        .spawn(|| {
+            let mut realm = Realm::new();
+            let r = realm.run("function f(n) { return n === 0 ? 0 : 1 + f(n - 1); } f(1000000)");
+            let ok = realm.run("function g(n) { return n === 0 ? 0 : 1 + g(n - 1); } g(5000)");
+            let caught = realm.run("function h(n) { try { return h(n + 1); } catch (e) { return -1; } } h(0)");
+            (r, ok, caught)
+        })
+        .unwrap();
+    let (r, ok, caught) = handle.join().unwrap();
+    assert_eq!(r.map_err(|e| e.kind), Err(RunErrorKind::Limit(LimitKind::Frames)));
+    assert_eq!(ok, Ok(JsValue::Number(5000.0)));
+    assert_eq!(caught.map_err(|e| e.kind), Err(RunErrorKind::Limit(LimitKind::Frames)), "catch cannot swallow the frame limit");
+}
+
+#[test]
+fn reentry_through_getters_ends_with_the_reentry_limit() {
+    let handle = std::thread::Builder::new()
+        .stack_size(8 << 20)
+        .spawn(|| {
+            let mut realm = Realm::new();
+            let getter = realm.run("var o = { get x() { return this.x; } }; o.x");
+            let conversion = realm.run("var v = { valueOf: function() { return v * 1; } }; v * 1");
+            let eval = realm.run("function e() { return (0, eval)('e()'); } e()");
+            (getter, conversion, eval)
+        })
+        .unwrap();
+    let (getter, conversion, eval) = handle.join().unwrap();
+    for r in [getter, conversion, eval] {
+        assert_eq!(r.map_err(|e| e.kind), Err(RunErrorKind::Limit(LimitKind::Reentry)));
+    }
+}
+
+#[test]
+fn the_script_itself_does_not_count_against_the_reentry_limit() {
+    let mut realm = small(Limits { reentry: 0, ..Limits::default() });
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)));
+    assert_eq!(limit(&mut realm, "var o = { get x() { return 1; } }; o.x"), LimitKind::Reentry);
+    realm.set_limits(Limits { reentry: 1, ..Limits::default() });
+    assert_eq!(realm.run("o.x"), Ok(JsValue::Number(1.0)));
+    assert_eq!(realm.run("(0, eval)('2 + 2')"), Ok(JsValue::Number(4.0)));
+    assert_eq!(limit(&mut realm, "var p = { get x() { return o.x; } }; p.x"), LimitKind::Reentry);
+}
+
+#[test]
+fn memory_bombs_end_with_the_heap_limit() {
+    let limits = Limits { heap_bytes: 4 << 20, ..Limits::default() };
+    for src in [
+        "var a = null; for (;;) a = {next: a, v: [a, a]};",
+        "var s = 'x'; for (;;) s = s + s;",
+        "var a = []; for (var i = 0; ; i++) a[i] = 'item' + i;",
+        "var s = 'x'; for (;;) { s = s + s; var o = {}; o[s] = 1; }",
+    ] {
+        let mut realm = small(limits.clone());
+        assert_eq!(limit(&mut realm, src), LimitKind::Heap, "{src}");
+        // What the bomb built is still reachable from the globals; raising the limit lets the
+        // realm drop it.
+        realm.set_limits(Limits::default());
+        assert_eq!(realm.run("a = s = null; 1"), Ok(JsValue::Number(1.0)));
+        realm.set_limits(limits.clone());
+        assert_eq!(realm.run("2"), Ok(JsValue::Number(2.0)));
+    }
+}
+
+#[test]
+fn garbage_is_collected_cycles_included() {
+    let mut realm = small(Limits { heap_bytes: 2 << 20, ..Limits::default() });
+    let src = "for (var i = 0; i < 200000; i++) { var a = {}, b = {a: a, s: 'x' + i}; a.b = b; } i";
+    assert_eq!(realm.run(src), Ok(JsValue::Number(200_000.0)));
+    assert!(realm.interp().heap.collections > 0);
+    let before = realm.collect_garbage();
+    realm.run("var keep = []; for (var j = 0; j < 1000; j++) keep[j] = {j: j};").unwrap();
+    let live = realm.collect_garbage();
+    realm.run("keep = null;").unwrap();
+    let after = realm.collect_garbage();
+    assert!(live > before && after < live, "{before} {live} {after}");
+    let cells = realm.interp().heap.live_cells();
+    assert!(cells < 200, "{cells} cells are still live");
+}
+
+#[test]
+fn a_million_appends_flatten_without_recursion() {
+    let handle = std::thread::Builder::new()
+        .stack_size(1 << 20)
+        .spawn(|| {
+            let mut realm = Realm::new();
+            realm.run("var s = '', t = ''; for (var i = 0; i < 1000000; i++) { s += 'ab'; t = t + 'ab'; } s.length === 2000000 && s === t && s[1999999] === 'b'")
+        })
+        .unwrap();
+    assert_eq!(handle.join().unwrap(), Ok(JsValue::Bool(true)));
+}
+
+#[test]
+fn the_interrupt_flag_stops_a_run() {
+    let mut realm = Realm::new();
+    let flag = realm.interrupt();
+    flag.set();
+    assert_eq!(limit(&mut realm, "1 + 1"), LimitKind::Interrupted);
+    flag.clear();
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)));
+    let from_host = realm.interrupt();
+    realm.define_function("stop", move |_| {
+        from_host.set();
+        Ok(JsValue::Undefined)
+    });
+    assert_eq!(limit(&mut realm, "for (var i = 0; ; i++) { if (i === 1000) stop(); }"), LimitKind::Interrupted);
+    assert!(flag.is_set());
+    assert_eq!(limit(&mut realm, "i"), LimitKind::Interrupted, "the flag stays set");
+    flag.clear();
+    assert_eq!(realm.run("i"), Ok(JsValue::Number(1000.0)));
+}
+
+#[test]
+fn eval_and_function_source_counts_against_the_source_limit() {
+    let mut realm = Realm::with_options(Options { max_source_units: 200, ..Options::default() }, Limits::default());
+    assert_eq!(realm.run("eval('1 + 1')"), Ok(JsValue::Number(2.0)));
+    let e = realm.run("var s = 'x'; for (var i = 0; i < 8; i++) s += s; eval(s)").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "{e:?}");
+    let e = realm.run("for (var i = 0; i < 20; i++) eval('1 + 1 + 1 + 1 + 1 + 1 + 1 + 1');").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "the sources of one run count together: {e:?}");
+    let e = realm.run("Function('return 1;' + '                                                                                                                                                                                                       ')").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "{e:?}");
+}
+
+#[test]
+fn the_function_constructor_checks_the_source_limit_before_reading_its_arguments() {
+    // A rope argument that is too long is refused before it is flattened.
+    let mut realm = Realm::with_options(Options { max_source_units: 1000, ..Options::default() }, Limits::default());
+    let e = realm.run("var s = 'return 1;'; for (var i = 0; i < 12; i++) s += s; Function('a', s)").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "{e:?}");
+    let interp = realm.interp();
+    match interp.find_property(interp.global, &crate::heap::key("s")) {
+        Ok(Some(crate::heap::Prop::Data { value: crate::value::Value::String(s), .. })) => assert!(s.is_rope(), "the argument was flattened"),
+        other => panic!("{other:?}"),
+    }
+    // The source is read as code units, so a lone surrogate in an argument is kept.
+    let mut realm = Realm::new();
+    assert_eq!(realm.run("Function('return \"\\ud800\"')() === '\\ud800'"), Ok(JsValue::Bool(true)));
+}
+
+#[test]
+fn a_script_longer_than_the_source_limit_is_a_syntax_error() {
+    let mut realm = Realm::with_options(Options { max_source_units: 10, ..Options::default() }, Limits::default());
+    let e = realm.run("1 + 2 + 3 + 4").unwrap_err();
+    assert_eq!((&e.kind, e.message.contains(crate::TOO_LONG)), (&RunErrorKind::Syntax, true), "{e:?}");
+    // Ten UTF-16 code units in 18 bytes of UTF-8 fit.
+    assert_eq!(realm.run("'\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}'"), Ok(JsValue::String("\u{e9}".repeat(8))));
+    let mut realm = Realm::with_options(Options { max_source_units: 40, ..Options::default() }, Limits::default());
+    let e = realm.run("Function('return 1;')").unwrap_err();
+    assert_eq!((&e.kind, e.message.contains(crate::TOO_LONG)), (&RunErrorKind::Thrown, true), "{e:?}");
+}
+
+#[test]
+fn bind_last_thrown_binds_undefined_after_a_run_that_did_not_throw() {
+    let mut realm = Realm::new();
+    assert_eq!(realm.run("throw 'first'").map_err(|e| e.kind), Err(RunErrorKind::Thrown));
+    realm.bind_last_thrown("caught");
+    assert_eq!(realm.run("caught"), Ok(JsValue::String("first".into())));
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)));
+    realm.bind_last_thrown("caught");
+    assert_eq!(realm.run("caught"), Ok(JsValue::Undefined));
+    let _ = realm.run("throw 'second'");
+    assert_eq!(realm.run("var").map_err(|e| e.kind), Err(RunErrorKind::Syntax));
+    realm.bind_last_thrown("caught");
+    assert_eq!(realm.run("caught"), Ok(JsValue::Undefined), "a run that does not parse throws nothing");
+    realm.set_limits(Limits { fuel: 100, ..Limits::default() });
+    let _ = realm.run("throw 'third'");
+    assert_eq!(limit(&mut realm, "for (;;) {}"), LimitKind::Fuel);
+    realm.bind_last_thrown("caught");
+    realm.set_limits(Limits::default());
+    assert_eq!(realm.run("caught"), Ok(JsValue::Undefined), "a run that reached a limit threw nothing");
+}
+
+#[test]
+fn a_strict_realm_runs_scripts_as_strict_mode_code() {
+    let mut realm = Realm::with_options(Options { strict: true, ..Options::default() }, Limits::default());
+    assert_eq!(realm.run("with ({}) {}").map_err(|e| e.kind), Err(RunErrorKind::Syntax));
+    assert_eq!(realm.run("(function () { return this; })()"), Ok(JsValue::Undefined));
+    assert_eq!(realm.run("(function () { return typeof this; })()"), Ok(JsValue::String("undefined".into())));
+    let mut realm = Realm::new();
+    assert_eq!(realm.run("with ({}) {} 1"), Ok(JsValue::Number(1.0)));
+    assert_eq!(realm.run("(function () { return typeof this; })()"), Ok(JsValue::String("object".into())));
+}
+
+#[test]
+fn an_apply_that_throws_while_reading_its_arguments_keeps_nothing_alive() {
+    // Each call reads a fresh array at index 0 before index 1 throws; the arrays must not stay
+    // reachable after the call ends.
+    let mut realm = small(Limits { heap_bytes: 2 << 20, ..Limits::default() });
+    let src = "function f() {} var caught = 0; \
+        var list = {length: 2, get 0() { var a = []; for (var k = 0; k < 100; k++) a[k] = k; return a; }, get 1() { throw 'stop'; }}; \
+        for (var i = 0; i < 5000; i++) { try { f.apply(null, list); } catch (e) { caught++; } } caught";
+    assert_eq!(realm.run(src), Ok(JsValue::Number(5000.0)));
+}
+
+#[test]
+fn for_in_over_a_long_string_checks_the_heap_before_listing_its_indices() {
+    // The string fits in the heap and its 131,072 index names do not. The fuel runs out partway
+    // through listing them, so only the check before the listing ends the run with the heap limit.
+    let mut realm = small(Limits { heap_bytes: 1 << 20, fuel: 50_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "var s = 'x'; while (s.length < 100000) s += s; for (var k in s) {}"), LimitKind::Heap);
+    assert_eq!(realm.run("var n = ''; for (var k in 'abc') n += k; n"), Ok(JsValue::String("012".into())));
+}
+
+#[test]
+fn long_property_names_count_toward_the_heap_after_their_strings_are_collected() {
+    // Each name is a 16,385-unit buffer that only the object's key or the function's binding
+    // holds once the string that made it is garbage, so about 32 of them fill the heap well before
+    // the fuel runs out. In the second script the property lookup flattens a long string each
+    // time, so collections run.
+    let mut realm = small(Limits { heap_bytes: 1 << 20, fuel: 20_000, ..Limits::default() });
+    let src = "var s = 'x'; while (s.length < 10000) s += s; var o = {}; for (var i = 0; ; i++) o[s + i] = 1;";
+    assert_eq!(limit(&mut realm, src), LimitKind::Heap);
+    let src = "var s = 'x'; while (s.length < 10000) s += s; \
+        (function () { for (var i = 0; ; i++) { eval('var ' + s + i + ' = 1'); ({})[s + i]; } })();";
+    let mut realm = small(Limits { heap_bytes: 1 << 20, fuel: 20_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, src), LimitKind::Heap);
+}
+
+#[test]
+fn for_in_over_a_long_string_takes_fuel_for_each_index() {
+    let mut realm = small(Limits { fuel: 10_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "var s = 'x'; while (s.length < 100000) s += s; for (var k in s) break;"), LimitKind::Fuel);
+}
+
+#[test]
+fn wasm_builds_have_smaller_default_limits() {
+    let limits = Limits::default();
+    #[cfg(target_arch = "wasm32")]
+    assert_eq!(limits, Limits { fuel: 250_000_000, heap_bytes: 128 << 20, frames: 2_000, reentry: 16 });
+    #[cfg(not(target_arch = "wasm32"))]
+    assert_eq!(limits, Limits { fuel: 1_000_000_000, heap_bytes: 512 << 20, frames: 10_000, reentry: 32 });
+}
+
+#[test]
+fn deep_nesting_compiles_on_a_small_stack() {
+    let n = crate::DEFAULT_MAX_DEPTH - 5;
+    let cases = [
+        format!("x = {}1{};", "[".repeat(n), "]".repeat(n)),
+        format!("x = {}1{};", "{a:".repeat(n), "}".repeat(n)),
+        format!("{}{}", "function f(){".repeat(n), "}".repeat(n)),
+        format!("{}x = 1;", "if (1) ".repeat(n)),
+        format!("x = {}1;", "1 ? 1 : ".repeat(n)),
+        format!("x = 0; {}x++;{}", "while (x < 1) { try { ".repeat(n / 2), " } finally { } }".repeat(n / 2)),
+    ];
+    let handle = std::thread::Builder::new()
+        .stack_size(1 << 20)
+        .spawn(move || cases.iter().map(|src| Realm::new().run(src).map(|_| ()).map_err(|e| e.kind)).collect::<Vec<_>>())
+        .unwrap();
+    for r in handle.join().unwrap() {
+        assert!(r.is_ok() || r == Err(RunErrorKind::Syntax), "{r:?}");
+    }
+    let long = [
+        format!("x = 1{};", " + 1".repeat(100_000)),
+        format!("{}x = 1;", "a = ".repeat(100_000)),
+        format!("x = {{}}; x.y = x; x{};", ".y".repeat(100_000)),
+    ];
+    for src in &long {
+        Realm::new().run(src).unwrap();
+    }
+    assert_eq!(num(&format!("var a; {}1; a", "a = ".repeat(100_000))), 1.0);
+    assert_eq!(num(&format!("x = 1{}", " + 1".repeat(100_000))), 100_001.0);
+}
+
+// ---- the verifier ----
+
+fn code(ops: Vec<Op>) -> Code {
+    let source = Rc::new(Source { lines: crate::LineTable::new(&[]), text: Rc::from(Vec::<u16>::new()) });
+    Code {
+        positions: vec![0; ops.len()],
+        ops,
+        numbers: vec![1.0],
+        strings: Vec::new(),
+        names: Vec::new(),
+        functions: Vec::new(),
+        regexps: Vec::new(),
+        handlers: Vec::new(),
+        finally_tables: Vec::new(),
+        max_stack: 0,
+        strict: false,
+        self_name: None,
+        params: Vec::new(),
+        vars: Vec::new(),
+        fun_decls: Vec::new(),
+        uses_arguments: false,
+        source,
+        span: (0, 0),
+    }
+}
+
+#[test]
+fn the_verifier_rejects_bad_bytecode() {
+    assert_eq!(verify(&code(vec![Op::Number(0), Op::Return])), Ok(1));
+    let bad: Vec<(Vec<Op>, &str)> = vec![
+        (vec![Op::Jump(9)], "past the end"),
+        (vec![Op::Pop, Op::Undefined, Op::Return], "pops below"),
+        (vec![Op::Number(5), Op::Return], "number 5 out of range"),
+        (vec![Op::GetVar(0), Op::Return], "name 0 out of range"),
+        (vec![Op::Closure(0), Op::Return], "function 0 out of range"),
+        (vec![Op::Undefined], "past its last instruction"),
+        (vec![Op::True, Op::JumpIfFalse(3), Op::Undefined, Op::Undefined, Op::Return], "depths"),
+        (vec![Op::Undefined, Op::Undefined, Op::EndFinally(0)], "finally table 0"),
+        (vec![], "no instructions"),
+    ];
+    for (ops, want) in bad {
+        let e = verify(&code(ops.clone())).unwrap_err();
+        assert!(e.contains(want), "{ops:?}: {e}");
+    }
+    let mut c = code(vec![Op::Undefined, Op::Return]);
+    c.handlers.push(Handler { start: 0, end: 5, target: 0, depth: 0, env_depth: 0 });
+    assert!(verify(&c).unwrap_err().contains("handler range"));
+}
+
+#[test]
+fn every_compiled_function_passes_the_verifier() {
+    // Each code is verified as it is compiled; a failure would surface as an internal error.
+    let src = "function f(a) { try { for (var k in a) { switch (k) { case 'x': continue; default: break; } } } catch (e) { return e; } finally { a = 0; } \
+               with (a) { lbl: do { if (b) break lbl; } while (0); } return function() { return arguments; }; } 1";
+    assert_eq!(run(src), JsValue::Number(1.0));
+}
+
+// ---- robustness ----
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(256))]
+
+    #[test]
+    fn arbitrary_fragment_programs_never_panic(parts in proptest::collection::vec(0..crate::tests::FRAGMENTS.len(), 0..60)) {
+        let src: String = parts.iter().map(|&i| crate::tests::FRAGMENTS[i]).collect();
+        let mut realm = small(Limits { fuel: 20_000, heap_bytes: 1 << 20, frames: 200, reentry: 8 });
+        if let Err(e) = realm.run(&src) {
+            prop_assert!(e.kind != RunErrorKind::Internal, "{src:?}: {e:?}");
+        }
+    }
+
+    #[test]
+    fn arbitrary_text_never_panics(src in ".{0,120}") {
+        let mut realm = small(Limits { fuel: 20_000, heap_bytes: 1 << 20, frames: 200, reentry: 8 });
+        if let Err(e) = realm.run(&src) {
+            prop_assert!(e.kind != RunErrorKind::Internal, "{src:?}: {e:?}");
+        }
+    }
+}
diff --git a/crates/js/src/lexer.rs b/crates/js/src/lexer.rs
index 9b16b16c7..8b82570a7 100644
--- a/crates/js/src/lexer.rs
+++ b/crates/js/src/lexer.rs
@@ -13,7 +13,7 @@
 //!
 //! The lexer moves forward through the source one character at a time and never recurses.
 
-use crate::chars::{hex_value, is_decimal_digit, is_id_part, is_id_start, is_line_terminator, is_octal_digit, is_whitespace};
+use crate::chars::{hex_value, is_decimal_digit, is_id_part, is_id_start, is_line_terminator, is_octal_digit, is_whitespace, radix_value};
 use crate::error::SyntaxError;
 use crate::regexp;
 use crate::token::{Directive, DirectiveName, Keyword, Punct, Span, Token, TokenKind};
@@ -352,26 +352,10 @@ impl<'s> Lexer<'s> {
     /// Reads digits in `radix` (8 or 16) and returns their value, or `None` when there are none.
     fn radix_digits(&mut self, radix: u32) -> Option<f64> {
         let begin = self.pos;
-        let mut exact: u128 = 0;
-        let mut value = 0.0_f64;
-        let mut overflow = false;
-        while let Some(d) = self.peek().and_then(hex_value).filter(|&d| d < radix) {
-            match exact.checked_mul(u128::from(radix)).and_then(|v| v.checked_add(u128::from(d))) {
-                Some(v) if !overflow => exact = v,
-                _ => {
-                    if !overflow {
-                        value = exact as f64;
-                        overflow = true;
-                    }
-                    value = value * f64::from(radix) + f64::from(d);
-                }
-            }
+        while self.peek().and_then(hex_value).is_some_and(|d| d < radix) {
             self.pos += 1;
         }
-        if self.pos == begin {
-            return None;
-        }
-        Some(if overflow { value } else { exact as f64 })
+        radix_value(self.src[begin..self.pos].iter().filter_map(|&u| hex_value(u32::from(u))), radix)
     }
 
     /// After `0` and a digit: an octal literal when every digit is octal, else a decimal literal
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 4d8d32271..9c0c192aa 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -18,16 +18,34 @@
 //! `SyntaxError` ("nesting too deep") instead of exhausting the stack, binary operators, `if` …
 //! `else if` chains, labels and prefix operators are read with loops, and the syntax tree is
 //! dropped without recursion.
+//!
+//! A [`Realm`] runs scripts. It compiles the syntax tree to bytecode, checks the bytecode with a
+//! verifier, and runs it on an interpreter that keeps JavaScript calls on its own frame stack, so
+//! deep recursion in a script does not use the native stack. Objects and environments live in an
+//! arena with a mark-and-sweep collector; strings built by repeated `+` are flattened and dropped
+//! with loops. The realm provides the language (sections 10 to 14 of ECMA-262 5.1) and a minimal
+//! set of built-ins: `Object` and `Object.prototype`'s basic methods, `Function` with
+//! `Function.prototype.call` and `apply`, `eval`, and the error constructors. Every run is bounded
+//! by [`Limits`]: instructions run (fuel), heap bytes, frames, nested host calls, and an
+//! [`Interrupt`] flag another thread can set. A run that reaches a limit ends with
+//! [`RunErrorKind::Limit`], which a script's `try` cannot catch.
 #![forbid(unsafe_code)]
 
 pub mod ast;
+mod builtins;
+mod bytecode;
 mod chars;
+mod compiler;
 mod error;
+mod heap;
+mod interp;
 mod lexer;
 mod number;
 mod parser;
+mod realm;
 mod regexp;
 mod token;
+mod value;
 
 pub use ast::{
     AssignOp, Ast, BinaryOp, CatchClause, Expr, ExprId, ForInTarget, ForInit, Function, FunctionId, FunctionKind, LogicalOp, Name, Program, Property,
@@ -36,6 +54,7 @@ pub use ast::{
 pub use error::{SyntaxError, TOO_DEEP, TOO_LONG};
 pub use lexer::{Goal, Lexer};
 pub use number::to_string as number_to_string;
+pub use realm::{Interrupt, JsValue, LimitKind, Limits, Realm, RunError, RunErrorKind};
 pub use token::{Directive, DirectiveName, Keyword, Punct, Span, Token, TokenKind};
 
 /// How a script is read.
@@ -136,6 +155,11 @@ impl LineTable {
         (u32::try_from(line).unwrap_or(u32::MAX), offset.saturating_sub(start) + 1)
     }
 
+    /// The estimated bytes the table holds.
+    pub(crate) fn heap_bytes(&self) -> usize {
+        32 + 4 * self.starts.len()
+    }
+
     pub(crate) fn line_count(&self) -> u32 {
         if self.empty {
             return 0;
@@ -145,5 +169,7 @@ impl LineTable {
     }
 }
 
+#[cfg(test)]
+mod interp_tests;
 #[cfg(test)]
 mod tests;
diff --git a/crates/js/src/realm.rs b/crates/js/src/realm.rs
new file mode 100644
index 000000000..29d3aacb2
--- /dev/null
+++ b/crates/js/src/realm.rs
@@ -0,0 +1,222 @@
+//! The embedding API: a [`Realm`] holds a global object and its built-ins, runs scripts in them,
+//! and enforces [`Limits`].
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use crate::bytecode::CodeKind;
+use crate::heap::{Func, HIDDEN, Object, Prop, key};
+use crate::interp::{Abrupt, CompileError, Interp};
+use crate::value::Value;
+use crate::{Options, SyntaxError};
+
+/// The limits a run is held to. Reaching one ends the run with [`RunErrorKind::Limit`]; scripts
+/// cannot catch it, and their `finally` blocks do not run.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Limits {
+    /// Instructions a run may execute.
+    pub fuel: u64,
+    /// Estimated bytes the heap (objects, environments and the strings they hold) may reach
+    /// after a collection. A string longer than a quarter of this many code units cannot be
+    /// made.
+    pub heap_bytes: usize,
+    /// Call frames that may be active at once.
+    pub frames: usize,
+    /// How deeply the interpreter may run again inside an operation (getters and setters,
+    /// conversions that call `valueOf` or `toString`, indirect `eval`).
+    pub reentry: usize,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Default for Limits {
+    fn default() -> Self {
+        Self { fuel: 1_000_000_000, heap_bytes: 512 << 20, frames: 10_000, reentry: 32 }
+    }
+}
+
+/// A wasm build has less memory and a smaller stack.
+#[cfg(target_arch = "wasm32")]
+impl Default for Limits {
+    fn default() -> Self {
+        Self { fuel: 250_000_000, heap_bytes: 128 << 20, frames: 2_000, reentry: 16 }
+    }
+}
+
+/// Which limit a run reached.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LimitKind {
+    Fuel,
+    Heap,
+    Frames,
+    Reentry,
+    /// The host set the interrupt flag.
+    Interrupted,
+}
+
+/// A flag the host sets, from any thread, to stop the running script at its next instruction.
+/// It stays set until [`Interrupt::clear`].
+#[derive(Clone, Debug)]
+pub struct Interrupt(Arc<AtomicBool>);
+
+impl Interrupt {
+    pub fn set(&self) {
+        self.0.store(true, Ordering::Relaxed);
+    }
+
+    pub fn clear(&self) {
+        self.0.store(false, Ordering::Relaxed);
+    }
+
+    pub fn is_set(&self) -> bool {
+        self.0.load(Ordering::Relaxed)
+    }
+}
+
+/// A value passed between a script and the host. An object is given by its class name.
+#[derive(Clone, Debug, PartialEq)]
+pub enum JsValue {
+    Undefined,
+    Null,
+    Bool(bool),
+    Number(f64),
+    String(String),
+    Object(String),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum RunErrorKind {
+    /// The source does not parse.
+    Syntax,
+    /// The script threw an exception it did not catch.
+    Thrown,
+    Limit(LimitKind),
+    /// The interpreter reached a state it never makes.
+    Internal,
+}
+
+/// Why a run did not complete. `line` and `column` count from 1 (the column in UTF-16 code units)
+/// and give where the error was raised; they are 0 when that is not known.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RunError {
+    pub kind: RunErrorKind,
+    pub message: String,
+    pub line: u32,
+    pub column: u32,
+}
+
+impl std::fmt::Display for RunError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{} (line {}, column {})", self.message, self.line, self.column)
+    }
+}
+
+impl std::error::Error for RunError {}
+
+impl From<SyntaxError> for RunError {
+    fn from(e: SyntaxError) -> Self {
+        RunError { kind: RunErrorKind::Syntax, message: e.to_string(), line: e.line, column: e.column }
+    }
+}
+
+/// A global environment with the built-ins, in which scripts run one after another.
+pub struct Realm {
+    interp: Interp,
+}
+
+impl Default for Realm {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Realm {
+    pub fn new() -> Self {
+        Self::with_options(Options::default(), Limits::default())
+    }
+
+    /// A realm whose scripts (and the source given to `eval` and `Function`) are read with
+    /// `options`; [`Options::max_source_units`] caps the source parsed in one run, all of it
+    /// counted together.
+    pub fn with_options(options: Options, limits: Limits) -> Self {
+        Self { interp: Interp::new(options, limits) }
+    }
+
+    pub fn limits(&self) -> &Limits {
+        &self.interp.limits
+    }
+
+    /// Sets the limits for the next run. A heap that is already larger than the new
+    /// [`Limits::heap_bytes`] ends the next run with the heap limit unless a collection frees
+    /// enough of it.
+    pub fn set_limits(&mut self, limits: Limits) {
+        self.interp.limits = limits;
+        self.interp.reset_gc_threshold();
+    }
+
+    /// The realm's interrupt flag. Setting it stops a running script, or the next one to start.
+    pub fn interrupt(&self) -> Interrupt {
+        Interrupt(self.interp.interrupt.clone())
+    }
+
+    /// Defines a global function that calls `f` with its arguments. An `Err` from `f` is thrown
+    /// to the script as an `Error` with that message.
+    pub fn define_function(&mut self, name: &str, f: impl Fn(&[JsValue]) -> Result<JsValue, String> + 'static) {
+        let interp = &mut self.interp;
+        let proto = interp.intrinsics.function_proto;
+        let func = Func::Host { f: std::rc::Rc::new(f), name: name.into() };
+        let o = interp.heap.alloc_object(Object::new(crate::heap::Class::Function(func), Some(proto)));
+        let global = interp.global;
+        let _ = interp.define(global, key(name), Prop::Data { value: Value::Object(o), flags: HIDDEN });
+    }
+
+    /// Runs `source` as a script in the global environment and returns its completion value (the
+    /// value of the last expression statement that ran).
+    pub fn run(&mut self, source: &str) -> Result<JsValue, RunError> {
+        let interp = &mut self.interp;
+        interp.fuel = interp.limits.fuel;
+        interp.source_units = 0;
+        interp.throw_site = None;
+        interp.last_thrown = Value::Undefined;
+        let strict = interp.options.strict;
+        let code = match interp.encode_source(source).and_then(|units| interp.compile_source(&units, strict, CodeKind::Global)) {
+            Ok(code) => code,
+            Err(CompileError::Syntax(e)) => return Err(e.into()),
+            Err(CompileError::Internal(m)) => return Err(RunError { kind: RunErrorKind::Internal, message: m, line: 0, column: 0 }),
+        };
+        let result = interp.run_global(code, false);
+        let (line, column) = interp.throw_site.take().map_or((0, 0), |(code, pc)| code.line_column(pc));
+        interp.stack.clear();
+        interp.frames.clear();
+        interp.temp_roots.clear();
+        match result {
+            Ok(v) => Ok(interp.to_js_value(&v)),
+            Err(Abrupt::Throw(v)) => {
+                let message = interp.describe(&v);
+                interp.last_thrown = v;
+                Err(RunError { kind: RunErrorKind::Thrown, message, line, column })
+            }
+            Err(Abrupt::Limit(kind)) => Err(RunError { kind: RunErrorKind::Limit(kind), message: format!("limit reached: {kind:?}"), line, column }),
+            Err(Abrupt::Internal(message)) => Err(RunError { kind: RunErrorKind::Internal, message, line, column }),
+        }
+    }
+
+    /// Defines the global variable `name` holding the exception the last run did not catch
+    /// (`undefined` if there was none).
+    pub fn bind_last_thrown(&mut self, name: &str) {
+        let interp = &mut self.interp;
+        let v = interp.last_thrown.clone();
+        let global = interp.global;
+        let _ = interp.define(global, key(name), Prop::Data { value: v, flags: HIDDEN });
+    }
+
+    /// Collects garbage now and returns the heap's estimated size in bytes afterwards.
+    pub fn collect_garbage(&mut self) -> usize {
+        self.interp.collect_garbage();
+        self.interp.heap.bytes
+    }
+
+    #[cfg(test)]
+    pub(crate) fn interp(&mut self) -> &mut Interp {
+        &mut self.interp
+    }
+}
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index fb357e1bf..c1cd09547 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -321,6 +321,9 @@ fn numeric_literals() {
     assert_eq!(number("0x1F;"), 31.0);
     assert_eq!(number("0XfF;"), 255.0);
     assert_eq!(number("0x20000000000001;"), 9007199254740992.0);
+    // 2^136 + 2^83 + 1 and 2^150 + 2^97 + 1: a set bit past 128 bits rounds the half-way case up.
+    assert_eq!(number(&format!("0x1{}8{}1;", "0".repeat(13), "0".repeat(19))), 2f64.powi(136) + 2f64.powi(84));
+    assert_eq!(number(&format!("01{}2{}1;", "0".repeat(17), "0".repeat(31))), 2f64.powi(150) + 2f64.powi(98));
     assert_eq!(number("017;"), 15.0);
     assert_eq!(number("08;"), 8.0);
     assert_eq!(number("09.5;"), 9.5);
@@ -703,7 +706,7 @@ fn sources_over_the_length_limit_are_refused() {
 // ---- robustness ----
 
 /// Fragments of the language, put together at random so the parser reaches its deeper states.
-const FRAGMENTS: &[&str] = &[
+pub(crate) const FRAGMENTS: &[&str] = &[
     "var ",
     "function ",
     "f",
diff --git a/crates/js/src/value.rs b/crates/js/src/value.rs
new file mode 100644
index 000000000..e164001ad
--- /dev/null
+++ b/crates/js/src/value.rs
@@ -0,0 +1,397 @@
+//! Values (ECMA-262 5.1 section 8) and the conversions between primitives (section 9).
+//!
+//! A string is a rope: concatenation makes a node that points at its two halves, and the first
+//! read of its characters flattens it, with a loop and an explicit stack, into one buffer that
+//! replaces the node. Strings hold no objects, so the reference counts that share them cannot form
+//! a cycle; dropping a long rope also uses a loop, not recursion.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use crate::heap::ObjId;
+
+/// A JavaScript value. Objects are handles into the interpreter's heap.
+#[derive(Clone, Debug)]
+pub(crate) enum Value {
+    Undefined,
+    Null,
+    Bool(bool),
+    Number(f64),
+    String(Str),
+    Object(ObjId),
+}
+
+impl Value {
+    pub(crate) fn str(s: &str) -> Value {
+        Value::String(Str::from(s))
+    }
+
+    pub(crate) fn as_object(&self) -> Option<ObjId> {
+        match self {
+            Value::Object(id) => Some(*id),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn is_nullish(&self) -> bool {
+        matches!(self, Value::Undefined | Value::Null)
+    }
+
+    /// ToBoolean (section 9.2).
+    pub(crate) fn truthy(&self) -> bool {
+        match self {
+            Value::Undefined | Value::Null => false,
+            Value::Bool(b) => *b,
+            Value::Number(n) => !(n.is_nan() || *n == 0.0),
+            Value::String(s) => s.len() > 0,
+            Value::Object(_) => true,
+        }
+    }
+}
+
+/// The text of a string value, in UTF-16 code units: a flat buffer or a concatenation.
+#[derive(Clone)]
+pub(crate) struct Str(Rc<RefCell<Node>>);
+
+enum Node {
+    Flat(Rc<[u16]>),
+    Concat {
+        left: Str,
+        right: Str,
+        len: usize,
+    },
+    /// A node whose halves were moved out while it was dropped.
+    Taken,
+}
+
+impl std::fmt::Debug for Str {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:?}", self.to_rust_string())
+    }
+}
+
+impl From<&str> for Str {
+    fn from(s: &str) -> Self {
+        Str::from_units(s.encode_utf16().collect())
+    }
+}
+
+/// Strings at most this long are copied when concatenated instead of becoming a rope node.
+const FLAT_CONCAT: usize = 32;
+
+impl Str {
+    pub(crate) fn from_units(units: Vec<u16>) -> Self {
+        Str::from_rc(units.into())
+    }
+
+    pub(crate) fn from_rc(units: Rc<[u16]>) -> Self {
+        Str(Rc::new(RefCell::new(Node::Flat(units))))
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        match &*self.0.borrow() {
+            Node::Flat(f) => f.len(),
+            Node::Concat { len, .. } => *len,
+            Node::Taken => 0,
+        }
+    }
+
+    /// The node is not yet flattened.
+    pub(crate) fn is_rope(&self) -> bool {
+        matches!(&*self.0.borrow(), Node::Concat { .. })
+    }
+
+    /// An address that identifies the node, for counting shared nodes once.
+    pub(crate) fn node_addr(&self) -> usize {
+        Rc::as_ptr(&self.0) as *const () as usize
+    }
+
+    /// The address of the code-unit buffer of a flat node, which a property name can share.
+    pub(crate) fn buffer_addr(&self) -> Option<usize> {
+        match &*self.0.borrow() {
+            Node::Flat(f) => Some(Rc::as_ptr(f) as *const () as usize),
+            _ => None,
+        }
+    }
+
+    /// The two halves of a concatenation node.
+    pub(crate) fn halves(&self) -> Option<(Str, Str)> {
+        match &*self.0.borrow() {
+            Node::Concat { left, right, .. } => Some((left.clone(), right.clone())),
+            _ => None,
+        }
+    }
+
+    /// `a + b`. The caller checks the length limit first.
+    pub(crate) fn concat(a: &Str, b: &Str) -> Str {
+        let (la, lb) = (a.len(), b.len());
+        if la == 0 {
+            return b.clone();
+        }
+        if lb == 0 {
+            return a.clone();
+        }
+        if la + lb <= FLAT_CONCAT {
+            let mut units = Vec::with_capacity(la + lb);
+            units.extend_from_slice(&a.flat());
+            units.extend_from_slice(&b.flat());
+            return Str::from_units(units);
+        }
+        Str(Rc::new(RefCell::new(Node::Concat { left: a.clone(), right: b.clone(), len: la + lb })))
+    }
+
+    /// The code units, flattening the rope first if it is one.
+    pub(crate) fn flat(&self) -> Rc<[u16]> {
+        if let Node::Flat(f) = &*self.0.borrow() {
+            return f.clone();
+        }
+        let mut units = Vec::with_capacity(self.len());
+        let mut stack = vec![self.clone()];
+        while let Some(s) = stack.pop() {
+            match &*s.0.borrow() {
+                Node::Flat(f) => units.extend_from_slice(f),
+                Node::Concat { left, right, .. } => {
+                    stack.push(right.clone());
+                    stack.push(left.clone());
+                }
+                Node::Taken => {}
+            }
+        }
+        let flat: Rc<[u16]> = units.into();
+        let old = std::mem::replace(&mut *self.0.borrow_mut(), Node::Flat(flat.clone()));
+        drop_node(old);
+        flat
+    }
+
+    pub(crate) fn to_rust_string(&self) -> String {
+        String::from_utf16_lossy(&self.flat())
+    }
+}
+
+impl PartialEq for Str {
+    fn eq(&self, other: &Self) -> bool {
+        Rc::ptr_eq(&self.0, &other.0) || (self.len() == other.len() && self.flat() == other.flat())
+    }
+}
+
+/// Drops a node's halves with a loop, so a rope of a million appends does not recurse a million
+/// levels deep.
+fn drop_node(node: Node) {
+    let mut stack = Vec::new();
+    if let Node::Concat { left, right, .. } = node {
+        stack.push(left);
+        stack.push(right);
+    }
+    while let Some(s) = stack.pop() {
+        if Rc::strong_count(&s.0) == 1 {
+            let taken = std::mem::replace(&mut *s.0.borrow_mut(), Node::Taken);
+            if let Node::Concat { left, right, .. } = taken {
+                stack.push(left);
+                stack.push(right);
+            }
+        }
+    }
+}
+
+impl Drop for Str {
+    fn drop(&mut self) {
+        if Rc::strong_count(&self.0) == 1 && self.is_rope() {
+            let node = std::mem::replace(&mut *self.0.borrow_mut(), Node::Taken);
+            drop_node(node);
+        }
+    }
+}
+
+/// White space and line terminators as StrWhiteSpaceChar (section 9.3.1) counts them: the same
+/// classes the lexer uses between tokens.
+pub(crate) fn is_str_space(u: u16) -> bool {
+    crate::chars::is_whitespace(u32::from(u)) || crate::chars::is_line_terminator(u32::from(u))
+}
+
+/// ToNumber applied to a string (section 9.3.1): the StringNumericLiteral grammar, NaN for
+/// anything else.
+pub(crate) fn string_to_number(units: &[u16]) -> f64 {
+    let start = units.iter().position(|&u| !is_str_space(u)).unwrap_or(units.len());
+    let end = units.iter().rposition(|&u| !is_str_space(u)).map_or(start, |i| i + 1);
+    let Some(text) = units.get(start..end) else { return f64::NAN };
+    if text.is_empty() {
+        return 0.0;
+    }
+    let Ok(s) = String::from_utf16(text) else { return f64::NAN };
+    if let Some(hex) = s.strip_prefix("0x").or_else(|| s.strip_prefix("0X")) {
+        if hex.is_empty() || !hex.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return f64::NAN;
+        }
+        return crate::chars::radix_value(hex.bytes().filter_map(|b| crate::chars::hex_value(u32::from(b))), 16).unwrap_or(f64::NAN);
+    }
+    let (sign, body) = match s.as_bytes().first() {
+        Some(b'+') => (1.0, &s[1..]),
+        Some(b'-') => (-1.0, &s[1..]),
+        _ => (1.0, s.as_str()),
+    };
+    if body == "Infinity" {
+        return sign * f64::INFINITY;
+    }
+    if !is_decimal_literal(body) {
+        return f64::NAN;
+    }
+    body.parse::<f64>().map_or(f64::NAN, |n| sign * n)
+}
+
+/// `body` is a StrUnsignedDecimalLiteral without `Infinity`: digits with an optional fraction and
+/// exponent, at least one digit in the mantissa.
+fn is_decimal_literal(body: &str) -> bool {
+    let b = body.as_bytes();
+    let mut i = 0;
+    let digits = |i: &mut usize| {
+        let s = *i;
+        while b.get(*i).is_some_and(u8::is_ascii_digit) {
+            *i += 1;
+        }
+        *i - s
+    };
+    let mut mantissa = digits(&mut i);
+    if b.get(i) == Some(&b'.') {
+        i += 1;
+        mantissa += digits(&mut i);
+    }
+    if mantissa == 0 {
+        return false;
+    }
+    if matches!(b.get(i), Some(b'e' | b'E')) {
+        i += 1;
+        if matches!(b.get(i), Some(b'+' | b'-')) {
+            i += 1;
+        }
+        if digits(&mut i) == 0 {
+            return false;
+        }
+    }
+    i == b.len()
+}
+
+/// ToString applied to a number (section 9.8.1).
+pub(crate) fn number_to_str(n: f64) -> Str {
+    Str::from(crate::number::to_string(n).as_str())
+}
+
+/// ToInt32 (section 9.5).
+pub(crate) fn to_int32(n: f64) -> i32 {
+    to_uint32(n) as i32
+}
+
+/// ToUint32 (section 9.6).
+pub(crate) fn to_uint32(n: f64) -> u32 {
+    if !n.is_finite() || n == 0.0 {
+        return 0;
+    }
+    let int = n.trunc();
+    let m = int.rem_euclid(4_294_967_296.0);
+    m as u32
+}
+
+/// The array index a property name stands for (section 15.4: a canonical numeric string below
+/// 2^32 − 1).
+pub(crate) fn array_index(key: &[u16]) -> Option<u32> {
+    if key.is_empty() || key.len() > 10 || (key.len() > 1 && key.first() == Some(&u16::from(b'0'))) {
+        return None;
+    }
+    let mut n: u64 = 0;
+    for &u in key {
+        let d = u.checked_sub(u16::from(b'0')).filter(|d| *d <= 9)?;
+        n = n * 10 + u64::from(d);
+    }
+    u32::try_from(n).ok().filter(|&n| n != u32::MAX)
+}
+
+/// The decimal digits of an array index.
+pub(crate) fn index_key(i: u32) -> Rc<[u16]> {
+    i.to_string().encode_utf16().collect::<Vec<u16>>().into()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Str, array_index, string_to_number, to_int32, to_uint32};
+
+    fn u(s: &str) -> Vec<u16> {
+        s.encode_utf16().collect()
+    }
+
+    #[test]
+    fn strings_convert_to_numbers_by_the_string_numeric_literal_grammar() {
+        let cases: &[(&str, f64)] = &[
+            ("", 0.0),
+            ("  \n ", 0.0),
+            ("12", 12.0),
+            (" -1.5e2 ", -150.0),
+            ("0x1F", 31.0),
+            (".5", 0.5),
+            ("5.", 5.0),
+            ("+Infinity", f64::INFINITY),
+            ("-Infinity", f64::NEG_INFINITY),
+        ];
+        for (s, want) in cases {
+            assert_eq!(string_to_number(&u(s)), *want, "{s:?}");
+        }
+        for s in ["inf", "nan", "1_0", "0x", "1e", ".", "--1", "0x-1", "infinity", "1 2"] {
+            assert!(string_to_number(&u(s)).is_nan(), "{s:?}");
+        }
+    }
+
+    #[test]
+    fn hex_strings_round_once_to_the_nearest_number() {
+        assert_eq!(string_to_number(&u("0xc83ce80553ee648")), 0xc83_ce80_553e_e648_u64 as f64);
+        // 2^136 + 2^83 + 1: a set bit past 128 bits rounds the half-way case up.
+        let digits = format!("0x1{}8{}1", "0".repeat(13), "0".repeat(19));
+        assert_eq!(string_to_number(&u(&digits)), 2f64.powi(136) + 2f64.powi(84));
+    }
+
+    #[test]
+    fn int32_and_uint32_wrap() {
+        assert_eq!(to_int32(4_294_967_296.0 + 5.0), 5);
+        assert_eq!(to_int32(2_147_483_648.0), i32::MIN);
+        assert_eq!(to_uint32(-1.0), u32::MAX);
+        assert_eq!(to_int32(f64::NAN), 0);
+        assert_eq!(to_int32(-1.9), -1);
+    }
+
+    #[test]
+    fn array_indices_are_canonical_and_below_the_largest_u32() {
+        assert_eq!(array_index(&u("0")), Some(0));
+        assert_eq!(array_index(&u("4294967294")), Some(4_294_967_294));
+        assert_eq!(array_index(&u("4294967295")), None);
+        assert_eq!(array_index(&u("01")), None);
+        assert_eq!(array_index(&u("1.0")), None);
+        assert_eq!(array_index(&u("")), None);
+    }
+
+    #[test]
+    fn a_million_appends_flatten_and_drop_without_recursion() {
+        let handle = std::thread::Builder::new()
+            .stack_size(256 << 10)
+            .spawn(|| {
+                let x = Str::from("abcdefghijklmnopqrstuvwxyz0123456789");
+                let mut s = Str::from("");
+                for _ in 0..1_000_000 {
+                    s = Str::concat(&s, &x);
+                }
+                let len = s.len();
+                let flat = s.flat();
+                (len, flat.len())
+            })
+            .unwrap();
+        assert_eq!(handle.join().unwrap(), (36_000_000, 36_000_000));
+        let handle = std::thread::Builder::new()
+            .stack_size(256 << 10)
+            .spawn(|| {
+                let x = Str::from("abcdefghijklmnopqrstuvwxyz0123456789");
+                let mut s = Str::from("");
+                for _ in 0..1_000_000 {
+                    s = Str::concat(&x, &s);
+                }
+                s.len()
+            })
+            .unwrap();
+        assert_eq!(handle.join().unwrap(), 36_000_000);
+    }
+}
diff --git a/crates/js/tests/test262.rs b/crates/js/tests/test262.rs
index c32045507..8c87bb19d 100644
--- a/crates/js/tests/test262.rs
+++ b/crates/js/tests/test262.rs
@@ -11,17 +11,29 @@
 //! `INTERPRETING.md` says), unless its `onlyStrict`, `noStrict` or `raw` flag says otherwise. The
 //! test prints the counts and writes each failure to `failures.txt` beside the suite; it fails only
 //! when the suite cannot be read.
+//!
+//! A second test runs the same ES5 tests through the interpreter, each in a new realm after the
+//! suite's `assert.js`, `sta.js` and the files its `includes:` names: every test that must parse
+//! and uses only the built-ins the interpreter has (those that name a missing global or method,
+//! in their own source or an included file, are counted as skipped, as are `async` tests). A test
+//! passes when it completes, or, for `negative: phase: runtime`, when it throws an object whose
+//! `constructor` is the global its `type:` names. Its counts are printed apart from the parse
+//! counts, and its failures go to `run-failures.txt`.
 
+use std::collections::HashSet;
 use std::path::{Path, PathBuf};
 
-use vectorcraft_js::{Options, parse};
+use vectorcraft_js::{JsValue, Limits, Options, Realm, RunErrorKind, TokenKind, parse, tokenize};
 
 /// A test file's metadata, from its `/*--- … ---*/` block.
 #[derive(Default)]
 struct Meta {
     features: Vec<String>,
     flags: Vec<String>,
+    includes: Vec<String>,
     negative_phase: Option<String>,
+    /// The error constructor a negative test expects (`negative: type:`).
+    negative_type: Option<String>,
     /// The test names the ES5 section it was written for (`es5id:`).
     es5: bool,
 }
@@ -86,6 +98,10 @@ fn meta(source: &str) -> Meta {
             meta.features = list(v, &mut lines);
         } else if let Some(v) = trimmed.strip_prefix("flags:").filter(|_| !indented) {
             meta.flags = list(v, &mut lines);
+        } else if let Some(v) = trimmed.strip_prefix("includes:").filter(|_| !indented) {
+            meta.includes = list(v, &mut lines);
+        } else if let Some(v) = trimmed.strip_prefix("type:").filter(|_| in_negative) {
+            meta.negative_type = Some(v.trim().to_string());
         } else if trimmed.starts_with("es5id:") && !indented {
             meta.es5 = true;
         } else if trimmed == "negative:" && !indented {
@@ -176,3 +192,129 @@ fn es5_parse_subset() {
         report.display()
     );
 }
+
+/// Globals and method names the interpreter does not provide yet: a test that names one is
+/// skipped.
+const MISSING_BUILTINS: &str = "Array String Number Boolean Math JSON Date RegExp parseInt parseFloat isNaN isFinite encodeURI \
+    decodeURI encodeURIComponent decodeURIComponent escape unescape print $262 $DONE Symbol Proxy Reflect Promise Map Set WeakMap \
+    WeakSet ArrayBuffer DataView Int8Array Uint8Array Float64Array defineProperty defineProperties getOwnPropertyDescriptor \
+    getOwnPropertyNames getPrototypeOf create keys freeze isFrozen seal isSealed preventExtensions isExtensible push pop shift unshift \
+    slice splice concat join reverse sort indexOf lastIndexOf every some forEach map filter reduce reduceRight charAt charCodeAt \
+    fromCharCode substring substr split replace match search exec test toUpperCase toLowerCase trim toFixed toPrecision toExponential \
+    bind now isArray compareArray verifyProperty fnGlobalObject";
+
+/// The stand-in for `String` that the harness's failure messages call.
+const HARNESS_STRING: &str = "function String(value) { return '' + value; }";
+
+/// The source names a missing built-in, as an identifier, a property name or a word inside a
+/// string literal (code passed to `eval` or `Function`), or does not parse as ES5 (the tests that
+/// use `let` and `const`).
+fn needs_missing_builtin(source: &str, missing: &HashSet<&str>) -> bool {
+    let Ok(tokens) = tokenize(source, &Options::default()) else { return true };
+    tokens.iter().any(|t| match &t.kind {
+        TokenKind::Ident(name) => missing.contains(name.as_str()),
+        TokenKind::String(units) => {
+            String::from_utf16_lossy(units).split(|c: char| !(c.is_ascii_alphanumeric() || c == '_' || c == '$')).any(|word| missing.contains(word))
+        }
+        _ => false,
+    })
+}
+
+/// Runs one test in a new realm; `Err` describes a failure.
+fn run_one(script: &str, negative_type: Option<&str>) -> Result<(), String> {
+    let mut realm = Realm::with_options(Options::default(), Limits { fuel: 20_000_000, heap_bytes: 256 << 20, ..Limits::default() });
+    match (realm.run(script), negative_type) {
+        (Ok(_), None) => Ok(()),
+        (Ok(_), Some(t)) => Err(format!("completed; a {t} was expected")),
+        (Err(e), Some(t)) if e.kind == RunErrorKind::Thrown => {
+            realm.bind_last_thrown("__thrown");
+            match realm.run(&format!("typeof __thrown === 'object' && __thrown !== null && __thrown.constructor === {t}")) {
+                Ok(JsValue::Bool(true)) => Ok(()),
+                _ => Err(format!("threw {} (line {}); a {t} was expected", e.message, e.line)),
+            }
+        }
+        (Err(e), _) => Err(format!("{:?}: {} (line {}, column {})", e.kind, e.message, e.line, e.column)),
+    }
+}
+
+#[test]
+fn es5_language_subset_runs() {
+    let Some(dir) = suite_dir() else {
+        println!("test262 interpreter: SKIPPED (no suite; run cargo xtask test262)");
+        return;
+    };
+    // Each test runs on a thread with a stack large enough for the nested runs the re-entry limit
+    // allows in an unoptimized build.
+    let handle = std::thread::Builder::new().stack_size(64 << 20).spawn(move || run_language_subset(&dir)).unwrap();
+    handle.join().unwrap();
+}
+
+fn run_language_subset(dir: &Path) {
+    let language = dir.join("test").join("language");
+    let harness_dir = dir.join("harness");
+    // A file that cannot be read gives an empty source.
+    let read = |p: &Path| String::from_utf8_lossy(&std::fs::read(p).unwrap_or_default()).into_owned();
+    // `assert.js` formats a failed assertion's message with the global `String`, which the
+    // interpreter does not provide yet; the stand-in converts with `+` so a failure reports the
+    // assertion's message instead of a ReferenceError.
+    let prelude = format!("{HARNESS_STRING}\n{}\n{}\n", read(&harness_dir.join("assert.js")), read(&harness_dir.join("sta.js")));
+    let missing: HashSet<&str> = MISSING_BUILTINS.split_whitespace().collect();
+    let verbose = std::env::var_os("VECTORCRAFT_TEST262_VERBOSE").is_some();
+    let (mut tests, mut skipped, mut passed, mut failed, mut panicked) = (0usize, 0usize, 0usize, 0usize, 0usize);
+    let mut failures = String::new();
+    for path in test_files(&language) {
+        let source = read(&path);
+        let meta = meta(&source);
+        let negative_parse = matches!(meta.negative_phase.as_deref(), Some("parse" | "resolution"));
+        if !meta.es5 || !meta.features.is_empty() || negative_parse || meta.flags.iter().any(|f| f == "module") {
+            continue;
+        }
+        let includes: String = meta.includes.iter().map(|i| read(&harness_dir.join(i)) + "\n").collect();
+        if meta.flags.iter().any(|f| f == "async") || needs_missing_builtin(&source, &missing) || needs_missing_builtin(&includes, &missing) {
+            skipped += 1;
+            continue;
+        }
+        tests += 1;
+        let has = |flag: &str| meta.flags.iter().any(|f| f == flag);
+        let modes: &[bool] = if has("raw") || has("noStrict") {
+            &[false]
+        } else if has("onlyStrict") {
+            &[true]
+        } else {
+            &[false, true]
+        };
+        let rel = path.strip_prefix(dir).unwrap_or(&path).display().to_string().replace('\\', "/");
+        for &strict in modes {
+            let mode = if strict { "strict" } else { "sloppy" };
+            if verbose {
+                eprintln!("{rel} ({mode})");
+            }
+            let body = if has("raw") { source.clone() } else { format!("{prelude}{includes}{source}") };
+            let script = if strict { format!("\"use strict\";\n{body}") } else { body };
+            let negative_type = meta.negative_type.clone().filter(|_| meta.negative_phase.as_deref() == Some("runtime"));
+            let outcome = std::panic::catch_unwind(|| run_one(&script, negative_type.as_deref()));
+            match outcome {
+                Ok(Ok(())) => passed += 1,
+                Ok(Err(why)) => {
+                    failed += 1;
+                    failures.push_str(&format!("{rel} ({mode}): {why}\n"));
+                }
+                Err(_) => {
+                    failed += 1;
+                    panicked += 1;
+                    failures.push_str(&format!("{rel} ({mode}): PANIC\n"));
+                }
+            }
+        }
+    }
+    let report = dir.join("run-failures.txt");
+    if let Err(e) = std::fs::write(&report, &failures) {
+        println!("could not write {}: {e}", report.display());
+    }
+    println!(
+        "test262 ES5 language subset through the interpreter: {tests} tests that need only the built-ins present, {passed} runs passed, \
+         {failed} failed ({panicked} panicked). Skipped {skipped} tests that need other built-ins, use syntax after ES5 or are asynchronous. Failures: {}",
+        report.display()
+    );
+    assert_eq!(panicked, 0, "the interpreter panicked; see {}", report.display());
+}
diff --git a/crates/pathops/src/boolean.rs b/crates/pathops/src/boolean.rs
index 3a9aaaec8..2201894b4 100644
--- a/crates/pathops/src/boolean.rs
+++ b/crates/pathops/src/boolean.rs
@@ -5,7 +5,8 @@
 //! [`tidy_segments`] then re-joins pieces that came from the same smooth curve by refitting, so
 //! results have roughly as few anchors as the inputs.
 
-use std::collections::BTreeSet;
+use std::cmp::Reverse;
+use std::collections::HashSet;
 
 use kurbo::{BezPath, CubicBez, PathSeg, Point, Shape as _};
 use linesweeper::topology::{ContourIdx, Contours, Topology, WindingNumber};
@@ -433,19 +434,28 @@ impl Arrangement {
         std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.contours(pred))).map_err(|_| PathOpsError::Degenerate)
     }
 
-    /// All distinct non-empty coverage masks that occur next to some edge, sorted.
-    pub(crate) fn distinct_masks(&self) -> Vec<Vec<bool>> {
-        let mut set = BTreeSet::new();
+    /// All distinct non-empty coverages that occur next to some edge, each as the inputs it covers
+    /// (ascending, as [`Self::covered`] gives them), in the order of their masks ([`Self::mask`])
+    /// sorted.
+    pub(crate) fn distinct_masks(&self) -> Vec<Vec<usize>> {
+        let mut set: HashSet<Vec<usize>> = HashSet::new();
+        let mut cover = Vec::new();
         for s in self.top.segment_indices() {
             let h = s.first_half();
             for w in [self.top.winding_clockwise(h), self.top.winding_counter_clockwise(h)] {
-                let m = self.mask(w);
-                if m.iter().any(|&b| b) {
-                    set.insert(m);
+                cover.clear();
+                cover.extend(self.covered(w));
+                if !cover.is_empty() && !set.contains(cover.as_slice()) {
+                    set.insert(cover.clone());
                 }
             }
         }
-        set.into_iter().collect()
+        let mut masks: Vec<Vec<usize>> = set.into_iter().collect();
+        // Masks sort by the first input only one of them covers: the one without it comes first.
+        // That input is the smaller of the first two entries that differ, or the next entry of the
+        // longer list where the shorter one ends.
+        masks.sort_unstable_by(|a, b| a.iter().map(Reverse).cmp(b.iter().map(Reverse)));
+        masks
     }
 
     /// Vertices where three or more edges meet (true intersections / touch points).
diff --git a/crates/pathops/src/pathfinder.rs b/crates/pathops/src/pathfinder.rs
index d6d85c9ad..112f9620c 100644
--- a/crates/pathops/src/pathfinder.rs
+++ b/crates/pathops/src/pathfinder.rs
@@ -177,21 +177,33 @@ pub fn pathfinder_with(op: PathfinderOp, shapes: &[Shape], precision: f64) -> Ve
             subpaths.into_iter().zip(shapes).filter(|(sp, _)| !sp.is_empty()).flat_map(|(sp, s)| one(PathData::new(sp), s.key)).collect()
         }
         PathfinderOp::Merge => {
+            // The distinct keys in first-seen order, and the index in `keys` of each shape's key.
             let mut keys: Vec<u64> = Vec::new();
-            for s in shapes {
-                if !keys.contains(&s.key) {
-                    keys.push(s.key);
-                }
-            }
-            let mut out = Vec::new();
-            for k in keys {
-                // topmost(m) is a shape with key k
-                let c = arr.contours_where(|w| arr.covered(w).next_back().is_some_and(|t| shapes[t].key == k));
-                for g in c.grouped() {
-                    out.extend(one(contours_to_path(&c, g, p), k));
-                }
-            }
-            out
+            let mut index: HashMap<u64, usize> = HashMap::new();
+            let class: Vec<usize> = shapes
+                .iter()
+                .map(|s| {
+                    *index.entry(s.key).or_insert_with(|| {
+                        keys.push(s.key);
+                        keys.len() - 1
+                    })
+                })
+                .collect();
+            // topmost(m) is a shape with key k; a same-key island in a hole stays with the
+            // contour around it, as `Contours::grouped` keeps it.
+            let mut faces: Vec<Vec<PathData>> = vec![Vec::new(); keys.len()];
+            each_classified_group(
+                &arr,
+                keys.len(),
+                |w| arr.covered(w).next_back().and_then(|t| class.get(t).copied()),
+                |c, owner| contour_trees(c, owner, false),
+                |i, c, group| {
+                    if let Some(f) = faces.get_mut(i) {
+                        f.push(contours_to_path(c, group.iter().copied(), p));
+                    }
+                },
+            );
+            keys.into_iter().zip(faces).flat_map(|(k, fs)| fs.into_iter().flat_map(move |f| one(f, k))).collect()
         }
         PathfinderOp::Crop => {
             if n < 2 {
@@ -235,7 +247,7 @@ fn regions_of(arr: &Arrangement) -> Vec<Region> {
 /// without building the faces after it.
 fn regions_of_within(arr: &Arrangement, limit: usize) -> Option<Vec<Region>> {
     let masks = arr.distinct_masks();
-    let refs: Vec<&[bool]> = masks.iter().map(Vec::as_slice).collect();
+    let refs: Vec<&[usize]> = masks.iter().map(Vec::as_slice).collect();
     let mut faces: Vec<Vec<PathData>> = vec![Vec::new(); masks.len()];
     let mut found = 0usize;
     let walk = each_face_until(arr, &refs, |m, c, group| {
@@ -258,9 +270,8 @@ fn regions_of_within(arr: &Arrangement, limit: usize) -> Option<Vec<Region>> {
         return None;
     }
     let mut out = Vec::new();
-    for (mask, paths) in masks.iter().zip(faces) {
-        let sources: Vec<usize> = mask.iter().enumerate().filter(|(_, b)| **b).map(|(i, _)| i).collect();
-        out.extend(paths.into_iter().map(|path| Region { path, sources: sources.clone() }));
+    for (sources, paths) in masks.iter().zip(faces) {
+        out.extend(paths.into_iter().filter(|p| !p.is_empty()).map(|path| Region { path, sources: sources.clone() }));
     }
     Some(out)
 }
@@ -277,9 +288,21 @@ fn each_classified_face(
     arr: &Arrangement,
     num_classes: usize,
     classify: impl Fn(&Multi) -> Option<usize>,
+    f: impl FnMut(usize, &Contours, &[ContourIdx]),
+) {
+    each_classified_group(arr, num_classes, classify, face_groups, f);
+}
+
+/// [`each_classified_face`] with each contour pass split into groups by `group` instead of
+/// [`face_groups`]: `group` gets a pass and the class of each of its contours.
+fn each_classified_group(
+    arr: &Arrangement,
+    num_classes: usize,
+    classify: impl Fn(&Multi) -> Option<usize>,
+    group: impl Fn(&Contours, &[usize]) -> Vec<(usize, Vec<ContourIdx>)>,
     mut f: impl FnMut(usize, &Contours, &[ContourIdx]),
 ) {
-    let _ = each_classified_face_until(arr, num_classes, classify, |m, c, group| {
+    let _ = each_classified_group_until(arr, num_classes, classify, group, |m, c, group| {
         f(m, c, group);
         ControlFlow::Continue(())
     });
@@ -290,6 +313,17 @@ fn each_classified_face_until(
     arr: &Arrangement,
     num_classes: usize,
     classify: impl Fn(&Multi) -> Option<usize>,
+    f: impl FnMut(usize, &Contours, &[ContourIdx]) -> ControlFlow<()>,
+) -> ControlFlow<()> {
+    each_classified_group_until(arr, num_classes, classify, face_groups, f)
+}
+
+/// [`each_classified_group`] until `f` breaks: no group after that one is walked.
+fn each_classified_group_until(
+    arr: &Arrangement,
+    num_classes: usize,
+    classify: impl Fn(&Multi) -> Option<usize>,
+    group: impl Fn(&Contours, &[usize]) -> Vec<(usize, Vec<ContourIdx>)>,
     mut f: impl FnMut(usize, &Contours, &[ContourIdx]) -> ControlFlow<()>,
 ) -> ControlFlow<()> {
     if num_classes == 0 {
@@ -344,16 +378,16 @@ fn each_classified_face_until(
             for m in (0..num_classes).filter(|m| batch[*m] == b) {
                 let c = arr.contours_where(|w| classify(w) == Some(m));
                 let owner = vec![m; c.contours().count()];
-                for (_, group) in face_groups(&c, &owner) {
-                    if f(m, &c, &group).is_break() {
+                for (_, g) in group(&c, &owner) {
+                    if f(m, &c, &g).is_break() {
                         return ControlFlow::Break(());
                     }
                 }
             }
             continue;
         };
-        for (m, group) in face_groups(&c, &owner) {
-            if f(m, &c, &group).is_break() {
+        for (m, g) in group(&c, &owner) {
+            if f(m, &c, &g).is_break() {
                 return ControlFlow::Break(());
             }
         }
@@ -361,17 +395,18 @@ fn each_classified_face_until(
     ControlFlow::Continue(())
 }
 
-/// Calls `f` with each face of `arr` whose coverage is one of `masks` (distinct): the index of
-/// its mask in `masks`, the contour pass it is in, and its contours, an outer contour and the
-/// holes of its mask directly inside it ([`face_groups`]). Each mask's faces come in the order
-/// of that mask's own contour pass.
+/// Calls `f` with each face of `arr` whose coverage is one of `masks` (distinct, each the inputs
+/// it covers, ascending as [`Arrangement::covered`] gives them): the index of its mask in
+/// `masks`, the contour pass it is in, and its contours, an outer contour and the holes of its
+/// mask directly inside it ([`face_groups`]). Each mask's faces come in the order of that mask's
+/// own contour pass.
 ///
 /// A contour pass walks the whole arrangement, so one pass per mask would cost masks × edges
 /// (two blends crossing make thousands of each). Instead the masks go into batches whose faces
 /// share no vertex (so no edge either): one pass per batch walks each face's contours exactly as
 /// its own mask's pass would, and the mask a contour bounds is the one of its batch at its first
 /// point.
-fn each_face(arr: &Arrangement, masks: &[&[bool]], mut f: impl FnMut(usize, &Contours, &[ContourIdx])) {
+fn each_face(arr: &Arrangement, masks: &[&[usize]], mut f: impl FnMut(usize, &Contours, &[ContourIdx])) {
     let _ = each_face_until(arr, masks, |m, c, group| {
         f(m, c, group);
         ControlFlow::Continue(())
@@ -379,12 +414,12 @@ fn each_face(arr: &Arrangement, masks: &[&[bool]], mut f: impl FnMut(usize, &Con
 }
 
 /// [`each_face`] until `f` breaks: no face after that one is walked.
-fn each_face_until(arr: &Arrangement, masks: &[&[bool]], f: impl FnMut(usize, &Contours, &[ContourIdx]) -> ControlFlow<()>) -> ControlFlow<()> {
+fn each_face_until(arr: &Arrangement, masks: &[&[usize]], f: impl FnMut(usize, &Contours, &[ContourIdx]) -> ControlFlow<()>) -> ControlFlow<()> {
     if masks.is_empty() {
         return ControlFlow::Continue(());
     }
     // Each mask is found by the inputs it covers.
-    let ids = CoverIds::new(masks.iter().map(|m| m.iter().enumerate().filter(|(_, b)| **b).map(|(k, _)| k).collect()).collect());
+    let ids = CoverIds::new(masks.iter().map(|m| m.to_vec()).collect());
     each_classified_face_until(arr, masks.len(), |w| ids.of(arr, w), f)
 }
 
@@ -433,11 +468,20 @@ fn face_groups(c: &Contours, owner: &[usize]) -> Vec<(usize, Vec<ContourIdx>)> {
     if c.contours().zip(&areas).any(|(ct, &a)| ct.outer != (a > 0.0)) {
         return face_groups_by_winding(c, owner, &areas);
     }
+    contour_trees(c, owner, true)
+}
+
+/// Groups a contour pass by the sweep's tree, within each mask (`owner` gives each contour's
+/// mask): a contour goes under the nearest enclosing contour of its mask, and each contour with
+/// none starts a group, with every contour under it in depth-first order. With `islands_apart`,
+/// an outer contour also starts a group of its own ([`face_groups`]); without it, each group is
+/// what [`Contours::grouped`] gives for a pass of that mask alone.
+fn contour_trees(c: &Contours, owner: &[usize], islands_apart: bool) -> Vec<(usize, Vec<ContourIdx>)> {
     let mut children = vec![Vec::new(); owner.len()];
     let mut roots = Vec::new();
     for (i, &m) in owner.iter().enumerate() {
         let ct = &c[ContourIdx(i)];
-        let mut up = if ct.outer { None } else { ct.parent };
+        let mut up = if islands_apart && ct.outer { None } else { ct.parent };
         while let Some(p) = up.filter(|p| owner.get(p.0) != Some(&m)) {
             up = c[p].parent;
         }
@@ -635,19 +679,21 @@ impl FaceMerger {
     /// The contours of the faces of `arr` that are `faces`, each found by its coverage and a point
     /// inside it.
     fn contours_of(&self, arr: &Arrangement, faces: &[&Region]) -> Option<BezPath> {
-        let mut picks: Vec<(Vec<bool>, Point)> = Vec::with_capacity(faces.len());
+        let mut picks: Vec<(Vec<usize>, Point)> = Vec::with_capacity(faces.len());
         for r in faces {
-            let mut mask = vec![false; self.shapes];
-            for &s in &r.sources {
-                *mask.get_mut(s)? = true;
+            if r.sources.iter().any(|&s| s >= self.shapes) {
+                return None;
             }
+            let mut mask = r.sources.clone();
+            mask.sort_unstable();
+            mask.dedup();
             picks.push((mask, crate::planar::interior_point(&r.path)?));
         }
         // `masks` holds the coverages in the order they were first picked, `points` the picked
         // points of each, and `found` the faces of each that contain one of its points.
-        let mut masks: Vec<&[bool]> = vec![];
+        let mut masks: Vec<&[usize]> = vec![];
         let mut points: Vec<Vec<Point>> = vec![];
-        let mut index: HashMap<&[bool], usize> = HashMap::new();
+        let mut index: HashMap<&[usize], usize> = HashMap::new();
         for (mask, p) in &picks {
             let m = *index.entry(mask.as_slice()).or_insert_with(|| {
                 masks.push(mask);
@@ -720,17 +766,14 @@ fn add_slivers(arr: &Arrangement, faces: &[&Region], rest: Option<&Rest>, raw: &
     let ours = |w: &Multi| rest.is_none_or(|r| arr.covered(w).any(|i| i == r.shape));
     // The coverage of each face next to a picked one, if only shapes of `faces` cover it, and the
     // ends of the edges along faces of `rest` that would go to their merge.
-    let mut next_to: Vec<Vec<bool>> = Vec::new();
+    let mut next_to: Vec<Vec<usize>> = Vec::new();
     let mut taken: HashSet<(u64, u64)> = HashSet::new();
     for s in top.segment_indices() {
         let h = s.first_half();
         let (a, b) = (top.winding_clockwise(h), top.winding_counter_clockwise(h));
         for (w, other) in [(a, b), (b, a)] {
-            if within(w, &cover) && ours(w) && !is_picked(w) && is_picked(other) {
-                let mask = arr.mask(w);
-                if !next_to.contains(&mask) {
-                    next_to.push(mask);
-                }
+            if within(w, &cover) && ours(w) && !is_picked(w) && is_picked(other) && !next_to.iter().any(|m| arr.covered(w).eq(m.iter().copied())) {
+                next_to.push(arr.covered(w).collect());
             }
             if let Some(r) = rest
                 && within(w, &merged_cover)
@@ -744,7 +787,7 @@ fn add_slivers(arr: &Arrangement, faces: &[&Region], rest: Option<&Rest>, raw: &
         }
     }
     let along_merged = |path: &BezPath| path.elements().iter().any(|el| el.end_point().is_some_and(|p| taken.contains(&vertex_key(p))));
-    let masks: Vec<&[bool]> = next_to.iter().map(Vec::as_slice).collect();
+    let masks: Vec<&[usize]> = next_to.iter().map(Vec::as_slice).collect();
     let mut found: Vec<Vec<BezPath>> = vec![Vec::new(); masks.len()];
     each_face(arr, &masks, |m, c, group| {
         if contours_to_path(c, group.iter().copied(), &arr.tidy).is_empty()
@@ -1079,7 +1122,7 @@ mod tests {
     /// face lies inside a hole of its own mask (`grouped` puts such an island in the frame's face).
     fn regions_one_mask_at_a_time(arr: &Arrangement) -> Vec<Region> {
         let mut out = Vec::new();
-        for mask in arr.distinct_masks() {
+        for mask in flag_masks(arr) {
             let c = arr.contours(|m| m == mask.as_slice());
             let sources: Vec<usize> = mask.iter().enumerate().filter(|(_, b)| **b).map(|(i, _)| i).collect();
             for g in c.grouped() {
@@ -1092,8 +1135,27 @@ mod tests {
         out
     }
 
+    /// The distinct non-empty coverages next to some edge as a flag per input, sorted.
+    fn flag_masks(arr: &Arrangement) -> Vec<Vec<bool>> {
+        let mut set = std::collections::BTreeSet::new();
+        for s in arr.top.segment_indices() {
+            let h = s.first_half();
+            for w in [arr.top.winding_clockwise(h), arr.top.winding_counter_clockwise(h)] {
+                let m = arr.mask(w);
+                if m.iter().any(|&b| b) {
+                    set.insert(m);
+                }
+            }
+        }
+        set.into_iter().collect()
+    }
+
+    /// [`Arrangement::distinct_masks`] lists the inputs of each of [`flag_masks`] in its order, and
+    /// [`regions_of`] finds the faces one contour pass per flag mask finds, in the same order.
     fn same_as_one_mask_at_a_time(shapes: &[Shape]) {
         let arr = arrangement(shapes, DEFAULT_PRECISION).expect("arrangement");
+        let listed: Vec<Vec<usize>> = flag_masks(&arr).iter().map(|m| m.iter().enumerate().filter(|(_, b)| **b).map(|(i, _)| i).collect()).collect();
+        assert_eq!(arr.distinct_masks(), listed);
         assert_eq!(regions_of(&arr), regions_one_mask_at_a_time(&arr));
     }
 
@@ -1210,6 +1272,32 @@ mod tests {
         assert_eq!(regions(&v).len(), 12 * 12 + 2 * 12 * 13);
     }
 
+    /// The coverages come in the order of their flag masks, with the same regions, for shapes that
+    /// overlap, nest, touch or lie apart, and for more than 64 shapes stacked out of their order
+    /// across the page.
+    #[test]
+    fn coverages_keep_the_order_of_their_flag_masks() {
+        let r = |x0: f64, y0: f64, x1: f64, y1: f64| Shape::new(rect(x0, y0, x1, y1), FillRule::NonZero, 1);
+        let overlapping = vec![r(0.0, 0.0, 100.0, 100.0), r(50.0, 50.0, 150.0, 150.0), r(25.0, 75.0, 125.0, 175.0)];
+        let nested = vec![r(0.0, 0.0, 300.0, 300.0), r(50.0, 50.0, 250.0, 250.0), r(100.0, 100.0, 200.0, 200.0), r(140.0, 140.0, 160.0, 160.0)];
+        let touching = vec![r(0.0, 0.0, 100.0, 100.0), r(100.0, 0.0, 200.0, 100.0), r(0.0, 100.0, 100.0, 200.0), r(100.0, 100.0, 200.0, 200.0)];
+        let apart = vec![r(0.0, 0.0, 10.0, 10.0), r(50.0, 0.0, 60.0, 10.0), r(0.0, 50.0, 10.0, 60.0)];
+        // 70 strips, each overlapping its neighbors, stacked in an order other than across the
+        // page, and two bars across them.
+        let mut many: Vec<Shape> = (0..70)
+            .map(|i| {
+                let x = 10.0 * f64::from((i * 37) % 70);
+                r(x, 0.0, x + 15.0, 300.0)
+            })
+            .collect();
+        many.insert(20, r(-10.0, 100.0, 730.0, 110.0));
+        many.push(r(-10.0, 200.0, 730.0, 205.0));
+        for (what, shapes) in [("overlapping", overlapping), ("nested", nested), ("touching", touching), ("apart", apart), ("many", many)] {
+            assert!(!regions(&shapes).is_empty(), "{what}");
+            same_as_one_mask_at_a_time(&shapes);
+        }
+    }
+
     proptest! {
         #![proptest_config(ProptestConfig { cases: 256, failure_persistence: None, rng_seed: proptest::test_runner::RngSeed::Fixed(0x5eed_9a7f), ..ProptestConfig::default() })]
 
@@ -1542,4 +1630,85 @@ mod tests {
         assert_eq!(trim_cov_actual.len(), 1);
         assert_eq!(trim_cov_actual, trim_cov_expected);
     }
+
+    /// Merge with one contour pass per distinct key, each face of a key its own result.
+    fn old_merge(shapes: &[Shape], precision: f64) -> Vec<Shape> {
+        let Some(arr) = arrangement(shapes, precision) else { return Vec::new() };
+        let mut keys: Vec<u64> = Vec::new();
+        for s in shapes {
+            if !keys.contains(&s.key) {
+                keys.push(s.key);
+            }
+        }
+        let mut out = Vec::new();
+        for k in keys {
+            let c = arr.contours_where(|w| arr.covered(w).next_back().is_some_and(|t| shapes[t].key == k));
+            for g in c.grouped() {
+                out.extend(one(contours_to_path(&c, g, &arr.tidy), k));
+            }
+        }
+        out
+    }
+
+    /// Overlapping squares on a grid with repeated fills, touching squares with two fills, and a
+    /// fill's island inside a hole of the same fill, with another fill around it: Merge gives the
+    /// same results, in the same order, as a contour pass per fill.
+    #[test]
+    fn merge_matches_a_contour_pass_per_fill() {
+        let mut grid = Vec::new();
+        for row in 0..5u32 {
+            for col in 0..5u32 {
+                let (x, y) = (10.0 * f64::from(col), 10.0 * f64::from(row));
+                grid.push(Shape::new(rect(x, y, x + 15.0, y + 15.0), FillRule::NonZero, u64::from((row * 5 + col) * 7 % 4)));
+            }
+        }
+        let mut ring = rect(0.0, 0.0, 100.0, 100.0);
+        ring.subpaths.extend(rect(30.0, 30.0, 70.0, 70.0).subpaths);
+        let nested = vec![
+            Shape::new(ring, FillRule::EvenOdd, 1),
+            Shape::new(rect(40.0, 40.0, 60.0, 60.0), FillRule::NonZero, 2),
+            Shape::new(rect(45.0, 45.0, 55.0, 55.0), FillRule::NonZero, 1),
+        ];
+        // A fill's island sits inside a ring of another fill that shares no point with it, both
+        // inside a hole of the first fill.
+        let mut frame = rect(0.0, 0.0, 100.0, 100.0);
+        frame.subpaths.extend(rect(30.0, 30.0, 70.0, 70.0).subpaths);
+        let mut between = rect(35.0, 35.0, 65.0, 65.0);
+        between.subpaths.extend(rect(42.0, 42.0, 58.0, 58.0).subpaths);
+        let apart = vec![
+            Shape::new(frame, FillRule::EvenOdd, 1),
+            Shape::new(between, FillRule::EvenOdd, 3),
+            Shape::new(rect(45.0, 45.0, 55.0, 55.0), FillRule::NonZero, 1),
+        ];
+        let touching: Vec<Shape> = (0..16u32)
+            .map(|k| {
+                let (x, y) = (10.0 * f64::from(k % 4), 10.0 * f64::from(k / 4));
+                Shape::new(rect(x, y, x + 10.0, y + 10.0), FillRule::NonZero, u64::from((k % 4 + k / 4) % 2))
+            })
+            .collect();
+        for (label, shapes) in [("grid", grid), ("nested", nested), ("apart", apart), ("touching", touching)] {
+            let actual = pathfinder_with(PathfinderOp::Merge, &shapes, DEFAULT_PRECISION);
+            let expected = old_merge(&shapes, DEFAULT_PRECISION);
+            assert!(!expected.is_empty(), "{label}");
+            assert_eq!(actual, expected, "{label}");
+        }
+    }
+
+    /// 40 squares in a row, each overlapping the next and each with a fill of its own: Merge walks
+    /// the arrangement a few times, not once per fill.
+    #[test]
+    fn merge_with_many_fills_walks_the_arrangement_a_few_times() {
+        let v: Vec<Shape> = (0..40u32)
+            .map(|k| {
+                let x = 10.0 * f64::from(k);
+                Shape::new(rect(x, 0.0, x + 15.0, 40.0), FillRule::NonZero, u64::from(k))
+            })
+            .collect();
+        CONTOUR_PASSES.with(|n| n.set(0));
+        let merged = pathfinder_with(PathfinderOp::Merge, &v, DEFAULT_PRECISION);
+        let passes = CONTOUR_PASSES.with(std::cell::Cell::get);
+        assert!(passes <= 8, "{passes} contour passes");
+        assert_eq!(merged.len(), 40);
+        assert!(merged.iter().enumerate().all(|(k, s)| s.key == k as u64));
+    }
 }
diff --git a/crates/plugins/src/effect.rs b/crates/plugins/src/effect.rs
index b49f5b831..1a9420d34 100644
--- a/crates/plugins/src/effect.rs
+++ b/crates/plugins/src/effect.rs
@@ -44,6 +44,12 @@ pub fn effect_id(plugin_id: &str) -> String {
     format!("{PREFIX}{plugin_id}")
 }
 
+/// Does Safe Mode skip effect `effect_id` (a plug-in effect while Safe Mode is on)? Its object then
+/// draws its geometry without it, and keeps the effect.
+pub fn skipped(effect_id: &str) -> bool {
+    plugin_id(effect_id).is_some() && crate::safe_mode::active()
+}
+
 /// An installed live-effect plug-in by its effect id.
 pub fn installed(effect_id: &str) -> Option<std::sync::Arc<crate::Plugin>> {
     registry::get(plugin_id(effect_id)?).filter(|p| p.manifest().kind == Kind::Effect)
@@ -132,6 +138,57 @@ fn weight(key: &Key, out: Option<&PathData>) -> usize {
 }
 static ERRORS: Mutex<Option<HashMap<String, String>>> = Mutex::new(None);
 
+/// Where an installation ([`crate::Plugin::serial`]) stands as a live effect in this process.
+enum Runs {
+    /// Its first run is in progress, or a run that started while a guarded run was in progress:
+    /// how many of them are running, whether one has finished (wasn't cancelled), and the launch
+    /// marker's entry naming the plug-in until none is running.
+    Guarded { running: usize, finished: bool, loading: crate::safe_mode::Loading },
+    /// A guarded run finished and none is running: later runs aren't guarded.
+    Done,
+}
+
+static RUNS: Mutex<Option<HashMap<u64, Runs>>> = Mutex::new(None);
+
+/// A run of `plugin` starts → is it guarded (the launch marker names the plug-in while it runs)?
+/// The first run in this process is, and so is every run that starts while a guarded one is still
+/// running. Give a guarded run to [`end_run`] when it ends.
+fn begin_run(plugin: &crate::Plugin) -> bool {
+    let mut runs = RUNS.lock().unwrap_or_else(|e| e.into_inner());
+    let runs = runs.get_or_insert_with(HashMap::new);
+    match runs.get_mut(&plugin.serial()) {
+        Some(Runs::Done) => false,
+        Some(Runs::Guarded { running, .. }) => {
+            *running += 1;
+            true
+        }
+        None => {
+            let loading = crate::safe_mode::loading(&crate::safe_mode::Item::of(plugin));
+            runs.insert(plugin.serial(), Runs::Guarded { running: 1, finished: false, loading });
+            true
+        }
+    }
+}
+
+/// A guarded run of installation `serial` ended; `cancelled`: a drawing stopped it (an export
+/// stopped half way), which says nothing about the plug-in. When it was the last guarded run still
+/// running, the launch marker stops naming the plug-in, and when none of the guarded runs finished,
+/// the next run is guarded as the first.
+fn end_run(serial: u64, cancelled: bool) {
+    let mut runs = RUNS.lock().unwrap_or_else(|e| e.into_inner());
+    let Some(runs) = runs.as_mut() else { return };
+    let Some(Runs::Guarded { running, finished, .. }) = runs.get_mut(&serial) else { return };
+    *running = running.saturating_sub(1);
+    *finished |= !cancelled;
+    if *running > 0 {
+        return;
+    }
+    let ended = if *finished { runs.insert(serial, Runs::Done) } else { runs.remove(&serial) };
+    if let Some(Runs::Guarded { loading, .. }) = ended {
+        crate::safe_mode::loaded(loading);
+    }
+}
+
 /// The last error of live-effect plug-in `id` (cleared when it next succeeds).
 pub fn last_error(id: &str) -> Option<String> {
     ERRORS.lock().unwrap_or_else(|e| e.into_inner()).as_ref()?.get(id).cloned()
@@ -147,9 +204,14 @@ fn note(id: &str, r: &Result<PathData>) {
 }
 
 /// Runs live-effect plug-in `id` on `path` (whose reference box is `bounds`), of an object painted
-/// with `paints`: the new geometry, or `None` when the plug-in isn't installed, isn't an effect, or
-/// fails (the caller then keeps the geometry).
+/// with `paints`: the new geometry, or `None` when the plug-in isn't installed, isn't an effect,
+/// fails, or Safe Mode is on (the caller then keeps the geometry, and the object keeps its effect).
+/// The launch marker names the plug-in during its first run in this process, and until every run
+/// that started while it ran has ended too ([`crate::safe_mode::loading`]).
 pub fn apply(id: &str, params: &Value, path: &PathData, bounds: Rect, rule: FillRule, paints: Paints) -> Option<PathData> {
+    if crate::safe_mode::active() {
+        return None;
+    }
     let plugin = registry::get(id).filter(|p| p.manifest().kind == Kind::Effect)?;
     let resolved = Value::Object(plugin.manifest().resolve_params(params).ok()?);
     let given = paints.given();
@@ -167,10 +229,14 @@ pub fn apply(id: &str, params: &Value, path: &PathData, bounds: Rect, rule: Fill
     {
         return out.clone();
     }
+    let guarded = begin_run(&plugin);
     let r = run(&plugin, resolved, path, bounds, rule, given);
-    // A drawing that was cancelled (an export stopped half way) says nothing about the plug-in:
-    // the next drawing runs it again.
-    if matches!(r, Err(Error::Cancelled)) {
+    let cancelled = matches!(r, Err(Error::Cancelled));
+    if guarded {
+        end_run(plugin.serial(), cancelled);
+    }
+    // A drawing that was cancelled says nothing about the plug-in: the next drawing runs it again.
+    if cancelled {
         return None;
     }
     note(id, &r);
@@ -232,4 +298,66 @@ mod tests {
         let none = Paints::default().given();
         assert_eq!((none.fills, none.strokes, none.item), (vec![], vec![], json!("object")));
     }
+
+    /// A first run that is cancelled leaves the next run to be the first: the launch marker names
+    /// the plug-in during that one.
+    #[test]
+    fn a_cancelled_first_run_leaves_the_next_run_first() {
+        let _lock = crate::safe_mode::TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        crate::safe_mode::set_active(None);
+        let src = crate::wat::spinning(&crate::wat::manifest("test.effect.cancelled", "effect", "{}"), 1_000_000_000, r#"{"objects":[]}"#);
+        let plugin = registry::install(crate::Plugin::load(&wat::parse_str(&src).unwrap(), Limits::default()).unwrap());
+        let ran_first =
+            || RUNS.lock().unwrap_or_else(|e| e.into_inner()).as_ref().is_some_and(|r| matches!(r.get(&plugin.serial()), Some(Runs::Done)));
+        let draw =
+            || apply("test.effect.cancelled", &json!({}), &PathData::default(), Rect::new(0.0, 0.0, 1.0, 1.0), FillRule::NonZero, Paints::default());
+        let token = vectorcraft_doc::cancel::CancelToken::new();
+        token.cancel();
+        assert_eq!(vectorcraft_doc::cancel::scope(&token, None, draw), None);
+        assert!(!ran_first(), "the cancelled run doesn't count as the first");
+        // Runs to its instruction budget and fails: that run was the first.
+        assert_eq!(draw(), None);
+        assert!(ran_first());
+        registry::remove("test.effect.cancelled");
+    }
+
+    /// Two runs overlap during a plug-in's first run in this process: when the first ends while the
+    /// second is still running, the launch marker keeps naming the plug-in until the second ends.
+    #[test]
+    fn the_marker_stays_while_an_overlapping_run_is_running() {
+        let _lock = crate::safe_mode::TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        crate::safe_mode::set_active(None);
+        let dir = std::env::temp_dir().join(format!("vc-effect-overlap-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        assert_eq!(crate::safe_mode::begin_launch(&dir), None);
+        let marker = || {
+            let files = std::fs::read_dir(&dir).unwrap().filter_map(|e| Some(e.ok()?.path()));
+            let json = files.filter(|p| p.extension().is_some_and(|x| x == "json")).collect::<Vec<_>>();
+            assert_eq!(json.len(), 1, "one marker for this launch");
+            crate::safe_mode::parse_marker(&std::fs::read(&json[0]).unwrap())
+        };
+        let src = crate::wat::returning(&crate::wat::manifest("test.effect.overlap", "effect", "{}"), r#"{"objects":[]}"#);
+        let plugin = registry::install(crate::Plugin::load(&wat::parse_str(&src).unwrap(), Limits::default()).unwrap());
+        let named = Some(crate::safe_mode::Item::of(&plugin));
+        assert_eq!(marker(), None);
+
+        assert!(begin_run(&plugin), "the first run is guarded");
+        assert!(begin_run(&plugin), "a run that starts while the first is running is guarded");
+        assert_eq!(marker(), named);
+        end_run(plugin.serial(), false);
+        assert_eq!(marker(), named, "the second run is still running");
+        // A third run starts before the second ends, and the second is cancelled.
+        assert!(begin_run(&plugin));
+        end_run(plugin.serial(), true);
+        assert_eq!(marker(), named, "the third run is still running");
+        end_run(plugin.serial(), false);
+        assert_eq!(marker(), None, "no run is running");
+        assert!(!begin_run(&plugin), "later runs aren't guarded");
+        assert_eq!(marker(), None);
+
+        crate::safe_mode::end_launch();
+        crate::safe_mode::forget_previous();
+        registry::remove("test.effect.overlap");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/plugins/src/lib.rs b/crates/plugins/src/lib.rs
index 5e5da17b9..fd2375be6 100644
--- a/crates/plugins/src/lib.rs
+++ b/crates/plugins/src/lib.rs
@@ -21,7 +21,7 @@
 //! ([`objects::apply_output`]); a **live effect** ([`effect`]) rewrites one object's geometry each
 //! time it is drawn, from an appearance stack; an **exporter** ([`export`]) writes the whole
 //! document in a file format of its own. The process-wide [`registry`] holds the installed
-//! plug-ins. A plug-in's parameters ([`manifest`]) come with what the host's dialogs need to show
+//! plug-ins; in [`safe_mode`] none of them loads or runs. A plug-in's parameters ([`manifest`]) come with what the host's dialogs need to show
 //! them well: labels, units, groups, help and conditions ([`dialog`]). What a plug-in may do is
 //! the set of [`permissions`] its manifest lists, which the user approves when it is installed.
 #![forbid(unsafe_code)]
@@ -35,6 +35,7 @@ pub mod objects;
 pub mod permissions;
 pub mod registry;
 mod runtime;
+pub mod safe_mode;
 pub mod wat;
 
 pub use dialog::ParamUi;
@@ -71,6 +72,9 @@ pub enum Error {
     /// its instruction budget.
     #[error("cancelled")]
     Cancelled,
+    /// Safe Mode is on ([`safe_mode`]): no plug-in loads or runs.
+    #[error("Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally")]
+    SafeMode,
     #[error("{0}")]
     Io(String),
 }
diff --git a/crates/plugins/src/registry.rs b/crates/plugins/src/registry.rs
index 8e4635c3f..be1f0623f 100644
--- a/crates/plugins/src/registry.rs
+++ b/crates/plugins/src/registry.rs
@@ -113,6 +113,9 @@ pub fn load_file(path: &std::path::Path, limits: Limits) -> Result<Plugin> {
     Ok(Plugin::load(&bytes, limits)?.with_source(path.display().to_string()))
 }
 
+/// What [`load_folder`] reports for a plug-in the user disabled.
+pub const DISABLED: &str = "disabled: turn it on again in Help › Safe Mode, for the next launch";
+
 /// What [`load_folder`] did.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct FolderReport {
@@ -120,6 +123,10 @@ pub struct FolderReport {
     pub loaded: Vec<String>,
     /// `(file, error)` for each `.wasm` that failed to load.
     pub failed: Vec<(String, String)>,
+    /// The disabled items saved for the next launch changed: a plug-in disabled by its id alone was
+    /// found in a file, which is now disabled too ([`crate::safe_mode::disable_file_of`]). The app
+    /// saves the list again.
+    pub disabled_changed: bool,
 }
 
 /// Installs every `*.wasm` directly in `dir` (not recursive), in file-name order. A bad module is
@@ -132,13 +139,18 @@ pub fn load_folder(dir: &std::path::Path) -> Result<FolderReport> {
 }
 
 /// [`load_folder`], loading only the files `allow` accepts, and of the plug-ins that list
-/// permissions only those `approve` accepts; the others are reported as failed with the reason.
+/// permissions only those `approve` accepts; the others are reported as failed with the reason. A plug-in the user disabled ([`crate::safe_mode::skipped`]) is reported and
+/// skipped, by its file before it loads or by its id after (its file is then disabled too, so the
+/// next load skips it before it runs); the launch marker names each file while it loads
+/// ([`crate::safe_mode::loading`]). In Safe Mode nothing loads ([`Error::SafeMode`]).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn load_folder_where(
     dir: &std::path::Path,
     allow: impl Fn(&std::path::Path) -> std::result::Result<(), String>,
     approve: impl Fn(&Plugin) -> bool,
 ) -> Result<FolderReport> {
+    use crate::safe_mode::{self, Item};
+    safe_mode::check()?;
     let rd = std::fs::read_dir(dir).map_err(|e| Error::Io(format!("{}: {e}", dir.display())))?;
     let mut files: Vec<std::path::PathBuf> =
         rd.filter_map(|e| e.ok().map(|e| e.path())).filter(|p| p.extension().is_some_and(|x| x.eq_ignore_ascii_case("wasm"))).collect();
@@ -150,7 +162,19 @@ pub fn load_folder_where(
             report.failed.push((f.display().to_string(), why));
             continue;
         }
-        match load_file(&f, Limits::default()) {
+        let item = Item::file(f.display().to_string());
+        if safe_mode::skipped(&item) {
+            report.failed.push((f.display().to_string(), DISABLED.into()));
+            continue;
+        }
+        let token = safe_mode::loading(&item);
+        let loaded = load_file(&f, Limits::default());
+        safe_mode::loaded(token);
+        match loaded {
+            Ok(p) if safe_mode::skipped(&Item::of(&p)) => {
+                report.disabled_changed |= safe_mode::disable_file_of(&Item::of(&p));
+                report.failed.push((f.display().to_string(), DISABLED.into()));
+            }
             // A heavy plug-in installs once the user agrees, which loading a folder doesn't ask.
             Ok(p) if p.manifest().budget == crate::Budget::Heavy => {
                 report.failed.push((f.display().to_string(), "asks for a heavy budget, which the user allows when installing it on its own".into()));
diff --git a/crates/plugins/src/runtime.rs b/crates/plugins/src/runtime.rs
index e6c289b8f..7059aed15 100644
--- a/crates/plugins/src/runtime.rs
+++ b/crates/plugins/src/runtime.rs
@@ -133,8 +133,9 @@ type RunArgs = (i32, i32, i32, i32);
 impl Plugin {
     /// Validates and loads a module: checks the ABI version, the exports and reads the manifest, and
     /// checks that each host import it asks for is one the host offers ([`crate::host::IMPORTS`])
-    /// and its manifest allows.
+    /// and its manifest allows. In Safe Mode nothing is loaded ([`Error::SafeMode`]).
     pub fn load(bytes: &[u8], limits: Limits) -> Result<Plugin> {
+        crate::safe_mode::check()?;
         if bytes.len() > limits.max_module_bytes {
             return Err(Error::Module(format!("module is {} bytes (limit {})", bytes.len(), limits.max_module_bytes)));
         }
@@ -279,7 +280,8 @@ impl Plugin {
         self.run_limited(input, params, &self.limits)
     }
 
-    /// [`Plugin::run`] with other time and instruction budgets (live effects get a shorter one).
+    /// [`Plugin::run`] with other time and instruction budgets (live effects get a shorter one). In
+    /// Safe Mode nothing runs ([`Error::SafeMode`]), even a plug-in installed before it was on.
     pub fn run_limited(&self, input: &[u8], params: &[u8], limits: &Limits) -> Result<Vec<u8>> {
         self.run_reporting(input, params, limits).0
     }
@@ -290,6 +292,9 @@ impl Plugin {
     /// doesn't) and `vc_cancelled` sees the scope's Cancel.
     pub fn run_reporting(&self, input: &[u8], params: &[u8], limits: &Limits) -> (Result<Vec<u8>>, Report) {
         let mut report = Report::default();
+        if let Err(e) = crate::safe_mode::check() {
+            return (Err(e), report);
+        }
         // wasmi reports misbehaving modules as errors; a panic would be a bug in it, and must
         // still not take the document down (native builds; wasm aborts on panic anyway).
         let run = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.run_inner(input, params, limits, &mut report)));
diff --git a/crates/plugins/src/safe_mode.rs b/crates/plugins/src/safe_mode.rs
new file mode 100644
index 000000000..efa853d76
--- /dev/null
+++ b/crates/plugins/src/safe_mode.rs
@@ -0,0 +1,927 @@
+//! Safe Mode, disabled plug-ins and the launch marker.
+//!
+//! **Safe Mode**: while it is on, no plug-in code runs in this process. [`crate::Plugin::load`] and
+//! every run of an installed plug-in fail with [`Error::SafeMode`], so a plug-in installed before
+//! Safe Mode was turned on can't run either, and live effects draw their object's geometry
+//! unchanged. The apps turn it on at launch (`--safe-mode`, or the choice after a launch that
+//! stopped while a plug-in was loading) and off only when the user starts normally from that
+//! choice.
+//!
+//! **Disabled plug-ins**: the items the user turned off. Loading skips them by file or by id
+//! ([`skipped`]); nothing is uninstalled. [`set_disabled`] sets both the list this launch skips and
+//! the list saved for the next one; [`set_enabled`] changes only the saved list, so turning an item
+//! back on takes effect at the next launch.
+//!
+//! **Launch marker** (native builds): a small file in a folder the app picks, written before the
+//! stored plug-ins load, updated before and after each module load and each live effect's first
+//! evaluation (and each evaluation that starts while one of those is running) to name the oldest
+//! item still loading (several threads can load at once), and removed
+//! when the app quits ([`begin_launch`], [`loading`], [`loaded`], [`end_launch`]). A launch that
+//! ends while an item is still loading (a panic the app caught while a plug-in loaded) keeps its
+//! marker naming that item. A marker left behind by a
+//! launch that is no longer running names the item that was loading when it stopped, which may or
+//! may not be what stopped it. Until the user
+//! chooses what to do about that item ([`forget_previous`]), the next launch's marker names it too
+//! and stays when that launch quits, so a launch that asks nothing (`--safe-mode`) or one closed in
+//! Safe Mode leaves the choice to the launch after it. Each launch has
+//! its own marker and holds a lock on a file beside it, so a launch that is still running (a second
+//! window) is never taken for one that stopped. A marker that is missing, empty, unreadable,
+//! malformed, larger than [`MAX_MARKER_BYTES`] or of another version names nothing.
+
+use std::sync::atomic::{AtomicU8, Ordering};
+use std::sync::{Mutex, RwLock};
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+use crate::{Error, Result};
+
+/// The longest id, file or name a stored item keeps, in characters.
+const MAX_FIELD_CHARS: usize = 1024;
+/// The most bytes one stored item takes in JSON: three fields of [`MAX_FIELD_CHARS`] characters,
+/// each written in at most 6 bytes (`\u001f`), plus keys, quotes and indentation.
+const MAX_ITEM_JSON_BYTES: usize = 3 * MAX_FIELD_CHARS * 6 + 256;
+/// The largest launch marker read, in bytes: room for one stored item.
+pub const MAX_MARKER_BYTES: u64 = (MAX_ITEM_JSON_BYTES + 256) as u64;
+/// The longest name an item is shown with, in characters (longer ones end with "…").
+pub const MAX_NAME_CHARS: usize = 64;
+/// The most disabled items kept.
+pub const MAX_DISABLED: usize = 1000;
+/// The largest disabled-items file read, in bytes: room for [`MAX_DISABLED`] stored items.
+pub const MAX_DISABLED_FILE_BYTES: u64 = (MAX_DISABLED * MAX_ITEM_JSON_BYTES + 256) as u64;
+/// The `format` of a launch marker, and its version.
+const MARKER_FORMAT: &str = "vectorcraft-launch";
+const MARKER_VERSION: u64 = 1;
+
+/// Why Safe Mode is on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Source {
+    /// The `--safe-mode` option.
+    Flag,
+    /// The launch after one that stopped while a plug-in was loading, until the user chooses.
+    Startup,
+}
+
+impl Source {
+    /// Its name in `plugin.safeMode`.
+    pub fn name(self) -> &'static str {
+        match self {
+            Source::Flag => "flag",
+            Source::Startup => "startup",
+        }
+    }
+}
+
+/// 0: off; otherwise a [`Source`].
+static ACTIVE: AtomicU8 = AtomicU8::new(0);
+
+/// Turns Safe Mode on for `source`, or off with `None`.
+pub fn set_active(source: Option<Source>) {
+    ACTIVE.store(
+        match source {
+            None => 0,
+            Some(Source::Flag) => 1,
+            Some(Source::Startup) => 2,
+        },
+        Ordering::SeqCst,
+    );
+}
+
+/// Why Safe Mode is on; `None` while it is off.
+pub fn source() -> Option<Source> {
+    match ACTIVE.load(Ordering::SeqCst) {
+        1 => Some(Source::Flag),
+        2 => Some(Source::Startup),
+        _ => None,
+    }
+}
+
+/// Is Safe Mode on?
+pub fn active() -> bool {
+    source().is_some()
+}
+
+/// [`Error::SafeMode`] while Safe Mode is on.
+pub fn check() -> Result<()> {
+    if active() { Err(Error::SafeMode) } else { Ok(()) }
+}
+
+/// A plug-in as the launch marker and the disabled list name it: its id when known, the file it
+/// was loaded from, and its name. Two items are the same plug-in when their ids match, or, when
+/// either has no id, their files match. An id or file longer than [`MAX_FIELD_CHARS`] characters
+/// is kept, and compared, as its start followed by a hash of the whole ([`bound`]).
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Item {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub file: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+}
+
+impl Item {
+    /// The item of a module loaded from `file`, before its id is known.
+    pub fn file(file: impl Into<String>) -> Self {
+        Item { file: Some(file.into()), ..Item::default() }
+    }
+
+    /// The item of an installed plug-in.
+    pub fn of(plugin: &crate::Plugin) -> Self {
+        Item { id: Some(plugin.id().to_string()), file: plugin.source().map(str::to_string), name: Some(plugin.manifest().name.clone()) }
+    }
+
+    /// Is `other` the same plug-in?
+    pub fn same(&self, other: &Item) -> bool {
+        match (&self.id, &other.id) {
+            (Some(a), Some(b)) => bound(a) == bound(b),
+            _ => match (&self.file, &other.file) {
+                (Some(a), Some(b)) => bound(a) == bound(b),
+                _ => false,
+            },
+        }
+    }
+
+    /// The name it is shown with: its name, else its id, else its file's name, through
+    /// [`display_name`].
+    pub fn label(&self) -> String {
+        let file_name = || self.file.as_deref().map(|f| f.rsplit(['/', '\\']).next().unwrap_or(f));
+        display_name(self.name.as_deref().filter(|n| !n.trim().is_empty()).or(self.id.as_deref()).or_else(file_name).unwrap_or(""))
+    }
+
+    /// Its fields, each at most [`MAX_FIELD_CHARS`] characters (the id and the file through
+    /// [`bound`], the name cut); `None` when it has neither an id nor a file.
+    fn bounded(self) -> Option<Item> {
+        let keep = |s: Option<String>| s.filter(|s| !s.is_empty()).map(|s| bound(&s).into_owned());
+        let name = self.name.filter(|s| !s.is_empty()).map(|s| s.chars().take(MAX_FIELD_CHARS).collect::<String>());
+        let item = Item { id: keep(self.id), file: keep(self.file), name };
+        (item.id.is_some() || item.file.is_some()).then_some(item)
+    }
+
+    /// As `plugin.safeMode` lists it: `{id, file, name, label}`.
+    pub fn to_json(&self) -> Value {
+        json!({"id": self.id, "file": self.file, "name": self.name, "label": self.label()})
+    }
+}
+
+/// `s` when it has at most [`MAX_FIELD_CHARS`] characters; else its start, `#` and a hash of the
+/// whole of it, [`MAX_FIELD_CHARS`] characters in all, so two long values that share a start stay
+/// apart. A value made this way is its own bound.
+fn bound(s: &str) -> std::borrow::Cow<'_, str> {
+    if s.chars().nth(MAX_FIELD_CHARS).is_none() {
+        return std::borrow::Cow::Borrowed(s);
+    }
+    // FNV-1a: stable across versions and platforms.
+    let hash = s.bytes().fold(0xcbf2_9ce4_8422_2325_u64, |h, b| (h ^ u64::from(b)).wrapping_mul(0x0100_0000_01b3));
+    let start: String = s.chars().take(MAX_FIELD_CHARS - 17).collect();
+    std::borrow::Cow::Owned(format!("{start}#{hash:016x}"))
+}
+
+/// `s` safe to show in a sentence: control characters and the characters that reorder text
+/// (U+061C, U+200E, U+200F, U+202A to U+202E, U+2066 to U+2069) removed, at most
+/// [`MAX_NAME_CHARS`] characters (a longer name ends with "…").
+pub fn display_name(s: &str) -> String {
+    let reorders = |c: char| matches!(c, '\u{061C}' | '\u{200E}' | '\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}');
+    let clean: Vec<char> = s.trim().chars().filter(|&c| !c.is_control() && !reorders(c)).collect();
+    if clean.len() > MAX_NAME_CHARS {
+        clean[..MAX_NAME_CHARS - 1].iter().chain(std::iter::once(&'…')).collect()
+    } else {
+        clean.into_iter().collect()
+    }
+}
+
+/// The disabled items this launch skips, the ones saved for the next launch, and the changes made
+/// to the saved list since this launch last read or wrote the file the apps keep it in.
+struct Disabled {
+    skipped: Vec<Item>,
+    saved: Vec<Item>,
+    changes: Vec<Change>,
+    /// Counts the [`set_disabled`] calls.
+    read: u64,
+}
+
+/// One change to the saved list, made again to the file's list when it is saved ([`merge_saved`]).
+#[derive(Clone)]
+enum Change {
+    /// [`set_enabled`] (or [`disable`], turning it off).
+    Enabled(Item, bool),
+    /// [`disable_file_of`].
+    FileOf(Item),
+}
+
+impl Change {
+    /// Makes the change to `list` → whether it changed.
+    fn apply(&self, list: &mut Vec<Item>) -> bool {
+        match self {
+            Change::Enabled(item, enabled) => enable_in(list, item, *enabled),
+            Change::FileOf(plugin) => file_of_in(list, plugin),
+        }
+    }
+}
+
+static DISABLED: RwLock<Disabled> = RwLock::new(Disabled { skipped: Vec::new(), saved: Vec::new(), changes: Vec::new(), read: 0 });
+
+/// Sets the disabled items, for this launch and the next, as read from the file the apps keep them
+/// in (at most [`MAX_DISABLED`]; one without an id or a file is dropped).
+pub fn set_disabled(items: Vec<Item>) {
+    let items: Vec<Item> = items.into_iter().filter_map(Item::bounded).take(MAX_DISABLED).collect();
+    let mut d = DISABLED.write().unwrap_or_else(|e| e.into_inner());
+    d.skipped = items.clone();
+    d.saved = items;
+    d.changes.clear();
+    d.read += 1;
+}
+
+/// What [`merge_saved`] made: the content to write to the file, and which changes it holds.
+#[derive(Debug)]
+pub struct Merged {
+    /// The file's new content.
+    pub bytes: Vec<u8>,
+    /// The changes it holds: the first `made` of them.
+    made: usize,
+    /// The [`set_disabled`] they follow.
+    read: u64,
+    /// Of those, the ones turning a plug-in off that a full list (another window's) had no room
+    /// for: they stay to be made at the next save.
+    full: Vec<usize>,
+}
+
+/// Before the saved list is written: takes in `theirs`, the list the file holds now (another
+/// window sharing the preferences may have saved it since this launch read it; `None` when it
+/// can't be read, and the saved list stays as it is). The changes this launch made to the saved
+/// list since it last read or wrote the file ([`saved_written`]) are made again, in order, to
+/// `theirs`, and the result becomes the saved list. This launch's skipped list stays as it is.
+pub fn merge_saved(theirs: Option<Vec<Item>>) -> Merged {
+    let mut d = DISABLED.write().unwrap_or_else(|e| e.into_inner());
+    let made = d.changes.len();
+    let mut full = Vec::new();
+    if let Some(theirs) = theirs {
+        let mut merged: Vec<Item> = theirs.into_iter().filter_map(Item::bounded).take(MAX_DISABLED).collect();
+        for (i, change) in d.changes.iter().enumerate() {
+            if !change.apply(&mut merged)
+                && let Change::Enabled(item, false) = change
+                && !merged.iter().any(|m| m.same(item))
+            {
+                full.push(i);
+            }
+        }
+        d.saved = merged;
+    }
+    Merged { bytes: file_bytes(&d.saved), made, read: d.read, full }
+}
+
+impl Merged {
+    /// Does the content hold every change? A plug-in turned off that a full list had no room for
+    /// is not in it (it waits for the next save).
+    pub fn complete(&self) -> bool {
+        self.full.is_empty()
+    }
+}
+
+/// `merged`'s content went to the file: later saves make again only the changes made after
+/// [`merge_saved`], and the ones it had no room for ([`merge_saved`]).
+pub fn saved_written(merged: &Merged) {
+    let mut d = DISABLED.write().unwrap_or_else(|e| e.into_inner());
+    if d.read != merged.read {
+        return;
+    }
+    let made = merged.made.min(d.changes.len());
+    let kept: Vec<Change> = merged.full.iter().filter_map(|&i| d.changes.get(i).filter(|_| i < made).cloned()).collect();
+    d.changes.drain(..made);
+    d.changes.splice(0..0, kept);
+}
+
+/// Adds `item` to the disabled items, for this launch and the next → whether the list saved for
+/// the next launch has it (`false` when that list is full). This launch skips it either way.
+pub fn disable(item: Item) -> bool {
+    let Some(item) = item.bounded() else { return false };
+    let mut d = DISABLED.write().unwrap_or_else(|e| e.into_inner());
+    let d = &mut *d;
+    if !d.skipped.iter().any(|s| s.same(&item)) {
+        d.skipped.push(item.clone());
+    }
+    if enable_in(&mut d.saved, &item, false) {
+        d.changes.push(Change::Enabled(item, false));
+        return true;
+    }
+    d.saved.iter().any(|s| s.same(&item))
+}
+
+/// Turns `item` on or off for the next launch, leaving this launch as it is → whether the saved
+/// list changed.
+pub fn set_enabled(item: &Item, enabled: bool) -> bool {
+    let mut d = DISABLED.write().unwrap_or_else(|e| e.into_inner());
+    let changed = enable_in(&mut d.saved, item, enabled);
+    if changed {
+        d.changes.push(Change::Enabled(item.clone(), enabled));
+    }
+    changed
+}
+
+/// Turns `item` on (removes every entry for it) or off (adds it unless an entry has it, within
+/// [`MAX_DISABLED`]) in `list` → whether it changed.
+fn enable_in(list: &mut Vec<Item>, item: &Item, enabled: bool) -> bool {
+    let before = list.len();
+    if enabled {
+        list.retain(|i| !i.same(item));
+        list.len() != before
+    } else if let Some(item) = item.clone().bounded().filter(|i| !list.iter().any(|s| s.same(i)) && before < MAX_DISABLED) {
+        list.push(item);
+        true
+    } else {
+        false
+    }
+}
+
+/// `plugin`, loaded from its file and then skipped by its id: each list that disables it gets its
+/// file too (the entry naming its id without a file takes it, or a new entry is added), so a later
+/// load skips that file before running any of its code → whether the saved list changed.
+pub fn disable_file_of(plugin: &Item) -> bool {
+    let mut d = DISABLED.write().unwrap_or_else(|e| e.into_inner());
+    let d = &mut *d;
+    file_of_in(&mut d.skipped, plugin);
+    let changed = file_of_in(&mut d.saved, plugin);
+    if changed {
+        d.changes.push(Change::FileOf(plugin.clone()));
+    }
+    changed
+}
+
+/// [`disable_file_of`] for one list → whether it changed.
+fn file_of_in(list: &mut Vec<Item>, plugin: &Item) -> bool {
+    let Some(file) = plugin.file.as_deref().filter(|f| !f.is_empty()) else { return false };
+    let by_file = Item::file(file);
+    if list.iter().any(|i| i.same(&by_file)) || !list.iter().any(|i| i.same(plugin)) {
+        return false;
+    }
+    if let Some(entry) = list.iter_mut().find(|i| i.same(plugin) && i.file.is_none()) {
+        entry.file = Some(bound(file).into_owned());
+    } else if let Some(item) = plugin.clone().bounded().filter(|_| list.len() < MAX_DISABLED) {
+        list.push(item);
+    } else {
+        return false;
+    }
+    true
+}
+
+/// The disabled items saved for the next launch.
+pub fn disabled() -> Vec<Item> {
+    DISABLED.read().unwrap_or_else(|e| e.into_inner()).saved.clone()
+}
+
+/// Does this launch skip `item` (a module file before it loads, or a plug-in once its id is known)?
+pub fn skipped(item: &Item) -> bool {
+    DISABLED.read().unwrap_or_else(|e| e.into_inner()).skipped.iter().any(|i| i.same(item))
+}
+
+/// The ids of the disabled items this launch skips.
+pub fn skipped_ids() -> Vec<String> {
+    DISABLED.read().unwrap_or_else(|e| e.into_inner()).skipped.iter().filter_map(|i| i.id.clone()).collect()
+}
+
+/// The disabled items saved for the next launch, as the file the apps keep them in.
+pub fn disabled_file() -> Vec<u8> {
+    file_bytes(&disabled())
+}
+
+/// `items` as the file the apps keep the disabled items in.
+fn file_bytes(items: &[Item]) -> Vec<u8> {
+    serde_json::to_vec_pretty(&json!({"format": "vectorcraft-disabled-plugins", "version": 1, "items": items})).unwrap_or_default()
+}
+
+/// The items of a file [`disabled_file`] wrote; none when it isn't one.
+pub fn parse_disabled_file(bytes: &[u8]) -> Vec<Item> {
+    read_disabled_file(bytes).unwrap_or_default()
+}
+
+/// The items of a file [`disabled_file`] wrote, `None` when the file is JSON of another format or
+/// version (a later version's list, which a save must not replace). Bytes that aren't JSON hold no
+/// items any launch can read: none.
+pub fn read_disabled_file(bytes: &[u8]) -> Option<Vec<Item>> {
+    let Ok(v) = serde_json::from_slice::<Value>(bytes) else { return Some(vec![]) };
+    if v["format"] != "vectorcraft-disabled-plugins" || v["version"] != 1 {
+        return None;
+    }
+    Some(
+        v["items"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .filter_map(|i| serde_json::from_value::<Item>(i.clone()).ok()?.bounded())
+            .take(MAX_DISABLED)
+            .collect(),
+    )
+}
+
+/// The item the launch before this one was loading when it stopped, once [`begin_launch`] read it.
+static PREVIOUS: Mutex<Option<Item>> = Mutex::new(None);
+
+/// The item the launch before this one was loading when it stopped ([`begin_launch`]); `None` once
+/// the user chose what to do about it ([`forget_previous`]).
+pub fn previous() -> Option<Item> {
+    PREVIOUS.lock().unwrap_or_else(|e| e.into_inner()).clone()
+}
+
+/// The user chose what to do about [`previous`]: this launch's marker stops naming it.
+pub fn forget_previous() {
+    *PREVIOUS.lock().unwrap_or_else(|e| e.into_inner()) = None;
+    refresh();
+}
+
+/// The items still loading, oldest first: one entry for each [`loading`] call, until the [`loaded`]
+/// given its [`Loading`].
+struct Running {
+    next: u64,
+    items: Vec<(u64, Item)>,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Running {
+    /// The item this launch's marker names: the oldest item still loading, else [`previous`].
+    fn pending(&self) -> Option<Item> {
+        self.items.first().map(|(_, i)| i.clone()).or_else(previous)
+    }
+}
+
+static LOADING: Mutex<Running> = Mutex::new(Running { next: 0, items: Vec::new() });
+
+/// One item [`loading`] named, until it is given to [`loaded`].
+#[must_use]
+#[derive(Debug)]
+pub struct Loading(u64);
+
+/// Writes this launch's marker naming the item [`Running::pending`] gives, while holding the lock
+/// on the items still loading, so two threads' writes land in the order of their changes.
+fn refresh() {
+    #[cfg(not(target_arch = "wasm32"))]
+    marker::write(LOADING.lock().unwrap_or_else(|e| e.into_inner()).pending().as_ref());
+}
+
+/// The marker's content naming `item`, cut as a stored item is (none: nothing is loading).
+#[cfg(not(target_arch = "wasm32"))]
+fn marker_bytes(item: Option<&Item>) -> Vec<u8> {
+    let item = item.cloned().and_then(Item::bounded);
+    serde_json::to_vec(&json!({"format": MARKER_FORMAT, "version": MARKER_VERSION, "item": item})).unwrap_or_default()
+}
+
+/// The item a marker's content names; `None` when it names none or isn't a marker of this version.
+pub fn parse_marker(bytes: &[u8]) -> Option<Item> {
+    if bytes.len() as u64 > MAX_MARKER_BYTES {
+        return None;
+    }
+    let v: Value = serde_json::from_slice(bytes).ok()?;
+    if v["format"] != MARKER_FORMAT || v["version"] != MARKER_VERSION {
+        return None;
+    }
+    serde_json::from_value::<Item>(v.get("item").filter(|i| i.is_object())?.clone()).ok()?.bounded()
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub use marker::{begin_launch, end_launch};
+
+/// Adds `item` to the items still loading and writes this launch's marker naming the oldest of
+/// them (no marker: only the list changes) → the [`Loading`] to give to [`loaded`] when it is done.
+pub fn loading(item: &Item) -> Loading {
+    let mut running = LOADING.lock().unwrap_or_else(|e| e.into_inner());
+    let token = running.next;
+    running.next = running.next.wrapping_add(1);
+    running.items.push((token, item.clone()));
+    #[cfg(not(target_arch = "wasm32"))]
+    marker::write(running.pending().as_ref());
+    Loading(token)
+}
+
+/// Removes the item `token` names from the items still loading and writes this launch's marker
+/// naming the oldest one left; with none left, the item of [`previous`] or nothing.
+pub fn loaded(token: Loading) {
+    let mut running = LOADING.lock().unwrap_or_else(|e| e.into_inner());
+    running.items.retain(|(t, _)| *t != token.0);
+    #[cfg(not(target_arch = "wasm32"))]
+    marker::write(running.pending().as_ref());
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+mod marker {
+    use std::fs::File;
+    use std::io::{Read, Write};
+    use std::path::{Path, PathBuf};
+    use std::sync::Mutex;
+
+    use super::{Item, LOADING, MAX_MARKER_BYTES, PREVIOUS, marker_bytes, parse_marker};
+
+    /// The most marker files looked at in the folder.
+    const MAX_MARKERS: usize = 100;
+    const PREFIX: &str = "launch-";
+
+    /// This launch's marker: its folder, its name and the open lock file.
+    struct Current {
+        dir: PathBuf,
+        token: String,
+        _lock: File,
+    }
+
+    static CURRENT: Mutex<Option<Current>> = Mutex::new(None);
+
+    fn json_path(dir: &Path, token: &str) -> PathBuf {
+        dir.join(format!("{PREFIX}{token}.json"))
+    }
+    fn lock_path(dir: &Path, token: &str) -> PathBuf {
+        dir.join(format!("{PREFIX}{token}.lock"))
+    }
+    fn tmp_path(dir: &Path, token: &str) -> PathBuf {
+        dir.join(format!("{PREFIX}{token}.json.tmp"))
+    }
+
+    /// Is the launch `token` still running (does it hold its lock)?
+    fn running(dir: &Path, token: &str) -> bool {
+        let Ok(f) = File::options().read(true).write(true).open(lock_path(dir, token)) else { return false };
+        match f.try_lock() {
+            Ok(()) => {
+                let _ = f.unlock();
+                false
+            }
+            Err(_) => true,
+        }
+    }
+
+    /// The content of `path` up to [`MAX_MARKER_BYTES`]; `None` when it can't be read or is larger.
+    fn read(path: &Path) -> Option<Vec<u8>> {
+        let mut bytes = Vec::new();
+        File::open(path).ok()?.take(MAX_MARKER_BYTES + 1).read_to_end(&mut bytes).ok()?;
+        (bytes.len() as u64 <= MAX_MARKER_BYTES).then_some(bytes)
+    }
+
+    /// Starts this launch's marker in `dir` → the item a launch that is no longer running was
+    /// loading when it stopped, if one was (its marker is then removed, and this launch's marker
+    /// names the item until [`super::forget_previous`]). A folder that can't be written leaves this
+    /// launch without a marker; it still starts.
+    pub fn begin_launch(dir: &Path) -> Option<Item> {
+        let mut previous = None;
+        let mut tokens: Vec<String> = std::fs::read_dir(dir)
+            .into_iter()
+            .flatten()
+            .filter_map(|e| e.ok()?.file_name().into_string().ok())
+            .filter_map(|n| Some(n.strip_prefix(PREFIX)?.strip_suffix(".json")?.to_string()))
+            .collect();
+        tokens.sort();
+        tokens.truncate(MAX_MARKERS);
+        for token in tokens {
+            if running(dir, &token) {
+                continue;
+            }
+            if previous.is_none() {
+                previous = read(&json_path(dir, &token)).as_deref().and_then(parse_marker);
+            }
+            for path in [json_path(dir, &token), tmp_path(dir, &token), lock_path(dir, &token)] {
+                let _ = std::fs::remove_file(path);
+            }
+        }
+        *PREVIOUS.lock().unwrap_or_else(|e| e.into_inner()) = previous.clone();
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
+        let token = format!("{}-{nanos:x}", std::process::id());
+        let lock = std::fs::create_dir_all(dir)
+            .and_then(|()| File::options().create(true).truncate(false).read(true).write(true).open(lock_path(dir, &token)));
+        if let Ok(lock) = lock.and_then(|f| f.try_lock().map(|()| f).map_err(std::io::Error::other)) {
+            *CURRENT.lock().unwrap_or_else(|e| e.into_inner()) = Some(Current { dir: dir.to_path_buf(), token, _lock: lock });
+            super::refresh();
+        }
+        previous
+    }
+
+    /// Replaces this launch's marker with one naming `item`: written to a temporary file first,
+    /// then renamed over the marker, so a reader finds the old marker or the new one. A write that
+    /// fails leaves the marker as it was.
+    pub(super) fn write(item: Option<&Item>) {
+        let current = CURRENT.lock().unwrap_or_else(|e| e.into_inner());
+        let Some(c) = current.as_ref() else { return };
+        let tmp = tmp_path(&c.dir, &c.token);
+        let _ = File::create(&tmp)
+            .and_then(|mut f| f.write_all(&marker_bytes(item)).and_then(|()| f.sync_all()))
+            .and_then(|()| std::fs::rename(&tmp, json_path(&c.dir, &c.token)));
+    }
+
+    /// Removes this launch's marker: the app is quitting normally. While an item is still loading
+    /// ([`super::loading`] without [`super::loaded`]), the marker stays, naming the oldest one;
+    /// otherwise, while the user has not chosen what to do about [`super::previous`], the marker
+    /// stays, naming that, so the next launch asks.
+    pub fn end_launch() {
+        let running = LOADING.lock().unwrap_or_else(|e| e.into_inner());
+        let pending = running.pending();
+        if pending.is_some() {
+            write(pending.as_ref());
+        }
+        let Some(c) = CURRENT.lock().unwrap_or_else(|e| e.into_inner()).take() else { return };
+        let Current { dir, token, _lock } = c;
+        drop(_lock);
+        let marker = pending.is_none().then(|| json_path(&dir, &token));
+        for path in marker.into_iter().chain([tmp_path(&dir, &token), lock_path(&dir, &token)]) {
+            let _ = std::fs::remove_file(path);
+        }
+    }
+
+    #[cfg(test)]
+    pub(super) fn path_of_current() -> Option<PathBuf> {
+        CURRENT.lock().unwrap_or_else(|e| e.into_inner()).as_ref().map(|c| json_path(&c.dir, &c.token))
+    }
+}
+
+/// Serializes the tests that change this module's process-wide state.
+#[cfg(test)]
+pub(crate) static TEST_LOCK: Mutex<()> = Mutex::new(());
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Safe Mode off, no launch marker, nothing loading, pending or disabled.
+    fn reset() {
+        LOADING.lock().unwrap_or_else(|e| e.into_inner()).items.clear();
+        end_launch();
+        set_active(None);
+        forget_previous();
+        set_disabled(vec![]);
+    }
+
+    /// Holds [`TEST_LOCK`] for one test and resets the module's state when the test starts and when
+    /// it ends, so a test that fails leaves the next one as it would find a new process.
+    struct Fresh {
+        _guard: std::sync::MutexGuard<'static, ()>,
+    }
+
+    fn fresh() -> Fresh {
+        let guard = TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        reset();
+        Fresh { _guard: guard }
+    }
+
+    impl Drop for Fresh {
+        fn drop(&mut self) {
+            reset();
+        }
+    }
+
+    fn temp_dir(name: &str) -> std::path::PathBuf {
+        let d = std::env::temp_dir().join(format!("vc-safe-mode-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn names_are_bounded_and_cannot_reorder_or_hide_text() {
+        assert_eq!(display_name("Good\u{202E}gnp.exe"), "Goodgnp.exe");
+        assert_eq!(display_name("a\u{0007}b\nc\u{2067}d\u{200F}"), "abcd");
+        let long = "x".repeat(200);
+        let shown = display_name(&long);
+        assert_eq!(shown.chars().count(), MAX_NAME_CHARS);
+        assert!(shown.ends_with('…'));
+        // The label shows the name, but the id still picks the plug-in.
+        let item = Item { id: Some("org.example.a".into()), file: None, name: Some("\u{202E}evil".into()) };
+        assert_eq!(item.label(), "evil");
+        assert!(item.same(&Item { id: Some("org.example.a".into()), file: None, name: Some("other".into()) }));
+        assert!(!item.same(&Item { id: Some("org.example.b".into()), file: None, name: Some("\u{202E}evil".into()) }));
+        assert_eq!(Item::file("C:\\Plug-ins\\x.wasm").label(), "x.wasm");
+    }
+
+    #[test]
+    fn only_a_marker_of_this_version_names_an_item() {
+        let item = Item { id: Some("org.example.x".into()), file: Some("/p/x.wasm".into()), name: None };
+        assert_eq!(parse_marker(&marker_bytes(Some(&item))), Some(item));
+        assert_eq!(parse_marker(&marker_bytes(None)), None, "nothing was loading");
+        for bad in [
+            &b""[..],
+            b"{",
+            b"[]",
+            br#"{"format":"vectorcraft-launch","version":2,"item":{"id":"x"}}"#,
+            br#"{"format":"other","version":1,"item":{"id":"x"}}"#,
+            br#"{"format":"vectorcraft-launch","version":1,"item":"x"}"#,
+            br#"{"format":"vectorcraft-launch","version":1,"item":{}}"#,
+            br#"{"format":"vectorcraft-launch","version":1,"item":{"id":"x""#,
+        ] {
+            assert_eq!(parse_marker(bad), None, "{}", String::from_utf8_lossy(bad));
+        }
+        let mut big =
+            format!(r#"{{"format":"vectorcraft-launch","version":1,"item":{{"id":"{}"}}}}"#, "y".repeat(MAX_MARKER_BYTES as usize)).into_bytes();
+        assert_eq!(parse_marker(&big), None, "larger than the limit");
+        big.truncate(10);
+        assert_eq!(parse_marker(&big), None, "cut short");
+    }
+
+    #[test]
+    fn a_launch_that_stopped_names_its_item_and_a_running_one_does_not() {
+        let _f = fresh();
+        let dir = temp_dir("marker");
+        // A launch that stopped while loading x: its marker without a held lock, and a stray
+        // temporary file from a write it didn't finish.
+        let x = Item { id: Some("org.example.x".into()), file: None, name: Some("X".into()) };
+        std::fs::write(dir.join("launch-1-a.json"), marker_bytes(Some(&x))).unwrap();
+        std::fs::write(dir.join("launch-1-a.json.tmp"), b"{\"format\":\"vectorcr").unwrap();
+        assert_eq!(begin_launch(&dir), Some(x.clone()));
+        assert_eq!(previous(), Some(x.clone()));
+        assert!(!dir.join("launch-1-a.json").exists() && !dir.join("launch-1-a.json.tmp").exists(), "read once");
+        let mine = marker::path_of_current().unwrap();
+        assert_eq!(std::fs::read(&mine).ok().as_deref().and_then(parse_marker), Some(x.clone()), "named until the user chooses");
+        forget_previous();
+        assert_eq!(std::fs::read(&mine).ok().as_deref().and_then(parse_marker), None);
+        let token = loading(&x);
+        assert_eq!(std::fs::read(&mine).ok().as_deref().and_then(parse_marker), Some(x.clone()));
+        assert!(!mine.with_extension("json.tmp").exists(), "the temporary file is renamed over the marker");
+        loaded(token);
+        assert_eq!(std::fs::read(&mine).ok().as_deref().and_then(parse_marker), None);
+        end_launch();
+        assert!(!mine.exists(), "a normal quit removes the marker");
+        assert_eq!(begin_launch(&dir), None, "nothing left behind");
+        end_launch();
+        forget_previous();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_launch_that_quits_before_the_user_chooses_leaves_the_choice_to_the_next() {
+        let _f = fresh();
+        let dir = temp_dir("pending");
+        let x = Item { id: Some("org.example.x".into()), file: None, name: Some("X".into()) };
+        std::fs::write(dir.join("launch-1-a.json"), marker_bytes(Some(&x))).unwrap();
+        assert_eq!(begin_launch(&dir), Some(x.clone()));
+        end_launch();
+        assert_eq!(begin_launch(&dir), Some(x.clone()), "asked again");
+        forget_previous();
+        end_launch();
+        assert_eq!(begin_launch(&dir), None, "once the user chose");
+        end_launch();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_launch_that_ends_while_a_plug_in_loads_names_it_at_the_next_launch() {
+        let _f = fresh();
+        let dir = temp_dir("ends-loading");
+        let x = Item { id: Some("org.example.x".into()), file: None, name: Some("X".into()) };
+        assert_eq!(begin_launch(&dir), None);
+        let token = loading(&x);
+        // A panic the app caught while x loaded: the app quits without `loaded`.
+        end_launch();
+        loaded(token);
+        assert_eq!(begin_launch(&dir), Some(x.clone()), "the next launch asks");
+        forget_previous();
+        end_launch();
+        assert_eq!(begin_launch(&dir), None);
+        end_launch();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn the_marker_names_a_plug_in_still_loading_when_another_one_is_done() {
+        let _f = fresh();
+        let dir = temp_dir("two-loading");
+        let a = Item { id: Some("org.example.a".into()), file: None, name: Some("A".into()) };
+        let b = Item { id: Some("org.example.b".into()), file: None, name: Some("B".into()) };
+        assert_eq!(begin_launch(&dir), None);
+        let mine = marker::path_of_current().unwrap();
+        let marker = || std::fs::read(&mine).ok().as_deref().and_then(parse_marker);
+        // Two threads run their plug-ins' first evaluations at once.
+        let ta = loading(&a);
+        let tb = loading(&b);
+        assert_eq!(marker(), Some(a.clone()), "the oldest item still loading");
+        loaded(ta);
+        assert_eq!(marker(), Some(b.clone()), "b is still loading");
+        // The app stops while b loads.
+        end_launch();
+        loaded(tb);
+        assert_eq!(begin_launch(&dir), Some(b.clone()), "the next launch offers b");
+        forget_previous();
+        end_launch();
+        assert_eq!(begin_launch(&dir), None);
+        end_launch();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_long_file_path_names_and_matches_its_plug_in() {
+        let _f = fresh();
+        let dir = temp_dir("long-path");
+        // Each character written as 6 or 2 bytes, so the item is far larger in JSON than in characters.
+        let long = format!("C:\\{}\\x.wasm", "\u{1}é".repeat(700));
+        assert_eq!(begin_launch(&dir), None);
+        let token = loading(&Item::file(long.clone()));
+        end_launch();
+        loaded(token);
+        let stopped = begin_launch(&dir).expect("the marker names the module");
+        assert!(stopped.same(&Item::file(long.clone())), "the stored item matches the full path");
+        disable(stopped);
+        assert!(skipped(&Item::file(long.clone())), "Disable and Continue skips it");
+        assert!(!skipped(&Item::file(format!("D{}", &long[1..]))), "a path that differs within the kept part is another plug-in");
+        let other = long.replace("x.wasm", "y.wasm");
+        assert!(!skipped(&Item::file(other.clone())), "a path that differs after the kept part is another plug-in");
+        assert!(!Item::file(long.clone()).same(&Item::file(other)));
+        forget_previous();
+        end_launch();
+        set_disabled(vec![]);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_full_list_of_long_items_fits_the_file_the_apps_read() {
+        let _f = fresh();
+        let field = |i: usize, tag: &str| format!("{tag}{i:04}{}", "\u{1}".repeat(MAX_FIELD_CHARS));
+        set_disabled((0..MAX_DISABLED).map(|i| Item { id: Some(field(i, "i")), file: Some(field(i, "f")), name: Some(field(i, "n")) }).collect());
+        let file = disabled_file();
+        assert!(file.len() as u64 <= MAX_DISABLED_FILE_BYTES, "{} bytes", file.len());
+        assert_eq!(parse_disabled_file(&file).len(), MAX_DISABLED);
+        // A full list has no room for one more: this launch skips it, and the caller is told.
+        let late = Item::file("late.wasm");
+        assert!(!disable(late.clone()));
+        assert!(skipped(&late) && !disabled().contains(&late));
+        assert!(disable(Item { id: Some(field(0, "i")), ..Item::default() }), "one the list has");
+        set_disabled(vec![]);
+    }
+
+    /// A plug-in turned on here is removed from the file's list even when another window saved its
+    /// entry with more details. A change whose save failed, one made while the file was written and
+    /// one that a full list had no room for are made again at the next save.
+    #[test]
+    fn merging_the_saved_list_matches_plug_ins_and_keeps_unsaved_changes() {
+        let _f = fresh();
+        let id = |s: &str| Item { id: Some(s.into()), ..Item::default() };
+        set_disabled(vec![id("x")]);
+        assert!(set_enabled(&id("x"), true));
+        let theirs_x = Item { id: Some("x".into()), file: Some("/p/x.wasm".into()), name: Some("X".into()) };
+        let merged = merge_saved(Some(vec![theirs_x, id("y")]));
+        assert_eq!(disabled(), [id("y")], "x is turned on, whatever details the other window saved");
+        assert_eq!(parse_disabled_file(&merged.bytes), [id("y")]);
+        saved_written(&merged);
+
+        assert!(set_enabled(&id("a"), false));
+        // Another window has turned c off.
+        let _ = merge_saved(Some(vec![id("y"), id("c")]));
+        // The write failed: no saved_written. The other window turns c on again.
+        assert!(set_enabled(&id("b"), false));
+        let merged = merge_saved(Some(vec![id("y")]));
+        assert_eq!(disabled(), [id("y"), id("a"), id("b")], "a is still saved, and c stays on");
+        // A change made while the file is written is made again at the next save.
+        assert!(set_enabled(&id("d"), false));
+        saved_written(&merged);
+        let _ = merge_saved(Some(vec![id("y"), id("a"), id("b")]));
+        assert_eq!(disabled(), [id("y"), id("a"), id("b"), id("d")]);
+        set_disabled(vec![]);
+
+        // Another window filled the list: the plug-in turned off here waits for room.
+        let full: Vec<Item> = (0..MAX_DISABLED).map(|i| id(&format!("full{i}"))).collect();
+        assert!(set_enabled(&id("e"), false));
+        let merged = merge_saved(Some(full.clone()));
+        assert_eq!(disabled(), full);
+        saved_written(&merged);
+        let _ = merge_saved(Some(full[1..].to_vec()));
+        assert_eq!(disabled().last(), Some(&id("e")), "made once there is room");
+
+        // This launch adds x's file to its entry: the file's entry for x takes it, unless another
+        // window turned x on meanwhile.
+        let x_file = Item { id: Some("x".into()), file: Some("/p/x.wasm".into()), name: Some("X".into()) };
+        let x_entry = Item { name: None, ..x_file.clone() };
+        for (theirs, expected) in [(vec![id("x"), id("y")], vec![x_entry, id("y")]), (vec![id("y")], vec![id("y")])] {
+            set_disabled(vec![id("x"), id("y")]);
+            assert!(disable_file_of(&x_file));
+            let _ = merge_saved(Some(theirs));
+            assert_eq!(disabled(), expected);
+        }
+    }
+
+    #[test]
+    fn a_marker_whose_launch_holds_its_lock_is_left_alone() {
+        let _f = fresh();
+        let dir = temp_dir("running");
+        let x = Item { id: Some("org.example.x".into()), file: None, name: None };
+        std::fs::write(dir.join("launch-9-b.json"), marker_bytes(Some(&x))).unwrap();
+        let lock = std::fs::File::create(dir.join("launch-9-b.lock")).unwrap();
+        lock.try_lock().unwrap();
+        assert_eq!(begin_launch(&dir), None, "that launch is still running");
+        assert!(dir.join("launch-9-b.json").exists());
+        end_launch();
+        drop(lock);
+        assert_eq!(begin_launch(&dir), Some(x), "once it stopped");
+        end_launch();
+        forget_previous();
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn enabling_takes_effect_at_the_next_launch() {
+        let _f = fresh();
+        let x = Item { id: Some("org.example.x".into()), file: Some("/p/x.wasm".into()), name: None };
+        let y = Item::file("/p/y.wasm");
+        set_disabled(vec![x.clone(), Item::default()]);
+        assert_eq!(disabled(), std::slice::from_ref(&x), "an item that names nothing is dropped");
+        assert!(skipped(&Item { id: Some("org.example.x".into()), ..Item::default() }));
+        assert!(!skipped(&y));
+        assert!(set_enabled(&x, true));
+        assert!(disabled().is_empty());
+        assert!(skipped(&x), "still skipped until the next launch");
+        assert!(set_enabled(&y, false) && !set_enabled(&y, false));
+        assert!(!skipped(&y), "turning one off waits for the next launch too");
+        disable(y.clone());
+        assert!(skipped(&y));
+        assert_eq!(parse_disabled_file(&disabled_file()), disabled());
+        assert!(parse_disabled_file(b"{\"format\":\"other\",\"version\":1,\"items\":[{\"id\":\"x\"}]}").is_empty());
+        set_disabled(vec![]);
+    }
+}
diff --git a/crates/plugins/tests/safe_mode.rs b/crates/plugins/tests/safe_mode.rs
new file mode 100644
index 000000000..b496e4edb
--- /dev/null
+++ b/crates/plugins/tests/safe_mode.rs
@@ -0,0 +1,134 @@
+//! Safe Mode and disabled plug-ins: in Safe Mode no plug-in loads or runs (one installed before it
+//! was turned on included), and loading a folder skips the plug-ins the user disabled. Safe Mode is
+//! process-wide, so these tests run in their own test binary, one at a time.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::sync::Mutex;
+
+use serde_json::json;
+use vectorcraft_geom::{FillRule, PathData, Rect};
+use vectorcraft_plugins::safe_mode::{self, Item, Source};
+use vectorcraft_plugins::{Error, Limits, Plugin, effect, registry, wat as tpl};
+
+static LOCK: Mutex<()> = Mutex::new(());
+
+/// Safe Mode off, nothing disabled or installed.
+fn reset() {
+    safe_mode::set_active(None);
+    safe_mode::set_disabled(vec![]);
+    for p in registry::list() {
+        registry::remove(p.id());
+    }
+}
+
+/// Holds the lock for one test and resets the process-wide state when the test starts and when it
+/// ends, so a test that fails leaves the next one as it would find a new process.
+struct Fresh {
+    _guard: std::sync::MutexGuard<'static, ()>,
+}
+
+fn fresh() -> Fresh {
+    let guard = LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    reset();
+    Fresh { _guard: guard }
+}
+
+impl Drop for Fresh {
+    fn drop(&mut self) {
+        reset();
+    }
+}
+
+fn build(src: &str) -> Vec<u8> {
+    wat::parse_str(src).unwrap_or_else(|e| panic!("bad test WAT: {e}\n{src}"))
+}
+
+fn filter(id: &str) -> Vec<u8> {
+    build(&tpl::returning(&tpl::manifest(id, "filter", "{}"), r#"{"objects":[]}"#))
+}
+
+fn temp_dir(name: &str) -> std::path::PathBuf {
+    let d = std::env::temp_dir().join(format!("vc-safe-mode-it-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+#[test]
+fn in_safe_mode_nothing_loads_or_runs() {
+    let _f = fresh();
+    // Installed before Safe Mode was turned on.
+    let before = registry::install(Plugin::load(&filter("test.safe.before"), Limits::default()).unwrap());
+    let fx = build(&tpl::returning(&tpl::manifest("test.safe.effect", "effect", "{}"), r#"{"objects":[]}"#));
+    registry::install(Plugin::load(&fx, Limits::default()).unwrap());
+    let dir = temp_dir("gate");
+    std::fs::write(dir.join("a.wasm"), filter("test.safe.folder")).unwrap();
+
+    safe_mode::set_active(Some(Source::Flag));
+    assert_eq!((safe_mode::active(), safe_mode::source()), (true, Some(Source::Flag)));
+    assert_eq!(Plugin::load(&filter("test.safe.new"), Limits::default()).err(), Some(Error::SafeMode));
+    assert_eq!(before.run(br#"{"objects":[]}"#, b"{}"), Err(Error::SafeMode), "an installed plug-in can't run either");
+    assert_eq!(registry::load_folder(&dir), Err(Error::SafeMode));
+    assert!(registry::get("test.safe.folder").is_none());
+    let path = PathData::default();
+    let drawn = effect::apply("test.safe.effect", &json!({}), &path, Rect::new(0.0, 0.0, 1.0, 1.0), FillRule::NonZero, effect::Paints::default());
+    assert_eq!(drawn, None, "the geometry is drawn unchanged");
+    assert_eq!(effect::last_error("test.safe.effect"), None, "not a failure of the plug-in");
+    assert_eq!(Error::SafeMode.to_string(), "Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally");
+
+    safe_mode::set_active(None);
+    assert!(before.run(br#"{"objects":[]}"#, b"{}").is_ok(), "nothing was uninstalled");
+    assert_eq!(registry::load_folder(&dir).unwrap().loaded, ["test.safe.folder"]);
+    registry::remove("test.safe.before");
+    registry::remove("test.safe.effect");
+    registry::remove("test.safe.folder");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn loading_a_folder_skips_disabled_plug_ins_by_file_or_id() {
+    let _f = fresh();
+    let dir = temp_dir("disabled");
+    let (x, y, z) = (dir.join("x.wasm"), dir.join("y.wasm"), dir.join("z.wasm"));
+    std::fs::write(&x, filter("test.disabled.x")).unwrap();
+    std::fs::write(&y, filter("test.disabled.y")).unwrap();
+    std::fs::write(&z, filter("test.disabled.z")).unwrap();
+    safe_mode::set_disabled(vec![Item::file(x.display().to_string()), Item { id: Some("test.disabled.z".into()), ..Item::default() }]);
+    let report = registry::load_folder(&dir).unwrap();
+    assert_eq!(report.loaded, ["test.disabled.y"]);
+    let failed: Vec<(&str, &str)> = report.failed.iter().map(|(f, e)| (f.as_str(), e.as_str())).collect();
+    assert_eq!(failed, [(x.display().to_string().as_str(), registry::DISABLED), (z.display().to_string().as_str(), registry::DISABLED)]);
+    assert!(registry::get("test.disabled.x").is_none() && registry::get("test.disabled.z").is_none());
+    safe_mode::set_disabled(vec![]);
+    registry::remove("test.disabled.y");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_module_disabled_by_id_alone_runs_no_code_on_the_next_folder_load() {
+    let _f = fresh();
+    let dir = temp_dir("by-id");
+    let w = dir.join("w.wasm");
+    std::fs::write(&w, filter("test.byid.w")).unwrap();
+    let by_id = Item { id: Some("test.byid.w".into()), name: Some("W".into()), ..Item::default() };
+    safe_mode::set_disabled(vec![by_id]);
+    let first = registry::load_folder(&dir).unwrap();
+    assert_eq!(first.failed, [(w.display().to_string(), registry::DISABLED.to_string())]);
+    assert!(first.disabled_changed, "the app saves the list with the file");
+    assert_eq!(safe_mode::disabled().len(), 1, "the entry takes the file; no second entry");
+    assert_eq!(safe_mode::disabled()[0].file.as_deref(), Some(w.display().to_string().as_str()));
+    // A module that fails as soon as it loads: the file is skipped before any of it runs.
+    std::fs::write(&w, b"not a module").unwrap();
+    let second = registry::load_folder(&dir).unwrap();
+    assert_eq!(second.failed, [(w.display().to_string(), registry::DISABLED.to_string())]);
+    assert!(!second.disabled_changed);
+    // Turned back on for the next launch: loading doesn't disable its file again for that launch.
+    std::fs::write(&w, filter("test.byid.w")).unwrap();
+    safe_mode::set_disabled(vec![Item { id: Some("test.byid.w".into()), ..Item::default() }]);
+    assert!(safe_mode::set_enabled(&Item { id: Some("test.byid.w".into()), ..Item::default() }, true));
+    let third = registry::load_folder(&dir).unwrap();
+    assert!(!third.disabled_changed && safe_mode::disabled().is_empty());
+    assert!(safe_mode::skipped(&Item::file(w.display().to_string())), "this launch still skips it");
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/render/src/fx/bounds.rs b/crates/render/src/fx/bounds.rs
index 3e2692179..b31175fdb 100644
--- a/crates/render/src/fx/bounds.rs
+++ b/crates/render/src/fx/bounds.rs
@@ -33,6 +33,19 @@ pub(crate) fn effected_path(n: &Node, bp: &BezPath) -> BezPath {
     apply(&n.appearance.effects, bp, &GeomContext::of(n))
 }
 
+/// [`apply`], and how gradients follow the effects ([`effects::Carry`]).
+pub(super) fn apply_carrying(effects: &[Effect], bp: &BezPath, ctx: &GeomContext) -> (BezPath, effects::Carry) {
+    if !effects::has_geometry(effects) || bp.elements().is_empty() {
+        return (bp.clone(), effects::Carry::default());
+    }
+    effects::apply_geometry_bez_carrying(effects, bp, bp.bounding_box(), ctx)
+}
+
+/// [`effected_path`], and how `n`'s gradients follow its effects.
+pub(crate) fn effected_path_carrying(n: &Node, bp: &BezPath) -> (BezPath, effects::Carry) {
+    apply_carrying(&n.appearance.effects, bp, &GeomContext::of(n))
+}
+
 pub(super) fn item_effects(item: &AppearanceItem) -> &[Effect] {
     match item {
         AppearanceItem::Fill(f) => &f.effects,
diff --git a/crates/render/src/fx/entries.rs b/crates/render/src/fx/entries.rs
index ec223173b..29f5724c3 100644
--- a/crates/render/src/fx/entries.rs
+++ b/crates/render/src/fx/entries.rs
@@ -360,6 +360,11 @@ pub(super) fn raster_bytes(pm: &vello_cpu::Pixmap) -> usize {
 pub(crate) struct FxGeom {
     pub(crate) node: Arc<Node>,
     pub(super) g: Arc<BezPath>,
-    pub(super) items: Vec<Option<Arc<BezPath>>>,
+    /// The node with its gradients moved along with its effects, when they move.
+    pub(super) carried: Option<Arc<Node>>,
+    pub(super) items: Vec<Option<ItemGeom>>,
     pub(crate) stamp: u64,
 }
+
+/// One appearance item's own effected geometry, and how its gradient follows those effects.
+pub(super) type ItemGeom = (Arc<BezPath>, Arc<effects::Carry>);
diff --git a/crates/render/src/fx/pixels.rs b/crates/render/src/fx/pixels.rs
index b544be8d1..a2ace3dbd 100644
--- a/crates/render/src/fx/pixels.rs
+++ b/crates/render/src/fx/pixels.rs
@@ -1,5 +1,5 @@
-use super::bounds::{apply, item_effects};
-use super::entries::{Content, DocInputs, Drawn, FX_RASTER_BUDGET, Inputs, KeptImage, Made, Reads, feather_outline};
+use super::bounds::{apply_carrying, item_effects};
+use super::entries::{Content, DocInputs, Drawn, FX_RASTER_BUDGET, Inputs, ItemGeom, KeptImage, Made, Reads, feather_outline};
 #[cfg(test)]
 use super::raster::RASTERIZED;
 use super::raster::{
@@ -630,7 +630,7 @@ impl Renderer {
         g: &BezPath,
         rule: FillRule,
         gctx: &GeomContext,
-        mut cache: Option<&mut Vec<Option<Arc<BezPath>>>>,
+        mut cache: Option<&mut Vec<Option<ItemGeom>>>,
     ) {
         let bounds = g.bounding_box();
         for (j, item) in n.appearance.items.iter().enumerate() {
@@ -639,12 +639,23 @@ impl Renderer {
             }
             // The item's own geometry effects on `g`, from the cache when there is one.
             let slot = cache.as_deref_mut().and_then(|c| c.get_mut(j));
-            let ig: Arc<BezPath> = match slot {
-                Some(Some(ig)) => ig.clone(),
-                Some(s) => s.insert(Arc::new(apply(item_effects(item), g, &gctx.item(item)))).clone(),
-                None => Arc::new(apply(item_effects(item), g, &gctx.item(item))),
+            let made = || {
+                let (ig, carry) = apply_carrying(item_effects(item), g, &gctx.item(item));
+                (Arc::new(ig), Arc::new(carry))
+            };
+            let (ig, carry): ItemGeom = match slot {
+                Some(Some(e)) => e.clone(),
+                Some(s) => s.insert(made()).clone(),
+                None => made(),
             };
             let ig = &*ig;
+            // The item with its gradient moved along with its own effects.
+            let carried = (!carry.is_empty() && matches!(item.paint(), vectorcraft_color::Paint::Gradient(_))).then(|| {
+                let mut ap = vectorcraft_doc::Appearance { items: vec![item.clone()], ..Default::default() };
+                carry.apply(&mut ap);
+                ap.items.pop()
+            });
+            let item = carried.as_ref().and_then(Option::as_ref).unwrap_or(item);
             let ib = if effects::has_geometry(item_effects(item)) && !ig.elements().is_empty() { ig.bounding_box() } else { bounds };
             let rfx = effects::raster_effects(item_effects(item));
             if rfx.is_empty() {
diff --git a/crates/render/src/fx/renderer.rs b/crates/render/src/fx/renderer.rs
index 6b7aa49f7..31ae6d102 100644
--- a/crates/render/src/fx/renderer.rs
+++ b/crates/render/src/fx/renderer.rs
@@ -1,5 +1,5 @@
-use super::bounds::{cull_bounds, effected_path};
-use super::entries::{Content, Drawn, FX_RASTER_BUDGET, FxGeom, Inputs, Kept, Made, Reads, Shadow, ShadowEntry};
+use super::bounds::{cull_bounds, effected_path_carrying};
+use super::entries::{Content, Drawn, FX_RASTER_BUDGET, FxGeom, Inputs, ItemGeom, Kept, Made, Reads, Shadow, ShadowEntry};
 use super::predicates::{evaluates_live, is_container, rasterize_bounds, reads_outside, shifted};
 use super::raster::{
     DRAG_PIXEL_BUDGET, MAX_RASTERIZE, PIXEL_BUDGET, ViewCrop, content_changing, doc_raster_ppi, image_size, linear_key, pan_margin, pcolor,
@@ -339,29 +339,39 @@ impl Renderer {
             let stamp = self.stamp;
             let e = match self.fx_geom.remove(&key) {
                 Some(e) if Arc::ptr_eq(&e.node, &o) => e,
-                _ => FxGeom { g: Arc::new(effected_path(n, bp)), items: vec![None; n.appearance.items.len()], node: o, stamp },
+                _ => {
+                    let (g, carry) = effected_path_carrying(n, bp);
+                    FxGeom { g: Arc::new(g), carried: carried(n, &carry), items: vec![None; n.appearance.items.len()], node: o, stamp }
+                }
             };
             (key, FxGeom { stamp, ..e })
         });
-        let g = match &cached {
-            Some((_, e)) => e.g.clone(),
-            None => Arc::new(effected_path(n, bp)),
+        let (g, carried) = match &cached {
+            Some((_, e)) => (e.g.clone(), e.carried.clone()),
+            None => {
+                let (g, carry) = effected_path_carrying(n, bp);
+                (Arc::new(g), carried(n, &carry))
+            }
         };
-        self.draw_shape_fx_geom(ctx, f, n, &g, rule, cached.as_mut().map(|(_, e)| &mut e.items));
+        let paints = carried.as_deref().unwrap_or(n);
+        self.draw_shape_fx_geom(ctx, f, n, paints, &g, rule, cached.as_mut().map(|(_, e)| &mut e.items));
         if let Some((key, e)) = cached {
             self.fx_geom.insert(key, e);
         }
     }
 
-    /// [`Self::draw_shape_fx`] on the effected geometry `g`, with the items' cached geometry.
+    /// [`Self::draw_shape_fx`] on the effected geometry `g`, with the items' cached geometry:
+    /// `paints` is `n` with the fills and strokes it paints.
+    #[allow(clippy::too_many_arguments)]
     fn draw_shape_fx_geom(
         &mut self,
         ctx: &mut RenderContext,
         f: &Frame,
         n: &Node,
+        paints: &Node,
         g: &BezPath,
         rule: FillRule,
-        items: Option<&mut Vec<Option<Arc<BezPath>>>>,
+        items: Option<&mut Vec<Option<ItemGeom>>>,
     ) {
         if g.elements().is_empty() {
             return;
@@ -370,7 +380,7 @@ impl Renderer {
             self.hairline(ctx, f, g, [0, 0, 0, 255]);
             return;
         }
-        let gctx = GeomContext::of(n);
+        let gctx = GeomContext::of(paints);
         let rfx = effects::raster_effects(&n.appearance.effects);
         // Document-space reach of the painted geometry (strokes, arrowheads…).
         let outset = n.appearance.outset();
@@ -380,7 +390,7 @@ impl Renderer {
         let reach = bounds.map_or(reach, |b| reach.union(b));
         let content = Content { node: n, owner: None, cache: Some(0), reach, outline: Some((g, rule)), bounds, kept: None };
         let mut items = items;
-        self.raster_fx(ctx, f, &content, &rfx, &mut |r, c, fr| r.paint_items(c, fr, n, g, rule, &gctx, items.as_deref_mut()));
+        self.raster_fx(ctx, f, &content, &rfx, &mut |r, c, fr| r.paint_items(c, fr, paints, g, rule, &gctx, items.as_deref_mut()));
         ctx.set_transform(Affine::IDENTITY);
     }
 
@@ -797,6 +807,16 @@ impl Renderer {
     }
 }
 
+/// `n` with the gradients of its fills and strokes moved along with its effects by `carry`, or
+/// `None` when they stay where they are.
+fn carried(n: &Node, carry: &effects::Carry) -> Option<Arc<Node>> {
+    carry.moves(&n.appearance).then(|| {
+        let mut m = n.clone();
+        carry.apply(&mut m.appearance);
+        Arc::new(m)
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/render/src/tests/objectfx.rs b/crates/render/src/tests/objectfx.rs
index b6baab074..173d91bb0 100644
--- a/crates/render/src/tests/objectfx.rs
+++ b/crates/render/src/tests/objectfx.rs
@@ -811,6 +811,52 @@ fn a_path_with_its_own_transform_paints_each_copy_with_its_own_gradient() {
     }
 }
 
+#[test]
+fn a_paths_gradient_moves_with_its_transform_and_free_distort() {
+    use vectorcraft_color::GradientGeom;
+    let stops = vec![GradientStop::new(0.0, Color::rgb(1.0, 0.0, 0.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 1.0))];
+    let ramp = GradientPaint::new(Gradient::new(GradientKind::Linear, stops));
+    // Placed across the square from its left edge (red) to its right edge (blue).
+    let geom = GradientGeom { start: Point::new(10.0, 50.0), end: Point::new(40.0, 50.0), aspect: 1.0, focal: None };
+    let draw = |paint: &GradientPaint, e: Option<Effect>| {
+        let square = shapes::rectangle(vectorcraft_geom::Rect::new(10.0, 35.0, 40.0, 65.0));
+        let mut n = Node::path(NodeId(0), square, Appearance::basic(Paint::Gradient(Box::new(paint.clone())), Paint::None, 0.0));
+        n.appearance.effects = e.into_iter().collect();
+        render(&doc_with(Document::new(100.0, 100.0), n))
+    };
+    let placed = GradientPaint { geom: Some(geom), ..ramp.clone() };
+    let rb = |img: &Rendered, x: u32, y: u32| {
+        let p = img.pixel(x, y);
+        (p[0], p[2])
+    };
+    let red = |(r, b): (u8, u8)| r > 200 && b < 60;
+    let blue = |(r, b): (u8, u8)| b > 200 && r < 60;
+    // Moved 40 pt right by Transform, and 30 pt (one width) right by a Free Distort that moves
+    // every corner.
+    let corners = json!({"corners": [[1.0, 0.0], [2.0, 0.0], [2.0, 1.0], [1.0, 1.0]]});
+    for e in [fx("distort.transform", json!({"moveH": 40})), fx("distort.freeDistort", corners)] {
+        let img = draw(&placed, Some(e.clone()));
+        let moved = if e.id == "distort.transform" { 40 } else { 30 };
+        let (left, right) = (11 + moved, 38 + moved);
+        assert!(red(rb(&img, left, 50)) && blue(rb(&img, right, 50)), "{}: {:?} {:?}", e.id, rb(&img, left, 50), rb(&img, right, 50));
+    }
+    // Turned a quarter: the gradient runs from top to bottom (or bottom to top).
+    let turn = fx("distort.transform", json!({"rotate": 90}));
+    let img = draw(&placed, Some(turn));
+    let (top, bottom) = (rb(&img, 25, 36), rb(&img, 25, 63));
+    assert!((red(top) && blue(bottom)) || (blue(top) && red(bottom)), "{top:?} {bottom:?}");
+    assert_eq!(rb(&img, 12, 50), rb(&img, 38, 50), "the same color across");
+    // Scaled to half its width about its center: the gradient spans the narrower square.
+    let img = draw(&placed, Some(fx("distort.transform", json!({"scaleH": 50}))));
+    assert!(red(rb(&img, 18, 50)) && blue(rb(&img, 31, 50)), "{:?} {:?}", rb(&img, 18, 50), rb(&img, 31, 50));
+    // The fill's own Transform moves its gradient too.
+    let square = shapes::rectangle(vectorcraft_geom::Rect::new(10.0, 35.0, 40.0, 65.0));
+    let mut n = Node::path(NodeId(0), square, Appearance::basic(Paint::Gradient(Box::new(placed.clone())), Paint::None, 0.0));
+    n.appearance.items[0].effects_mut().push(fx("distort.transform", json!({"moveH": 40})));
+    let img = render(&doc_with(Document::new(100.0, 100.0), n));
+    assert!(red(rb(&img, 51, 50)) && blue(rb(&img, 78, 50)), "{:?} {:?}", rb(&img, 51, 50), rb(&img, 78, 50));
+}
+
 #[test]
 fn darkness_subtracts_from_rgb_before_shadow_opacity() {
     for opacity in [50.0, 100.0] {
diff --git a/crates/svg/src/export/paint.rs b/crates/svg/src/export/paint.rs
index 902bfc7e1..19719d8f2 100644
--- a/crates/svg/src/export/paint.rs
+++ b/crates/svg/src/export/paint.rs
@@ -497,13 +497,30 @@ impl Writer<'_> {
     /// gradients require rendered-effect preparation by the caller to preserve their appearance.
     /// Photoshop-style
     /// filters have no SVG equivalent: they are left out with a warning (exports from the app turn
-    /// such objects into images first).
+    /// such objects into images first). An SVG filter (Effect › SVG Filters) that is the last
+    /// effect is written as its own `<filter>` element; elsewhere in the stack it is left out
+    /// like them.
     pub(super) fn filtered(&mut self, n: &Node) {
         let mut inner = n.clone();
         inner.appearance.effects.retain(|e| !vectorcraft_effects::is_raster(&e.id));
+        // An SVG filter's user-space coordinates are the document's from the effect's origin: the
+        // object is written in them, in a group that moves it where the rest of the art goes.
+        let xf = self.xf;
+        let origin = live_svg_filter(&n.appearance.effects).map(|f| Affine::translate(f.origin()));
+        let moved = origin.is_some_and(|o| xf * o != Affine::IDENTITY);
+        if let Some(o) = origin.filter(|_| moved) {
+            self.line(&format!("<g transform=\"{}\">", self.matrix(xf * o)));
+            self.depth += 1;
+            self.xf = o.inverse();
+        }
         let opened = self.open_filters(n, &n.appearance.effects);
         self.node_body(&inner);
         self.close_filters(opened);
+        if moved {
+            self.xf = xf;
+            self.depth -= 1;
+            self.line("</g>");
+        }
     }
 
     /// Open one `<g filter>` per visible raster effect of `effects` (an object's, or one fill or
@@ -525,7 +542,27 @@ impl Writer<'_> {
                 + 2.0;
         let region = bounds.map(|b| self.xf.transform_rect_bbox(b).inflate(reach, reach));
         let mut opened = 0;
-        for f in fx.iter().rev() {
+        // An SVG filter that is the object's last effect is written as it is ([`Self::filtered`]).
+        let live = if std::ptr::eq(effects, n.appearance.effects.as_slice()) { live_svg_filter(effects) } else { None };
+        for (k, f) in fx.iter().enumerate().rev() {
+            if let RasterFx::Pixel(vectorcraft_effects::PixelFx::Svg(sf)) = f
+                && live.is_some()
+                && k + 1 == fx.len()
+            {
+                let fid = self.fresh_id("filter");
+                // The filter as it is drawn: a region given against the object's box is measured
+                // against the object alone, which is all it runs on ([`live_svg_filter`]).
+                let mut input = n.clone();
+                input.appearance.effects.clear();
+                let input_bounds = input.visual_bounds_with(&self.doc.symbol_boxes()).unwrap_or_default();
+                if let Some(def) = sf.written_xml(input_bounds).and_then(|xml| vectorcraft_effects::svg_filter::with_id(&xml, &fid)) {
+                    self.def(1, &def);
+                    self.line(&format!("<g filter=\"url(#{fid})\">"));
+                    self.depth += 1;
+                    opened += 1;
+                    continue;
+                }
+            }
             if matches!(f, RasterFx::Pixel(_) | RasterFx::Rasterize(_)) {
                 self.warn("SVG has no pixel effects such as Radial Blur, Smart Blur or Unsharp Mask: they are left out");
                 continue;
@@ -644,6 +681,25 @@ pub(super) fn pixel_gradient(p: &Paint, fill: bool) -> Option<&GradientPaint> {
     }
 }
 
+/// The SVG filter (Effect › SVG Filters) of an object's `effects` that SVG keeps as a `<filter>`:
+/// its last visible effect, measured in points.
+fn live_svg_filter(effects: &[vectorcraft_doc::Effect]) -> Option<vectorcraft_effects::svg_filter::SvgFilterFx> {
+    if !vectorcraft_effects::svg_filter::writes_live(effects) {
+        return None;
+    }
+    let mut fx = vectorcraft_effects::raster_effects(effects);
+    // A region measured against the object's box is kept only when the filter runs on the object itself.
+    let alone = fx.len() == 1;
+    match fx.pop() {
+        Some(vectorcraft_effects::RasterFx::Pixel(vectorcraft_effects::PixelFx::Svg(f)))
+            if f.in_points() && (alone || !f.measured()) && f.writes_as_svg11() =>
+        {
+            Some(f)
+        }
+        _ => None,
+    }
+}
+
 /// Any visible raster effect (shadow, glow, blur, feather) in `effects`?
 pub(super) fn has_raster(effects: &[vectorcraft_doc::Effect]) -> bool {
     effects.iter().any(|e| e.visible && vectorcraft_effects::is_raster(&e.id))
diff --git a/crates/svg/src/export/text.rs b/crates/svg/src/export/text.rs
index 44af6c1ee..dd956692d 100644
--- a/crates/svg/src/export/text.rs
+++ b/crates/svg/src/export/text.rs
@@ -235,6 +235,12 @@ impl Writer<'_> {
                 self.warn("type on a path with an end bracket, Align to Path or Spacing is outlined to keep its look");
                 return self.text_outlines(n, t);
             }
+            // A reader turns each `<textPath>` glyph with the path, as Rainbow does: Skew, 3D
+            // Ribbon, Stair Step and Gravity keep their look as outlines.
+            if t.path_effect != vectorcraft_doc::PathEffect::Rainbow {
+                self.warn("type on a path with an effect other than Rainbow is outlined to keep its look");
+                return self.text_outlines(n, t);
+            }
             // It cannot hang glyphs outside the start bracket either.
             if hangs_on_path(t, &lay) {
                 self.warn("type on a path with glyphs hanging outside its brackets is outlined to keep its look");
diff --git a/crates/svg/src/import.rs b/crates/svg/src/import.rs
index a70d750cc..1e852ee53 100644
--- a/crates/svg/src/import.rs
+++ b/crates/svg/src/import.rs
@@ -101,6 +101,21 @@ fn convolve_matrices_ok(xml: &roxmltree::Document) -> Result<(), SvgError> {
     Ok(())
 }
 
+/// The SVG filters of SVG text `svg` ([`vectorcraft_effects::svg_filter::filters_of`]), read with
+/// the limits on depth and entities that [`import`] reads documents with: up to `room`, leaving
+/// out the names `taken` says.
+pub(crate) fn svg_filters(svg: &str, room: usize, taken: impl Fn(&str) -> bool) -> Result<(Vec<(String, String)>, usize), SvgError> {
+    let too_deep = || SvgError::TooDeep(depth::MAX_ELEMENT_DEPTH);
+    if depth::prescan(svg).too_deep {
+        return Err(too_deep());
+    }
+    let xml = parse(svg)?;
+    if depth::height(&xml, depth::MAX_ELEMENT_DEPTH).is_none() {
+        return Err(too_deep());
+    }
+    Ok(vectorcraft_effects::svg_filter::filters_of(&xml, svg, room, taken))
+}
+
 /// The document SVG text `svg` holds, read with `opts`, and the warnings about what it couldn't keep.
 pub(crate) fn import(svg: &str, opts: &ImportOptions, max_nodes: usize) -> Result<(Document, Vec<String>), SvgError> {
     // Before anything reads the tree: the XML reader, usvg, and what is made of its tree, all by
@@ -160,6 +175,7 @@ pub(crate) fn import(svg: &str, opts: &ImportOptions, max_nodes: usize) -> Resul
         symbol_suffixes: HashMap::new(),
         pattern_suffixes: HashMap::new(),
         blends: fx::blends(&xml, &scan.markers),
+        filter_sources: fx::sources(&xml, &scan.markers),
         files,
         non_scaling: found.non_scaling,
         data: found.data,
@@ -318,6 +334,8 @@ struct Importer {
     pattern_suffixes: HashMap<String, usize>,
     /// Blend modes of the shadows and glows our export wrote, by filter id ([`fx::blends`]).
     blends: HashMap<String, String>,
+    /// Each `<filter>` element as written, by id ([`fx::sources`]).
+    filter_sources: HashMap<String, fx::Source>,
     /// The files `<image>` elements link to.
     files: files::Files,
     /// Ids of the shapes whose strokes don't scale ([`vector_effect`]).
diff --git a/crates/svg/src/import/fx.rs b/crates/svg/src/import/fx.rs
index e5da2936d..b760b1b11 100644
--- a/crates/svg/src/import/fx.rs
+++ b/crates/svg/src/import/fx.rs
@@ -33,6 +33,104 @@ pub(super) fn blends(xml: &roxmltree::Document, markers: &str) -> HashMap<String
         .collect()
 }
 
+/// A `<filter>` element as written ([`sources`]): its XML, its primitives' element names and its
+/// place among the filters in document order, and whether it looks different outside the document
+/// ([`vectorcraft_effects::svg_filter::depends_on_styles`]). Its check and its primitives as usvg
+/// reads them are worked out once, when first asked for.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct Source {
+    xml: String,
+    primitives: Vec<String>,
+    order: usize,
+    styled: bool,
+    name: std::cell::OnceCell<Option<String>>,
+    forms: std::cell::OnceCell<Option<Vec<String>>>,
+}
+
+impl Source {
+    /// The filter's name when [`vectorcraft_effects::svg_filter::check`] takes it.
+    fn name(&self) -> Option<&String> {
+        self.name.get_or_init(|| vectorcraft_effects::svg_filter::check(&self.xml).ok()).as_ref()
+    }
+
+    /// Its primitives as usvg reads them ([`vectorcraft_effects::svg_filter::primitive_forms`]).
+    fn forms(&self) -> Option<&Vec<String>> {
+        self.forms.get_or_init(|| vectorcraft_effects::svg_filter::primitive_forms(&self.xml)).as_ref()
+    }
+}
+
+/// Each `<filter>` element with an id, as written, by id, with the document's style sheets read
+/// once for all of them. A source is checked and read by usvg only when art uses it, once.
+/// `markers` is the text with its data URLs left out ([`super::depth::prescan`]).
+pub(super) fn sources(xml: &roxmltree::Document, markers: &str) -> HashMap<String, Source> {
+    if !markers.contains("<filter") && !markers.contains(":filter") {
+        return HashMap::new();
+    }
+    let text = xml.input_text();
+    let styles = vectorcraft_effects::svg_filter::Styles::of(xml);
+    xml.descendants()
+        .filter(|n| n.has_tag_name((super::SVG_NS, "filter")))
+        .enumerate()
+        .filter_map(|(order, n)| {
+            let id = n.attribute("id")?.to_string();
+            let primitives = n.children().filter(roxmltree::Node::is_element).map(|p| p.tag_name().name().to_string()).collect();
+            let xml = vectorcraft_effects::svg_filter::element_xml(n, text)?;
+            let styled = vectorcraft_effects::svg_filter::depends_on_styles(n, &styles);
+            Some((id, Source { xml, primitives, order, styled, ..Default::default() }))
+        })
+        .collect()
+}
+
+/// The element name of primitive `k` (`feGaussianBlur`).
+fn element_name(k: &Kind) -> String {
+    let debug = format!("{k:?}");
+    format!("fe{}", debug.split(|c: char| !c.is_ascii_alphanumeric()).next().unwrap_or_default())
+}
+
+/// The source of `filter` in `sources`: by its id, else (usvg gives each further element that uses
+/// a filter a copy with an id of its own) the only source with the same primitives, compared by
+/// element name and then as usvg reads them. Sources that differ only in their ids draw alike: the
+/// first of them in document order is taken. usvg's tree doesn't say which `<filter>` an element
+/// named, so other sources with the same primitives leave the filter without a source.
+fn source_of<'a>(filter: &Filter, sources: &'a HashMap<String, Source>) -> Option<&'a Source> {
+    use vectorcraft_effects::svg_filter::with_id;
+    if let Some(s) = sources.get(filter.id()) {
+        return Some(s);
+    }
+    let names: Vec<String> = filter.primitives().iter().map(|p| element_name(p.kind())).collect();
+    let same: Vec<&Source> = sources.values().filter(|s| s.primitives == names).collect();
+    if let [one] = same.as_slice() {
+        return Some(one);
+    }
+    let forms: Vec<String> = filter.primitives().iter().map(|p| format!("{:?}", p.kind())).collect();
+    let read_alike: Vec<&Source> = same.into_iter().filter(|s| s.forms() == Some(&forms)).collect();
+    let first = read_alike.iter().copied().min_by_key(|s| s.order)?;
+    let unnamed = |s: &Source| with_id(&s.xml, "");
+    read_alike.iter().all(|s| unnamed(s) == unnamed(first)).then_some(first)
+}
+
+/// `filters` (in the order they apply) as Effect › SVG Filters effects, each holding its filter's
+/// XML from `sources` ([`sources`]), in user space mapped to the document by `ts`. `None` when one
+/// isn't there, looks different outside the document, or isn't a filter the effect draws
+/// ([`vectorcraft_effects::svg_filter::check`]), or
+/// when `ts` turns or skews the user space or scales it past what the effect measures (0.001 to
+/// 1000 points to a unit). Where `ts` moves the user space is the effect's `origin`.
+pub(super) fn kept(filters: &[Arc<Filter>], ts: Affine, sources: &HashMap<String, Source>) -> Option<Vec<Effect>> {
+    let [a, b, c, d, e, f] = ts.as_coeffs();
+    if b != 0.0 || c != 0.0 || !(0.001..=1000.0).contains(&a) || (a - d).abs() > 1e-9 * a.abs().max(1.0) || !e.is_finite() || !f.is_finite() {
+        return None;
+    }
+    filters
+        .iter()
+        .map(|filter| {
+            // A filter styled by the document is left out rather than drawn differently.
+            let source = source_of(filter, sources).filter(|s| !s.styled)?;
+            let params = json!({ "name": source.name()?, "xml": source.xml, "scale": a, "origin": [e, f] });
+            Some(Effect { id: vectorcraft_effects::SVG_FILTER.into(), params, visible: true })
+        })
+        .collect()
+}
+
 /// The object's alpha, blurred (σ), moved and maybe inverted.
 #[derive(Clone, Copy, Debug, Default, PartialEq)]
 struct Shape {
diff --git a/crates/svg/src/import/importer.rs b/crates/svg/src/import/importer.rs
index 2f8843220..6324e5380 100644
--- a/crates/svg/src/import/importer.rs
+++ b/crates/svg/src/import/importer.rs
@@ -301,10 +301,11 @@ impl Importer {
             (None, id) => format!("'{id}'"),
         };
         let mask = g.mask().and_then(|m| self.opacity_mask(m, ts, &label));
-        // Blurs, shadows and glows become live effects (see [`fx`]).
+        // Blurs, shadows and glows become live effects (see [`fx`]); other filters become Effect ›
+        // SVG Filters effects that keep their XML.
         let effects = match g.filters() {
             [] => vec![],
-            filters => fx::effects(filters, ts, &self.blends).unwrap_or_else(|| {
+            filters => fx::effects(filters, ts, &self.blends).or_else(|| fx::kept(filters, ts, &self.filter_sources)).unwrap_or_else(|| {
                 // usvg wraps a filtered element in a group of its own: name the element then.
                 let on = match g.children() {
                     [usvg::Node::Group(_)] | [] => label.clone(),
@@ -777,9 +778,10 @@ impl Importer {
             std::mem::take(&mut self.data),
             std::mem::take(&mut self.events),
             std::mem::take(&mut self.ellipses),
+            std::mem::take(&mut self.filter_sources),
         );
         let art = self.group_node(tree.root(), acc);
-        (self.links, self.hidden, self.uses, self.labels, self.non_scaling, self.data, self.events, self.ellipses) = outer;
+        (self.links, self.hidden, self.uses, self.labels, self.non_scaling, self.data, self.events, self.ellipses, self.filter_sources) = outer;
         art
     }
 }
@@ -811,6 +813,7 @@ mod tests {
             symbol_suffixes: HashMap::new(),
             pattern_suffixes: HashMap::new(),
             blends: HashMap::new(),
+            filter_sources: HashMap::new(),
             files: Files::default(),
             non_scaling: HashSet::new(),
             data: HashMap::new(),
diff --git a/crates/svg/src/lib.rs b/crates/svg/src/lib.rs
index 58cb434ed..1dbc7035b 100644
--- a/crates/svg/src/lib.rs
+++ b/crates/svg/src/lib.rs
@@ -548,6 +548,15 @@ pub fn import_with_report(svg: &str) -> Result<(Document, Vec<String>), SvgError
     import_with(svg, &ImportOptions::default())
 }
 
+/// Effect › SVG Filters › Import SVG Filter: the `<filter>` elements of SVG text `svg` that an SVG
+/// filter effect takes, as (name, XML) in document order, up to `room` of them and leaving out the
+/// names `taken` says, and how many it doesn't take. Filters past `room` or named as `taken` says
+/// are not checked. The text is read with the limits on depth and entities that [`import`] reads
+/// documents with.
+pub fn svg_filters(svg: &str, room: usize, taken: impl Fn(&str) -> bool) -> Result<(Vec<(String, String)>, usize), SvgError> {
+    import::svg_filters(svg, room, taken)
+}
+
 pub use glyph::glyph_art;
 pub use import::{MAX_ELEMENT_DEPTH, MAX_FOREIGN, MAX_FOREIGN_VALUE, MAX_NESTED_SVG_IMAGES, MAX_NODES};
 
diff --git a/crates/svg/tests/it/import_details.rs b/crates/svg/tests/it/import_details.rs
index 7857ba07c..57a7251bd 100644
--- a/crates/svg/tests/it/import_details.rs
+++ b/crates/svg/tests/it/import_details.rs
@@ -546,17 +546,25 @@ fn percentages_in_a_symbol_are_of_its_view_box() {
     assert_similar(&drawing("100%", "100%", "25%", "50%"), &drawing("100", "50", "25", "25"), 24.0, 0.001);
 }
 
-/// #1598: an unsupported filter's warning names the filter, its primitives and the object, and
-/// says it is drawn without it (not "a group": usvg wraps the element in one).
+/// #1598: the warning for a filter that neither the live effects nor an SVG filter effect can hold
+/// (here, on turned objects) names the filter, its primitives and the object, and says it is drawn
+/// without it (not "a group": usvg wraps the element in one). Such a filter on an object that
+/// isn't turned comes in as an SVG filter effect holding the filter's XML.
 #[test]
 fn unsupported_filters_are_named_in_the_warning() {
     let body = r#"<filter id="f"><feColorMatrix type="saturate" values="0"/></filter><filter id="t"><feTurbulence baseFrequency="0.05"/></filter>
-        <rect x="20" y="20" width="60" height="60" fill="red" filter="url(#f)"/>
-        <rect id="r" x="100" y="20" width="60" height="60" fill="blue" filter="url(#t)"/>"#;
+        <rect x="20" y="20" width="60" height="60" fill="red" transform="rotate(10 50 50)" filter="url(#f)"/>
+        <rect id="r" x="100" y="20" width="60" height="60" fill="blue" transform="rotate(10 130 50)" filter="url(#t)"/>
+        <rect x="20" y="90" width="20" height="20" fill="red" filter="url(#f)"/>"#;
     let (d, w) = import_with_report(&svg(body)).unwrap();
     assert!(w.iter().any(|w| w == "filter 'f' (feColorMatrix) on an object isn't supported; drawn without it"), "{w:?}");
     assert!(w.iter().any(|w| w == "filter 't' (feTurbulence) on 'r' isn't supported; drawn without it"), "{w:?}");
-    assert_eq!(art(&d).iter().filter(|n| n.path_data().is_some()).count(), 2, "both drawn");
+    assert_eq!(w.iter().filter(|w| w.contains("filter")).count(), 2, "{w:?}");
+    let kept: Vec<_> = art(&d).into_iter().flat_map(|n| &n.appearance.effects).collect();
+    assert_eq!(kept.len(), 1, "{kept:?}");
+    assert_eq!((kept[0].id.as_str(), &kept[0].params["name"]), ("svg.filter", &serde_json::json!("f")));
+    assert_eq!(kept[0].params["xml"], r#"<filter id="f"><feColorMatrix type="saturate" values="0"/></filter>"#, "as it is written");
+    assert_eq!(art(&d).iter().filter(|n| n.path_data().is_some()).count(), 3, "all drawn");
 }
 
 /// #1601: Inkscape's pages become artboards, at their places (through the viewBox) and with their
diff --git a/crates/svg/tests/it/import_live.rs b/crates/svg/tests/it/import_live.rs
index b93314b54..925c17176 100644
--- a/crates/svg/tests/it/import_live.rs
+++ b/crates/svg/tests/it/import_live.rs
@@ -412,7 +412,8 @@ fn drop_shadow_chains_become_drop_shadows() {
 }
 
 /// A proportional RGB filter is not additive Darkness. A fully black shadow remains
-/// recognizable, while other proportional transforms are reported rather than misrepresented.
+/// recognizable, while other proportional transforms are kept as SVG filters rather than
+/// misrepresented.
 #[test]
 fn proportional_filters_are_not_misread_as_additive_darkness() {
     let chain = |space: &str, transfer: &str, slope: f64| {
@@ -436,15 +437,108 @@ fn proportional_filters_are_not_misread_as_additive_darkness() {
     // Scaled on linear values, or blurred on them before an sRGB scale.
     for (space, transfer) in [(srgb, ""), ("", ""), ("", srgb)] {
         let (d, w) = open(&chain(space, transfer, 0.5));
-        assert!(w.iter().any(|w| w.contains("filter")), "{transfer}: {w:?}");
-        assert!(effects(&d).is_empty());
+        assert!(w.is_empty(), "{transfer}: {w:?}");
+        let ids: Vec<String> = effects(&d).iter().map(|e| e.id.clone()).collect();
+        assert_eq!(ids, ["svg.filter"], "{transfer}: kept as it is written, not as a shadow");
     }
 }
 
+/// Filters used by several objects keep their own XML on each, also when two filters have the same
+/// primitives with other values.
 #[test]
-fn other_filters_are_reported() {
+fn reused_filters_keep_their_own_xml() {
+    let body = r##"<defs><filter id="a"><feTurbulence baseFrequency="0.05"/></filter><filter id="b"><feTurbulence baseFrequency="0.2"/></filter></defs>
+        <rect width="20" height="20" filter="url(#a)"/><rect x="30" width="20" height="20" filter="url(#b)"/>
+        <rect y="30" width="20" height="20" filter="url(#a)"/><rect x="30" y="30" width="20" height="20" filter="url(#b)"/>"##;
+    let (d, w) = open(body);
+    assert!(w.is_empty(), "{w:?}");
+    let names: Vec<String> =
+        art(&d).into_iter().flat_map(|n| &n.appearance.effects).map(|e| e.params["name"].as_str().unwrap().to_string()).collect();
+    assert_eq!(names, ["a", "b", "a", "b"]);
+    // Two filters that differ only in their ids draw alike: a further use of either takes the first.
+    let same = r##"<defs><filter id="a"><feTurbulence baseFrequency="0.05"/></filter><filter id="b"><feTurbulence baseFrequency="0.05"/></filter></defs>
+        <rect width="20" height="20" filter="url(#a)"/><rect x="30" width="20" height="20" filter="url(#b)"/>
+        <rect y="30" width="20" height="20" filter="url(#a)"/><rect x="30" y="30" width="20" height="20" filter="url(#b)"/>"##;
+    let (d, w) = open(same);
+    assert!(w.is_empty(), "{w:?}");
+    let xml: Vec<String> = art(&d).into_iter().flat_map(|n| &n.appearance.effects).map(|e| e.params["xml"].as_str().unwrap().to_string()).collect();
+    assert_eq!(xml.len(), 4);
+    assert!(xml.iter().all(|x| x.contains("baseFrequency=\"0.05\"")), "{xml:?}");
+    // A `filter` element of another namespace with the same id isn't the source.
+    let foreign = r##"<defs><filter id="t"><feTurbulence baseFrequency="0.05"/></filter><o:filter xmlns:o="urn:other" id="t"><o:x/></o:filter></defs>
+        <rect width="20" height="20" filter="url(#t)"/>"##;
+    let (d, w) = open(foreign);
+    assert!(w.is_empty(), "{w:?}");
+    let fx = effects(&d);
+    assert!(fx[0].params["xml"].as_str().unwrap().contains("feTurbulence"), "{fx:?}");
+}
+
+/// An SVG image's filters are its own: one with the same id as a filter of the outer document is
+/// not imported with the outer document's XML. The image's own source isn't read, so its filter is
+/// left out with a warning.
+#[test]
+fn an_svg_images_filter_does_not_take_the_outer_filter_of_its_id() {
+    let inner = r##"<svg xmlns="http://www.w3.org/2000/svg" width="20" height="10"><filter id="f"><feTurbulence baseFrequency="0.2"/></filter><rect width="10" height="10" filter="url(#f)"/></svg>"##;
+    let data = format!("data:image/svg+xml;base64,{}", vectorcraft_svg::base64_encode(inner.as_bytes()));
+    let (d, w) = open(&format!(
+        r#"<defs><filter id="f"><feTurbulence baseFrequency="0.05"/></filter></defs><rect width="20" height="20" filter="url(#f)"/><image href="{data}" x="100" width="40" height="20"/>"#
+    ));
+    let xml: Vec<String> = art(&d)
+        .into_iter()
+        .flat_map(|n| &n.appearance.effects)
+        .filter(|e| e.id == "svg.filter")
+        .map(|e| e.params["xml"].as_str().unwrap_or_default().to_string())
+        .collect();
+    assert_eq!(xml.len(), 1, "only the outer rect: {xml:?}");
+    assert!(xml[0].contains("baseFrequency=\"0.05\""), "{xml:?}");
+    assert!(w.iter().any(|w| w.contains("filter")), "{w:?}");
+}
+
+/// A filter the document's style sheet colors would draw differently on its own: it is reported
+/// and left out.
+#[test]
+fn filters_styled_by_the_document_are_reported() {
+    let (d, w) = open(
+        r##"<style>.red{flood-color:#f00}</style><defs><filter id="t"><feFlood class="red"/><feComposite in2="SourceGraphic" operator="in"/></filter></defs><rect width="60" height="40" filter="url(#t)"/>"##,
+    );
+    assert!(w.iter().any(|w| w.contains("filter")), "{w:?}");
+    assert!(effects(&d).is_empty());
+}
+
+/// Among many filters, art that uses one twice keeps it both times (the second use is a copy
+/// under another id).
+#[test]
+fn a_filter_used_twice_among_many_is_kept_twice() {
+    let used = r##"<filter id="g"><feOffset dx="1"/><feFlood flood-color="#f00"/><feComposite in2="SourceGraphic" operator="in"/></filter>"##;
+    let defs: String = (0..300)
+        .map(|i| format!(r##"<filter id="f{i}"><feFlood flood-color="#00f"/><feComposite in2="SourceGraphic" operator="in"/></filter>"##))
+        .collect();
+    let (d, w) = open(&format!(
+        r#"<defs>{defs}{used}</defs><rect width="60" height="40" filter="url(#g)"/><rect x="100" width="60" height="40" filter="url(#g)"/>"#
+    ));
+    assert!(w.is_empty(), "{w:?}");
+    let named = |n: &&Node| n.appearance.effects.iter().filter(|e| e.id == "svg.filter").map(|e| e.params["name"].clone()).collect::<Vec<_>>();
+    let filters: Vec<Vec<serde_json::Value>> = art(&d).iter().map(named).collect();
+    assert_eq!(filters, vec![vec![json!("g")], vec![json!("g")]], "{:?}", art(&d));
+}
+
+/// Other filters come in as SVG filters; one on a turned object is reported and left out.
+#[test]
+fn other_filters_are_kept_or_reported() {
     let (d, w) =
         open(r##"<defs><filter id="t"><feTurbulence baseFrequency="0.05"/></filter></defs><rect width="60" height="40" filter="url(#t)"/>"##);
+    assert!(w.is_empty(), "{w:?}");
+    let fx = effects(&d);
+    assert_eq!((fx.len(), fx[0].id.as_str(), &fx[0].params["name"]), (1, "svg.filter", &json!("t")));
+    let (d, w) = open(
+        r##"<defs><filter id="t"><feTurbulence baseFrequency="0.05"/></filter></defs><rect width="60" height="40" transform="rotate(30)" filter="url(#t)"/>"##,
+    );
+    assert!(w.iter().any(|w| w.contains("filter")), "{w:?}");
+    assert!(effects(&d).is_empty());
+    // Past the 0.001 to 1000 points a unit of the effect measures: reported and left out too.
+    let (d, w) = open(
+        r##"<defs><filter id="t"><feTurbulence baseFrequency="0.05"/></filter></defs><rect width="0.04" height="0.04" transform="scale(2000)" filter="url(#t)"/>"##,
+    );
     assert!(w.iter().any(|w| w.contains("filter")), "{w:?}");
     assert!(effects(&d).is_empty());
 }
@@ -530,6 +624,58 @@ fn an_exported_outer_glow_round_faint_art_draws_as_the_canvas_does() {
     assert_similar(&render_artboard(&d), &resvg_render(&svg, 200, 120), 40.0, 0.02);
 }
 
+/// A document with one red rectangle whose only effect is the SVG filter `xml`.
+fn filtered_rect(xml: &str) -> Document {
+    let mut d = Document::new(200.0, 120.0);
+    let mut n = Node::path(
+        d.alloc_id(),
+        shapes::rectangle(Rect::new(40.0, 20.0, 100.0, 70.0)),
+        Appearance::basic(Paint::solid(Color::rgb(0.9, 0.1, 0.1)), Paint::None, 0.0),
+    );
+    n.appearance.effects = vec![Effect { id: "svg.filter".into(), params: json!({ "xml": xml }), visible: true }];
+    let l = d.layers[0].id;
+    d.insert(Some(l), 0, n).unwrap();
+    d
+}
+
+/// SVG 1.1 export writes an SVG filter's image reference as `xlink:href`, and it imports back.
+#[test]
+fn an_exported_filter_image_has_an_xlink_reference() {
+    let data = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==";
+    let xml = format!(r#"<filter id="i"><feImage href="{data}"/><feComposite in2="SourceGraphic" operator="in"/></filter>"#);
+    let d = filtered_rect(&xml);
+    let svg = export(&d, &ExportOptions::default());
+    assert!(svg.contains(&format!(r#"<feImage xlink:href="{data}"/>"#)), "{svg}");
+    assert!(!svg.contains(" href="), "{svg}");
+    let (back, w) = import_with_report(&svg).unwrap();
+    assert!(w.is_empty(), "{w:?}");
+    match vectorcraft_effects::raster_effects(&effects(&back)).as_slice() {
+        [RasterFx::Pixel(vectorcraft_effects::PixelFx::Svg(f))] => {
+            assert!(f.xml().contains(&format!(r#"<feImage href="{data}"/>"#)), "the filter as it is drawn: {}", f.xml())
+        }
+        other => panic!("{other:?}"),
+    }
+}
+
+/// SVG 1.1 has no `feDropShadow`: export writes the SVG 1.1 primitives it stands for, which draw
+/// as the canvas draws the shadow and import back as a filter that draws the same.
+#[test]
+fn an_exported_svg_drop_shadow_is_svg_1_1_and_draws_as_the_canvas_does() {
+    let xml = r##"<filter id="s" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120"><feDropShadow dx="12" dy="9" stdDeviation="3" flood-color="#0040ff" flood-opacity="0.7"/></filter>"##;
+    let d = filtered_rect(xml);
+    let svg = export(&d, &ExportOptions::default());
+    assert!(!svg.contains("feDropShadow") && svg.contains("<feGaussianBlur") && svg.contains("<feMerge"), "{svg}");
+    let canvas = render_artboard(&d);
+    // The shadow, beside the art.
+    let [r, g, b] = canvas.over_white(105, 75);
+    assert!(b > 150 && r < 200 && g < 200, "{:?}", [r, g, b]);
+    assert_similar(&canvas, &resvg_render(&svg, 200, 120), 40.0, 0.02);
+    let (back, w) = import_with_report(&svg).unwrap();
+    assert!(w.is_empty(), "{w:?}");
+    assert_eq!(effects(&back).iter().map(|e| e.id.as_str()).collect::<Vec<_>>(), ["svg.filter"]);
+    assert_similar(&canvas, &render_artboard(&back), 40.0, 0.02);
+}
+
 #[test]
 fn symbols_and_effects_export_import_export_is_stable() {
     // A doc with a symbol instance carrying a shadow: export → import → export is stable.
diff --git a/crates/svg/tests/it/roundtrip.rs b/crates/svg/tests/it/roundtrip.rs
index 25d0169c6..8f479f348 100644
--- a/crates/svg/tests/it/roundtrip.rs
+++ b/crates/svg/tests/it/roundtrip.rs
@@ -501,6 +501,32 @@ fn text_on_path_options_svg_cannot_express_are_outlined() {
     }
 }
 
+/// Type on a path with Skew, 3D Ribbon, Stair Step or Gravity, whose glyphs a `<textPath>` would
+/// turn with the path as Rainbow does, keeps its look as outlines, with spacing or without it;
+/// Rainbow stays a `<textPath>`.
+#[test]
+fn text_on_path_effects_svg_cannot_express_are_outlined() {
+    use vectorcraft_doc::PathEffect;
+    let mut curve = vectorcraft_geom::BezPath::new();
+    curve.move_to((20.0, 150.0));
+    curve.curve_to((60.0, 40.0), (140.0, 40.0), (180.0, 150.0));
+    for effect in PathEffect::ALL {
+        for spacing in [0.0, 4.0] {
+            let mut d = Document::new(200.0, 200.0);
+            let mut t = TextObject::point(Point::ZERO, "On a curve", CharStyle { size: 14.0, ..CharStyle::default() });
+            t.kind = TextKind::OnPath { path: PathData::from_bezpath(&curve), start: 0.1, end: None };
+            t.path_effect = effect;
+            t.path_spacing = spacing;
+            let id = d.alloc_id();
+            let (svg, warnings) =
+                vectorcraft_svg::export_with_report(&doc_with(vec![Node::new(id, NodeKind::Text(Box::new(t)))]), &ExportOptions::default());
+            let live = effect == PathEffect::Rainbow && spacing == 0.0;
+            assert_eq!(svg.contains("<textPath"), live, "{effect:?} {spacing}: {svg}");
+            assert_eq!(warnings.iter().any(|w| w.contains("outlined")), !live, "{effect:?} {spacing}: {warnings:?}");
+        }
+    }
+}
+
 /// Type on a path whose punctuation hangs outside its brackets (Optical Margin Alignment or Roman
 /// Hanging Punctuation) keeps its look as outlines; with the option on and nothing at its ends to
 /// hang, it stays a `<textPath>`.
diff --git a/crates/three-d/src/lib.rs b/crates/three-d/src/lib.rs
index 43ec2d72a..ff21f37ba 100644
--- a/crates/three-d/src/lib.rs
+++ b/crates/three-d/src/lib.rs
@@ -15,6 +15,8 @@ pub use shading::{LightGradient, RgbGradient, ShadeGradient};
 mod lights;
 pub use lights::{Light, Lights, MAX_LIGHTS};
 mod caps;
+mod mesh;
+pub use mesh::{Mesh, extrude_mesh, inflate_meshes, plane_mesh, revolve_mesh};
 
 use vectorcraft_geom::{BezPath, ParamCurve, PathData, Point, Rect, Vec2, kurbo::ParamCurveDeriv};
 
@@ -447,7 +449,17 @@ fn project_face(vertices: &[V3], normals: Option<&[V3]>, o: Revolve, origin: Poi
 /// Evaluate a profile in document space. All subpaths share one axis from `bounds`.
 /// Invalid or excessively complex inputs return an error, never a partial surface.
 pub fn revolve(path: &PathData, bounds: Rect, options: Revolve) -> Result<Vec<Face>, String> {
+    revolve_faces(path, bounds, options, None)
+}
+
+/// [`revolve`], or with `mesh` the surface's faces before projection, kept there instead of drawn.
+fn revolve_faces(path: &PathData, bounds: Rect, options: Revolve, mut mesh: Option<&mut Vec<solid::Face3>>) -> Result<Vec<Face>, String> {
     let o = options.sanitized();
+    // A face kept for a mesh: its normal follows from its corners.
+    let keep = |mesh: &mut Vec<solid::Face3>, face: Vec<V3>, normal: V3| {
+        mesh.push((vec![face], normal));
+        if mesh.len() > MAX_FACES { Err("Revolve surface is too complex; reduce Segments or simplify the profile".to_string()) } else { Ok(()) }
+    };
     if ![bounds.x0, bounds.y0, bounds.x1, bounds.y1].iter().all(|v| v.is_finite() && v.abs() <= 1e8) {
         return Err("Revolve requires finite profile coordinates within 100 million points".into());
     }
@@ -543,6 +555,16 @@ pub fn revolve(path: &PathData, bounds: Rect, options: Revolve) -> Result<Vec<Fa
                 }
             }
         }
+        // For a mesh: which way the profile runs round the region it sweeps (closed against the
+        // axis at its ends when it is open), so the faces' normals point out of the solid.
+        let turn = {
+            let mut ring: Vec<(f64, f64)> = profile.iter().map(|p| (p.x - axis, p.y)).collect();
+            if let (false, Some(first), Some(last)) = (sp.closed, profile.first(), profile.last()) {
+                ring.extend([(0.0, last.y), (0.0, first.y)]);
+            }
+            let area: f64 = ring.iter().zip(ring.iter().cycle().skip(1)).take(ring.len()).map(|(p, q)| p.0 * q.1 - q.0 * p.1).sum();
+            if area < 0.0 { -1.0 } else { 1.0 }
+        };
         for (i, (pair, [ta, tb])) in profile.windows(2).zip(tangents).enumerate() {
             let [a, b] = pair else { continue };
             if ![a.x, a.y, b.x, b.y].iter().all(|v| v.is_finite() && v.abs() <= 1e8) {
@@ -550,6 +572,14 @@ pub fn revolve(path: &PathData, bounds: Rect, options: Revolve) -> Result<Vec<Fa
             }
             for j in 0..steps {
                 let [v0, v1, v2, v3] = [vertex(*a, j), vertex(*b, j), vertex(*b, j + 1), vertex(*a, j + 1)];
+                if let Some(mesh) = mesh.as_deref_mut() {
+                    // The edge's outward normal in the profile's plane (distance from the axis,
+                    // height), swept to the middle of the step.
+                    let (dr, dy) = ((b.x - a.x) * turn, (b.y - a.y) * turn);
+                    let (s, c) = (sweep * (j as f64 + 0.5) / steps as f64).sin_cos();
+                    keep(mesh, vec![v0, v1, v2, v3], o.rotate(V3(dy * c, -dr, dy * s)))?;
+                    continue;
+                }
                 let first = (i == 0).then(|| rings.first().and_then(Option::as_ref).and_then(|r| r.arcs.get(j))).flatten();
                 let last = (i + 2 == profile.len()).then(|| rings.last().and_then(Option::as_ref).and_then(|r| r.arcs.get(j))).flatten();
                 let projected = |vertices: &[V3], normals: Option<&[V3]>, edges: &[(usize, &caps::RingArc, bool)]| {
@@ -581,6 +611,17 @@ pub fn revolve(path: &PathData, bounds: Rect, options: Revolve) -> Result<Vec<Fa
                 } else {
                     1.0
                 };
+                if let Some(mesh) = mesh.as_deref_mut() {
+                    // The disk, or for a partial sweep the sector with its centre on the axis.
+                    let mut cap: Vec<V3> = (0..=steps).map(|j| vertex(*end, j)).collect();
+                    if o.angle >= 360.0 {
+                        cap.pop();
+                    } else {
+                        cap.insert(0, o.rotate(V3(0.0, end.y - center_y, 0.0)));
+                    }
+                    keep(mesh, cap, o.rotate(V3(0.0, outward, 0.0)))?;
+                    continue;
+                }
                 // Keep the original tessellation work budget, even though each cap
                 // now produces only one curved vector face.
                 emit(ring.face(bounds, o, light, outward)?, steps)?;
diff --git a/crates/three-d/src/mesh.rs b/crates/three-d/src/mesh.rs
new file mode 100644
index 000000000..04b5db626
--- /dev/null
+++ b/crates/three-d/src/mesh.rs
@@ -0,0 +1,371 @@
+//! The solids of the 3D effects as triangle meshes, for files that other 3D apps open (OBJ, glTF,
+//! USD). A mesh holds the faces the effect builds before they are projected onto the page: every
+//! face, those turned away from the viewer included, at the turn the effect gives the art.
+//!
+//! Coordinates are points with y up and z toward the viewer, about the point the solid turns about
+//! (the centre of the art's bounds; for Revolve, the axis at the profile's middle). Each face keeps
+//! its own corners and normal, so the mesh is shaded flat. Planar faces with holes (caps and the
+//! turned plane) are cut into triangles: each hole is joined to its outline by a bridge, then the
+//! outline is cut by ear clipping.
+
+use vectorcraft_geom::{FillRule, PathData, Rect};
+
+use crate::solid::{Face3, extrude_faces, inflate_faces, plane_faces};
+use crate::{Extrude, Inflate, Revolve, V3, View};
+
+/// Most steps the triangulation of one solid may take: a face's ears and bridges each test the
+/// face's other corners.
+const MAX_WORK: usize = 400_000_000;
+
+/// A triangle mesh.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Mesh {
+    /// Corner positions in points: x right, y up, z toward the viewer.
+    pub positions: Vec<[f64; 3]>,
+    /// One unit normal for each position: the normal of the face the corner belongs to.
+    pub normals: Vec<[f64; 3]>,
+    /// Corner indices, counterclockwise seen from the side the normals point to.
+    pub triangles: Vec<[u32; 3]>,
+}
+
+impl Mesh {
+    pub fn is_empty(&self) -> bool {
+        self.triangles.is_empty()
+    }
+
+    /// The smallest and largest coordinate on each axis; `None` for an empty mesh.
+    pub fn bounds(&self) -> Option<([f64; 3], [f64; 3])> {
+        let first = *self.positions.first()?;
+        Some(self.positions.iter().fold((first, first), |(lo, hi), p| {
+            ([lo[0].min(p[0]), lo[1].min(p[1]), lo[2].min(p[2])], [hi[0].max(p[0]), hi[1].max(p[1]), hi[2].max(p[2])])
+        }))
+    }
+
+    /// The meshes of `parts` as one, in order.
+    pub fn join(parts: impl IntoIterator<Item = Mesh>) -> Mesh {
+        let mut out = Mesh::default();
+        for m in parts {
+            let base = out.positions.len() as u32;
+            out.positions.extend(m.positions);
+            out.normals.extend(m.normals);
+            out.triangles.extend(m.triangles.into_iter().map(|t| t.map(|i| i + base)));
+        }
+        out
+    }
+}
+
+/// Extrude & Bevel's solid ([`crate::extrude`]) as a mesh.
+pub fn extrude_mesh(path: &PathData, rule: FillRule, bounds: Rect, options: Extrude, view: View) -> Result<Mesh, String> {
+    extrude_faces(path, rule, bounds, options, view, true).and_then(|(_, faces)| mesh(&faces))
+}
+
+/// Rotate's plane ([`crate::plane`]) as a mesh.
+pub fn plane_mesh(path: &PathData, rule: FillRule, bounds: Rect, view: View) -> Result<Mesh, String> {
+    plane_faces(path, rule, bounds, view, true).and_then(|(_, faces)| mesh(&faces))
+}
+
+/// Inflate's solids for several shapes of one object ([`crate::inflate_together`]) as meshes, one
+/// result for each shape, in order. Each mesh is cut as the iterator reaches it.
+pub fn inflate_meshes(
+    shapes: &[(&PathData, FillRule)],
+    bounds: Rect,
+    options: Inflate,
+    view: View,
+) -> impl Iterator<Item = Result<Mesh, String>> + use<> {
+    inflate_faces(shapes, bounds, options, view, true).into_iter().map(|r| r.and_then(|(_, faces)| mesh(&faces)))
+}
+
+/// Revolve's surface ([`crate::revolve`]) as a mesh. As the effect draws it, a sweep of less than
+/// 360° caps its ends with sectors and leaves its two cut sides open ([`Revolve::cap_ends`]).
+pub fn revolve_mesh(path: &PathData, bounds: Rect, options: Revolve) -> Result<Mesh, String> {
+    let mut faces = vec![];
+    crate::revolve_faces(path, bounds, options, Some(&mut faces))?;
+    mesh(&faces)
+}
+
+/// The area-weighted normal of `contours` (Newell's method).
+fn newell(contours: &[Vec<V3>]) -> V3 {
+    let mut n = V3::default();
+    for c in contours {
+        for (a, b) in c.iter().zip(c.iter().cycle().skip(1)).take(c.len()) {
+            let x = a.cross(*b);
+            n = V3(n.0 + x.0, n.1 + x.1, n.2 + x.2);
+        }
+    }
+    n
+}
+
+/// From the effects' view space (y down) to the mesh's (y up).
+fn up(v: V3) -> [f64; 3] {
+    [v.0, -v.1, v.2]
+}
+
+/// `faces` (view space) as one mesh, each cut into triangles turned to its normal (a face given no
+/// normal takes its corners' own).
+fn mesh(faces: &[Face3]) -> Result<Mesh, String> {
+    let mut out = Mesh::default();
+    let mut work = 0usize;
+    for (contours, normal) in faces {
+        let geometric = newell(contours);
+        let n = if normal.dot(*normal) > 0.5 { *normal } else { geometric.unit() };
+        if n.dot(n) < 0.5 {
+            continue;
+        }
+        let [nx, ny, nz] = up(n);
+        for [a, b, c] in triangulate(contours, geometric, &mut work)? {
+            let (pa, pb, pc) = (up(a), up(b), up(c));
+            let cross = V3(pb[0] - pa[0], pb[1] - pa[1], pb[2] - pa[2]).cross(V3(pc[0] - pa[0], pc[1] - pa[1], pc[2] - pa[2]));
+            if cross.dot(cross) < 1e-24 {
+                continue;
+            }
+            let (pb, pc) = if cross.dot(V3(nx, ny, nz)) < 0.0 { (pc, pb) } else { (pb, pc) };
+            let base = u32::try_from(out.positions.len()).map_err(|_| "The 3D object is too complex to export".to_string())?;
+            out.positions.extend([pa, pb, pc]);
+            out.normals.extend([[nx, ny, nz]; 3]);
+            out.triangles.push([base, base + 1, base + 2]);
+        }
+    }
+    Ok(out)
+}
+
+/// A corner of a face: its position on the plane the face is cut in, and in 3D.
+#[derive(Clone, Copy)]
+struct Corner {
+    x: f64,
+    y: f64,
+    v: V3,
+}
+
+fn area(ring: &[Corner]) -> f64 {
+    ring.iter().zip(ring.iter().cycle().skip(1)).take(ring.len()).map(|(a, b)| a.x * b.y - b.x * a.y).sum::<f64>() / 2.0
+}
+
+fn inside(ring: &[Corner], x: f64, y: f64) -> bool {
+    let mut odd = false;
+    for (a, b) in ring.iter().zip(ring.iter().cycle().skip(1)).take(ring.len()) {
+        if (a.y > y) != (b.y > y) && x < a.x + (y - a.y) / (b.y - a.y) * (b.x - a.x) {
+            odd = !odd;
+        }
+    }
+    odd
+}
+
+fn too_complex() -> String {
+    "The 3D object is too complex to export".to_string()
+}
+
+fn crossing_hole() -> String {
+    "The 3D object has a hole that crosses its outline or another hole".to_string()
+}
+
+/// Count `steps` of work against [`MAX_WORK`].
+fn spend(work: &mut usize, steps: usize) -> Result<(), String> {
+    *work = work.saturating_add(steps);
+    if *work > MAX_WORK { Err(too_complex()) } else { Ok(()) }
+}
+
+/// The triangles covering one face: `contours` (outlines one way round, holes the other) on the
+/// plane across `normal` (its Newell normal).
+fn triangulate(contours: &[Vec<V3>], normal: V3, work: &mut usize) -> Result<Vec<[V3; 3]>, String> {
+    // Cut the face on the coordinate plane it is least slanted to, turned so outlines run
+    // counterclockwise.
+    let (ax, ay, az) = (normal.0.abs(), normal.1.abs(), normal.2.abs());
+    let flat = |v: V3| -> (f64, f64) {
+        if az >= ax && az >= ay {
+            if normal.2 >= 0.0 { (v.0, v.1) } else { (v.1, v.0) }
+        } else if ax >= ay {
+            if normal.0 >= 0.0 { (v.1, v.2) } else { (v.2, v.1) }
+        } else if normal.1 >= 0.0 {
+            (v.2, v.0)
+        } else {
+            (v.0, v.2)
+        }
+    };
+    let mut outlines: Vec<(Vec<Corner>, f64)> = vec![];
+    let mut holes: Vec<Vec<Corner>> = vec![];
+    for c in contours {
+        let mut ring: Vec<Corner> = c
+            .iter()
+            .map(|v| {
+                let (x, y) = flat(*v);
+                Corner { x, y, v: *v }
+            })
+            .collect();
+        ring.dedup_by(|a, b| (a.x - b.x).hypot(a.y - b.y) < 1e-9);
+        while ring.len() > 1 && ring.first().zip(ring.last()).is_some_and(|(a, b)| (a.x - b.x).hypot(a.y - b.y) < 1e-9) {
+            ring.pop();
+        }
+        if ring.len() < 3 {
+            continue;
+        }
+        let a = area(&ring);
+        if a > 1e-12 {
+            outlines.push((ring, a));
+        } else if a < -1e-12 {
+            holes.push(ring);
+        }
+    }
+    // Each hole goes to the smallest outline around it.
+    let mut held: Vec<Vec<Vec<Corner>>> = vec![vec![]; outlines.len()];
+    for hole in holes {
+        let corners: usize = outlines.iter().map(|(o, _)| o.len()).sum();
+        spend(work, corners.saturating_mul(hole.len() + 1))?;
+        // A hole that crosses an outline can't be cut out of it; leaving it would fill it.
+        let edges = |r: &[Corner]| r.iter().zip(r.iter().cycle().skip(1)).take(r.len()).map(|(p, q)| ((p.x, p.y), (q.x, q.y))).collect::<Vec<_>>();
+        let sides = edges(&hole);
+        if outlines.iter().any(|(o, _)| edges(o).iter().any(|(c, d)| sides.iter().any(|(a, b)| crosses(*a, *b, *c, *d)))) {
+            return Err(crossing_hole());
+        }
+        let Some(first) = hole.first() else { continue };
+        let owner =
+            outlines.iter().enumerate().filter(|(_, (o, _))| inside(o, first.x, first.y)).min_by(|a, b| a.1.1.total_cmp(&b.1.1)).map(|(i, _)| i);
+        if let Some(i) = owner
+            && let Some(h) = held.get_mut(i)
+        {
+            h.push(hole);
+        }
+    }
+    let mut out = vec![];
+    for ((outline, _), mut holes) in outlines.into_iter().zip(held) {
+        // The rightmost hole first, as each bridge then reaches the outline past the others.
+        holes.sort_by(|a, b| {
+            let right = |h: &[Corner]| h.iter().map(|c| c.x).fold(f64::NEG_INFINITY, f64::max);
+            right(b).total_cmp(&right(a))
+        });
+        let mut ring = outline;
+        for k in 0..holes.len() {
+            let (hole, rest) = holes[k..].split_first().ok_or_else(too_complex)?;
+            ring = bridge(ring, hole, rest, work)?;
+        }
+        clip(&ring, &mut out, work)?;
+    }
+    Ok(out)
+}
+
+/// Do segments `a`–`b` and `c`–`d` cross (touching at a shared end does not count)?
+fn crosses(a: (f64, f64), b: (f64, f64), c: (f64, f64), d: (f64, f64)) -> bool {
+    let same = |p: (f64, f64), q: (f64, f64)| (p.0 - q.0).hypot(p.1 - q.1) < 1e-9;
+    if same(a, c) || same(a, d) || same(b, c) || same(b, d) {
+        return false;
+    }
+    let side = |p: (f64, f64), q: (f64, f64), r: (f64, f64)| (q.0 - p.0) * (r.1 - p.1) - (q.1 - p.1) * (r.0 - p.0);
+    let (d1, d2, d3, d4) = (side(c, d, a), side(c, d, b), side(a, b, c), side(a, b, d));
+    ((d1 > 0.0 && d2 < 0.0) || (d1 < 0.0 && d2 > 0.0)) && ((d3 > 0.0 && d4 < 0.0) || (d3 < 0.0 && d4 > 0.0))
+}
+
+/// Does point `p` lie on segment `a`–`b`, short of its ends?
+fn touches(p: (f64, f64), a: (f64, f64), b: (f64, f64)) -> bool {
+    let (dx, dy) = (b.0 - a.0, b.1 - a.1);
+    let len = dx.hypot(dy);
+    if len < 1e-9 {
+        return false;
+    }
+    let along = ((p.0 - a.0) * dx + (p.1 - a.1) * dy) / len;
+    let off = ((p.1 - a.1) * dx - (p.0 - a.0) * dy).abs() / len;
+    off < 1e-9 && along > 1e-9 && along < len - 1e-9
+}
+
+/// `ring` with `hole` joined to it: from the hole's rightmost corner to the nearest corner of the
+/// ring that a straight bridge reaches inside the face: it crosses no edge of the ring, the hole or
+/// the `others`, passes through none of their other corners, and its middle is inside the ring and
+/// outside the holes. The bridge runs there and back, so the result is one ring.
+fn bridge(ring: Vec<Corner>, hole: &[Corner], others: &[Vec<Corner>], work: &mut usize) -> Result<Vec<Corner>, String> {
+    let Some(m) = (0..hole.len()).max_by(|a, b| hole[*a].x.total_cmp(&hole[*b].x)) else { return Ok(ring) };
+    let at = (hole[m].x, hole[m].y);
+    let mut order: Vec<usize> = (0..ring.len()).collect();
+    order.sort_by(|a, b| {
+        let d = |i: usize| (ring[i].x - at.0).hypot(ring[i].y - at.1);
+        d(*a).total_cmp(&d(*b))
+    });
+    let edges = |r: &[Corner]| r.iter().zip(r.iter().cycle().skip(1)).take(r.len()).map(|(p, q)| ((p.x, p.y), (q.x, q.y))).collect::<Vec<_>>();
+    let mut walls = edges(&ring);
+    walls.extend(edges(hole));
+    for o in others {
+        walls.extend(edges(o));
+    }
+    let to = order.into_iter().find(|&i| {
+        let p = (ring[i].x, ring[i].y);
+        *work = work.saturating_add(2 * walls.len());
+        if *work > MAX_WORK || walls.iter().any(|(c, d)| crosses(at, p, *c, *d) || touches(*c, at, p)) {
+            return false;
+        }
+        let mid = ((at.0 + p.0) / 2.0, (at.1 + p.1) / 2.0);
+        inside(&ring, mid.0, mid.1) && !inside(hole, mid.0, mid.1) && !others.iter().any(|o| inside(o, mid.0, mid.1))
+    });
+    if *work > MAX_WORK {
+        return Err(too_complex());
+    }
+    // A hole no bridge reaches (one that crosses another hole) can't be cut out; leaving it would
+    // fill it.
+    let Some(i) = to else { return Err(crossing_hole()) };
+    let mut out = Vec::with_capacity(ring.len() + hole.len() + 2);
+    out.extend_from_slice(&ring[..=i]);
+    out.extend(hole[m..].iter().chain(&hole[..=m]).copied());
+    out.extend_from_slice(&ring[i..]);
+    Ok(out)
+}
+
+/// Cut `ring` (counterclockwise, possibly joined to its holes by bridges) into triangles by ear
+/// clipping. A corner in line with its neighbors goes without a triangle. If no ear is left (a
+/// ring that crosses itself), the rest is cut as a fan.
+fn clip(ring: &[Corner], out: &mut Vec<[V3; 3]>, work: &mut usize) -> Result<(), String> {
+    let n = ring.len();
+    if n < 3 {
+        return Ok(());
+    }
+    let mut next: Vec<usize> = (1..=n).map(|i| i % n).collect();
+    let mut prev: Vec<usize> = (0..n).map(|i| (i + n - 1) % n).collect();
+    let (mut left, mut i, mut tried) = (n, 0usize, 0usize);
+    let cross = |a: &Corner, b: &Corner, c: &Corner| (b.x - a.x) * (c.y - a.y) - (b.y - a.y) * (c.x - a.x);
+    let same = |a: &Corner, b: &Corner| (a.x - b.x).hypot(a.y - b.y) < 1e-12;
+    while left > 3 {
+        let (a, c) = (prev[i], next[i]);
+        let (pa, pb, pc) = (&ring[a], &ring[i], &ring[c]);
+        let turn = cross(pa, pb, pc);
+        let scale = (pb.x - pa.x).hypot(pb.y - pa.y) * (pc.x - pb.x).hypot(pc.y - pb.y);
+        let mut ear = false;
+        let drop = turn.abs() <= 1e-12 * scale.max(1e-300);
+        if !drop && turn > 0.0 {
+            spend(work, left)?;
+            ear = true;
+            let mut k = next[c];
+            while k != a {
+                let p = &ring[k];
+                if !same(p, pa) && !same(p, pb) && !same(p, pc) && cross(pa, pb, p) > 0.0 && cross(pb, pc, p) > 0.0 && cross(pc, pa, p) > 0.0 {
+                    ear = false;
+                    break;
+                }
+                k = next[k];
+            }
+        }
+        if !ear && !drop && tried > left {
+            // No ear anywhere: cut what is left as a fan.
+            let start = i;
+            let mut k = next[start];
+            while next[k] != start {
+                out.push([ring[start].v, ring[k].v, ring[next[k]].v]);
+                k = next[k];
+            }
+            return Ok(());
+        }
+        if ear || drop {
+            if ear {
+                out.push([pa.v, pb.v, pc.v]);
+            }
+            next[a] = c;
+            prev[c] = a;
+            left -= 1;
+            i = a;
+            tried = 0;
+        } else {
+            i = c;
+            tried += 1;
+        }
+    }
+    let (a, c) = (prev[i], next[i]);
+    out.push([ring[a].v, ring[i].v, ring[c].v]);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/three-d/src/mesh/tests.rs b/crates/three-d/src/mesh/tests.rs
new file mode 100644
index 000000000..4ee38fe1d
--- /dev/null
+++ b/crates/three-d/src/mesh/tests.rs
@@ -0,0 +1,283 @@
+use std::collections::HashMap;
+
+use vectorcraft_geom::{BezPath, FillRule, PathData, Rect};
+
+use super::*;
+use crate::{Bevel, Edge};
+
+fn square(b: &mut BezPath, x: f64, y: f64, s: f64, clockwise: bool) {
+    b.move_to((x, y));
+    if clockwise {
+        b.line_to((x, y + s));
+        b.line_to((x + s, y + s));
+        b.line_to((x + s, y));
+    } else {
+        b.line_to((x + s, y));
+        b.line_to((x + s, y + s));
+        b.line_to((x, y + s));
+    }
+    b.close_path();
+}
+
+fn shape(b: &BezPath) -> (PathData, Rect) {
+    let p = PathData::from_bezpath(b);
+    let r = p.bounds().unwrap();
+    (p, r)
+}
+
+/// Straight on, without perspective.
+fn front() -> View {
+    View { rotation_x: 0.0, rotation_y: 0.0, rotation_z: 0.0, perspective: 0.0, ..View::default() }
+}
+
+fn sub(a: [f64; 3], b: [f64; 3]) -> [f64; 3] {
+    [a[0] - b[0], a[1] - b[1], a[2] - b[2]]
+}
+
+fn cross(a: [f64; 3], b: [f64; 3]) -> [f64; 3] {
+    [a[1] * b[2] - a[2] * b[1], a[2] * b[0] - a[0] * b[2], a[0] * b[1] - a[1] * b[0]]
+}
+
+fn dot(a: [f64; 3], b: [f64; 3]) -> f64 {
+    a[0] * b[0] + a[1] * b[1] + a[2] * b[2]
+}
+
+fn corners(m: &Mesh, t: [u32; 3]) -> [[f64; 3]; 3] {
+    t.map(|i| m.positions[i as usize])
+}
+
+/// The area of every triangle together.
+fn area(m: &Mesh) -> f64 {
+    m.triangles
+        .iter()
+        .map(|t| {
+            let [a, b, c] = corners(m, *t);
+            dot(cross(sub(b, a), sub(c, a)), cross(sub(b, a), sub(c, a))).sqrt() / 2.0
+        })
+        .sum()
+}
+
+/// Every edge of every triangle is met by an edge running the other way, as often: the surface is
+/// closed and its triangles turn one way.
+fn closed(m: &Mesh) -> bool {
+    let key = |p: [f64; 3]| p.map(|v| (v * 1e6).round() as i64);
+    let mut edges: HashMap<([i64; 3], [i64; 3]), i64> = HashMap::new();
+    for t in &m.triangles {
+        let c = corners(m, *t).map(key);
+        for (a, b) in [(c[0], c[1]), (c[1], c[2]), (c[2], c[0])] {
+            *edges.entry((a, b)).or_default() += 1;
+            *edges.entry((b, a)).or_default() -= 1;
+        }
+    }
+    edges.values().all(|n| *n == 0)
+}
+
+/// Every triangle of a solid convex about the origin turns its front away from the origin, and
+/// agrees with its corners' normals.
+fn outward(m: &Mesh) -> bool {
+    m.triangles.iter().all(|t| {
+        let [a, b, c] = corners(m, *t);
+        let n = cross(sub(b, a), sub(c, a));
+        let centre = [(a[0] + b[0] + c[0]) / 3.0, (a[1] + b[1] + c[1]) / 3.0, (a[2] + b[2] + c[2]) / 3.0];
+        dot(n, centre) > 0.0 && dot(n, m.normals[t[0] as usize]) > 0.0
+    })
+}
+
+#[test]
+fn an_extruded_square_is_a_closed_box_about_its_centre() {
+    let mut b = BezPath::new();
+    square(&mut b, 200.0, 300.0, 100.0, false);
+    let (p, r) = shape(&b);
+    let m = extrude_mesh(&p, FillRule::NonZero, r, Extrude { depth: 50.0, ..Extrude::default() }, front()).unwrap();
+    assert_eq!(m.triangles.len(), 12, "two triangles for each side of the box");
+    assert_eq!(m.positions.len(), m.normals.len());
+    assert_eq!(m.bounds(), Some(([-50.0, -50.0, -25.0], [50.0, 50.0, 25.0])));
+    assert!((area(&m) - (2.0 * 100.0 * 100.0 + 4.0 * 100.0 * 50.0)).abs() < 1e-6, "{}", area(&m));
+    assert!(closed(&m));
+    assert!(outward(&m));
+    assert!(m.normals.iter().all(|n| (dot(*n, *n) - 1.0).abs() < 1e-9));
+}
+
+#[test]
+fn caps_with_holes_are_cut_around_them() {
+    // Two holes in one outline: each cap keeps the outline less both holes.
+    let mut b = BezPath::new();
+    square(&mut b, 0.0, 0.0, 100.0, false);
+    square(&mut b, 10.0, 10.0, 30.0, true);
+    square(&mut b, 60.0, 50.0, 30.0, true);
+    let (p, r) = shape(&b);
+    let m = extrude_mesh(&p, FillRule::NonZero, r, Extrude { depth: 20.0, ..Extrude::default() }, front()).unwrap();
+    let caps = 2.0 * (100.0 * 100.0 - 2.0 * 30.0 * 30.0);
+    let walls = 4.0 * 100.0 * 20.0 + 2.0 * 4.0 * 30.0 * 20.0;
+    assert!((area(&m) - (caps + walls)).abs() < 1e-6, "{} != {}", area(&m), caps + walls);
+    assert!(closed(&m));
+}
+
+#[test]
+fn a_bridge_from_a_hole_never_runs_through_the_hole() {
+    // The hole's rightmost corner (60, 50) is nearest the outline's spike tip (10, 50), and the
+    // straight line to it runs through the hole and out at its corner (20, 50).
+    let poly = |b: &mut BezPath, pts: &[(f64, f64)]| {
+        for (k, p) in pts.iter().enumerate() {
+            if k == 0 { b.move_to(*p) } else { b.line_to(*p) }
+        }
+        b.close_path();
+    };
+    let mut b = BezPath::new();
+    poly(&mut b, &[(0.0, 0.0), (200.0, 0.0), (200.0, 100.0), (0.0, 100.0), (0.0, 55.0), (10.0, 50.0), (0.0, 45.0)]);
+    let hole = [(60.0, 50.0), (30.0, 40.0), (20.0, 50.0), (30.0, 60.0)];
+    poly(&mut b, &hole);
+    let (p, r) = shape(&b);
+    let m = plane_mesh(&p, FillRule::EvenOdd, r, front()).unwrap();
+    let face = 200.0 * 100.0 - 50.0 - 400.0;
+    assert!((area(&m) - face).abs() < 1e-6, "{} != {face}", area(&m));
+    // No triangle's centre is in the hole (page coordinates: the mesh is y up about (100, 50)).
+    let in_hole = |x: f64, y: f64| {
+        let mut odd = false;
+        for (k, a) in hole.iter().enumerate() {
+            let c = hole[(k + 1) % hole.len()];
+            if (a.1 > y) != (c.1 > y) && x < a.0 + (y - a.1) / (c.1 - a.1) * (c.0 - a.0) {
+                odd = !odd;
+            }
+        }
+        odd
+    };
+    for t in &m.triangles {
+        let [a, b, c] = corners(&m, *t);
+        let (x, y) = ((a[0] + b[0] + c[0]) / 3.0 + 100.0, 50.0 - (a[1] + b[1] + c[1]) / 3.0);
+        assert!(!in_hole(x, y), "a triangle at ({x}, {y})");
+    }
+}
+
+#[test]
+fn a_hole_that_crosses_the_outline_is_refused_rather_than_filled() {
+    // The hole starts inside the square, but its rightmost corner (15, 5) lies outside it, so no
+    // bridge from there reaches the square through the face.
+    let ring = |pts: &[(f64, f64)]| pts.iter().map(|(x, y)| V3(*x, *y, 0.0)).collect::<Vec<_>>();
+    let outline = ring(&[(0.0, 0.0), (10.0, 0.0), (10.0, 10.0), (0.0, 10.0)]);
+    let hole = ring(&[(5.0, 4.0), (5.0, 6.0), (15.0, 5.0)]);
+    let mut work = 0;
+    assert!(super::triangulate(std::slice::from_ref(&outline), V3(0.0, 0.0, 1.0), &mut work).is_ok());
+    let r = super::triangulate(&[outline.clone(), hole], V3(0.0, 0.0, 1.0), &mut work);
+    assert!(r.as_ref().is_err_and(|e| e.contains("hole")), "{:?}", r.map(|t| t.len()));
+    // The same hole starting outside the square belongs to no outline, and is refused too.
+    let hole = ring(&[(15.0, 5.0), (5.0, 4.0), (5.0, 6.0)]);
+    let r = super::triangulate(&[outline, hole], V3(0.0, 0.0, 1.0), &mut work);
+    assert!(r.as_ref().is_err_and(|e| e.contains("hole")), "{:?}", r.map(|t| t.len()));
+}
+
+#[test]
+fn a_bridge_through_another_corner_touches_it() {
+    assert!(super::touches((5.0, 0.0), (0.0, 0.0), (10.0, 0.0)));
+    assert!(!super::touches((0.0, 0.0), (0.0, 0.0), (10.0, 0.0)), "an end is not a touch");
+    assert!(!super::touches((5.0, 1.0), (0.0, 0.0), (10.0, 0.0)));
+}
+
+#[test]
+fn a_beveled_extrusion_stays_closed() {
+    let mut b = BezPath::new();
+    square(&mut b, 0.0, 0.0, 100.0, false);
+    let (p, r) = shape(&b);
+    let bevel = Bevel { width: 6.0, height: 6.0, both_sides: true, ..Bevel::default() };
+    let m = extrude_mesh(&p, FillRule::NonZero, r, Extrude { depth: 40.0, bevel: Some(bevel), ..Extrude::default() }, front()).unwrap();
+    assert!(closed(&m));
+    assert!(outward(&m));
+}
+
+#[test]
+fn the_mesh_keeps_the_turn_of_the_view() {
+    let mut b = BezPath::new();
+    square(&mut b, 0.0, 0.0, 100.0, false);
+    let (p, r) = shape(&b);
+    // Turned 90° about the vertical axis, the extrusion's depth lies along x.
+    let view = View { rotation_y: 90.0, ..front() };
+    let m = extrude_mesh(&p, FillRule::NonZero, r, Extrude { depth: 20.0, ..Extrude::default() }, view).unwrap();
+    let (lo, hi) = m.bounds().unwrap();
+    assert!((hi[0] - lo[0] - 20.0).abs() < 1e-9 && (hi[2] - lo[2] - 100.0).abs() < 1e-9, "{lo:?} {hi:?}");
+}
+
+#[test]
+fn a_turned_plane_keeps_its_area_less_its_hole() {
+    let mut b = BezPath::new();
+    square(&mut b, 0.0, 0.0, 100.0, false);
+    square(&mut b, 25.0, 25.0, 50.0, true);
+    let (p, r) = shape(&b);
+    let view = View { rotation_x: 30.0, rotation_y: -40.0, ..front() };
+    let m = plane_mesh(&p, FillRule::NonZero, r, view).unwrap();
+    assert!((area(&m) - (100.0 * 100.0 - 50.0 * 50.0)).abs() < 1e-6, "{}", area(&m));
+}
+
+#[test]
+fn y_points_up() {
+    // The art's top edge (y 0 on the page) is the mesh's highest.
+    let mut b = BezPath::new();
+    b.move_to((0.0, 0.0));
+    b.line_to((100.0, 0.0));
+    b.line_to((50.0, 100.0));
+    b.close_path();
+    let (p, r) = shape(&b);
+    let m = plane_mesh(&p, FillRule::NonZero, r, front()).unwrap();
+    let top = m.positions.iter().filter(|q| (q[1] - 50.0).abs() < 1e-9).count();
+    assert!(top >= 2, "{:?}", m.positions);
+    assert!(m.normals.iter().all(|n| n[2] > 0.99), "a plane facing the viewer has its normal toward +z");
+}
+
+#[test]
+fn a_revolved_profile_is_a_closed_cylinder() {
+    // A vertical line 10 pt from the axis, swept round with its ends capped: a closed cylinder.
+    let mut b = BezPath::new();
+    b.move_to((20.0, 0.0));
+    b.line_to((20.0, 100.0));
+    let p = PathData::from_bezpath(&b);
+    let r = p.bounds().unwrap();
+    let o = Revolve { offset: 10.0, edge: Edge::Left, segments: 64, ..Revolve::default() };
+    let m = revolve_mesh(&p, r, o).unwrap();
+    assert!(closed(&m));
+    let exact = 2.0 * std::f64::consts::PI * 10.0 * 100.0 + 2.0 * std::f64::consts::PI * 100.0;
+    assert!((area(&m) - exact).abs() / exact < 0.01, "{} vs {exact}", area(&m));
+    assert!(outward(&m));
+}
+
+#[test]
+fn a_partial_revolve_caps_its_ends_with_sectors() {
+    let mut b = BezPath::new();
+    b.move_to((20.0, 0.0));
+    b.line_to((20.0, 100.0));
+    let p = PathData::from_bezpath(&b);
+    let r = p.bounds().unwrap();
+    let o = Revolve { angle: 90.0, offset: 10.0, segments: 64, ..Revolve::default() };
+    let m = revolve_mesh(&p, r, o).unwrap();
+    let exact = 0.25 * (2.0 * std::f64::consts::PI * 10.0 * 100.0 + 2.0 * std::f64::consts::PI * 100.0);
+    assert!((area(&m) - exact).abs() / exact < 0.01, "{} vs {exact}", area(&m));
+}
+
+#[test]
+fn inflate_puffs_the_front_toward_the_viewer() {
+    let mut b = BezPath::new();
+    square(&mut b, 0.0, 0.0, 100.0, false);
+    let (p, r) = shape(&b);
+    let m = inflate_meshes(&[(&p, FillRule::NonZero)], r, Inflate::default(), front()).last().unwrap().unwrap();
+    assert!(!m.is_empty());
+    let (lo, hi) = m.bounds().unwrap();
+    assert!(hi[2] > 0.0 && lo[2] < hi[2], "the front puffs toward the viewer: {lo:?} {hi:?}");
+}
+
+#[test]
+fn an_empty_shape_makes_an_empty_mesh() {
+    let p = PathData::new(vec![]);
+    let m = plane_mesh(&p, FillRule::NonZero, Rect::new(0.0, 0.0, 10.0, 10.0), front()).unwrap();
+    assert!(m.is_empty());
+    assert_eq!(m.bounds(), None);
+}
+
+#[test]
+fn join_numbers_each_parts_corners_after_the_last() {
+    let mut b = BezPath::new();
+    square(&mut b, 0.0, 0.0, 10.0, false);
+    let (p, r) = shape(&b);
+    let one = plane_mesh(&p, FillRule::NonZero, r, front()).unwrap();
+    let both = Mesh::join([one.clone(), one.clone()]);
+    assert_eq!(both.triangles.len(), 2 * one.triangles.len());
+    assert!(both.triangles.iter().all(|t| t.iter().all(|i| (*i as usize) < both.positions.len())));
+    assert_eq!(both.triangles[one.triangles.len()][0], one.triangles[0][0] + one.positions.len() as u32);
+}
diff --git a/crates/three-d/src/solid.rs b/crates/three-d/src/solid.rs
index 043e34766..20beda4ec 100644
--- a/crates/three-d/src/solid.rs
+++ b/crates/three-d/src/solid.rs
@@ -20,7 +20,9 @@ mod rings;
 
 #[cfg(test)]
 use build::{Camera, cuts, edge_distance, newell, section};
+pub(crate) use build::{Face3, extrude_faces, plane_faces};
 pub use build::{extrude, plane};
+pub(crate) use inflate::inflate_faces;
 pub use inflate::{inflate, inflate_together};
 #[cfg(test)]
 use membrane::{Edges, Membrane, cell_triangles};
diff --git a/crates/three-d/src/solid/build.rs b/crates/three-d/src/solid/build.rs
index c78f2a38b..7fbeb3e8c 100644
--- a/crates/three-d/src/solid/build.rs
+++ b/crates/three-d/src/solid/build.rs
@@ -41,6 +41,13 @@ impl Camera {
     }
 }
 
+/// A face of a solid before projection: its contours in view space (holes running the other way)
+/// and its outward normal.
+pub(crate) type Face3 = (Vec<Vec<V3>>, V3);
+
+/// What a solid's builder makes: its facets, or with a mesh asked for, its faces before projection.
+pub(crate) type Built = (Vec<Facet>, Vec<Face3>);
+
 /// Facets being collected for one solid.
 pub(super) struct Builder<'a> {
     pub(super) camera: &'a Camera,
@@ -48,6 +55,8 @@ pub(super) struct Builder<'a> {
     /// insides.
     pub(super) closed: bool,
     pub(super) facets: Vec<Facet>,
+    /// With `Some`, every face goes here as it is, none hidden or projected, for a mesh.
+    pub(super) mesh: Option<Vec<Face3>>,
 }
 
 /// Where a face goes in the order the facets are drawn, back to front.
@@ -73,6 +82,13 @@ impl Builder<'_> {
         if count < 3 {
             return Ok(());
         }
+        if let Some(mesh) = &mut self.mesh {
+            mesh.push((contours, n.unit()));
+            if mesh.len() > MAX_FACES {
+                return Err("The 3D surface is too complex; simplify the shape".into());
+            }
+            return Ok(());
+        }
         let centre = contours.iter().flatten().fold(V3::default(), |s, v| V3(s.0 + v.0, s.1 + v.1, s.2 + v.2));
         let centre = V3(centre.0 / count as f64, centre.1 / count as f64, centre.2 / count as f64);
         let n = n.unit();
@@ -182,9 +198,15 @@ impl Builder<'_> {
         Ok(())
     }
 
-    pub(super) fn finish(mut self) -> Vec<Facet> {
+    /// How many faces the builder holds: facets, or faces kept for a mesh.
+    pub(super) fn len(&self) -> usize {
+        self.mesh.as_ref().map_or(self.facets.len(), Vec::len)
+    }
+
+    /// The facets back to front, and the faces kept for a mesh (none without [`Builder::mesh`]).
+    pub(super) fn finish(mut self) -> Built {
         self.facets.sort_by(|a, b| a.depth.total_cmp(&b.depth));
-        self.facets
+        (self.facets, self.mesh.unwrap_or_default())
     }
 }
 
@@ -370,15 +392,20 @@ fn steps(o: &Extrude) -> Vec<Step> {
 /// Extrude & Bevel: the shape's outline extruded backwards, with optional twist, taper, bevels
 /// and caps.
 pub fn extrude(path: &PathData, rule: FillRule, bounds: Rect, options: Extrude, view: View) -> Result<Vec<Facet>, String> {
+    extrude_faces(path, rule, bounds, options, view, false).map(|(facets, _)| facets)
+}
+
+/// [`extrude`], or with `mesh` the solid's faces before projection instead of its facets.
+pub(crate) fn extrude_faces(path: &PathData, rule: FillRule, bounds: Rect, options: Extrude, view: View, mesh: bool) -> Result<Built, String> {
     check_bounds(bounds)?;
     let o = options.sanitized();
     // No depth: the flat shape, seen from either side.
     if o.depth <= 0.0 {
-        return plane(path, rule, bounds, view);
+        return plane_faces(path, rule, bounds, view, mesh);
     }
     let rings = rings(path, rule, bounds.width().max(bounds.height()), MAX_SOLID_POINTS)?;
     let camera = Camera::new(view, bounds, o.depth);
-    let mut b = Builder { camera: &camera, closed: o.cap, facets: vec![] };
+    let mut b = Builder { camera: &camera, closed: o.cap, facets: vec![], mesh: mesh.then(Vec::new) };
     let steps = steps(&o);
     let z = |t: f64| o.depth / 2.0 - o.depth * t;
     let ring_at =
@@ -428,10 +455,15 @@ pub fn extrude(path: &PathData, rule: FillRule, bounds: Rect, options: Extrude,
 /// Rotate: the flat art turned in 3D about the centre of `bounds` (which may be larger than the
 /// shape's own, so that every part of one object turns about the same point).
 pub fn plane(path: &PathData, rule: FillRule, bounds: Rect, view: View) -> Result<Vec<Facet>, String> {
+    plane_faces(path, rule, bounds, view, false).map(|(facets, _)| facets)
+}
+
+/// [`plane`], or with `mesh` its face before projection instead of its facet.
+pub(crate) fn plane_faces(path: &PathData, rule: FillRule, bounds: Rect, view: View, mesh: bool) -> Result<Built, String> {
     check_bounds(bounds)?;
     let rings = rings(path, rule, bounds.width().max(bounds.height()), MAX_PLANE_POINTS)?;
     let camera = Camera::new(view, bounds, 0.0);
-    let mut b = Builder { camera: &camera, closed: false, facets: vec![] };
+    let mut b = Builder { camera: &camera, closed: false, facets: vec![], mesh: mesh.then(Vec::new) };
     let contours: Vec<Vec<V3>> = rings.iter().map(|r| r.iter().map(|p| camera.place(*p, 0.0)).collect()).collect();
     // A plane is one flat face, seen from either side. Its normal is turned toward the viewer, so
     // it is drawn last, as a cap is, and planes drawn in one order keep the order they are given in.
diff --git a/crates/three-d/src/solid/inflate.rs b/crates/three-d/src/solid/inflate.rs
index d80fef185..9f1f5c3f7 100644
--- a/crates/three-d/src/solid/inflate.rs
+++ b/crates/three-d/src/solid/inflate.rs
@@ -1,4 +1,4 @@
-use super::build::{Builder, Camera, Order, Turn, check_bounds, cuts, fit, newell, outward};
+use super::build::{Builder, Built, Camera, Order, Turn, check_bounds, cuts, fit, newell, outward};
 use super::membrane::{Edges, MAX_MATERIAL_SEGMENTS, Membrane, cell_triangles, clip, filled, material};
 use super::rings::{MAX_SOLID_POINTS, rings, signed_area};
 use super::{Facet, FillRule, Inflate, MAX_FACES, PathData, Point, Rect, V3, Vec2, View};
@@ -51,6 +51,11 @@ pub fn inflate(path: &PathData, rule: FillRule, bounds: Rect, options: Inflate,
 /// on its own over the grid of `bounds`, and one eye sees them all, as far away as the highest
 /// puff needs with Perspective. One result for each shape, in order.
 pub fn inflate_together(shapes: &[(&PathData, FillRule)], bounds: Rect, options: Inflate, view: View) -> Vec<Result<Vec<Facet>, String>> {
+    inflate_faces(shapes, bounds, options, view, false).into_iter().map(|r| r.map(|(facets, _)| facets)).collect()
+}
+
+/// [`inflate_together`], or with `mesh` each solid's faces before projection instead of its facets.
+pub(crate) fn inflate_faces(shapes: &[(&PathData, FillRule)], bounds: Rect, options: Inflate, view: View, mesh: bool) -> Vec<Result<Built, String>> {
     let o = options.sanitized();
     let puffs: Vec<Result<Option<Puff>, String>> =
         shapes.iter().map(|(path, rule)| check_bounds(bounds).and_then(|()| puff(path, *rule, bounds, &o))).collect();
@@ -58,16 +63,17 @@ pub fn inflate_together(shapes: &[(&PathData, FillRule)], bounds: Rect, options:
     puffs
         .into_iter()
         .map(|p| match p {
-            Ok(Some(p)) => inflated(p, bounds, o, view, reach),
-            Ok(None) => Ok(vec![]),
+            Ok(Some(p)) => inflated(p, bounds, o, view, reach, mesh),
+            Ok(None) => Ok((vec![], vec![])),
             Err(e) => Err(e),
         })
         .collect()
 }
 
 /// The facets of one inflated shape, for a camera that allows for a puff `reach` high (or the
-/// shape's own, if higher): `reach` is the highest puff of the shapes drawn together.
-fn inflated(p: Puff, bounds: Rect, o: Inflate, view: View, reach: f64) -> Result<Vec<Facet>, String> {
+/// shape's own, if higher): `reach` is the highest puff of the shapes drawn together. With `mesh`,
+/// its faces before projection instead.
+fn inflated(p: Puff, bounds: Rect, o: Inflate, view: View, reach: f64, mesh: bool) -> Result<Built, String> {
     let Puff { rings, edges, cell, nx, ny, m, height } = p;
     let outline: Vec<(Rect, vectorcraft_geom::SubPath)> = rings
         .iter()
@@ -106,7 +112,7 @@ fn inflated(p: Puff, bounds: Rect, o: Inflate, view: View, reach: f64) -> Result
     let smooth = view.shade && view.has_colored_lights();
     let camera = Camera::new(view, bounds, o.depth + 2.0 * height.max(reach));
     // Without its back cap the object is a shell open behind, its inside showing.
-    let mut b = Builder { camera: &camera, closed: o.cap, facets: vec![] };
+    let mut b = Builder { camera: &camera, closed: o.cap, facets: vec![], mesh: mesh.then(Vec::new) };
     let half = o.depth / 2.0;
     // The back: turned and scaled by the twist and taper, its puff too.
     let back_turn = Turn::new(bounds, o.twist, o.taper, 1.0);
@@ -300,7 +306,7 @@ fn inflated(p: Puff, bounds: Rect, o: Inflate, view: View, reach: f64) -> Result
             ring.iter().map(|p| camera.place(turn.apply(*p), half - o.depth * t)).collect()
         };
         let mut pieces: Vec<Vec<usize>> = rings.iter().map(|r| if o.twist != 0.0 { cuts(&at(r, 0), &at(r, 1)) } else { vec![] }).collect();
-        fit(&mut pieces, slices, MAX_FACES.saturating_sub(b.facets.len()));
+        fit(&mut pieces, slices, MAX_FACES.saturating_sub(b.len()));
         for (ring, pieces) in rings.iter().zip(&pieces) {
             for k in 0..slices {
                 b.band(&at(ring, k), &at(ring, k + 1), pieces, |i| outward(ring, i, 0.0))?;
diff --git a/crates/tools/src/direct.rs b/crates/tools/src/direct.rs
index d27a9f2a4..a2ffbbf87 100644
--- a/crates/tools/src/direct.rs
+++ b/crates/tools/src/direct.rs
@@ -41,6 +41,11 @@
 //! Dragging the brackets of selected type on a path moves or flips it ([`crate::pathtype`]).
 //! A press on a selected object's centre point (Attributes panel › Show Center) selects the object
 //! whole, and a drag from it moves the object.
+//! A click on an instance of a dynamic symbol selects the object of the symbol's art under the
+//! pointer (`symbol.instance.selectPart`), outlined: the solid color Fill, Stroke, Color, Swatches
+//! and Eyedropper changes then go to that object for this instance only, and a drag moves nothing.
+//! The engine refuses any object but a path, compound path or type. Alt and Shift pick the instance
+//! whole, as for other objects.
 //!
 //! A press on the stroke of a path that isn't selected as a whole selects that segment's two anchors
 //! (the fill, or Alt, selects the whole path); dragging the segment bends it if it's curved, else
@@ -50,8 +55,8 @@ use std::borrow::Cow;
 use std::collections::{BTreeMap, BTreeSet};
 
 use serde_json::{Value, json};
-use vectorcraft_doc::hit::{Hit, HitKind, compound_part_at, hit_test, selected_hidden_at};
-use vectorcraft_doc::{AnchorRef, Node, NodeId, NodeKind, Selection};
+use vectorcraft_doc::hit::{Hit, HitKind, compound_part_at, hit_test, selected_hidden_at, symbol_part_at, symbol_part_outline};
+use vectorcraft_doc::{AnchorRef, Node, NodeId, NodeKind, Selection, symbol_overrides};
 use vectorcraft_geom::{Anchor, PathData, PathSeg, Point, Rect, Vec2};
 
 use crate::bbox::move_delta;
@@ -667,6 +672,12 @@ fn next_group(cx: &ToolContext, ancestry: &[NodeId]) -> Option<NodeId> {
         .find(|id| !cx.selection.contains(*id))
 }
 
+/// Is an object of instance `id`'s art selected ([`vectorcraft_doc::Selection::symbol_part`]),
+/// rather than the instance whole?
+fn part_picked(cx: &ToolContext, id: NodeId) -> bool {
+    cx.selection.symbol_part.as_ref().is_some_and(|sp| sp.instance == id)
+}
+
 /// The segment of path `id` nearest to `p`, where the hit test found its stroke.
 fn segment_at(cx: &ToolContext, id: NodeId, p: Point) -> Option<SegmentHit> {
     let pd = cx.doc.node(id)?.path_data()?;
@@ -984,6 +995,11 @@ impl Tool for DirectSelectionTool {
                 let mut out = self.spine_overlays(cx);
                 out.extend(self.mesh.overlays(cx, &|id| cx.selection.contains(id)));
                 if !self.group {
+                    if let Some(sp) = &cx.selection.symbol_part
+                        && let Some(path) = cx.doc.node(sp.instance).and_then(|n| symbol_part_outline(cx.doc, n, &sp.path))
+                    {
+                        out.push(Overlay::Path { path, color: cx.doc.layer_color(sp.instance), width: 1.0, dashed: false });
+                    }
                     out.extend(frame_overlays(cx, &self.frame_anchors(cx)));
                     let drag = if let State::Bracket(b) = &self.state { Some(b) } else { None };
                     out.extend(pathtype::overlays(cx, self.bracket_hover, drag));
@@ -1309,7 +1325,7 @@ impl DirectSelectionTool {
         if ev.mods.shift {
             return vec![Action::Exec("select.toggle".into(), json!({"id": id.0}))];
         }
-        if cx.selection.partial(id).is_some() || cx.selection.segments.contains_key(&id) {
+        if cx.selection.partial(id).is_some() || cx.selection.segments.contains_key(&id) || part_picked(cx, id) {
             return vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))];
         }
         vec![]
@@ -1319,6 +1335,26 @@ impl DirectSelectionTool {
             h.ancestry.push(part);
             h.leaf = part;
         }
+        // On an instance of a dynamic symbol a click picks the object of its art under the pointer;
+        // a drag from it moves nothing (`object.transform` refuses while it is selected).
+        if !ev.mods.alt
+            && !ev.mods.shift
+            && let Some(n) = cx.doc.node(h.leaf)
+            && let NodeKind::SymbolInstance { symbol, .. } = &n.kind
+            && let Some(sym) = cx.doc.symbols.iter().find(|s| s.name == *symbol && s.dynamic)
+            && let Some(path) = symbol_part_at(cx.doc, n, p, cx.selection_hit_options())
+        {
+            self.frame.clear();
+            // The engine refuses any other object with a status message, and the selection stays,
+            // so a drag from the press does not move it.
+            if symbol_overrides::part(&sym.art, &path).is_some_and(symbol_overrides::takes_part_paint) {
+                self.state = State::MoveObject { start: p, grab: None, hold: hold_point(cx, &h, p), began: false, deselect: None };
+            }
+            if cx.selection.symbol_part.as_ref().is_some_and(|sp| sp.instance == h.leaf && sp.path == path) {
+                return vec![];
+            }
+            return vec![Action::Exec("symbol.instance.selectPart".into(), json!({"id": h.leaf.0, "path": path}))];
+        }
         // On a gradient mesh a click picks the point, the mesh line's two ends or the four points
         // around the patch under it (Shift toggles them), and selects the mesh; a drag moves the
         // picked points.
@@ -1340,7 +1376,7 @@ impl DirectSelectionTool {
         // A segment pick keeps its endpoints available for movement without selecting
         // the anchors themselves. Dragging reshapes a curve, else moves it. Alt picks
         // the whole path (and Alt-drag copies it), as with Group Selection.
-        let whole = cx.selection.contains(h.leaf) && cx.selection.partial(h.leaf).is_none();
+        let whole = cx.selection.contains(h.leaf) && cx.selection.partial(h.leaf).is_none() && !part_picked(cx, h.leaf);
         if !ev.mods.alt
             && matches!(h.kind, HitKind::Stroke | HitKind::Outline)
             && let Some(s) = segment_at(cx, h.leaf, p)
@@ -1376,7 +1412,7 @@ impl DirectSelectionTool {
             return vec![Action::Exec("select.toggle".into(), json!({"id": h.leaf.0}))];
         }
         self.frame.clear();
-        if !cx.selection.contains(h.leaf) || cx.selection.partial(h.leaf).is_some() {
+        if !cx.selection.contains(h.leaf) || cx.selection.partial(h.leaf).is_some() || part_picked(cx, h.leaf) {
             return vec![Action::Exec("select.set".into(), json!({"ids": [h.leaf.0]}))];
         }
         vec![]
diff --git a/crates/tools/src/direct/tests.rs b/crates/tools/src/direct/tests.rs
index a8507e693..42396e241 100644
--- a/crates/tools/src/direct/tests.rs
+++ b/crates/tools/src/direct/tests.rs
@@ -2147,3 +2147,165 @@ fn selected_path_handle_over_background_rect_is_draggable() {
     let acts = t.pointer(&c, &PointerEvent::new(PointerKind::Down, 150.0, 150.0));
     assert_eq!(acts, vec![Action::Begin("Reshape".into())]);
 }
+
+/// On an instance of a dynamic symbol, a Direct Selection click picks the object of the symbol's
+/// art under the pointer, which is then outlined; Alt and Shift, a static symbol and Group
+/// Selection pick the instance whole, as before.
+#[test]
+fn a_click_on_a_dynamic_instance_picks_the_object_under_the_pointer() {
+    use std::sync::Arc;
+    use vectorcraft_doc::{Appearance, Node, Symbol};
+    let square = |id, x: f64| {
+        Arc::new(Node::path(NodeId(id), vectorcraft_geom::shapes::rectangle(Rect::new(x, 0.0, x + 10.0, 10.0)), Appearance::default_art()))
+    };
+    let art = Node::group(NodeId(0), vec![square(0, 0.0), square(0, 20.0)]);
+    let mut d = vectorcraft_doc::Document::new(500.0, 500.0);
+    d.symbols.push(Symbol { dynamic: true, name: "Pair".into(), art: Arc::new(art) });
+    let (l, id) = (d.layers[0].id, d.alloc_id());
+    let xf = vectorcraft_geom::Affine::translate((300.0, 300.0)) * vectorcraft_geom::Affine::scale(2.0);
+    d.insert(Some(l), usize::MAX, Node::new(id, NodeKind::SymbolInstance { symbol: "Pair".into(), xf })).unwrap();
+    let (none, p) = (Selection::default(), paint());
+    let down = |d: &vectorcraft_doc::Document, sel: &Selection, group: bool, x: f64, y: f64, m: Mods| {
+        DirectSelectionTool::new(group).pointer(&cx(d, sel, &p), &PointerEvent::new(PointerKind::Down, x, y).with_mods(m))
+    };
+    let part = |path: Value| vec![Action::Exec("symbol.instance.selectPart".into(), json!({"id": id.0, "path": path}))];
+    // The second square is drawn at 340..360.
+    assert_eq!(down(&d, &none, false, 350.0, 310.0, Mods::default()), part(json!([1])));
+    assert_eq!(down(&d, &none, false, 310.0, 310.0, Mods::default()), part(json!([0])));
+    let whole = vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))];
+    assert_eq!(down(&d, &none, false, 350.0, 310.0, Mods { alt: true, ..Mods::default() }), whole, "Alt picks the instance");
+    let shift = down(&d, &none, false, 350.0, 310.0, Mods { shift: true, ..Mods::default() });
+    assert_eq!(shift, vec![Action::Exec("select.toggle".into(), json!({"id": id.0}))]);
+    assert_eq!(down(&d, &none, true, 350.0, 310.0, Mods::default()), whole, "Group Selection picks the instance");
+    // The part selected: a click on it again keeps it, and it is outlined.
+    let mut sel = Selection::default();
+    sel.set_symbol_part(id, vec![1]);
+    assert_eq!(down(&d, &sel, false, 350.0, 310.0, Mods::default()), vec![]);
+    let outline = DirectSelectionTool::new(false).overlays(&cx(&d, &sel, &p));
+    let drawn =
+        outline.iter().find_map(|o| if let Overlay::Path { path, .. } = o { Some(vectorcraft_geom::kurbo::Shape::bounding_box(path)) } else { None });
+    assert_eq!(drawn, Some(Rect::new(340.0, 300.0, 360.0, 320.0)));
+    // With the part selected, an Alt-click on the instance, or a press on its center point, picks
+    // the instance whole again.
+    assert_eq!(down(&d, &sel, false, 350.0, 310.0, Mods { alt: true, ..Mods::default() }), whole, "Alt with the part selected");
+    d.node_mut(id).unwrap().edit_attrs(|a| a.show_center = Some(true));
+    assert_eq!(down(&d, &sel, false, 330.0, 310.0, Mods::default()), whole, "the center point with the part selected");
+    // A static symbol: the instance is picked whole.
+    d.symbols[0].dynamic = false;
+    assert_eq!(down(&d, &none, false, 350.0, 310.0, Mods::default()), whole);
+}
+
+/// In a dynamic symbol's art, a Direct Selection press passes over a locked object: it picks the
+/// unlocked object beneath it, and where only a locked object is under the pointer it picks the
+/// instance whole.
+#[test]
+fn a_press_on_a_dynamic_instance_passes_over_locked_objects() {
+    use std::sync::Arc;
+    use vectorcraft_doc::{Appearance, Node, Symbol};
+    let square = |x: f64, locked: bool| {
+        let mut n = Node::path(NodeId(0), vectorcraft_geom::shapes::rectangle(Rect::new(x, 0.0, x + 10.0, 10.0)), Appearance::default_art());
+        n.locked = locked;
+        Arc::new(n)
+    };
+    // The unlocked square at 0..10 has a locked square over it; the square at 20..30 is locked.
+    let art = Node::group(NodeId(0), vec![square(0.0, false), square(0.0, true), square(20.0, true)]);
+    let mut d = vectorcraft_doc::Document::new(500.0, 500.0);
+    d.symbols.push(Symbol { dynamic: true, name: "Locked".into(), art: Arc::new(art) });
+    let (l, id) = (d.layers[0].id, d.alloc_id());
+    let xf = vectorcraft_geom::Affine::translate((300.0, 300.0));
+    d.insert(Some(l), usize::MAX, Node::new(id, NodeKind::SymbolInstance { symbol: "Locked".into(), xf })).unwrap();
+    let (none, p) = (Selection::default(), paint());
+    let down = |x: f64, y: f64| DirectSelectionTool::new(false).pointer(&cx(&d, &none, &p), &PointerEvent::new(PointerKind::Down, x, y));
+    assert_eq!(down(305.0, 305.0), vec![Action::Exec("symbol.instance.selectPart".into(), json!({"id": id.0, "path": [0]}))]);
+    assert_eq!(down(325.0, 305.0), vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))]);
+    // A locked clipping path still clips, but a press on its outline picks the art it clips.
+    let mut clip = Node::path(NodeId(0), vectorcraft_geom::shapes::rectangle(Rect::new(0.0, 0.0, 20.0, 20.0)), Appearance::default_art());
+    clip.locked = true;
+    let art = Node::path(NodeId(0), vectorcraft_geom::shapes::rectangle(Rect::new(-10.0, -10.0, 30.0, 30.0)), Appearance::default_art());
+    let masked = Node::new(NodeId(0), NodeKind::Group { children: vec![Arc::new(clip), Arc::new(art)], clip: true });
+    let mut d = d.clone();
+    d.symbols[0].art = Arc::new(masked);
+    let down = |x: f64, y: f64| DirectSelectionTool::new(false).pointer(&cx(&d, &none, &p), &PointerEvent::new(PointerKind::Down, x, y));
+    assert_eq!(down(319.0, 310.0), vec![Action::Exec("symbol.instance.selectPart".into(), json!({"id": id.0, "path": [1]}))]);
+}
+
+/// In a dynamic symbol's art, a Direct Selection press passes over a guide path while guides are
+/// hidden or locked and picks the square beneath it; with guides shown and unlocked it picks the
+/// guide path. The same goes for a press on the edge of a guide used as a clipping path.
+#[test]
+fn a_press_on_a_dynamic_instance_passes_over_guides_while_they_cannot_be_picked() {
+    use std::sync::Arc;
+    use vectorcraft_doc::{Appearance, Node, Symbol};
+    let square = |r: Rect, is_guide: bool| {
+        let mut n = Node::path(NodeId(0), vectorcraft_geom::shapes::rectangle(r), Appearance::default_art());
+        let NodeKind::Path { guide, .. } = &mut n.kind else { panic!("Node::path makes a path") };
+        *guide = is_guide;
+        Arc::new(n)
+    };
+    let small = Rect::new(0.0, 0.0, 10.0, 10.0);
+    let art = Node::group(NodeId(0), vec![square(small, false), square(small, true)]);
+    let mut d = vectorcraft_doc::Document::new(500.0, 500.0);
+    d.symbols.push(Symbol { dynamic: true, name: "Guided".into(), art: Arc::new(art) });
+    let (l, id) = (d.layers[0].id, d.alloc_id());
+    let xf = vectorcraft_geom::Affine::translate((300.0, 300.0));
+    d.insert(Some(l), usize::MAX, Node::new(id, NodeKind::SymbolInstance { symbol: "Guided".into(), xf })).unwrap();
+    let (none, p) = (Selection::default(), paint());
+    let part = |path: Value| vec![Action::Exec("symbol.instance.selectPart".into(), json!({"id": id.0, "path": path}))];
+    let down = |d: &vectorcraft_doc::Document, guides: bool, x: f64, y: f64| {
+        let c = ToolContext { guides, ..cx(d, &none, &p) };
+        DirectSelectionTool::new(false).pointer(&c, &PointerEvent::new(PointerKind::Down, x, y))
+    };
+    assert_eq!(down(&d, false, 305.0, 305.0), part(json!([0])), "guides off: the square beneath");
+    assert_eq!(down(&d, true, 305.0, 305.0), part(json!([1])), "guides on: the guide");
+    // A guide gives a clip group no clip region, so nothing in the group is hit away from its edge,
+    // as outside symbols. With guides off a press on its edge picks the instance whole.
+    let clip = Rect::new(0.0, 0.0, 20.0, 20.0);
+    let masked =
+        Node::new(NodeId(0), NodeKind::Group { children: vec![square(clip, true), square(Rect::new(-10.0, -10.0, 30.0, 30.0), false)], clip: true });
+    d.symbols[0].art = Arc::new(masked);
+    assert_eq!(
+        down(&d, false, 319.0, 310.0),
+        vec![Action::Exec("select.set".into(), json!({"ids": [id.0]}))],
+        "guides off: the clipping path's edge"
+    );
+    assert_eq!(down(&d, true, 319.0, 310.0), part(json!([0])), "guides on: the clipping path's edge");
+}
+
+/// In a dynamic symbol's art, a Direct Selection press on the outline of a clip group's clipping
+/// path picks the clipping path, also where the art it clips covers the path's edge; inside the
+/// mask away from the edge the art is picked.
+#[test]
+fn a_press_on_a_clipping_path_in_a_dynamic_instance_picks_it() {
+    use std::sync::Arc;
+    use vectorcraft_doc::{Appearance, Node, Symbol};
+    let rect = |r: Rect| Arc::new(Node::path(NodeId(0), vectorcraft_geom::shapes::rectangle(r), Appearance::default_art()));
+    let art = Node::new(
+        NodeId(0),
+        NodeKind::Group { children: vec![rect(Rect::new(0.0, 0.0, 20.0, 20.0)), rect(Rect::new(-10.0, -10.0, 30.0, 30.0))], clip: true },
+    );
+    let mut d = vectorcraft_doc::Document::new(500.0, 500.0);
+    d.symbols.push(Symbol { dynamic: true, name: "Masked".into(), art: Arc::new(art) });
+    let (l, id) = (d.layers[0].id, d.alloc_id());
+    let xf = vectorcraft_geom::Affine::translate((300.0, 300.0));
+    d.insert(Some(l), usize::MAX, Node::new(id, NodeKind::SymbolInstance { symbol: "Masked".into(), xf })).unwrap();
+    let (none, p) = (Selection::default(), paint());
+    let down = |x: f64, y: f64| DirectSelectionTool::new(false).pointer(&cx(&d, &none, &p), &PointerEvent::new(PointerKind::Down, x, y));
+    let part = |path: Value| vec![Action::Exec("symbol.instance.selectPart".into(), json!({"id": id.0, "path": path}))];
+    // The clipping path's right edge is at x = 320; the art covers it.
+    assert_eq!(down(321.0, 310.0), part(json!([0])), "just outside the mask, on its edge");
+    assert_eq!(down(319.0, 310.0), part(json!([0])), "just inside the mask, on its edge");
+    assert_eq!(down(310.0, 310.0), part(json!([1])), "inside the mask, the art");
+    // Clipped art from 10 to 30 picked: its outline is cut to the clipping path's bounds (0 to 20),
+    // where it is picked.
+    let art = Node::new(
+        NodeId(0),
+        NodeKind::Group { children: vec![rect(Rect::new(0.0, 0.0, 20.0, 20.0)), rect(Rect::new(10.0, 10.0, 30.0, 30.0))], clip: true },
+    );
+    d.symbols[0].art = Arc::new(art);
+    let mut sel = Selection::default();
+    sel.set_symbol_part(id, vec![1]);
+    let outline = DirectSelectionTool::new(false).overlays(&cx(&d, &sel, &p));
+    let drawn =
+        outline.iter().find_map(|o| if let Overlay::Path { path, .. } = o { Some(vectorcraft_geom::kurbo::Shape::bounding_box(path)) } else { None });
+    assert_eq!(drawn, Some(Rect::new(310.0, 310.0, 320.0, 320.0)));
+}
diff --git a/crates/tools/src/text.rs b/crates/tools/src/text.rs
index 9cca37e67..6e48945e3 100644
--- a/crates/tools/src/text.rs
+++ b/crates/tools/src/text.rs
@@ -160,7 +160,8 @@ fn next_edit_session() -> u64 {
 pub struct TypeTool {
     vertical: bool,
     mode: Mode,
-    /// The tool to return to on Escape (e.g. when double-clicked from a selection tool).
+    /// The tool that was active before type editing began, which Escape and Cmd+Enter return to.
+    /// Clicks that move editing to other text keep it.
     prev_tool: Option<String>,
     /// Text object being edited.
     editing: Option<NodeId>,
@@ -396,7 +397,7 @@ impl TypeTool {
         out
     }
 
-    /// Stop editing and go back to the tool used before double-clicking into type (or to the
+    /// Stop editing and go back to the tool that was active before type editing began (or to the
     /// Selection tool), and leave the type selected.
     fn end_editing(&mut self, cx: &ToolContext) -> Vec<Action> {
         let target = self.prev_tool.take().unwrap_or_else(|| "selection".into());
diff --git a/crates/tools/src/text/tool.rs b/crates/tools/src/text/tool.rs
index 9f97f2372..696ed1c0e 100644
--- a/crates/tools/src/text/tool.rs
+++ b/crates/tools/src/text/tool.rs
@@ -25,7 +25,8 @@ impl Tool for TypeTool {
     fn wants_text(&self) -> bool {
         self.editing.is_some()
     }
-    /// Escape while editing is the tool's: it goes on to the Selection tool (#1686).
+    /// Escape while editing is the tool's: it goes back to the tool that was active before type
+    /// editing began, or to the Selection tool when there was none (#1686).
     fn claims_key(&self, _: &ToolContext, key: ToolKey) -> bool {
         key == ToolKey::Escape && self.editing.is_some()
     }
diff --git a/crates/tools/src/xform/artboard.rs b/crates/tools/src/xform/artboard.rs
index c3710c1bd..4ffd435af 100644
--- a/crates/tools/src/xform/artboard.rs
+++ b/crates/tools/src/xform/artboard.rs
@@ -21,8 +21,17 @@
 //! snap too. A new artboard's corners snap as drawn points do ([`DrawSnap`]). A locked artboard (the
 //! Artboards panel's lock column) is selected by a click, but a drag or an arrow key doesn't move it
 //! or copy it, it shows no handles, and Delete leaves it.
+//!
+//! While one artboard is selected and nothing is being dragged, a button with a plus sits just
+//! outside the middle of each of its edges where an artboard of the same size fits on that side
+//! ([`vectorcraft_doc::Document::room_beside_artboard`]: within the canvas, 20 pt away, overlapping
+//! no other artboard). Clicking one adds an empty artboard there (`artboard.new {beside, side}`);
+//! Alt-clicking duplicates the artboard with its art there (`artboard.duplicate {index, side}`),
+//! except on a locked artboard, where an Alt-click does nothing. Each is one undo step, and the new
+//! artboard becomes the active one.
 
 use serde_json::{Value, json};
+use vectorcraft_doc::ArtboardSide;
 use vectorcraft_geom::{Affine, Point, Rect, Vec2};
 
 use super::{BLUE, polygon, rect_corners};
@@ -282,6 +291,44 @@ fn bleed_offset(cx: &ToolContext, rect: Rect, handle: Handle) -> Vec2 {
     Vec2::new(if ax { d.x } else { 0.0 }, if ay { d.y } else { 0.0 })
 }
 
+/// How far outside the middle of an edge its add button sits, in screen pixels: past the handle
+/// on that edge.
+const EDGE_BUTTON_OFFSET: f64 = 18.0;
+/// The add button's radius in screen pixels: a press this near its center takes it.
+const EDGE_BUTTON_RADIUS: f64 = 7.0;
+
+impl ArtboardTool {
+    /// The add buttons on the active artboard's edges, each with its side and center: shown while
+    /// it is the only one selected and nothing is being dragged, and only on the sides with room
+    /// for an artboard of the same size ([`vectorcraft_doc::Document::room_beside_artboard`]).
+    fn edge_buttons(&self, cx: &ToolContext) -> Vec<(ArtboardSide, Point)> {
+        let Some(r) = self.active_rect(cx) else { return vec![] };
+        if self.drag.is_some() || self.selected(cx).len() != 1 {
+            return vec![];
+        }
+        let off = cx.tol(EDGE_BUTTON_OFFSET);
+        let c = r.center();
+        ArtboardSide::ALL
+            .into_iter()
+            .filter(|side| cx.doc.room_beside_artboard(self.active, *side).is_some())
+            .map(|side| {
+                let at = match side {
+                    ArtboardSide::Left => Point::new(r.x0 - off, c.y),
+                    ArtboardSide::Right => Point::new(r.x1 + off, c.y),
+                    ArtboardSide::Top => Point::new(c.x, r.y0 - off),
+                    ArtboardSide::Bottom => Point::new(c.x, r.y1 + off),
+                };
+                (side, at)
+            })
+            .collect()
+    }
+
+    /// The add button under `p`, if any.
+    fn edge_button_at(&self, cx: &ToolContext, p: Point) -> Option<ArtboardSide> {
+        self.edge_buttons(cx).into_iter().find(|(_, at)| at.distance(p) <= cx.tol(EDGE_BUTTON_RADIUS)).map(|(side, _)| side)
+    }
+}
+
 /// The grid's snapping step (gridline spacing over subdivisions), as `guides::snap_draw` uses.
 impl Tool for ArtboardTool {
     fn id(&self) -> &'static str {
@@ -305,6 +352,21 @@ impl Tool for ArtboardTool {
         match (ev.kind, self.drag) {
             (PointerKind::Down, _) => {
                 self.click_art = None;
+                // An add button: an empty artboard of the same size on that side, or with Alt a
+                // copy of the artboard and its art there; the new one becomes active. An Alt-click
+                // on a locked artboard's button does nothing: the tool doesn't copy a locked artboard.
+                if let Some(side) = self.edge_button_at(cx, p) {
+                    let index = self.active;
+                    if m.alt && cx.doc.artboards.get(index).is_some_and(|a| a.locked) {
+                        return vec![];
+                    }
+                    let (id, v) = if m.alt {
+                        ("artboard.duplicate", json!({ "index": index, "side": side.name(), "art": true }))
+                    } else {
+                        ("artboard.new", json!({ "beside": index, "side": side.name() }))
+                    };
+                    return vec![Action::Exec(id.into(), v), Action::Notify("created".into())];
+                }
                 if let Some(r) = self.resizable_rect(cx)
                     && let Some(handle) = hit_handle(r, p, cx.tol(5.0))
                 {
@@ -593,10 +655,24 @@ impl Tool for ArtboardTool {
         if self.drag.is_some() {
             o.extend(self.guides.iter().cloned());
         }
+        // The add buttons: a ring with a plus in it.
+        let (radius, arm) = (cx.tol(EDGE_BUTTON_RADIUS), cx.tol(3.5));
+        for (_, at) in self.edge_buttons(cx) {
+            let ring: Vec<Point> = (0..24).map(|k| at + Vec2::from_angle(f64::from(k) * std::f64::consts::TAU / 24.0) * radius).collect();
+            let mut path = polygon(&ring, true);
+            for arm in [Vec2::new(arm, 0.0), Vec2::new(0.0, arm)] {
+                path.move_to(at - arm);
+                path.line_to(at + arm);
+            }
+            o.push(Overlay::Path { path, color: BLUE, width: 1.0, dashed: false });
+        }
         o
     }
 
     fn cursor(&self, cx: &ToolContext, p: Point, m: Mods) -> Cursor {
+        if self.edge_button_at(cx, p).is_some() {
+            return Cursor::Arrow;
+        }
         if let Some(r) = self.resizable_rect(cx)
             && let Some(h) = hit_handle(r, p, cx.tol(5.0))
         {
diff --git a/crates/tools/src/xform/artboard/tests.rs b/crates/tools/src/xform/artboard/tests.rs
index 3c8900ff5..98410703f 100644
--- a/crates/tools/src/xform/artboard/tests.rs
+++ b/crates/tools/src/xform/artboard/tests.rs
@@ -562,3 +562,97 @@ fn alt_drag_moves_a_copy_of_the_artboard() {
     assert_eq!(a, vec![Action::Cancel, Action::Begin("Duplicate Artboard".into()), moved(70.0, true)]);
     assert_eq!(t.pointer(&cx, &ev(PointerKind::Up, 170.0, 100.0).with_mods(alt)), vec![Action::Commit]);
 }
+
+/// The sides of the active artboard that show an add button.
+fn button_sides(t: &ArtboardTool, c: &ToolContext) -> Vec<ArtboardSide> {
+    t.edge_buttons(c).into_iter().map(|(side, _)| side).collect()
+}
+
+/// The rings the add buttons draw.
+fn button_rings(t: &ArtboardTool, c: &ToolContext) -> usize {
+    t.overlays(c).iter().filter(|o| matches!(o, Overlay::Path { dashed: false, .. })).count()
+}
+
+#[test]
+fn add_buttons_show_only_on_sides_with_room_for_an_artboard_of_the_same_size() {
+    let mut d = two_boards();
+    let (s, p) = (Selection::default(), paint());
+    let t = ArtboardTool::default();
+    // Artboard 1 (0–500): a copy on its right (520–1020) would overlap artboard 2 (600–800).
+    let c = cx(&d, &s, &p);
+    assert_eq!(button_sides(&t, &c), vec![ArtboardSide::Top, ArtboardSide::Bottom, ArtboardSide::Left]);
+    assert_eq!(button_rings(&t, &c), 3);
+    // Artboard 2 (600–800 × 0–200): its left would overlap artboard 1, the rest has room.
+    let t2 = ArtboardTool { active: 1, ..Default::default() };
+    assert_eq!(button_sides(&t2, &c), vec![ArtboardSide::Top, ArtboardSide::Right, ArtboardSide::Bottom]);
+    // At the canvas's edge there is no room past it.
+    let m = vectorcraft_doc::MAX_COORD;
+    d.artboards[1].rect = Rect::new(m - 200.0, 0.0, m, 200.0);
+    let c = cx(&d, &s, &p);
+    assert_eq!(button_sides(&t2, &c), vec![ArtboardSide::Top, ArtboardSide::Bottom, ArtboardSide::Left]);
+    // The buttons sit just outside the middle of each edge.
+    let off = c.tol(EDGE_BUTTON_OFFSET);
+    assert_eq!(t.edge_buttons(&c)[0].1, Point::new(250.0, -off));
+}
+
+#[test]
+fn add_buttons_hide_with_several_artboards_selected_or_during_a_drag() {
+    let d = two_boards();
+    let (s, p) = (Selection::default(), paint());
+    let c = cx(&d, &s, &p);
+    let t = ArtboardTool { active: 1, others: vec![0], ..Default::default() };
+    assert!(button_sides(&t, &c).is_empty());
+    assert_eq!(button_rings(&t, &c), 0);
+    let off = c.tol(EDGE_BUTTON_OFFSET);
+    assert_eq!(t.edge_button_at(&c, Point::new(700.0, 200.0 + off)), None, "no button takes a press");
+    let mut t = ArtboardTool::default();
+    t.pointer(&c, &ev(PointerKind::Down, 700.0, 100.0));
+    t.pointer(&c, &ev(PointerKind::Drag, 720.0, 100.0));
+    assert!(button_sides(&t, &c).is_empty(), "none while an artboard is dragged");
+}
+
+#[test]
+fn an_add_button_adds_an_empty_artboard_and_alt_duplicates_on_that_side() {
+    let d = two_boards();
+    let (s, p) = (Selection::default(), paint());
+    let c = cx(&d, &s, &p);
+    let off = c.tol(EDGE_BUTTON_OFFSET);
+    let below = Point::new(250.0, 500.0 + off);
+    let mut t = ArtboardTool::default();
+    assert_eq!(t.cursor(&c, below, Mods::default()), Cursor::Arrow);
+    let a = t.pointer(&c, &ev(PointerKind::Down, below.x, below.y));
+    assert_eq!(a, vec![Action::Exec("artboard.new".into(), json!({"beside": 0, "side": "bottom"})), Action::Notify("created".into())]);
+    // The release that follows adds nothing more.
+    assert_eq!(t.pointer(&c, &ev(PointerKind::Up, below.x, below.y)), vec![]);
+    let alt = Mods { alt: true, ..Mods::default() };
+    let left = Point::new(-off, 250.0);
+    let a = t.pointer(&c, &ev(PointerKind::Down, left.x, left.y).with_mods(alt));
+    assert_eq!(
+        a,
+        vec![Action::Exec("artboard.duplicate".into(), json!({"index": 0, "side": "left", "art": true})), Action::Notify("created".into())]
+    );
+    // The new artboard, last in the document, becomes the active one.
+    let mut d3 = d.clone();
+    d3.artboards.push(d.artboards[0].clone());
+    t.notify(&cx(&d3, &s, &p), "created");
+    assert_eq!((t.active, t.others.clone()), (2, vec![]));
+}
+
+/// On a locked artboard, a click on an add button still adds an empty artboard beside it, but an
+/// Alt-click does nothing: the tool doesn't copy a locked artboard.
+#[test]
+fn an_alt_click_on_a_locked_artboards_add_button_does_not_duplicate_it() {
+    let mut d = two_boards();
+    d.artboards[0].locked = true;
+    let (s, p) = (Selection::default(), paint());
+    let c = cx(&d, &s, &p);
+    let off = c.tol(EDGE_BUTTON_OFFSET);
+    let left = Point::new(-off, 250.0);
+    let mut t = ArtboardTool::default();
+    let alt = Mods { alt: true, ..Mods::default() };
+    assert_eq!(t.pointer(&c, &ev(PointerKind::Down, left.x, left.y).with_mods(alt)), vec![]);
+    assert_eq!(t.pointer(&c, &ev(PointerKind::Up, left.x, left.y).with_mods(alt)), vec![]);
+    assert_eq!((t.active, t.others.clone()), (0, vec![]));
+    let a = t.pointer(&c, &ev(PointerKind::Down, left.x, left.y));
+    assert_eq!(a, vec![Action::Exec("artboard.new".into(), json!({"beside": 0, "side": "left"})), Action::Notify("created".into())]);
+}
diff --git a/crates/tools/src/xform/gradient.rs b/crates/tools/src/xform/gradient.rs
index 7a9b59e2d..d984504e1 100644
--- a/crates/tools/src/xform/gradient.rs
+++ b/crates/tools/src/xform/gradient.rs
@@ -444,6 +444,11 @@ impl GradientTool {
                 let id = paint_owner(cx.doc, h.leaf);
                 let Some(v) = cx.selection.objects.contains(&id).then(|| click_vector(cx, id)).flatten() else { return vec![] };
                 let mut params = Self::geom_params(cx, p, p + v);
+                // Without `ids`, the engine refuses the gradient while an object of a dynamic symbol
+                // instance's art is selected.
+                if cx.selection.symbol_part.is_some() {
+                    return vec![Action::Exec("paint.setGradientGeom".into(), params)];
+                }
                 params["ids"] = json!([id.0]);
                 // With `ids` the engine edits the topmost fill or stroke unless an item is named.
                 if let Some(i) = cx.doc.node(id).and_then(|n| n.appearance.item_of_kind(cx.appearance_item, cx.fill_active)) {
diff --git a/crates/tools/src/xform/gradient/tests.rs b/crates/tools/src/xform/gradient/tests.rs
index 2542ec7c5..c6582152b 100644
--- a/crates/tools/src/xform/gradient/tests.rs
+++ b/crates/tools/src/xform/gradient/tests.rs
@@ -268,6 +268,31 @@ fn a_click_inside_the_art_applies_the_gradient_from_there() {
     assert!(t.pointer(&cx, &ev(PointerKind::Up, Point::new(400.0, 400.0))).is_empty());
 }
 
+/// With an object of a dynamic symbol instance selected with Direct Selection, a click on the
+/// instance sends the gradient without `ids`, which the engine refuses.
+#[test]
+fn a_click_on_a_dynamic_instance_with_a_picked_object_names_no_object() {
+    use std::sync::Arc;
+    use vectorcraft_doc::{Appearance, Node, NodeId, NodeKind, Symbol};
+    let square =
+        Node::path(NodeId(0), vectorcraft_geom::shapes::rectangle(vectorcraft_geom::Rect::new(0.0, 0.0, 10.0, 10.0)), Appearance::default_art());
+    let art = Node::group(NodeId(0), vec![Arc::new(square)]);
+    let (mut d, _) = doc_with_rect();
+    d.symbols.push(Symbol { dynamic: true, name: "One".into(), art: Arc::new(art) });
+    let (l, id) = (d.layers[0].id, d.alloc_id());
+    d.insert(Some(l), usize::MAX, Node::new(id, NodeKind::SymbolInstance { symbol: "One".into(), xf: Affine::translate((300.0, 300.0)) })).unwrap();
+    let mut s = Selection::default();
+    s.set_symbol_part(id, vec![0]);
+    let p = paint();
+    let cx = cx(&d, &s, &p);
+    let mut t = GradientTool::default();
+    t.pointer(&cx, &ev(PointerKind::Down, Point::new(305.0, 305.0)));
+    let a = t.pointer(&cx, &ev(PointerKind::Up, Point::new(305.0, 305.0)));
+    let (c, v) = exec(&a[0]);
+    assert_eq!(c, "paint.setGradientGeom");
+    assert!(v.get("ids").is_none() && v.get("item").is_none(), "{v}");
+}
+
 #[test]
 fn double_click_on_a_stop_opens_its_popover() {
     let (d, s) = graded(two());
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 625670eb8..b7f839957 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -122,6 +122,7 @@ impl VectorcraftApp {
             frame_rate: Default::default(),
             canvas_rect: None,
             hover_doc: None,
+            titlebar_from_env: false,
             custom_titlebar: false,
             desktop_frame: false,
             last_window_title: String::new(),
@@ -365,6 +366,7 @@ impl VectorcraftApp {
         }
         crate::keymap::note_os(ctx);
         shortcut_editor::sync(&self.ui);
+        crate::dialogs::svg_filter::sync(self);
         crate::panels::actions::sync_function_keys(&self.ui);
         prefs_dialog::apply_runtime(self, ctx);
         // The OS title bar (and the taskbar / Alt-Tab entry) follows the active file; with the
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 135958756..f49851ad2 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -77,7 +77,16 @@ pub fn app_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
             let full = ui.max_rect();
             let right_edge = if custom { full.right() - titlebar::WIDTH - 10.0 } else { full.right() };
             let right = egui::Rect::from_min_max(egui::pos2(menus_end + 8.0, full.top()), egui::pos2(right_edge, full.bottom()));
-            let room = right.width();
+            // In Safe Mode, a label that stays in the bar whatever document is open, and opens
+            // Help › Safe Mode; the other controls fit in the room it leaves, and the workspace
+            // switcher (also under Window › Workspace) goes when a minimal one doesn't fit.
+            let safe = vectorcraft_plugins::safe_mode::active().then(|| egui::RichText::new(tl!("Safe Mode")).color(t.warning).size(12.0));
+            let safe_w = safe.as_ref().map_or(0.0, |label| {
+                let text = ui.painter().layout_no_wrap(label.text().to_string(), egui::FontId::proportional(12.0), t.warning);
+                text.size().x + 2.0 * ui.spacing().button_padding.x + 8.0 + ui.spacing().item_spacing.x
+            });
+            let room = (right.width() - safe_w).max(0.0);
+            let switcher = safe.is_none() || room >= 64.0 + 8.0;
             // Built-in workspace names translate; the user's own stay as typed.
             let ws_name =
                 if crate::workspaces::is_builtin(&app.ui.workspace) { tl!(&app.ui.workspace).to_string() } else { app.ui.workspace.clone() };
@@ -86,19 +95,27 @@ pub fn app_bar(app: &mut VectorcraftApp, ui: &mut Ui) {
             let gap = ui.spacing().item_spacing.x;
             // The search icon, as in PhotoCraft: shown while a minimal switcher fits beside it.
             let icon = 28.0;
-            let search = room >= 64.0 + 8.0 + gap + icon;
+            let search = switcher && room >= 64.0 + 8.0 + gap + icon;
             let ws_w = ws_w.min(room - 8.0 - gap - if search { icon } else { 0.0 }).max(64.0);
             let discord = search && room >= ws_w + 8.0 + gap + icon + 10.0 + gap + crate::community::discord_width(ui, false);
             let mut rui = ui.new_child(egui::UiBuilder::new().max_rect(right).layout(egui::Layout::right_to_left(egui::Align::Center)));
             let ui = &mut rui;
             // Workspace switcher: shows the current workspace, opens Window → Workspace.
-            let (wr, wresp) = ui.allocate_exact_size(vec2(ws_w, WIDGET_H), Sense::click());
-            ui.painter().rect_filled(wr, CornerRadius::same(4), if wresp.hovered() { t.hover } else { t.panel });
-            ui.painter().with_clip_rect(wr.shrink2(vec2(4.0, 0.0))).galley(wr.left_center() + vec2(10.0, -ws.size().y / 2.0), ws, t.text);
-            icons::paint(ui, "chevron-down", egui::Rect::from_center_size(wr.right_center() - vec2(12.0, 0.0), vec2(12.0, 12.0)), t.text_dim);
-            let wresp = wresp.on_hover_text(tl!("Switch workspace"));
-            egui::Popup::menu(&wresp).show(|ui| crate::workspaces::popup(app, ui));
-            ui.add_space(8.0);
+            if switcher {
+                let (wr, wresp) = ui.allocate_exact_size(vec2(ws_w, WIDGET_H), Sense::click());
+                ui.painter().rect_filled(wr, CornerRadius::same(4), if wresp.hovered() { t.hover } else { t.panel });
+                ui.painter().with_clip_rect(wr.shrink2(vec2(4.0, 0.0))).galley(wr.left_center() + vec2(10.0, -ws.size().y / 2.0), ws, t.text);
+                icons::paint(ui, "chevron-down", egui::Rect::from_center_size(wr.right_center() - vec2(12.0, 0.0), vec2(12.0, 12.0)), t.text_dim);
+                let wresp = wresp.on_hover_text(tl!("Switch workspace"));
+                egui::Popup::menu(&wresp).show(|ui| crate::workspaces::popup(app, ui));
+                ui.add_space(8.0);
+            }
+            if let Some(label) = safe {
+                if ui.add(egui::Button::new(label).frame(false)).on_hover_text(tl!("Safe Mode…")).clicked() {
+                    app.run("help.safeMode", json!({})).ok();
+                }
+                ui.add_space(8.0);
+            }
             // Search → command palette (its shortcut opens it too).
             if search {
                 let tip = match menus::shortcut_of("help.commandPalette") {
@@ -142,12 +159,14 @@ pub fn system_title_bar(app: &VectorcraftApp) -> bool {
 
 /// The OS window title: the active document's name suffixed with the app name (a `*` prefix
 /// marks unsaved changes, like the `*` in the document tabs), or just the app name with no
-/// document open.
+/// document open; in Safe Mode, followed by "(Safe Mode)".
 pub fn window_title(app: &VectorcraftApp) -> String {
-    app.session
+    let title = app
+        .session
         .active()
         .map(|d| format!("{}{} \u{2014} VectorCraft", if d.is_dirty() { "*" } else { "" }, d.title()))
-        .unwrap_or_else(|| "VectorCraft".into())
+        .unwrap_or_else(|| "VectorCraft".into());
+    if vectorcraft_plugins::safe_mode::active() { format!("{title} ({})", tl!("Safe Mode")) } else { title }
 }
 
 /// Keep the OS window title (and the taskbar / Alt-Tab entry) on the active file. Sends
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index bd77b4741..cda2b45c0 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -96,6 +96,7 @@ pub mod relink;
 pub mod rename_artboards;
 pub(crate) mod revolve;
 pub(crate) mod revolve_gizmo;
+pub mod safe_mode;
 pub mod saturate;
 pub mod save_brush_library;
 mod save_changes;
@@ -113,6 +114,7 @@ pub(crate) mod simplify_slider;
 pub mod slices;
 pub(crate) mod smooth_slider;
 pub mod spot_colors;
+pub mod svg_filter;
 pub(crate) mod svg_options;
 pub mod swatch_conflict;
 pub mod swatch_options;
@@ -349,6 +351,7 @@ registry! {
     SavePdf: [save_pdf::KIND] => save_pdf::SPEC,
     SvgOptions: [svg_options::KIND] => svg_options::SPEC,
     JavaScriptFiles: [javascript_files::KIND] => javascript_files::SPEC,
+    SvgFilter: [svg_filter::KIND] => svg_filter::SPEC,
     NewDocumentMore: [new_document::MORE] => new_document::MORE_SPEC,
     Place: [place::KIND] => place::SPEC,
     RasterOptions: ["pngOptions", "jpgOptions", "webpOptions", "gifOptions", "png8Options"] => png_options::SPEC,
@@ -381,6 +384,8 @@ registry! {
     DivideSlices: [slices::DIVIDE] => slices::DIVIDE_SPEC,
     EpsOptions: [eps_options::KIND] => eps_options::SPEC,
     Recovery: [crate::recovery::KIND] => recovery::SPEC,
+    PluginStopped: [safe_mode::STOPPED] => safe_mode::STOPPED_SPEC,
+    SafeMode: [safe_mode::KIND] => safe_mode::SPEC,
     DxfImport: [dxf_import::KIND] => dxf_import::SPEC,
     RasterFormatOptions: ["tiffOptions", "bmpOptions", "tgaOptions"] => png_options::SPEC,
     SaveForWeb: [save_for_web::KIND] => save_for_web::SPEC,
@@ -474,7 +479,8 @@ pub fn accepts_field(d: &Dialog, field: &str) -> bool {
 /// Pattern Brush Options corner tile set this way is saved by OK, as one chosen from its menu is,
 /// an Edit Data Set field set this way is no longer the row's empty text value, and a Layer
 /// Options setting set this way for several rows is sent to every row (Template also sets Lock
-/// and Dim Images, as its checkbox does).
+/// and Dim Images, as its checkbox does). A DXF Options preset set this way sets its fields, as
+/// one picked from its menu does, and the preset it shows follows the DXF options set this way.
 pub fn set_field(d: &mut Dialog, field: String, value: Value) {
     if d.kind == brush_options::KIND {
         brush_art_options::note_set(d, &field);
@@ -485,7 +491,11 @@ pub fn set_field(d: &mut Dialog, field: String, value: Value) {
     if d.kind == layer_options::KIND {
         layer_options::note_set(d, &field, &value);
     }
+    let dxf = (d.kind == dxf_options::KIND).then(|| field.clone());
     d.fields.insert(field, value);
+    if let Some(field) = dxf {
+        dxf_options::note_set(d, &field);
+    }
 }
 
 /// The fields `ui.dialog.set` can set on `d`, sorted, without the `__` ones: those it holds,
@@ -550,6 +560,9 @@ pub fn cancel(app: &mut VectorcraftApp) {
         if d.kind == plugin::INSTALL_KIND {
             app.pending_plugin_install = None;
         }
+        if d.kind == safe_mode::STOPPED {
+            safe_mode::cancel_stopped(app);
+        }
         // Toolbar-only Flare options start no preview and must not cancel a gesture
         // that was already active before opening them. The generic parameter dialog has a spec
         // without a preview, yet previews some commands (Grid Repeat Options) when asked to.
@@ -591,13 +604,15 @@ pub fn confirm(app: &mut VectorcraftApp) -> DialogResult {
 
 /// After a dialog closes, and each frame: a Missing Fonts dialog that another dialog replaced waits
 /// for its turn again, the search a Missing Fonts or Find Linked Files dialog started stops once
-/// that dialog is gone, and with no dialog open the next document's Missing Fonts dialog opens
-/// (one dialog at a time).
+/// that dialog is gone, and with no dialog open the choice about a stopped plug-in that another
+/// dialog replaced opens again, else the next document's Missing Fonts dialog (one dialog at a
+/// time).
 pub(crate) fn settle(app: &mut VectorcraftApp) {
     crate::placing::settle_swatch_paste(app);
     missing_fonts::requeue_replaced(app);
     missing_fonts::stop_when_closed(app);
     find_links::stop_when_closed(app);
+    safe_mode::reopen(app);
     missing_fonts::open_next(app);
 }
 
diff --git a/crates/ui-egui/src/dialogs/dxf_options.rs b/crates/ui-egui/src/dialogs/dxf_options.rs
index dc6a54d16..cc5262393 100644
--- a/crates/ui-egui/src/dialogs/dxf_options.rs
+++ b/crates/ui-egui/src/dialogs/dxf_options.rs
@@ -1,13 +1,15 @@
-//! DXF Options (Export As → DXF): version, scale (1 unit of the art = N drawing units) and
-//! lineweights, number of colours, the format of placed images, Preserve Appearance or Maximize
-//! Editability, and Export Selected Art Only, Alter Paths for Appearance and Outline Text.
+//! DXF Options (Export As → DXF): a preset (Custom, or CNC / CAM, which sets the options below for
+//! cutting software and shows Custom again once one is changed), version, scale (1 unit of the
+//! art = N drawing units) and lineweights, number of colours, the format of placed images,
+//! Preserve Appearance or Maximize Editability, and Export Selected Art Only, Alter Paths for
+//! Appearance and Outline Text.
 //!
 //! Fields: `document.export` params (`format: dxf`, `path?`, the artboard choice) and the DXF
 //! options of `document.exportDxf`. OK remembers the options for next time and writes the file
 //! (asking where when there is no path); bad options keep the dialog open.
 
 use serde_json::{Map, Value, json};
-use vectorcraft_cad::{ColorDepth, DxfVersion, Preserve, RasterFormat};
+use vectorcraft_cad::{ColorDepth, DxfPreset, DxfVersion, Preserve, RasterFormat};
 use vectorcraft_doc::Unit;
 use vectorcraft_engine::cmd::fileio;
 
@@ -32,40 +34,95 @@ pub(super) const SPEC: DialogSpec = DialogSpec {
 /// Fields that are not remembered between exports (they belong to one export).
 const PER_EXPORT: [&str; 7] = ["format", "path", "useArtboards", "range", "artboard", "artboards", "selectedOnly"];
 
+/// The preset field (the `dxfPreset` param).
+const PRESET: &str = "dxfPreset";
+/// The preset the fields were last set from or matched (a change of [`PRESET`] sets its fields).
+const SHOWN_PRESET: &str = "__shownPreset";
+
 /// The options a first DXF Options dialog starts from (the export's defaults).
 fn defaults() -> Map<String, Value> {
+    let mut m = preset_fields(DxfPreset::Custom);
+    m.insert(PRESET.into(), json!(DxfPreset::Custom.id()));
+    m.insert("selectedOnly".into(), json!(false));
+    m
+}
+
+/// The fields `preset` sets (Custom: the export's defaults).
+fn preset_fields(preset: DxfPreset) -> Map<String, Value> {
+    let o = preset.options();
     let mut m = Map::new();
     for (k, v) in [
-        ("version", json!(DxfVersion::default().id())),
-        ("unit", json!(Unit::Millimeters.label())),
-        ("scale", json!(1)),
-        ("scaleLineweights", json!(false)),
-        ("colors", json!(ColorDepth::default().id())),
-        ("rasterFormat", json!(RasterFormat::default().id())),
-        ("preserve", json!(Preserve::default().id())),
-        ("alterPaths", json!(false)),
-        ("outlineText", json!(false)),
-        ("selectedOnly", json!(false)),
+        ("version", json!(o.version.id())),
+        ("unit", json!(o.unit.label())),
+        ("scale", json!(o.scale)),
+        ("scaleLineweights", json!(o.scale_lineweights)),
+        ("colors", json!(o.colors.id())),
+        ("rasterFormat", json!(o.raster.id())),
+        ("preserve", json!(o.preserve.id())),
+        ("alterPaths", json!(o.alter_paths)),
+        ("outlineText", json!(o.outline_text)),
     ] {
         m.insert(k.into(), v);
     }
     m
 }
 
+/// Show the preset the fields match: CNC / CAM while every field it sets is as it sets it, else
+/// Custom. An unknown preset stays as it is, for OK to refuse.
+fn show_matching_preset(d: &mut Dialog) {
+    if DxfPreset::from_id(&d.str(PRESET)).is_none() {
+        return;
+    }
+    let preset = fileio::dxf::options(&super::form::params(d)).map_or(DxfPreset::Custom, |o| DxfPreset::of(&o));
+    d.fields.insert(PRESET.into(), json!(preset.id()));
+    d.fields.insert(SHOWN_PRESET.into(), json!(preset.id()));
+}
+
+/// A preset picked since the fields were last matched, or any preset when `force` is set, sets
+/// its fields; Custom puts back the export's defaults.
+fn apply_picked_preset(d: &mut Dialog, force: bool) {
+    if (force || !d.str(PRESET).eq_ignore_ascii_case(&d.str(SHOWN_PRESET)))
+        && let Some(p) = DxfPreset::from_id(&d.str(PRESET))
+    {
+        d.fields.extend(preset_fields(p));
+    }
+}
+
+/// `field` was set (`ui.dialog.set`): a preset sets its fields now, even the one shown, so fields
+/// set after it keep their values, and any other field shows the preset the fields then match, as
+/// drawing does.
+pub(super) fn note_set(d: &mut Dialog, field: &str) {
+    if field == PRESET {
+        apply_picked_preset(d, true);
+    }
+    show_matching_preset(d);
+}
+
 /// Open DXF Options for an export whose params (path, artboard choice, any DXF option) are
-/// `params`, over the options used last.
+/// `params`, over the options used last. A `dxfPreset` in `params` sets its fields under the
+/// options `params` gives.
 pub fn open(app: &mut VectorcraftApp, params: &Value) {
     let mut fields = defaults();
-    for given in [&app.ui.dxf_options, params] {
-        if let Some(o) = given.as_object() {
-            fields.extend(o.iter().map(|(k, v)| (k.clone(), v.clone())));
+    if let Some(o) = app.ui.dxf_options.as_object() {
+        fields.extend(o.iter().map(|(k, v)| (k.clone(), v.clone())));
+    }
+    if let Some(o) = params.as_object() {
+        if let Some(p) = o.get(PRESET).and_then(Value::as_str).and_then(DxfPreset::from_id) {
+            fields.extend(preset_fields(p));
         }
+        fields.extend(o.iter().map(|(k, v)| (k.clone(), v.clone())));
     }
     fields.insert("format".into(), json!("dxf"));
-    app.ui.dialog = Some(Dialog::new(KIND, Value::Object(fields)));
+    let mut d = Dialog::new(KIND, Value::Object(fields));
+    show_matching_preset(&mut d);
+    app.ui.dialog = Some(d);
 }
 
 fn body(app: &mut VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog) -> bool {
+    let presets: Vec<(&str, &str)> = DxfPreset::ALL.iter().map(|p| (p.id(), p.label())).collect();
+    choice(ui, d, PRESET, tl!("Preset:"), &presets);
+    apply_picked_preset(d, false);
+    ui.add_space(4.0);
     let versions: Vec<(&str, &str)> = DxfVersion::ALL.iter().map(|v| (v.id(), v.label())).collect();
     choice(ui, d, "version", tl!("Version:"), &versions);
     ui.add_space(4.0);
@@ -113,6 +170,7 @@ fn body(app: &mut VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog) -> bool {
             Preserve::Editability => tl!("Type stays text, and every stroke is a line with its lineweight and dashes."),
         },
     );
+    show_matching_preset(d);
     false
 }
 
@@ -146,14 +204,20 @@ fn note(ui: &mut egui::Ui, text: &str) {
 
 /// Check the options, remember them, and write the file(s).
 fn confirm(app: &mut VectorcraftApp, d: &Dialog) -> Result<Value, String> {
+    // A preset or field set since the dialog last drew (the control channel sets fields without
+    // drawing) counts as drawn.
+    let mut d = d.clone();
+    apply_picked_preset(&mut d, false);
+    show_matching_preset(&mut d);
+    let d = &d;
     let params = super::form::params(d);
     fileio::dxf::check(&params)?;
     // Nothing selected keeps the dialog open too.
     if let Some(st) = app.session.active() {
         fileio::export_source(st, &params).map_err(|e| e.to_string())?;
     }
-    app.ui.dxf_options =
-        Value::Object(d.fields.iter().filter(|(k, _)| !PER_EXPORT.contains(&k.as_str())).map(|(k, v)| (k.clone(), v.clone())).collect());
+    let remembered = params.as_object().map(|o| o.iter().filter(|(k, _)| !PER_EXPORT.contains(&k.as_str())).map(|(k, v)| (k.clone(), v.clone())));
+    app.ui.dxf_options = Value::Object(remembered.into_iter().flatten().collect());
     app.ui.dialog = None;
     let path = d.fields.get("path").and_then(Value::as_str).map(str::to_string);
     io::export(app, Some("dxf"), path, &params)
diff --git a/crates/ui-egui/src/dialogs/effect.rs b/crates/ui-egui/src/dialogs/effect.rs
index a77d0eed6..324cc144a 100644
--- a/crates/ui-egui/src/dialogs/effect.rs
+++ b/crates/ui-egui/src/dialogs/effect.rs
@@ -64,6 +64,10 @@ pub(super) const EXISTS_SPEC: DialogSpec = DialogSpec {
 /// or add `effect`, first asking when that list already has it.
 pub fn open(app: &mut VectorcraftApp, p: &Value) -> Result<Value, String> {
     let id = p.get("effect").and_then(Value::as_str).unwrap_or_default();
+    // An SVG filter is chosen and edited in Apply SVG Filter.
+    if id == vectorcraft_effects::SVG_FILTER {
+        return super::svg_filter::open(app, p);
+    }
     let info = vectorcraft_effects::effect_info(id).ok_or_else(|| format!("unknown effect `{id}`"))?;
     // The list the effect goes to: `item` as given, else the active item's (the object's without
     // one). A new effect keeps `item` unresolved, so `effect.apply` targets each object as usual.
diff --git a/crates/ui-egui/src/dialogs/export_for_screens.rs b/crates/ui-egui/src/dialogs/export_for_screens.rs
index 24f2d7367..90c1ddd39 100644
--- a/crates/ui-egui/src/dialogs/export_for_screens.rs
+++ b/crates/ui-egui/src/dialogs/export_for_screens.rs
@@ -108,12 +108,13 @@ pub(crate) fn saved_rows(saved: &Map<String, Value>) -> (Vec<Value>, Option<&str
 /// Open the dialog on its Assets tab with `checked` assets checked (every asset when `None`).
 pub(crate) fn open_assets(app: &mut VectorcraftApp, checked: Option<&[u64]>) {
     open(app);
+    let shown: Vec<u64> = app.session.active().map(|st| picture_assets(st).iter().map(|a| a.id).collect()).unwrap_or_default();
     if let Some(d) = app.ui.dialog.as_mut() {
         d.fields.insert("tab".into(), json!("assets"));
         if let Some(c) = checked {
             d.fields.insert("assets".into(), json!(c));
-            // The list scrolls to the first of them once: new assets land at its end.
-            if let Some(first) = c.first() {
+            // The list scrolls to the first of them it shows, once: new assets land at its end.
+            if let Some(first) = c.iter().find(|id| shown.contains(id)) {
                 d.fields.insert("__scrollTo".into(), json!(first));
             }
         }
@@ -128,7 +129,7 @@ pub fn open(app: &mut VectorcraftApp) {
     let (n, saved, assets) = app
         .session
         .active()
-        .map(|st| (st.doc.artboards.len(), st.doc.export_settings.clone(), st.doc.assets.iter().map(|a| a.id).collect::<Vec<_>>()))
+        .map(|st| (st.doc.artboards.len(), st.doc.export_settings.clone(), picture_assets(st).iter().map(|a| a.id).collect::<Vec<_>>()))
         .unwrap_or_default();
     let get = |k: &str| saved.get(k).filter(|v| !v.is_null());
     let flag = |k: &str, default: bool| get(k).and_then(Value::as_bool).unwrap_or(default);
@@ -575,16 +576,23 @@ fn tiles(
     toggled
 }
 
-/// The checked assets that are still in the document, in panel order.
-fn checked_assets(app: &VectorcraftApp, d: &Dialog) -> Vec<u64> {
-    let on: Vec<u64> = d.fields.get("assets").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_u64).collect()).unwrap_or_default();
-    app.session.active().map(|st| st.doc.assets.iter().map(|a| a.id).filter(|id| on.contains(id)).collect()).unwrap_or_default()
+/// The document's assets exported as pictures, in panel order: 3D assets export as mesh files from
+/// the Asset Export panel (`assets.export3D`).
+fn picture_assets(st: &vectorcraft_engine::DocState) -> Vec<&vectorcraft_doc::ExportAsset> {
+    st.doc.assets.iter().filter(|a| a.format_3d.is_none()).collect()
 }
 
-/// The Assets tab: each asset's thumbnail with its checkbox and name, in a grid or a list.
+/// The checked picture assets that are still in the document, in panel order.
+fn checked_assets(app: &VectorcraftApp, d: &Dialog) -> Vec<u64> {
+    let on: Vec<u64> = d.fields.get("assets").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_u64).collect()).unwrap_or_default();
+    app.session.active().map(|st| picture_assets(st).iter().map(|a| a.id).filter(|id| on.contains(id)).collect()).unwrap_or_default()
+}
+
+/// The Assets tab: each picture asset's thumbnail with its checkbox and name, in a grid or a list.
 fn assets(app: &VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog, list: bool) {
     let Some(st) = app.session.active() else { return };
-    if st.doc.assets.is_empty() {
+    let shown = picture_assets(st);
+    if shown.is_empty() {
         ui.add_space(24.0);
         widgets::dim_label(ui, tl!("No assets yet. Collect art with Object › Collect for Export, or drag it into the Asset Export panel."));
         return;
@@ -592,10 +600,10 @@ fn assets(app: &VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog, list: bool) {
     let mut on = checked_assets(app, d);
     let before = on.clone();
     // Asked for until its row is in view: the dialog's first frame only measures it.
-    let scroll_to = d.fields.get("__scrollTo").and_then(Value::as_u64).filter(|id| st.doc.assets.iter().any(|a| a.id == *id));
+    let scroll_to = d.fields.get("__scrollTo").and_then(Value::as_u64).filter(|id| shown.iter().any(|a| a.id == *id));
     let mut in_view = scroll_to.is_none();
-    let clicked = tiles(ui, "efs-assets", st.doc.assets.len(), list, |ui, i, r| {
-        let Some(a) = st.doc.assets.get(i) else { return (String::new(), String::new(), false) };
+    let clicked = tiles(ui, "efs-assets", shown.len(), list, |ui, i, r| {
+        let Some(a) = shown.get(i) else { return (String::new(), String::new(), false) };
         crate::panels::asset_export::paint_thumb(ui, st, a, r);
         if scroll_to == Some(a.id) {
             if ui.clip_rect().contains_rect(r) {
@@ -607,7 +615,7 @@ fn assets(app: &VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog, list: bool) {
         (a.name.clone(), a.name.clone(), on.contains(&a.id))
     });
     for i in clicked {
-        if let Some(a) = st.doc.assets.get(i) {
+        if let Some(a) = shown.get(i) {
             if on.contains(&a.id) {
                 on.retain(|id| *id != a.id);
             } else {
diff --git a/crates/ui-egui/src/dialogs/safe_mode.rs b/crates/ui-egui/src/dialogs/safe_mode.rs
new file mode 100644
index 000000000..99ea560bb
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/safe_mode.rs
@@ -0,0 +1,211 @@
+//! Safe Mode in the app: the choice after a launch that stopped while a plug-in was loading
+//! ([`ask_about_stopped`]: Disable and Continue, Start Normally, or Start in Safe Mode), and Help ›
+//! Safe Mode ([`open`]), which lists the disabled plug-ins with Enable on Re-launch. Safe Mode
+//! itself, the disabled list and the launch marker are `vectorcraft_plugins::safe_mode`'s.
+
+use serde_json::{Value, json};
+use vectorcraft_plugins::safe_mode::{self, Item};
+
+use super::DialogSpec;
+use crate::VectorcraftApp;
+use crate::state::Dialog;
+use crate::theme::Tokens;
+
+/// Dialog kind of the choice after a launch that stopped. Fields: `item` (`{id, file, name, label}`)
+/// and `normal` (Start Normally instead of Disable and Continue). Cancel starts in Safe Mode.
+pub const STOPPED: &str = "pluginStopped";
+
+/// Dialog kind of Help › Safe Mode. Fields: `items` (`[{id, file, name, label, enable}]`, the
+/// disabled plug-ins, `enable` being Enable on Re-launch).
+pub const KIND: &str = "safeMode";
+
+/// Before any plug-in loads (desktop): starts this launch's marker in `marker_dir` (none: no
+/// marker), and turns Safe Mode on for `--safe-mode` (`flag`), or until the user chooses after a
+/// launch that stopped while a plug-in was loading → that plug-in, for [`after_start`]. With `flag`
+/// nothing is asked, and the plug-in stays pending (`plugin.safeMode`'s `pendingItem`): the next
+/// launch asks about it.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn begin_launch(marker_dir: Option<&std::path::Path>, flag: bool) -> Option<Item> {
+    let stopped = marker_dir.and_then(safe_mode::begin_launch);
+    if flag {
+        safe_mode::set_active(Some(safe_mode::Source::Flag));
+        return None;
+    }
+    if stopped.is_some() {
+        safe_mode::set_active(Some(safe_mode::Source::Startup));
+    }
+    stopped
+}
+
+/// The app is quitting normally: its launch marker goes.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn end_launch() {
+    safe_mode::end_launch();
+}
+
+/// Once the app is made: the choice about `stopped` ([`begin_launch`]), or in Safe Mode a status
+/// line saying so.
+pub fn after_start(app: &mut VectorcraftApp, stopped: Option<Item>) {
+    match stopped {
+        Some(item) => ask_about_stopped(app, &item),
+        None if safe_mode::active() => app.status(vectorcraft_plugins::Error::SafeMode.to_string()),
+        None => {}
+    }
+}
+
+/// Ask what to do about `item`, the plug-in the last launch was loading when it stopped. Safe Mode
+/// is on until the user chooses. A dialog that takes the choice's place leaves it waiting: it opens
+/// again once no dialog is open ([`reopen`]).
+pub fn ask_about_stopped(app: &mut VectorcraftApp, item: &Item) {
+    let item = item.to_json();
+    app.ui.stopped_plugin = Some(item.clone());
+    app.ui.dialog = Some(Dialog::new(STOPPED, json!({ "item": item })));
+}
+
+/// With no dialog open, the choice about a stopped plug-in that another dialog replaced opens again.
+pub(super) fn reopen(app: &mut VectorcraftApp) {
+    if app.ui.dialog.is_none()
+        && let Some(item) = app.ui.stopped_plugin.clone()
+    {
+        app.ui.dialog = Some(Dialog::new(STOPPED, json!({ "item": item })));
+    }
+}
+
+/// The choice's Cancel, Start in Safe Mode: Safe Mode stays on for this launch, and the plug-in
+/// stays pending for the next one.
+pub(super) fn cancel_stopped(app: &mut VectorcraftApp) {
+    app.ui.stopped_plugin = None;
+}
+
+/// The choice about a stopped plug-in is waiting for the user (shown, or replaced by another
+/// dialog): Safe Mode is on, and nothing has loaded yet.
+pub fn choosing(app: &VectorcraftApp) -> bool {
+    app.ui.stopped_plugin.is_some()
+}
+
+/// Safe Mode is on for the rest of this launch: `--safe-mode`, or Start in Safe Mode chosen.
+pub fn staying_on(app: &VectorcraftApp) -> bool {
+    safe_mode::active() && !choosing(app)
+}
+
+/// The item a dialog field holds.
+fn item_of(v: &Value) -> Item {
+    let s = |k: &str| v.get(k).and_then(Value::as_str).map(str::to_string);
+    Item { id: s("id"), file: s("file"), name: s("name") }
+}
+
+/// The choice's Disable and Continue (OK) or Start Normally: Safe Mode ends and the plug-ins load,
+/// without the stopped one for Disable and Continue (kept off for later launches too).
+fn confirm_stopped(app: &mut VectorcraftApp, d: &Dialog) -> Result<Value, String> {
+    app.ui.dialog = None;
+    app.ui.stopped_plugin = None;
+    let item = item_of(d.fields.get("item").unwrap_or(&Value::Null));
+    // When the disabled plug-in can't be saved for the next launch, that launch asks again.
+    let saved = d.bool("normal") || (safe_mode::disable(item) && app.session.store_disabled_plugins());
+    if saved {
+        safe_mode::forget_previous();
+    } else {
+        not_saved(app);
+    }
+    safe_mode::set_active(None);
+    vectorcraft_engine::cmd::plugin::load_prefs_folder(&mut app.session);
+    Ok(Value::Null)
+}
+
+/// Help › Safe Mode: the disabled plug-ins, none ticked for Enable on Re-launch.
+pub fn open(app: &mut VectorcraftApp) -> Result<Value, String> {
+    let items: Vec<Value> = safe_mode::disabled()
+        .iter()
+        .map(|i| {
+            let mut v = i.to_json();
+            v["enable"] = json!(false);
+            v
+        })
+        .collect();
+    app.ui.dialog = Some(Dialog::new(KIND, json!({ "items": items })));
+    Ok(Value::Null)
+}
+
+/// Help › Safe Mode's OK: each ticked plug-in loads again from the next launch
+/// (`plugin.setEnabled`).
+fn confirm(app: &mut VectorcraftApp, d: &Dialog) -> Result<Value, String> {
+    app.ui.dialog = None;
+    let mut errors = vec![];
+    let mut unsaved = false;
+    for v in d.fields.get("items").and_then(Value::as_array).into_iter().flatten().filter(|v| v["enable"] == true) {
+        let p = match (v["id"].as_str(), v["file"].as_str()) {
+            (Some(id), _) => json!({"id": id, "enabled": true}),
+            (None, Some(file)) => json!({"file": file, "enabled": true}),
+            (None, None) => continue,
+        };
+        match app.run("plugin.setEnabled", p) {
+            Ok(r) => unsaved |= r["saved"] == false,
+            Err(e) => errors.push(e),
+        }
+    }
+    if unsaved {
+        not_saved(app);
+    }
+    if errors.is_empty() { Ok(Value::Null) } else { Err(errors.join("; ")) }
+}
+
+/// The disabled plug-ins couldn't be written to the plug-in folder: the next launch doesn't have
+/// the change, which goes with the next change that saves.
+fn not_saved(app: &mut VectorcraftApp) {
+    app.status("Couldn't save the disabled plug-ins for the next launch");
+}
+
+pub(super) const STOPPED_SPEC: DialogSpec = DialogSpec {
+    heading: |_| tl!("Safe Mode").into(),
+    body: |_, ui, d| {
+        let t = Tokens::get(ui.ctx());
+        let name = item_of(d.fields.get("item").unwrap_or(&Value::Null)).label();
+        let text = crate::i18n::fmt(
+            tl!("The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it."),
+            &[("name", &name)],
+        );
+        ui.label(egui::RichText::new(text).color(t.text));
+        false
+    },
+    confirm: confirm_stopped,
+    ok: Some("Disable and Continue"),
+    cancel: Some("Start in Safe Mode"),
+    alternate: Some(("Start Normally", "normal")),
+    min_width: 380.0,
+    max_width: Some(520.0),
+    ..DialogSpec::FORM
+};
+
+pub(super) const SPEC: DialogSpec = DialogSpec {
+    heading: |_| tl!("Safe Mode").into(),
+    body: |_, ui, d| {
+        let t = Tokens::get(ui.ctx());
+        if safe_mode::active() {
+            ui.label(egui::RichText::new(tl!("VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.")).color(t.text));
+            ui.add_space(8.0);
+        }
+        ui.label(egui::RichText::new(tl!("Disabled plug-ins")).color(t.text_dim));
+        let Some(items) = d.fields.get_mut("items").and_then(Value::as_array_mut).filter(|i| !i.is_empty()) else {
+            ui.label(egui::RichText::new(tl!("No plug-ins are disabled.")).color(t.text_dim));
+            return false;
+        };
+        egui::ScrollArea::vertical().max_height(240.0).show(ui, |ui| {
+            for (k, v) in items.iter_mut().enumerate() {
+                ui.horizontal(|ui| {
+                    // A name made safe to show: control and reordering characters removed, bounded.
+                    let label = safe_mode::display_name(v["label"].as_str().unwrap_or_default());
+                    ui.label(egui::RichText::new(label).color(t.text));
+                    let mut on = v["enable"] == true;
+                    if ui.push_id(k, |ui| ui.checkbox(&mut on, tl!("Enable on Re-launch"))).inner.changed() {
+                        v["enable"] = json!(on);
+                    }
+                });
+            }
+        });
+        false
+    },
+    confirm,
+    min_width: 380.0,
+    max_width: Some(520.0),
+    ..DialogSpec::FORM
+};
diff --git a/crates/ui-egui/src/dialogs/save_options/tests.rs b/crates/ui-egui/src/dialogs/save_options/tests.rs
index 1f33575e7..959079968 100644
--- a/crates/ui-egui/src/dialogs/save_options/tests.rs
+++ b/crates/ui-egui/src/dialogs/save_options/tests.rs
@@ -221,6 +221,7 @@ fn save_a_copy_and_template_suggest_their_names() {
     assert_eq!(picks.borrow()[0].name, "Untitled-1 copy.vectorcraft");
     assert!(app.ui.dialog.is_none(), "the native format has no options");
     assert!(vectorcraft_format::sniff(&written.borrow()[0].1));
+    assert!(vectorcraft_format::pdf_content(&written.borrow()[0].1).is_some());
     assert!(app.session.active().unwrap().path.is_none() && app.session.active().unwrap().is_dirty());
     app.run("file.saveAsTemplate", json!({})).unwrap();
     let pick = &picks.borrow()[1];
diff --git a/crates/ui-egui/src/dialogs/svg_filter.rs b/crates/ui-egui/src/dialogs/svg_filter.rs
new file mode 100644
index 000000000..af6849de4
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/svg_filter.rs
@@ -0,0 +1,453 @@
+//! Apply SVG Filter (Effect › SVG Filters › Apply SVG Filter…): the document's SVG filters in a
+//! list. OK applies the selected one to the selection as a live effect (`svgFilter.apply`), or,
+//! opened from the Appearance panel for an applied SVG filter, puts it in that effect's place
+//! (`effect.setParams`). New and Edit open the filter's code under the list; Save adds the filter
+//! or replaces the one being edited (`svgFilter.define`). Delete removes the selected filter
+//! (`svgFilter.delete`) and Import… adds the filters of an SVG file (`svgFilter.import`). Those
+//! act at once. Effect › SVG Filters lists the same filters below its first items.
+//!
+//! Fields: `selected` (a filter's name), `code` (the code being edited), `editing` (`""`, `"new"`
+//! or the name of the filter being edited), and with an applied effect `__index`, `__item` and
+//! `missing` (the name of a deleted filter the effect names).
+
+use serde_json::{Value, json};
+use vectorcraft_engine::doc::SvgFilter;
+
+use super::DialogSpec;
+use crate::picks::PickRequest;
+use crate::state::Dialog;
+use crate::{FilePick, VectorcraftApp, widgets};
+
+/// The dialog kind of Apply SVG Filter.
+pub const KIND: &str = "svgFilter";
+
+pub(super) const SPEC: DialogSpec = DialogSpec {
+    heading: |_| tl!("Apply SVG Filter…").trim_end_matches('…').to_string(),
+    body,
+    confirm,
+    ok_enabled: Some(|app, d| d.str("editing").is_empty() && filters(app).iter().any(|f| f.name == d.str("selected"))),
+    min_width: 440.0,
+    ..DialogSpec::FORM
+};
+
+/// The active document's SVG filters.
+fn filters(app: &VectorcraftApp) -> Vec<SvgFilter> {
+    app.session.active().map(|st| st.doc.svg_filters.clone()).unwrap_or_default()
+}
+
+/// `ui.svgFilterDialog {index?, item?}`: open Apply SVG Filter for the active document; with
+/// `index`, for the applied SVG filter at `index` of `item` (null: the object's effects): the
+/// document's filter of its name selected; when the document has none of its name, the name shown
+/// above the list if the filter was deleted, or else its code open as a new filter.
+pub fn open(app: &mut VectorcraftApp, p: &Value) -> Result<Value, String> {
+    if app.session.active().is_none() {
+        return Err("no document open".into());
+    }
+    let mut fields = json!({ "selected": "", "code": "", "editing": "" });
+    if let Some(k) = p.get("index").and_then(Value::as_u64) {
+        let mut q = json!({});
+        if let Some(item) = p.get("item") {
+            q["item"] = item.clone();
+        }
+        let applied = app.session.appearance_effect_target(&q).map(|(_, fx)| fx.to_vec()).unwrap_or_default();
+        let e = applied.get(k as usize).filter(|e| e.id == vectorcraft_effects::SVG_FILTER).ok_or_else(|| format!("no SVG filter at index {k}"))?;
+        let name = e.params.get("name").and_then(Value::as_str).unwrap_or_default().to_string();
+        let xml = e.params.get("xml").and_then(Value::as_str).unwrap_or_default().to_string();
+        let held = filters(app).into_iter().find(|f| f.name == name);
+        match held {
+            // The document's filter it names: selected.
+            Some(_) => fields["selected"] = json!(name),
+            // Deleted from the document: shown above the list, not selectable; OK waits for a choice.
+            None if xml.is_empty() => fields["missing"] = json!(name),
+            // A filter the document doesn't hold (from an opened file): its code, to add it.
+            None => {
+                fields["code"] = json!(xml);
+                fields["editing"] = json!("new");
+            }
+        }
+        fields["__index"] = json!(k);
+        // As given: `null` is the object's own effects, and none is the active item's.
+        if let Some(item) = p.get("item") {
+            fields["__item"] = item.clone();
+        }
+    }
+    app.ui.dialog = Some(Dialog::new(KIND, fields));
+    Ok(Value::Null)
+}
+
+/// OK: the selected filter to the selection, or in the applied effect's place.
+fn confirm(app: &mut VectorcraftApp, d: &Dialog) -> Result<Value, String> {
+    let name = d.str("selected");
+    let f = filters(app).into_iter().find(|f| f.name == name).ok_or("select an SVG filter")?;
+    let r = match d.fields.get("__index").and_then(Value::as_u64) {
+        Some(k) => {
+            let mut p = json!({ "index": k, "params": { "name": f.name, "xml": f.xml } });
+            if let Some(item) = d.fields.get("__item") {
+                p["item"] = item.clone();
+            }
+            app.run("effect.setParams", p)?
+        }
+        None => app.run("svgFilter.apply", json!({ "name": f.name }))?,
+    };
+    app.ui.dialog = None;
+    Ok(r)
+}
+
+/// The active document's filter names, mirrored for the (static) menu tree ([`sync`]).
+fn names_store() -> &'static std::sync::RwLock<Vec<&'static str>> {
+    static NAMES: std::sync::OnceLock<std::sync::RwLock<Vec<&'static str>>> = std::sync::OnceLock::new();
+    NAMES.get_or_init(Default::default)
+}
+
+/// Mirror the active document's SVG filter names for the menu tree (cheap when unchanged).
+pub fn sync(app: &VectorcraftApp) {
+    let names: Vec<String> = app.session.active().map(|st| st.doc.svg_filters.iter().map(|f| f.name.clone()).collect()).unwrap_or_default();
+    let same = names_store().read().map(|v| v.len() == names.len() && v.iter().zip(&names).all(|(a, b)| *a == b)).unwrap_or(true);
+    if !same {
+        if let Ok(mut v) = names_store().write() {
+            *v = names.iter().map(|n| crate::shortcut_editor::intern(n)).collect();
+        }
+        crate::shortcut_editor::GENERATION.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    }
+}
+
+/// Effect › SVG Filters: Apply SVG Filter…, Import SVG Filter… and then the active document's
+/// filters, each applying itself to the selection.
+pub fn menu_items() -> Vec<crate::menus::Item> {
+    items_for(names_store().read().map(|v| v.clone()).unwrap_or_default())
+}
+
+/// [`menu_items`] for filters named `names`.
+fn items_for(names: Vec<&'static str>) -> Vec<crate::menus::Item> {
+    use crate::menus::Item;
+    let mut v =
+        vec![Item::Cmd("Apply SVG Filter…", "ui.svgFilterDialog", Value::Null), Item::Cmd("Import SVG Filter…", "ui.importSvgFilter", Value::Null)];
+    if !names.is_empty() {
+        v.push(Item::Sep);
+        v.extend(names.into_iter().map(|n| Item::Cmd(n, "svgFilter.apply", json!({ "name": n }))));
+    }
+    v
+}
+
+/// `ui.importSvgFilter {}`: add the filters of an SVG file the user picks to the active document.
+pub fn import_file(app: &mut VectorcraftApp) -> Result<Value, String> {
+    let path = crate::picks::open(app, &pick()).ok_or("cancelled")?;
+    let r = app.run("svgFilter.import", json!({ "path": path }))?;
+    let added = r["added"].as_array().map_or(0, Vec::len);
+    app.status(crate::i18n::msg_n(added as u64, "Imported {n} SVG filter", "Imported {n} SVG filters", &[]));
+    Ok(r)
+}
+
+/// The extensions of the SVG files Import… reads.
+const SVG_EXTS: &[&str] = &["svg"];
+
+/// The open dialog for an SVG file.
+pub(crate) fn pick() -> FilePick {
+    FilePick { filters: vec![FilePick::filter("SVG", SVG_EXTS)], ..Default::default() }
+}
+
+/// Import…: the filters of the SVG file picked in the open dialog, added to the document, the first
+/// one added selected.
+fn import(app: &mut VectorcraftApp, d: &mut Dialog) -> Result<(), String> {
+    let Some(path) = crate::picks::open(app, &pick()) else { return Ok(()) };
+    let r = app.run("svgFilter.import", json!({ "path": path }))?;
+    if let Some(first) = r["added"].get(0).and_then(Value::as_str) {
+        d.fields.insert("selected".into(), json!(first));
+    }
+    Ok(())
+}
+
+/// What a button asked for, done once the dialog is drawn.
+enum Action {
+    Select(String),
+    New,
+    /// Open this filter's code (a double-clicked row, or the selected one).
+    Edit(String),
+    Delete,
+    Import,
+    Save,
+    Discard,
+}
+
+fn body(app: &mut VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog) -> bool {
+    let list = filters(app);
+    let selected = d.str("selected");
+    let editing = d.str("editing");
+    let mut act = None;
+    widgets::list_box(ui, |ui| {
+        egui::ScrollArea::vertical().id_salt("svg-filters").min_scrolled_height(160.0).max_height(160.0).show(ui, |ui| {
+            ui.set_width(ui.available_width());
+            ui.set_min_height(160.0);
+            // Filter names are data: shown as they are. A deleted filter the effect still names
+            // comes first, dimmed and not selectable.
+            let missing = d.str("missing");
+            if !missing.is_empty() {
+                ui.add_enabled_ui(false, |ui| ui.selectable_label(false, missing.as_str()));
+            }
+            for f in &list {
+                let r = ui.selectable_label(f.name == selected, f.name.as_str());
+                if r.double_clicked() && editing.is_empty() {
+                    act = Some(Action::Edit(f.name.clone()));
+                } else if r.clicked() {
+                    act = Some(Action::Select(f.name.clone()));
+                }
+            }
+        });
+    });
+    ui.add_space(6.0);
+    let has = list.iter().any(|f| f.name == selected);
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 4.0;
+        let idle = editing.is_empty();
+        if ui.add_enabled_ui(idle && list.len() < SvgFilter::MAX, |ui| widgets::flat_button(ui, tl!("New"), 64.0)).inner.clicked() {
+            act = Some(Action::New);
+        }
+        if ui.add_enabled_ui(idle && has, |ui| widgets::flat_button(ui, tl!("Edit"), 64.0)).inner.clicked() {
+            act = Some(Action::Edit(selected.clone()));
+        }
+        if ui.add_enabled_ui(idle && has, |ui| widgets::flat_button(ui, tl!("Delete"), 64.0)).inner.clicked() {
+            act = Some(Action::Delete);
+        }
+        if crate::picks::can(app, &PickRequest::Open(pick()))
+            && ui.add_enabled_ui(idle, |ui| widgets::flat_button(ui, tl!("Import…"), 64.0)).inner.clicked()
+        {
+            act = Some(Action::Import);
+        }
+    });
+    if !editing.is_empty() {
+        ui.add_space(8.0);
+        let mut code = d.str("code");
+        // The filter's code is data: edited as it is written.
+        let r = ui.add(egui::TextEdit::multiline(&mut code).font(egui::TextStyle::Monospace).desired_width(f32::INFINITY).desired_rows(10));
+        if r.changed() {
+            d.fields.insert("code".into(), json!(code));
+        }
+        ui.add_space(6.0);
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = 4.0;
+            if ui.add_enabled_ui(!code.trim().is_empty(), |ui| widgets::flat_button(ui, tl!("Save"), 64.0)).inner.clicked() {
+                act = Some(Action::Save);
+            }
+            if widgets::flat_button(ui, tl!("Cancel"), 64.0).clicked() {
+                act = Some(Action::Discard);
+            }
+        });
+    }
+    let r = match act {
+        None => Ok(()),
+        Some(Action::Select(name)) => {
+            d.fields.insert("selected".into(), json!(name));
+            Ok(())
+        }
+        Some(Action::New) => {
+            d.fields.insert("editing".into(), json!("new"));
+            d.fields.insert("code".into(), json!(""));
+            Ok(())
+        }
+        Some(Action::Edit(name)) => {
+            if let Some(f) = list.iter().find(|f| f.name == name) {
+                d.fields.insert("selected".into(), json!(f.name));
+                d.fields.insert("editing".into(), json!(f.name));
+                d.fields.insert("code".into(), json!(f.xml));
+            }
+            Ok(())
+        }
+        Some(Action::Delete) => app.run("svgFilter.delete", json!({ "name": selected })).map(|_| {
+            d.fields.insert("selected".into(), json!(""));
+        }),
+        // The open dialog, shown off the UI thread, fills the dialog as it is then.
+        Some(Action::Import) => crate::picks::in_dialog(app, d, import),
+        Some(Action::Save) => {
+            let mut p = json!({ "xml": d.str("code") });
+            if editing != "new" {
+                p["replace"] = json!(editing);
+            }
+            app.run("svgFilter.define", p).map(|r| {
+                d.fields.insert("selected".into(), r["name"].clone());
+                d.fields.insert("editing".into(), json!(""));
+                d.fields.insert("code".into(), json!(""));
+            })
+        }
+        Some(Action::Discard) => {
+            d.fields.insert("editing".into(), json!(""));
+            d.fields.insert("code".into(), json!(""));
+            Ok(())
+        }
+    };
+    if let Err(e) = r {
+        app.status(e);
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vectorcraft_engine::Session;
+
+    const SHIFT: &str = r#"<filter id="Shift"><feOffset dx="3"/></filter>"#;
+
+    fn app() -> VectorcraftApp {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        app.session.execute("file.new", &json!({"width": 100, "height": 100})).unwrap();
+        app
+    }
+
+    /// One headless frame of the dialog's body: the texts drawn.
+    fn frame(app: &mut VectorcraftApp, d: &mut Dialog) -> Vec<String> {
+        fn texts(s: &egui::Shape, out: &mut Vec<String>) {
+            match s {
+                egui::Shape::Text(t) => out.push(t.galley.text().to_string()),
+                egui::Shape::Vec(v) => v.iter().for_each(|s| texts(s, out)),
+                _ => {}
+            }
+        }
+        let ctx = egui::Context::default();
+        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
+            body(app, ui, d);
+        });
+        out.textures_delta.clear();
+        let mut v = vec![];
+        out.shapes.iter().for_each(|c| texts(&c.shape, &mut v));
+        v
+    }
+
+    #[test]
+    fn lists_the_documents_filters_and_ok_applies_the_selected_one() {
+        let mut app = VectorcraftApp::new(Session::new(), Default::default());
+        assert!(open(&mut app, &json!({})).is_err(), "no document");
+        let mut app = self::app();
+        app.session.execute("svgFilter.define", &json!({"xml": SHIFT})).unwrap();
+        let id = app.session.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 20, "height": 20})).unwrap()["id"].as_u64().unwrap();
+        crate::menus::invoke(&mut app, "ui.svgFilterDialog", json!({}));
+        let mut d = app.ui.dialog.clone().unwrap();
+        assert_eq!(d.kind, KIND);
+        assert!(frame(&mut app, &mut d).iter().any(|t| t == "Shift"), "the filter's name, as it is");
+        assert!(!(SPEC.ok_enabled.unwrap())(&app, &d), "nothing selected");
+        d.fields.insert("selected".into(), json!("Shift"));
+        assert!((SPEC.ok_enabled.unwrap())(&app, &d));
+        confirm(&mut app, &d).unwrap();
+        assert!(app.ui.dialog.is_none());
+        let fx = &app.session.active().unwrap().doc.node(vectorcraft_doc::NodeId(id)).unwrap().appearance.effects;
+        assert_eq!((fx.len(), fx[0].params["name"].as_str()), (1, Some("Shift")));
+    }
+
+    #[test]
+    fn opened_for_an_applied_filter_ok_replaces_it() {
+        let mut app = app();
+        app.session.execute("svgFilter.define", &json!({"xml": SHIFT})).unwrap();
+        app.session.execute("svgFilter.define", &json!({"xml": "<filter id=\"Other\"><feOffset dy=\"2\"/></filter>"})).unwrap();
+        let id = app.session.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 20, "height": 20})).unwrap()["id"].as_u64().unwrap();
+        app.session.execute("svgFilter.apply", &json!({"name": "Shift"})).unwrap();
+        // With a fill row active, the object's own effect is still the one edited.
+        app.session.execute("appearance.setActiveItem", &json!({"index": 0})).unwrap();
+        // The Appearance panel opens the effect's dialog: this one.
+        app.run("effect.dialog", json!({"effect": "svg.filter", "index": 0, "item": null})).unwrap();
+        let mut d = app.ui.dialog.clone().unwrap();
+        assert_eq!((d.kind.as_str(), d.str("selected").as_str()), (KIND, "Shift"));
+        d.fields.insert("selected".into(), json!("Other"));
+        confirm(&mut app, &d).unwrap();
+        let fx = &app.session.active().unwrap().doc.node(vectorcraft_doc::NodeId(id)).unwrap().appearance.effects;
+        assert_eq!((fx.len(), fx[0].params["name"].as_str()), (1, Some("Other")), "in its place, not added");
+        // Edited since it was applied: the effect follows the edit, and the filter stays selected.
+        app.session.execute("svgFilter.define", &json!({"xml": "<filter id=\"Other\"><feOffset dy=\"9\"/></filter>", "replace": "Other"})).unwrap();
+        app.run("effect.dialog", json!({"effect": "svg.filter", "index": 0, "item": null})).unwrap();
+        let d = app.ui.dialog.clone().unwrap();
+        assert_eq!((d.str("selected").as_str(), d.str("editing").as_str()), ("Other", ""));
+        // Deleted: its name shows above the list, nothing is selected, and OK waits for a choice.
+        app.session.execute("svgFilter.delete", &json!({"name": "Other"})).unwrap();
+        app.run("effect.dialog", json!({"effect": "svg.filter", "index": 0, "item": null})).unwrap();
+        let d = app.ui.dialog.clone().unwrap();
+        assert_eq!((d.str("missing").as_str(), d.str("selected").as_str(), d.str("editing").as_str()), ("Other", "", ""));
+        assert!(!(SPEC.ok_enabled.unwrap())(&app, &d));
+        // An applied filter the document never held (from an opened file) opens as code to save.
+        let e = vectorcraft_doc::Effect {
+            id: "svg.filter".into(),
+            params: json!({"name": "Kept", "xml": "<filter id=\"Kept\"><feOffset dx=\"1\"/></filter>"}),
+            visible: true,
+        };
+        app.session
+            .edit("Plant", |d, _| {
+                d.node_mut(vectorcraft_doc::NodeId(id)).unwrap().appearance.effects = vec![e];
+                Ok(())
+            })
+            .unwrap();
+        app.run("effect.dialog", json!({"effect": "svg.filter", "index": 0, "item": null})).unwrap();
+        let d = app.ui.dialog.clone().unwrap();
+        assert_eq!(d.str("editing"), "new");
+        assert!(d.str("code").contains("id=\"Kept\""));
+    }
+
+    /// Edit, started from one object's effect in the Appearance panel, changes every object that uses
+    /// the filter; a deleted filter's name is drawn above the list.
+    #[test]
+    fn an_edit_from_one_objects_effect_changes_every_user() {
+        let mut app = app();
+        app.session.execute("svgFilter.define", &json!({"xml": SHIFT})).unwrap();
+        let rect = |app: &mut VectorcraftApp, x: f64| {
+            app.session.execute("shape.rectangle", &json!({"x": x, "y": 10, "width": 20, "height": 20})).unwrap()["id"].as_u64().unwrap()
+        };
+        let (a, b) = (rect(&mut app, 10.0), rect(&mut app, 50.0));
+        app.session.execute("svgFilter.apply", &json!({"name": "Shift", "ids": [a, b]})).unwrap();
+        app.session.execute("select.set", &json!({"ids": [a]})).unwrap();
+        app.run("effect.dialog", json!({"effect": "svg.filter", "index": 0, "item": null})).unwrap();
+        let mut d = app.ui.dialog.clone().unwrap();
+        // Edit opens the selected filter's code; Save replaces it, as its button does.
+        d.fields.insert("editing".into(), json!(d.str("selected")));
+        let edited = r#"<filter id="Shift"><feOffset dx="8"/></filter>"#;
+        app.run("svgFilter.define", json!({"xml": edited, "replace": d.str("editing")})).unwrap();
+        let xml = |app: &VectorcraftApp, id: u64| {
+            app.session.active().unwrap().doc.node(vectorcraft_doc::NodeId(id)).unwrap().appearance.effects[0].params["xml"].clone()
+        };
+        assert_eq!((xml(&app, a), xml(&app, b)), (json!(edited), json!(edited)));
+        app.session.execute("svgFilter.delete", &json!({"name": "Shift"})).unwrap();
+        app.run("effect.dialog", json!({"effect": "svg.filter", "index": 0, "item": null})).unwrap();
+        let mut d = app.ui.dialog.clone().unwrap();
+        assert!(frame(&mut app, &mut d).iter().any(|t| t == "Shift"), "the deleted filter's name");
+    }
+
+    #[test]
+    fn the_submenu_lists_the_documents_filters_below_its_commands() {
+        use crate::menus::Item;
+        let ids =
+            |items: &[Item]| items.iter().map(|i| if let Item::Cmd(l, c, p) = i { format!("{l} {c} {p}") } else { "—".into() }).collect::<Vec<_>>();
+        assert_eq!(ids(&items_for(vec![])), ["Apply SVG Filter… ui.svgFilterDialog null", "Import SVG Filter… ui.importSvgFilter null"]);
+        assert_eq!(
+            ids(&items_for(vec!["Shift", "A (1)"]))[2..],
+            ["—", "Shift svgFilter.apply {\"name\":\"Shift\"}", "A (1) svgFilter.apply {\"name\":\"A (1)\"}"]
+        );
+        let mut app = app();
+        assert!(!crate::menus::enabled(&app, "svgFilter.apply"), "nothing selected");
+        app.session.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 20, "height": 20})).unwrap();
+        assert!(crate::menus::enabled(&app, "svgFilter.apply"));
+        assert_eq!(crate::menus::display_label(&app, "svgFilter.apply", "Shift"), "Shift", "a filter's name as it is");
+    }
+
+    #[test]
+    fn new_saves_the_code_and_selects_the_filter() {
+        let mut app = app();
+        open(&mut app, &json!({})).unwrap();
+        let mut d = app.ui.dialog.clone().unwrap();
+        d.fields.insert("editing".into(), json!("new"));
+        d.fields.insert("code".into(), json!(SHIFT));
+        assert!(!(SPEC.ok_enabled.unwrap())(&app, &d), "not while the code is open");
+        // Save, as its button does.
+        let r = app.run("svgFilter.define", json!({"xml": d.str("code")})).unwrap();
+        assert_eq!(r["name"], "Shift");
+        assert_eq!(app.session.active().unwrap().doc.svg_filters.len(), 1);
+    }
+
+    #[test]
+    fn import_adds_the_picked_files_filters() {
+        let mut app = app();
+        let path = std::env::temp_dir().join(format!("vc-ui-svgfilters-{}.svg", std::process::id()));
+        std::fs::write(&path, format!("<svg xmlns=\"http://www.w3.org/2000/svg\"><defs>{SHIFT}</defs></svg>")).unwrap();
+        let picked = path.to_string_lossy().into_owned();
+        app.services.pick_open = Some(Box::new(move |_: &FilePick| Some(picked.clone())));
+        let mut d = Dialog::new(KIND, json!({ "selected": "", "code": "", "editing": "" }));
+        import(&mut app, &mut d).unwrap();
+        std::fs::remove_file(&path).ok();
+        assert_eq!(d.str("selected"), "Shift");
+        assert_eq!(app.session.active().unwrap().doc.svg_filters[0].name, "Shift");
+    }
+}
diff --git a/crates/ui-egui/src/dialogs/tests.rs b/crates/ui-egui/src/dialogs/tests.rs
index 51959c320..5794ae7e4 100644
--- a/crates/ui-egui/src/dialogs/tests.rs
+++ b/crates/ui-egui/src/dialogs/tests.rs
@@ -466,12 +466,13 @@ fn dialogs_do_not_stretch_to_the_screen() {
 #[test]
 fn workspace_and_toolbar_dialogs_end_at_their_buttons() {
     // New Workspace, Manage Workspaces, New Toolbar and Manage Toolbars draw their own windows: each
-    // ends just below its OK button, with no empty band above or below the buttons.
-    for (kind, fields, window) in [
-        ("newWorkspace", json!({"name": "Mine"}), "dialog-workspace"),
-        ("manageWorkspaces", json!({"selected": "", "name": ""}), "dialog-workspace"),
-        (crate::custom_toolbars::KIND, json!({"name": "Toolbar 1"}), "dialog-new-toolbar"),
-        (crate::custom_toolbars::MANAGE, json!({"selected": "", "name": ""}), "dialog-manage-toolbars"),
+    // ends just below its OK button, with no empty band above or below the buttons, and Cancel (where
+    // the dialog has one) sits on OK's row, to its left.
+    for (kind, fields, window, has_cancel) in [
+        ("newWorkspace", json!({"name": "Mine"}), "dialog-workspace", true),
+        ("manageWorkspaces", json!({"selected": "", "name": ""}), "dialog-workspace", false),
+        (crate::custom_toolbars::KIND, json!({"name": "Toolbar 1"}), "dialog-new-toolbar", true),
+        (crate::custom_toolbars::MANAGE, json!({"selected": "", "name": ""}), "dialog-manage-toolbars", false),
     ] {
         let mut app = app();
         open(&mut app, kind, fields);
@@ -479,20 +480,46 @@ fn workspace_and_toolbar_dialogs_end_at_their_buttons() {
         theme::install_fonts(&ctx);
         theme::apply(&ctx, Default::default());
         let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1600.0, 1000.0));
-        let mut ok = None;
+        let mut shapes = Vec::new();
         for _ in 0..4 {
             let input = egui::RawInput { screen_rect: Some(screen), ..Default::default() };
             let mut out = ctx.run_ui(input, |ui| show(&mut app, ui.ctx()));
             out.textures_delta.clear();
-            ok = out.shapes.iter().find_map(|c| match &c.shape {
-                egui::Shape::Text(t) if t.galley.text() == "OK" => Some(t.visual_bounding_rect()),
-                _ => None,
-            });
+            shapes = out.shapes;
         }
-        let ok = ok.unwrap_or_else(|| panic!("{kind} draws no OK button"));
         let outer = ctx.memory(|m| m.area_rect(egui::Id::unique(window))).unwrap();
+        let texts = |label: &str| -> Vec<egui::Rect> {
+            shapes
+                .iter()
+                .filter_map(|c| match &c.shape {
+                    egui::Shape::Text(t) if t.galley.text() == label && outer.intersects(t.visual_bounding_rect()) => Some(t.visual_bounding_rect()),
+                    _ => None,
+                })
+                .collect()
+        };
+        let oks = texts("OK");
+        assert_eq!(oks.len(), 1, "{kind} draws {} OK buttons in its window", oks.len());
+        let ok = oks[0];
         let below = outer.bottom() - ok.bottom();
-        assert!(below < 40.0, "{kind}: {below} pt between OK and the bottom of its {} pt window", outer.height());
+        assert!((0.0..40.0).contains(&below), "{kind}: {below} pt between OK and the bottom of its {} pt window", outer.height());
+        // The nearest thing drawn above the button row: the last field, its label or its list.
+        let above = shapes
+            .iter()
+            .map(|c| c.shape.visual_bounding_rect())
+            .filter(|r| r.is_finite() && outer.intersects(*r) && r.bottom() <= ok.top())
+            .map(|r| r.bottom())
+            .fold(outer.top(), f32::max);
+        let gap = ok.top() - above;
+        assert!(gap < 40.0, "{kind}: {gap} pt between OK and what is drawn above it in its {} pt window", outer.height());
+        let cancels = texts("Cancel");
+        if has_cancel {
+            assert_eq!(cancels.len(), 1, "{kind} draws {} Cancel buttons in its window", cancels.len());
+            let cancel = cancels[0];
+            assert!((cancel.center().y - ok.center().y).abs() < 1.0, "{kind}: Cancel at y {} and OK at y {}", cancel.center().y, ok.center().y);
+            assert!(cancel.right() < ok.left(), "{kind}: Cancel ends at x {} but OK starts at x {}", cancel.right(), ok.left());
+        } else {
+            assert!(cancels.is_empty(), "{kind} draws a Cancel button");
+        }
     }
 }
 
diff --git a/crates/ui-egui/src/dialogs/tests_dxf.rs b/crates/ui-egui/src/dialogs/tests_dxf.rs
index 252c67f7e..22429b164 100644
--- a/crates/ui-egui/src/dialogs/tests_dxf.rs
+++ b/crates/ui-egui/src/dialogs/tests_dxf.rs
@@ -40,6 +40,66 @@ fn export_as_dxf_shows_dxf_options_then_writes_and_remembers_them() {
     assert!(app.ui.dxf_options.get("useArtboards").is_none());
 }
 
+#[test]
+fn the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom() {
+    let (mut app, written) = app(1);
+    app.run("ui.dxfOptionsDialog", json!({"path": "/out/a.dxf"})).unwrap();
+    frame(&mut app);
+    assert_eq!(app.ui.dialog.as_ref().unwrap().str("dxfPreset"), "custom");
+    set(&mut app, "dxfPreset", json!("cnc"));
+    frame(&mut app);
+    let d = app.ui.dialog.as_ref().unwrap();
+    let fields = |d: &crate::state::Dialog| {
+        ["dxfPreset", "version", "unit", "scale", "colors", "preserve", "alterPaths", "outlineText"].map(|k| d.str(k)).join(" ")
+    };
+    assert_eq!(fields(d), "cnc 2000 Millimeters 1.0 256 editability false true");
+    // Any change to a field the preset sets shows Custom, and keeps the other fields.
+    set(&mut app, "colors", json!("true"));
+    frame(&mut app);
+    assert_eq!(fields(app.ui.dialog.as_ref().unwrap()), "custom 2000 Millimeters 1.0 true editability false true");
+    set(&mut app, "colors", json!("256"));
+    frame(&mut app);
+    assert_eq!(app.ui.dialog.as_ref().unwrap().str("dxfPreset"), "cnc", "matching every field again");
+    confirm(&mut app).unwrap();
+    let dxf = text(&written.borrow()[0].1);
+    let lines: Vec<&str> = dxf.lines().collect();
+    let header = |var: &str| lines.iter().position(|l| *l == var).and_then(|i| lines.get(i + 2)).map(|v| v.trim());
+    assert_eq!((header("$ACADVER"), header("$INSUNITS")), (Some("AC1015"), Some("4")));
+    // The next DXF Options start from the preset; Custom puts back the defaults.
+    crate::menus::invoke(&mut app, "ui.dxfOptionsDialog", json!({}));
+    assert_eq!(app.ui.dialog.as_ref().unwrap().str("dxfPreset"), "cnc");
+    set(&mut app, "dxfPreset", json!("custom"));
+    frame(&mut app);
+    assert_eq!(fields(app.ui.dialog.as_ref().unwrap()), "custom 2018 Millimeters 1.0 true appearance false false");
+    // A preset the command gives sets the fields it does not give.
+    app.ui.dialog = None;
+    app.run("ui.dxfOptionsDialog", json!({"dxfPreset": "cnc", "unit": "Inches"})).unwrap();
+    let d = app.ui.dialog.as_ref().unwrap();
+    assert_eq!(fields(d), "custom 2000 Inches 1.0 256 editability false true");
+    // A preset set and confirmed without drawing (the control channel) sets its fields too.
+    set(&mut app, "dxfPreset", json!("cnc"));
+    confirm(&mut app).unwrap();
+    assert_eq!((app.ui.dxf_options["dxfPreset"].as_str(), app.ui.dxf_options["unit"].as_str()), (Some("cnc"), Some("Millimeters")));
+    // `ui.dialog.set` sets the preset's fields at once, so a field set after it keeps its value.
+    app.run("ui.dxfOptionsDialog", json!({"dxfPreset": "custom"})).unwrap();
+    let d = app.ui.dialog.as_mut().unwrap();
+    set_field(d, "dxfPreset".into(), json!("cnc"));
+    assert_eq!(fields(d), "cnc 2000 Millimeters 1.0 256 editability false true");
+    set_field(d, "unit".into(), json!("Inches"));
+    assert_eq!(d.str("dxfPreset"), "custom");
+    // Setting the preset again sets its fields again.
+    set_field(d, "dxfPreset".into(), json!("cnc"));
+    assert_eq!(d.str("unit"), "Millimeters");
+    set_field(d, "unit".into(), json!("Inches"));
+    // Setting Custom while Custom is shown still puts back the defaults.
+    let mut reset = d.clone();
+    set_field(&mut reset, "dxfPreset".into(), json!("custom"));
+    assert_eq!(fields(&reset), "custom 2018 Millimeters 1.0 true appearance false false");
+    confirm(&mut app).unwrap();
+    let remembered = ["dxfPreset", "version", "unit"].map(|k| app.ui.dxf_options[k].as_str());
+    assert_eq!(remembered, [Some("custom"), Some("2000"), Some("Inches")]);
+}
+
 #[test]
 fn bad_dxf_options_keep_the_dialog_open() {
     let (mut app, written) = app(1);
@@ -47,6 +107,12 @@ fn bad_dxf_options_keep_the_dialog_open() {
     set(&mut app, "scale", json!(-1));
     assert!(confirm(&mut app).is_err());
     assert_eq!(kind(&app), Some("dxfOptions"));
+    set(&mut app, "scale", json!(1));
+    set(&mut app, "dxfPreset", json!("laser"));
+    frame(&mut app);
+    let e = confirm(&mut app).unwrap_err();
+    assert!(e.contains("custom or cnc"), "{e}");
+    set(&mut app, "dxfPreset", json!("custom"));
     set(&mut app, "scale", json!(10));
     // Export Selected Art Only with nothing selected.
     app.run("select.none", json!({})).unwrap();
diff --git a/crates/ui-egui/src/dialogs/tests_screen_assets.rs b/crates/ui-egui/src/dialogs/tests_screen_assets.rs
index 32f585e81..df218bd0a 100644
--- a/crates/ui-egui/src/dialogs/tests_screen_assets.rs
+++ b/crates/ui-egui/src/dialogs/tests_screen_assets.rs
@@ -122,6 +122,28 @@ fn the_assets_tab_exports_the_checked_assets_into_the_folder() {
     let _ = std::fs::remove_dir_all(dir);
 }
 
+/// 3D assets export as mesh files from the Asset Export panel: the Assets tab lists and checks the
+/// picture assets alone.
+#[test]
+fn the_assets_tab_leaves_3d_assets_out() {
+    let (mut app, _, [a, b]) = app(false);
+    app.run("select.set", json!({"ids": [a]})).unwrap();
+    app.run("effect.apply", json!({"effect": "threeD.extrude", "params": {}})).unwrap();
+    let three_d = app.run("assets.add3D", json!({"ids": [a]})).unwrap()["assets"][0].as_u64().unwrap();
+    let picture = app.run("assets.add", json!({"ids": [b], "name": "Flat"})).unwrap()["assets"][0].as_u64().unwrap();
+    app.run("assets.rename", json!({"asset": three_d, "name": "Solid"})).unwrap();
+    app.run("file.exportForScreens", json!({})).unwrap();
+    assert_eq!(field(&app, "assets"), json!([picture]));
+    set(&mut app, "tab", json!("assets"));
+    let text = painted_text(&mut app, |app, ui| super::show(app, ui.ctx()));
+    assert!(text.contains("Flat") && !text.contains("Solid"), "{text}");
+    // Opened from the panel with both checked, the tab still shows the picture asset alone.
+    open_export_for_screens_assets(&mut app, Some(&[three_d, picture]));
+    assert_eq!(field(&app, "__scrollTo"), json!(picture), "the list scrolls to the first asset it shows");
+    let text = painted_text(&mut app, |app, ui| super::show(app, ui.ctx()));
+    assert!(text.contains("Flat") && !text.contains("Solid"), "{text}");
+}
+
 #[test]
 fn an_empty_assets_tab_says_how_to_collect_art() {
     let (mut app, _, _) = app(false);
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index 981975808..d758e8db3 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -1057,6 +1057,9 @@ font-technology	Variable	Променливи
 	Export As SVG…	Експортиране като SVG…
 	Export Asset	Експортиране на актив
 	Export Assets	Експортиране на активи
+	Export 3D Object	Експортиране на 3D обект
+	3D Export Format	Формат на 3D експортиране
+	Export 3D Assets	Експортиране на 3D активи
 	Export As…	Експортиране като…
 	Export CSS	Експортиране на CSS
 	Export CSS…	Експортиране на CSS…
@@ -1666,6 +1669,7 @@ font-technology	Variable	Променливи
 	Report copied	Отчетът е копиран
 	Line {line}	Ред {line}
 	Line {line}: {name}: {status}	Ред {line}: {name}: {status}
+	Read Action Set File	Четене на файл с набор от действия
 	Read Shortcut Set File	Четене на файл с набор от клавишни комбинации
 	Import Matches	Импортиране на съответствия
 	Remember Import Matches	Запомняне на съответствията при импортиране
@@ -3886,7 +3890,7 @@ axis	Both	И двете
 	Float Tool Group	Плаваща група инструменти
 @msg	no library `{id}`	няма библиотека `{id}`
 @msg	select some type first	първо изберете текст
-@msg	kerning must be a number, "auto", or "optical"	Кернингът трябва да е число, „auto“ или „optical“
+@msg	kerning must be a number, "auto", or "optical"	kerning трябва да е число, „auto“ или „optical“
 @msg	{_1} has no {_2} style	{_1} няма стил {_2}
 @msg	a layer couldn't be read	слой не можа да бъде прочетен
 @msg	it has more than one artboard	има повече от една работна област
@@ -4063,10 +4067,10 @@ axis	Both	И двете
 @msg	already editing a pattern	мострата вече се редактира
 @msg	an object can't be read	обектът не може да бъде прочетен
 @msg	an object in perspective would leave the edited grid	обект в перспектива би напуснал редактираната мрежа
-@msg	antiAlias `{id}`: none, art or type	заглаждане `{id}`: няма, художествено или текстово
+@msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art или type
 @msg	artboard {0} does not exist	работна област {0} не съществува
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	при този мащаб чертежът е {w} × {h} pt, повече отколкото платното побира: изберете по-малък мащаб или го вгонесете в работната област
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	оста трябва да бъде "vertical", "horizontal" или ъгъл в градуси, а не `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis трябва да бъде "vertical", "horizontal" или ъгъл в градуси, а не `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	фон {other}: прозрачен, бял, черен или цвят като "#ff8800"
 @msg	bad color {v}	грешен цвят {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio трябва да бъде число от 0,1 до 10
@@ -4075,9 +4079,9 @@ axis	Both	И двете
 @msg	bad shortcut	грешен клавишен бърз път
 @msg	bad stream length	грешна дължина на потока
 @msg	bad trailer	грешен край (trailer)
-@msg	balance must be between 0 and 100	балансът трябва да бъде между 0 и 100
+@msg	balance must be between 0 and 100	balance трябва да бъде между 0 и 100
 @msg	batch step {_1} (`{id}`) failed: {e}	стъпка от пакет {_1} (`{id}`) неуспешна: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	яркостта трябва да бъде dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness трябва да бъде dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	документът не може да бъде кодиран: {0}
 @msg	can't parse shortcut `{c}`	клавишният бърз път `{c}` не може да бъде разпознат
 @msg	can't parse shortcut `{s}` for `{k}`	клавишният бърз път `{s}` за `{k}` не може да бъде разпознат
@@ -4102,7 +4106,7 @@ axis	Both	И двете
 @msg	compound paths can only contain paths	съставните пътища могат да съдържат само пътища
 @msg	compressed (RLE) bitmaps can't be read yet	компресираните (RLE) битови карти все още не могат да бъдат четени
 @msg	damaged	повреден
-@msg	decimals must be {_1}–{_2} (got {_3})	десетичните знаци трябва да бъдат {_1}–{_2} (получени {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals трябва да бъде {_1}–{_2} (получено {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	разделяне на 1 до {MAX_PIECES} парчета
 @msg	effect {k} is `{_1}`, not `{id}`	ефектът {k} е `{_1}`, а не `{id}`
 @msg	empty brush stroke	празен щрих с четка
@@ -4120,9 +4124,9 @@ axis	Both	И двете
 @msg	an image has no pixels and was left out	изображение без пиксели беше пропуснато
 @msg	image data `{_1}` is missing	данните за изображение `{_1}` липсват
 @msg	image would be too large; lower the resolution	изображението ще бъде твърде голямо; намалете разделителната способност
-@msg	index must be a number or first, previous, next or last	индексът трябва да е число или first, previous, next или last
-@msg	index must be a number or first, previous, next or last, not `{other}`	индексът трябва да е число или first, previous, next или last, а не `{other}`
-@msg	index must be ≥ 0	индексът не може да е отрицателен
+@msg	index must be a number or first, previous, next or last	index трябва да е число или first, previous, next или last
+@msg	index must be a number or first, previous, next or last, not `{other}`	index трябва да е число или first, previous, next или last, а не `{other}`
+@msg	index must be ≥ 0	index трябва да е ≥ 0
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	инсталирането от път не е налично в уеб; предайте модула като `dataBase64`
 @msg	internal error in `{cmd}`: {msg} (the document was left as it was before; please report this bug)	вътрешна грешка в `{cmd}`: {msg} (документът беше оставен в състоянието си отпреди; моля, докладвайте тази грешка)
 @msg	internal error: {msg} (please report this bug)	вътрешна грешка: {msg} (моля, докладвайте тази грешка)
@@ -4222,6 +4226,8 @@ axis	Both	И двете
 @msg	no such action set	няма такъв набор от действия
 @msg	the action sets changed; nothing was deleted	наборите от действия се промениха; нищо не беше изтрито
 @msg	no action set to save	няма набор от действия за запазване
+@msg	the action set file can't be read in full	файлът с набор от действия не може да се прочете изцяло
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Зареден е „{name}“: {n} стъпка е пропусната|Зареден е „{name}“: {n} стъпки са пропуснати
 @msg	not an action set file	не е файл с набор от действия
 @msg	the action set file is larger than 8 MiB	файлът с набор от действия е по-голям от 8 MiB
 @msg	the action set file holds more than 1,000 actions	файлът с набор от действия съдържа повече от 1000 действия
@@ -4294,9 +4300,9 @@ axis	Both	И двете
 @msg	replace: the object to replace was changed or deleted	замяна: обектът за замяна е променен или изтрит
 @msg	pattern missing	липсва мостра
 @msg	patterns nested too deeply are filled with mid-grey	мострите, вложени прекалено дълбоко, се запълват със средно сиво
-@msg	percent must be above 0 and at most 6400, not {p}	процентът трябва да е над 0 и най-много 6400, а не {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent трябва да е над 0 и най-много 6400, а не {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	изберете цвят, градиент или мостра за запазване като образец
-@msg	plane must be left, right or ground	равнината трябва да е лява, дясна или земна
+@msg	plane must be left, right or ground	plane трябва да е left, right или ground
 @msg	plug-in ABI: {0}	ABI на плъгин: {0}
 @msg	plug-in exceeded its {0}	плъгинът надвиши своя {0}
 @msg	plug-in failed: {0}	плъгинът се провали: {0}
@@ -4315,8 +4321,8 @@ axis	Both	И двете
 @msg	result would exceed the canvas (coordinates out of range)	резултатът ще надвиши платното (координатите са извън обхвата)
 @msg	objects can't be nested more than 32 deep	 обектите не могат да бъдат вложени на повече от 32 нива
 @msg	the SVG's elements are nested more than {0} deep	 елементите на SVG са вложени на повече от {0} нива
-@msg	scale must be a number from {_1} to {_2}, not {_3}	мащабът трябва да е число от {_1} до {_2}, а не {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	мащабът трябва да е число от {_1} до {_2}, а не {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale трябва да е число от {_1} до {_2}, а не {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale трябва да е число от {_1} до {_2}, а не {s}
 @msg	select (or target) objects whose appearance isn't basic	изберете (или насочете към) обекти, чийто изглед не е основен
 @msg	select a Live Paint group	изберете група за интерактивно оцветяване (Live Paint)
 @msg	select a blend	изберете преход (blend)
@@ -4727,6 +4733,9 @@ axis	Both	И двете
 effect	Soft	Меко
 	Edge	Роб
 	System Title Bar	Заглавна лента на системата
+	VectorCraft Title Bar on Every Desktop	Заглавна лента на VectorCraft на всеки работен плот
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Докато е зададена, променливата на средата VECTORCRAFT_TITLEBAR избира заглавната лента.
+	System Title Bar takes precedence over this option while it is on.	Докато е включена, „Заглавна лента на системата“ има предимство пред тази опция.
 	Value Axis	Ос на стойностите
 	On Left Side	От лявата страна
 	On Right Side	От дясната страна
@@ -4767,24 +4776,24 @@ effect	Soft	Меко
 	Resize panels	Преоразмеряване на панели
 	Resize panel window	Преоразмеряване на прозореца на панела
 @msg	Invalid panel layout; restored the default dock	Невалидно оформление на панела; възстановено е подразбиращото се разположение
-@msg	action is required	необходимо е действие
-@msg	anchor must name a registered panel	опорната точка трябва да указва регистриран панел
-@msg	before must name a panel	параметърът „преди“ трябва да указва панел
+@msg	action is required	action е задължителен
+@msg	anchor must name a registered panel	anchor трябва да указва регистриран панел
+@msg	before must name a panel	before трябва да указва панел
 @msg	docking action contains an unknown panel or an excessive split path	действието по закачане съдържа непознат панел или прекомерен път на разделяне
 @msg	group must be true or false	group трябва да е true или false
-@msg	panel is not in a dock group	панелът не е в група на дока
+@msg	panel is not in a dock group	panel не е в група на дока
 @msg	only a dock group above or below others collapses, not one beside another	свива се само група на дока над или под други, не и такава до друга
 @msg	icon must be true or false	icon трябва да е true или false
 @msg	icon only docks a panel in the icon column, with no anchor	icon закачва панел само в колоната с икони, без anchor
 @msg	column docks a set as a dock column, with no anchor or icon	column закачва набор като колона на дока, без anchor или icon
 @msg	move requires a destination panel	преместването изисква целеви панел
 @msg	move requires an existing destination panel	преместването изисква съществуващ целеви панел
-@msg	onto must name a floating panel	параметърът „върху“ трябва да указва плаващ панел
+@msg	onto must name a floating panel	onto трябва да указва плаващ панел
 @msg	panel group is empty	групата от панели е празна
-@msg	panel must name a registered panel	панелът трябва да указва регистриран панел
+@msg	panel must name a registered panel	panel трябва да указва регистриран панел
 @msg	saved panel layout is invalid; reset the workspace first	запазеното оформление на панелите е невалидно; нулирайте работното пространство първо
-@msg	zone must be a string	зоната трябва да е низ
-@msg	zone must be tab, center, left, right, top or bottom	зоната трябва да бъде tab, center, left, right, top или bottom
+@msg	zone must be a string	zone трябва да е низ
+@msg	zone must be tab, center, left, right, top or bottom	zone трябва да бъде tab, center, left, right, top или bottom
 @msg	{key} must be a finite coordinate	{key} трябва да е крайна координата
 @msg	x and y must be provided together	x и y трябва да бъдат подадени заедно
 @msg	invalid restored panel group	невалидна възстановена група от панели
@@ -5366,7 +5375,7 @@ theme	Appearance	Външен вид
 	Screen Mode Controls	Контроли за режим на екран
 	Drawer menu	Меню на чекмеджето
 	Toolbar: Show Controls	Лента с инструменти: Показване на контроли
-@msg	control must be fillStroke, coloring, drawMode or screenMode	 контролът трябва да бъде fillStroke, coloring, drawMode или screenMode
+@msg	control must be fillStroke, coloring, drawMode or screenMode	control трябва да бъде fillStroke, coloring, drawMode или screenMode
 @msg	unknown control `{name}`: fillStroke, coloring, drawMode or screenMode	 неизвестен контрол `{name}`: fillStroke, coloring, drawMode или screenMode
 @msg	give a fraction `t` from 0 to 1	 въведете дробно число `t` от 0 до 1
 @msg	give the path `id`	 въведете `id` на пътя
@@ -6229,6 +6238,7 @@ breakText	Glyphs	Глифи
 	Reset Symbol Instance	Нулиране на екземпляра на символ
 @msg	type must be static or dynamic, not {v}	type трябва да е static или dynamic, а не {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` е статичен символ: първо задайте типа на символа на „Динамичен“
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	На път, съставен път или текст, избран в екземпляр на символ, могат да се променят само плътните цветове на запълването и контура
 @msg	path must be a list of child indices	path трябва да е списък с индекси на дъщерни обекти
 @msg	no object at path {shown} in the symbol's art	в графиката на символа няма обект на пътя {shown}
 @msg	give fill, stroke, opacity and/or blend	задайте fill, stroke, opacity и/или blend
@@ -6326,3 +6336,24 @@ breakText	Glyphs	Глифи
 # 3D Box add-on
 	3D Box	3D кутия
 	3D Box Tool	Инструмент за 3D кутия
+
+# Safe Mode
+	Safe Mode…	Безопасен режим…
+	Safe Mode	Безопасен режим
+	Help › Safe Mode…	Помощ › Безопасен режим…
+	Enable on Re-launch	Включване при следващо стартиране
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Последното стартиране на VectorCraft спря, докато се зареждаше добавката {name}. Възможно е тя да не е причината.
+	Disable and Continue	Изключване и продължаване
+	Start Normally	Нормално стартиране
+	Start in Safe Mode	Стартиране в безопасен режим
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft е в безопасен режим: добавките не се зареждат и не се изпълняват, докато не стартира нормално.
+	Disabled plug-ins	Изключени добавки
+	No plug-ins are disabled.	Няма изключени добавки.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Безопасният режим е включен: добавките не се зареждат и не се изпълняват, докато VectorCraft не стартира нормално
+@msg	give `id` or `file` (see plugin.safeMode)	задайте `id` или `file` (вижте plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	тази добавка не е изключена (вижте plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Изключените добавки не можаха да бъдат запазени за следващото стартиране
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Разширяване на облика: ефект на добавка в селекцията не може да бъде разширен в безопасен режим
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Подравняване към пикселната мрежа
diff --git a/crates/ui-egui/src/i18n/bs.tsv b/crates/ui-egui/src/i18n/bs.tsv
index c61bb9d7e..98bae6438 100644
--- a/crates/ui-egui/src/i18n/bs.tsv
+++ b/crates/ui-egui/src/i18n/bs.tsv
@@ -142,6 +142,7 @@
 	Report copied	Izvještaj kopiran
 	Line {line}	Red {line}
 	Line {line}: {name}: {status}	Red {line}: {name}: {status}
+	Read Action Set File	Pročitaj datoteku skupa akcija
 	Read Shortcut Set File	Pročitaj datoteku skupa prečica
 	Import Matches	Uparivanja uvoza
 	Remember Import Matches	Zapamti uparivanja uvoza
@@ -880,6 +881,9 @@
 	Stained Glass…	Vitraž…
 	Texturizer…	Teksturizator…
 	System Title Bar	Sistemska naslovna traka
+	VectorCraft Title Bar on Every Desktop	Naslovna traka VectorCrafta na svakoj radnoj površini
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Dok je varijabla okruženja VECTORCRAFT_TITLEBAR postavljena, ona bira naslovnu traku.
+	System Title Bar takes precedence over this option while it is on.	Dok je uključena, Sistemska naslovna traka ima prednost pred ovom opcijom.
 	Exit	Izlaz
 	Distort	Izobliči
 	Diffuse Glow…	Difuzni sjaj…
@@ -3148,6 +3152,9 @@ theme	Appearance	Izgled
 	Asset Export Settings	Postavke izvoza resursa
 	Assets	Resursi
 	Export Assets	Izvezi resurse
+	Export 3D Object	Izvezi 3D objekat
+	3D Export Format	Format 3D izvoza
+	Export 3D Assets	Izvezi 3D resurse
 	Remove Asset	Ukloni resurs
 	Rename Asset	Preimenuj resurs
 	Fill Rule	Pravilo ispune
@@ -4237,7 +4244,7 @@ imageTrace	Outline	Obris
 @plural	{n} stroke|{n} strokes	{n} potez|{n} poteza|{n} poteza
 @msg	no library `{id}`	nema biblioteke `{id}`
 @msg	select some type first	prvo odaberite tekst
-@msg	kerning must be a number, "auto", or "optical"	Podrezivanje mora biti broj, „auto” ili „optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning mora biti broj, „auto” ili „optical”
 @msg	the selection has no gradient fill	odabir nema ispunu gradijentom
 @msg	the selection has no gradient stroke	odabir nema potez gradijentom
 @msg	the selection has no pattern fill	odabir nema ispunu uzorkom
@@ -4448,7 +4455,7 @@ imageTrace	Outline	Obris
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art ili type
 @msg	artboard {0} does not exist	radna ploča {0} ne postoji
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	u ovoj skali crtež je {w} × {h} pt, više nego što platno može primiti: odaberite manju skalu ili ga uklopite u radnu ploču
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	osa mora biti "vertical", "horizontal" ili ugao u stepenima, a ne `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis mora biti "vertical", "horizontal" ili ugao u stepenima, a ne `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	pozadina {other}: transparent, white, black ili boja poput "#ff8800"
 @msg	bad color {v}	loša boja {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio mora biti broj od 0,1 do 10
@@ -4462,7 +4469,7 @@ imageTrace	Outline	Obris
 @msg	bad shortcut	loša prečica
 @msg	bad stream length	loša dužina toka
 @msg	bad trailer	loš trailer
-@msg	balance must be between 0 and 100	balans mora biti između 0 i 100
+@msg	balance must be between 0 and 100	balance mora biti između 0 i 100
 @msg	batch step {_1} (`{id}`) failed: {e}	korak paketa {_1} (`{id}`) nije uspio: {e}
 @msg	brightness must be dark|mediumDark|mediumLight|light	brightness mora biti dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	nije moguće kodirati dokument: {0}
@@ -4613,6 +4620,8 @@ imageTrace	Outline	Obris
 @msg	no such action set	nema takvog skupa akcija
 @msg	the action sets changed; nothing was deleted	skupovi akcija su se promijenili; ništa nije izbrisano
 @msg	no action set to save	nema skupa akcija za čuvanje
+@msg	the action set file can't be read in full	datoteka skupa akcija ne može se pročitati u cijelosti
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Učitano „{name}”: {n} korak je izostavljen|Učitano „{name}”: {n} koraka su izostavljena|Učitano „{name}”: {n} koraka je izostavljeno
 @msg	not an action set file	nije datoteka skupa akcija
 @msg	the action set file is larger than 8 MiB	datoteka skupa akcija je veća od 8 MiB
 @msg	the action set file holds more than 1,000 actions	datoteka skupa akcija sadrži više od 1.000 akcija
@@ -4687,7 +4696,7 @@ imageTrace	Outline	Obris
 @msg	replace: the object to replace was changed or deleted	replace: objekat za zamjenu je promijenjen ili izbrisan
 @msg	pattern missing	uzorak nedostaje
 @msg	patterns nested too deeply are filled with mid-grey	previše duboko ugniježđeni uzorci ispunjavaju se srednje sivom
-@msg	percent must be above 0 and at most 6400, not {p}	postotak mora biti iznad 0 i najviše 6400, a ne {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent mora biti iznad 0 i najviše 6400, a ne {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	odaberite boju, gradijent ili uzorak za čuvanje kao uzorak boje
 @msg	plane must be left, right or ground	plane mora biti left, right ili ground
 @msg	plug-in ABI: {0}	ABI dodatka: {0}
@@ -4708,8 +4717,8 @@ imageTrace	Outline	Obris
 @msg	result would exceed the canvas (coordinates out of range)	rezultat bi premašio platno (koordinate izvan raspona)
 @msg	objects can't be nested more than 32 deep	objekti ne mogu biti ugniježđeni dublje od 32 nivoa
 @msg	the SVG's elements are nested more than {0} deep	elementi SVG-a ugniježđeni su dublje od {0} nivoa
-@msg	scale must be a number from {_1} to {_2}, not {_3}	skala mora biti broj od {_1} do {_2}, a ne {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	skala mora biti broj od {_1} do {_2}, a ne {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale mora biti broj od {_1} do {_2}, a ne {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale mora biti broj od {_1} do {_2}, a ne {s}
 @msg	select (or target) objects whose appearance isn't basic	odaberite (ili ciljajte) objekte čiji izgled nije osnovni
 @msg	select a Live Paint group	odaberite grupu živog bojenja
 @msg	select a blend	odaberite stapanje
@@ -5040,7 +5049,7 @@ imageTrace	Outline	Obris
 @msg	the PSD file's image data can't be read: {e}	podaci slike PSD datoteke se ne mogu pročitati: {e}
 @msg	Imported library {name}	Uvezena biblioteka {name}
 @msg	Invalid panel layout; restored the default dock	Nevažeći raspored panela; vraćeno je zadano sidrište
-@msg	action is required	akcija je obavezna
+@msg	action is required	action je obavezan
 @msg	anchor must name a registered panel	anchor mora navesti registrovani panel
 @msg	before must name a panel	before mora navesti panel
 @msg	docking action contains an unknown panel or an excessive split path	akcija sidrenja sadrži nepoznat panel ili prekomjernu putanju podjele
@@ -5842,7 +5851,7 @@ axis	Y Axis	Y osa
 @msg	the document has no symbols to save	dokument nema simbola za čuvanje
 @msg	Trap: select two or more objects filled with solid colours	Zamka: odaberite dva ili više objekata ispunjenih punim bojama
 @msg	Trap: no edges of different colours meet among the selected objects	Zamka: među odabranim objektima ne susreću se ivice različitih boja
-@msg	thickness must be from 0.01 to 5000 pt	debljina mora biti od 0,01 do 5000 pt
+@msg	thickness must be from 0.01 to 5000 pt	thickness mora biti od 0,01 do 5000 pt
 @msg	heightWidth must be from 1 to 1000 %	heightWidth mora biti od 1 do 1000 %
 @msg	tintReduction must be from 0 to 100 %	tintReduction mora biti od 0 do 100 %
 	Rectangular Grid Tool Options	Opcije alata pravougaona mreža
@@ -5850,7 +5859,7 @@ axis	Y Axis	Y osa
 	Fill Line	Ispuni liniju
 	Pathfinder Options	Opcije Pathfindera
 	Divide and Outline Will Remove Unpainted Artwork	Podijeli i Obris uklanjaju neobojenu grafiku
-@msg	precision must be from 0.001 to 10 pt	preciznost mora biti od 0,001 do 10 pt
+@msg	precision must be from 0.001 to 10 pt	precision mora biti od 0,001 do 10 pt
 @msg	`pathfinder` must be an object	`pathfinder` mora biti objekat
 	Add to Brushes	Dodaj u četkice
 	Brush Library	Biblioteka četkica
@@ -6280,6 +6289,7 @@ shape	Open	Otvoren
 	Reset Symbol Instance	Vrati instancu simbola na početno
 @msg	type must be static or dynamic, not {v}	type mora biti static ili dynamic, a ne {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` je statički simbol: prvo postavite vrstu simbola na Dinamički
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Putanji, složenoj putanji ili tekstu odabranom u instanci simbola mogu se mijenjati samo pune boje ispune i poteza
 @msg	path must be a list of child indices	path mora biti lista indeksa podređenih objekata
 @msg	no object at path {shown} in the symbol's art	nema objekta na putanji {shown} u grafici simbola
 @msg	give fill, stroke, opacity and/or blend	navedite fill, stroke, opacity i/ili blend
@@ -6378,3 +6388,24 @@ shape	Open	Otvoren
 # 3D Box add-on
 	3D Box	3D kutija
 	3D Box Tool	Alat za 3D kutiju
+
+# Safe Mode
+	Safe Mode…	Sigurni način rada…
+	Safe Mode	Sigurni način rada
+	Help › Safe Mode…	Pomoć › Sigurni način rada…
+	Enable on Re-launch	Omogući pri sljedećem pokretanju
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Posljednje pokretanje programa VectorCraft zaustavilo se dok se učitavao dodatak {name}. Možda on nije uzrok zaustavljanja.
+	Disable and Continue	Onemogući i nastavi
+	Start Normally	Pokreni normalno
+	Start in Safe Mode	Pokreni u sigurnom načinu rada
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft je u sigurnom načinu rada: dodaci se ne učitavaju niti pokreću dok se program ne pokrene normalno.
+	Disabled plug-ins	Onemogućeni dodaci
+	No plug-ins are disabled.	Nijedan dodatak nije onemogućen.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Sigurni način rada je uključen: dodaci se ne učitavaju niti pokreću dok se VectorCraft ne pokrene normalno
+@msg	give `id` or `file` (see plugin.safeMode)	navedite `id` ili `file` (vidi plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	taj dodatak nije onemogućen (vidi plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Onemogućeni dodaci nisu mogli biti sačuvani za sljedeće pokretanje
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Proširi izgled: efekat dodatka u odabiru ne može se proširiti u sigurnom načinu rada
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Poravnaj s mrežom piksela
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 15533d114..b21e52584 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -1465,6 +1465,14 @@
 	Export As SVG…	Exporta com a SVG…
 	Export Asset	Exporta el recurs
 	Export Assets	Exporta els recursos
+	Export 3D Object	Exporta l’objecte 3D
+	3D Export Format	Format d’exportació 3D
+	Export 3D Assets	Exporta els recursos 3D
+@msg	{what} can't be exported in 3D: {e}	no es pot exportar {what} en 3D: {e}
+@msg	asset {id} isn't a 3D asset	el recurs {id} no és un recurs 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	el recurs {id} és un recurs 3D: l’escriu assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	encara no hi ha cap recurs 3D: recolliu primer un objecte amb un efecte 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	seleccioneu un objecte amb un efecte 3D (o indiqueu-ne els id)
 	Export As…	Exporta com a…
 	Export CSS	Exporta CSS
 	Export CSS…	Exporta CSS…
@@ -3218,6 +3226,7 @@ digits	Malayalam	Malaiàlam
 	Rating:	Valoració:
 	Ratio	Proporció
 	Rays	Raigs
+	Read Action Set File	Llegeix el fitxer de conjunt d’accions
 	Read Shortcut Set File	Llegeix el fitxer de conjunt de drets de teclat
 	Reads or sets environment variables	Llegeix o defineix variables d’entorn
 	Ready	A punt
@@ -4282,6 +4291,9 @@ digits	Malayalam	Malaiàlam
 	Syntax newer than ES3	Sintaxi més nova que ES3
 	System Layout	Disposició del sistema
 	System Title Bar	Barra de títol del sistema
+	VectorCraft Title Bar on Every Desktop	Barra de títol de VectorCraft a tots els escriptoris
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Mentre està definida, la variable d’entorn VECTORCRAFT_TITLEBAR determina la barra de títol.
+	System Title Bar takes precedence over this option while it is on.	Mentre està activada, Barra de títol del sistema té prioritat sobre aquesta opció.
 	Tab	Tabulació
 	Tab Stops	Aturades de tabulació
 	Table	Taula
@@ -5007,7 +5019,7 @@ digits	Malayalam	Malaiàlam
 @msg	a value has the wrong type for the operator	un valor té el tipus incorrecte per a l’operador
 @msg	a value is outside the range the operator takes	un valor està fora de l’interval que accepta l’operador
 @msg	a {width}×{height} screenshot's byte count overflows	el recompte de bytes d’una captura de pantalla de {width}×{height} es desborda
-@msg	action is required	cal una acció
+@msg	action is required	cal action
 @msg	add a format to export	afegiu un format per exportar
 @msg	aiVersion 7 writes legacy .ai files, not .ait templates	aiVersion 7 escriu fitxers .ai heretats, no plantilles .ait
 @msg	already editing a pattern	ja s’està editant un motiu
@@ -5026,9 +5038,9 @@ digits	Malayalam	Malaiàlam
 @msg	an object can't be read	no es pot llegir un objecte
 @msg	an object in perspective would leave the edited grid	un objecte en perspectiva sortiria de la quadrícula editada
 @msg	An object takes one 3D effect. Edit the existing effect's options, or remove it first.	Un objecte admet un efecte 3D. Editeu les opcions de l’efecte existent o suprimiu-lo primer.
-@msg	anchor must name a registered panel	l’àncora ha de nomenar un panell registrat
+@msg	anchor must name a registered panel	anchor ha de nomenar un panell registrat
 @msg	Angles require two straight segments	Els angles requereixen dos segments rectes
-@msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: cap, art o text
+@msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art o type
 @msg	area type in frames too short for a line of the font it shows in got taller frames ({_1}): their type wouldn't show otherwise	el text d’àrea en marcs massa baixos per a una línia del tipus de lletra que mostren ha rebut marcs més alts ({_1}): d’altra manera el seu text no es veuria
 @msg	artboard {0} does not exist	el tauler {0} no existeix
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	a aquesta escala el dibuix fa {w} × {h} pt, més del que admet el llenç: trieu una escala més petita o ajusteu-lo al tauler
@@ -5043,7 +5055,7 @@ digits	Malayalam	Malaiàlam
 @msg	automation path rejected: parent traversal below a folder that doesn't exist: {path}	camí d’automatització rebutjat: recorregut ascendent per sota d’una carpeta que no existeix: {path}
 @msg	automation path rejected: path is empty	camí d’automatització rebutjat: el camí és buit
 @msg	automation path rejected: reserved device names are not allowed: {path}	camí d’automatització rebutjat: no es permeten noms de dispositiu reservats: {path}
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	l’eix ha de ser "vertical", "horizontal" o un angle en graus, no `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis ha de ser "vertical", "horizontal" o un angle en graus, no `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	fons {other}: transparent, blanc, negre o un color com "#ff8800"
 @msg	bad color {v}	color incorrecte {v}
 @msg	bad colour `{hex}` (#rrggbb)	color incorrecte `{hex}` (#rrggbb)
@@ -5051,7 +5063,7 @@ digits	Malayalam	Malaiàlam
 @msg	bad shortcut	drecera incorrecta
 @msg	bad stream length	longitud de flux incorrecta
 @msg	bad trailer	tràiler incorrecte
-@msg	balance must be between 0 and 100	l’equilibri ha d’estar entre 0 i 100
+@msg	balance must be between 0 and 100	balance ha d’estar entre 0 i 100
 @msg	batch step {_1} (`{id}`) failed: {e}	el pas de lot {_1} (`{id}`) ha fallat: {e}
 @msg	Batch: {count} processed	Lot: {count} processats
 @msg	Batch: {count} processed, {failed} failed	Lot: {count} processats, {failed} fallits
@@ -5059,7 +5071,7 @@ digits	Malayalam	Malaiàlam
 @msg	below and above must name a panel floating in another group	below i above han de nomenar un panell flotant en un altre grup
 @msg	Blend colors: select at least three objects with filled colours	Fusiona colors: seleccioneu com a mínim tres objectes amb colors de farciment
 @msg	BMP files are RGB or grayscale: colorModel rgb or gray	Els fitxers BMP són RGB o escala de grisos: colorModel rgb o gray
-@msg	brightness must be dark|mediumDark|mediumLight|light	la brillantor ha de ser dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness ha de ser dark|mediumDark|mediumLight|light
 @msg	brushes move only within their type	els pinzells només es mouen dins del seu tipus
 @msg	can't encode the document: {0}	no es pot codificar el document: {0}
 @msg	can't parse shortcut `{c}`	no es pot analitzar la drecera `{c}`
@@ -5372,6 +5384,8 @@ digits	Malayalam	Malaiàlam
 @msg	no such action set	no existeix aquest conjunt d’accions
 @msg	the action sets changed; nothing was deleted	els conjunts d’accions han canviat; no s’ha suprimit res
 @msg	no action set to save	no hi ha cap conjunt d’accions per desar
+@msg	the action set file can't be read in full	el fitxer de conjunt d’accions no es pot llegir sencer
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	S’ha carregat “{name}”: s’ha omès {n} pas|S’ha carregat “{name}”: s’han omès {n} passos
 @msg	not an action set file	no és un fitxer de conjunt d’accions
 @msg	the action set file is larger than 8 MiB	el fitxer de conjunt d’accions supera els 8 MiB
 @msg	the action set file holds more than 1,000 actions	el fitxer de conjunt d’accions conté més de 1.000 accions
@@ -5469,7 +5483,7 @@ digits	Malayalam	Malaiàlam
 @msg	page size {w} × {h}	mida de pàgina {w} × {h}
 @msg	page {0} does not exist (the PDF has {1})	la pàgina {0} no existeix (el PDF en té {1})
 @msg	panel group is empty	el grup de panells és buit
-@msg	panel is not in a dock group	el panell no és en un grup d’acoblament
+@msg	panel is not in a dock group	panel no és en un grup d’acoblament
 @msg	panel must name a registered panel	panel ha de nomenar un panell registrat
 @msg	part of the program isn't valid PostScript text	una part del programa no és text PostScript vàlid
 @msg	paste unavailable	enganxament no disponible
@@ -5481,7 +5495,7 @@ digits	Malayalam	Malaiàlam
 @msg	PDF security settings are not an object	la configuració de seguretat del PDF no és un objecte
 @msg	PDF settings are not an object	la configuració del PDF no és un objecte
 @msg	PDF writer error: {0}	error de l’escriptor PDF: {0}
-@msg	percent must be above 0 and at most 6400, not {p}	el percentatge ha de ser superior a 0 i com a màxim 6400, no {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent ha de ser superior a 0 i com a màxim 6400, no {p}
 @msg	Persistent libraries not found: {files}	No s’han trobat biblioteques persistents: {files}
 @msg	pick a colour, gradient or pattern to save as a swatch	tria un color, un degradat o un motiu per desar-lo com a mostra
 @msg	Placing {_1}	Col·locant {_1}
@@ -5494,7 +5508,7 @@ digits	Malayalam	Malaiàlam
 @msg	plug-in output: {0}	sortida del complement: {0}
 @msg	plug-in parameters: {0}	paràmetres del complement: {0}
 @msg	plug-in trapped: {0}	el complement ha quedat atrapat: {0}
-@msg	precision must be from 0.001 to 10 pt	la precisió ha de ser d’entre 0,001 i 10 pt
+@msg	precision must be from 0.001 to 10 pt	precision ha de ser d’entre 0,001 i 10 pt
 @msg	Preview in Browser needs the desktop app (the web downloads files instead)	La previsualització al navegador necessita l’aplicació d’escriptori (a la web es baixen els fitxers)
 @msg	print settings are not an object	la configuració d’impressió no és un objecte
 @msg	printing isn't available here	la impressió no està disponible aquí
@@ -5548,8 +5562,8 @@ digits	Malayalam	Malaiàlam
 @msg	Saving	S’està desant
 @msg	Saving recovery data for {_1}	S’estan desant les dades de recuperació de {_1}
 @msg	Saving {_1}	S’està desant {_1}
-@msg	scale must be a number from {_1} to {_2}, not {_3}	l’escala ha de ser un número de {_1} a {_2}, no {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	l’escala ha de ser un número de {_1} a {_2}, no {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale ha de ser un número de {_1} a {_2}, no {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale ha de ser un número de {_1} a {_2}, no {s}
 @msg	Scale must be drawing:real, for example 1:10	L’escala ha de ser drawing:real, per exemple 1:10
 @msg	Scale ratio must be between 1:1000000 and 1000000:1	La relació d’escala ha d’estar entre 1:1000000 i 1000000:1
 @msg	Scale Text Attributes: selected type has no scale to bake	Escala els atributs de text: el text seleccionat no té cap escala per aplicar
@@ -5736,7 +5750,7 @@ digits	Malayalam	Malaiàlam
 @msg	the {tool} tool has no options	l’eina {tool} no té opcions
 @msg	there are no objects to release	no hi ha cap objecte per alliberar
 @msg	there are no printer settings to open here	aquí no hi ha cap configuració d’impressora per obrir
-@msg	thickness must be from 0.01 to 5000 pt	el gruix ha de ser d’entre 0,01 i 5000 pt
+@msg	thickness must be from 0.01 to 5000 pt	thickness ha de ser d’entre 0,01 i 5000 pt
 @msg	this file was saved without PDF compatibility, and its editing data can't be read ({why})	aquest fitxer s’ha desat sense compatibilitat amb PDF i les seves dades d’edició no es poden llegir ({why})
 @msg	the PDF part couldn't be read ({_1}): the file opened from its editing data	no s’ha pogut llegir la part PDF ({_1}): el fitxer s’ha obert a partir de les seves dades d’edició
 @msg	this file's PostScript couldn't be read ({why}): {what}	no s’ha pogut llegir el PostScript d’aquest fitxer ({why}): {what}
@@ -6391,6 +6405,7 @@ breakText	Glyphs	Glifs
 	Reset Symbol Instance	Restableix la instància de símbol
 @msg	type must be static or dynamic, not {v}	type ha de ser static o dynamic, no {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` és un símbol estàtic: primer establiu el tipus de símbol a Dinàmic
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	D'un traçat, un traçat compost o un text seleccionat en una instància de símbol només es pot canviar el color sòlid de l'emplenament i el traç
 @msg	path must be a list of child indices	path ha de ser una llista d’índexs de fills
 @msg	no object at path {shown} in the symbol's art	no hi ha cap objecte al camí {shown} de l’art del símbol
 @msg	give fill, stroke, opacity and/or blend	indiqueu fill, stroke, opacity i/o blend
@@ -6488,3 +6503,25 @@ breakText	Glyphs	Glifs
 # 3D Box add-on
 	3D Box	Caixa 3D
 	3D Box Tool	Eina Caixa 3D
+
+# Safe Mode
+	Safe Mode…	Mode segur…
+	Safe Mode	Mode segur
+	Help › Safe Mode…	Ajuda › Mode segur…
+	Enable on Re-launch	Activa en el proper inici
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	L'últim inici de VectorCraft es va aturar mentre es carregava el complement {name}. Pot ser que no en sigui la causa.
+	Disable and Continue	Desactiva i continua
+	Start Normally	Inicia normalment
+	Start in Safe Mode	Inicia en mode segur
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft és en mode segur: cap complement no es carrega ni s'executa fins que s'iniciï normalment.
+	Disabled plug-ins	Complements desactivats
+	No plug-ins are disabled.	No hi ha cap complement desactivat.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	El mode segur és actiu: els complements no es carreguen ni s'executen fins que VectorCraft s'iniciï normalment
+@msg	give `id` or `file` (see plugin.safeMode)	indiqueu `id` o `file` (vegeu plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	aquest complement no està desactivat (vegeu plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	No s’han pogut desar els complements desactivats per al proper inici
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Expandeix l’aparença: un efecte d’un complement de la selecció no es pot expandir en mode segur
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Alinea a la quadrícula de píxels
+@msg	only paths and compound paths can be aligned to the pixel grid	només els traçats i els traçats compostos es poden alinear a la quadrícula de píxels
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index bf723ab69..2f6238cc3 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -150,6 +150,7 @@
 	Report copied	Zpráva zkopírována
 	Line {line}	Řádek {line}
 	Line {line}: {name}: {status}	Řádek {line}: {name}: {status}
+	Read Action Set File	Přečíst soubor sady akcí
 	Read Shortcut Set File	Přečíst soubor sady klávesových zkratek
 	Import Matches	Přiřazení z importů
 	Remember Import Matches	Zapamatovat přiřazení z importů
@@ -894,6 +895,9 @@
 	Stained Glass…	Vitráž…
 	Texturizer…	Texturovač…
 	System Title Bar	Systémové záhlaví okna
+	VectorCraft Title Bar on Every Desktop	Záhlaví okna VectorCraftu v každém desktopovém prostředí
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Dokud je proměnná prostředí VECTORCRAFT_TITLEBAR nastavena, záhlaví okna volí ona.
+	System Title Bar takes precedence over this option while it is on.	Dokud je Systémové záhlaví okna zapnuté, má přednost před touto volbou.
 	Exit	Ukončit
 	Distort	Zkreslení
 	Diffuse Glow…	Rozptýlená záře…
@@ -3187,6 +3191,14 @@ theme	Appearance	Motiv
 	Asset Export Settings	Nastavení exportu prvků
 	Assets	Prvky
 	Export Assets	Exportovat prvky
+	Export 3D Object	Exportovat 3D objekt
+	3D Export Format	Formát 3D exportu
+	Export 3D Assets	Exportovat 3D prvky
+@msg	{what} can't be exported in 3D: {e}	{what} nelze exportovat ve 3D: {e}
+@msg	asset {id} isn't a 3D asset	prvek {id} není 3D prvek
+@msg	asset {id} is a 3D asset: assets.export3D writes it	prvek {id} je 3D prvek: zapisuje jej assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	zatím žádné 3D prvky: nejprve shromážděte objekt s 3D efektem (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	vyberte objekt s 3D efektem (nebo zadejte jeho ID)
 	Remove Asset	Odebrat prvek
 	Rename Asset	Přejmenovat prvek
 	Fill Rule	Pravidlo výplně
@@ -4287,7 +4299,7 @@ imageTrace	Outline	Obrys
 # Status and error messages
 @msg	no library `{id}`	knihovna `{id}` neexistuje
 @msg	select some type first	nejprve vyberte text
-@msg	kerning must be a number, "auto", or "optical"	Vyrovnání párů musí být číslo, „auto“ nebo „optical“
+@msg	kerning must be a number, "auto", or "optical"	kerning musí být číslo, „auto“ nebo „optical“
 @msg	the selection has no gradient fill	výběr nemá přechodovou výplň
 @msg	the selection has no gradient stroke	výběr nemá přechodový tah
 @msg	the selection has no pattern fill	výběr nemá vzorkovou výplň
@@ -4499,7 +4511,7 @@ imageTrace	Outline	Obrys
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art nebo type
 @msg	artboard {0} does not exist	pracovní plocha {0} neexistuje
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	v tomto měřítku má kresba {w} × {h} pt, víc než pojme plátno: zvolte menší měřítko nebo ji přizpůsobte pracovní ploše
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	osa musí být "vertical", "horizontal" nebo úhel ve stupních, ne `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis musí být "vertical", "horizontal" nebo úhel ve stupních, ne `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	pozadí {other}: transparent, white, black nebo barva jako "#ff8800"
 @msg	bad color {v}	chybná barva {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio musí být číslo od 0,1 do 10
@@ -4513,9 +4525,9 @@ imageTrace	Outline	Obrys
 @msg	bad shortcut	chybná klávesová zkratka
 @msg	bad stream length	chybná délka datového proudu
 @msg	bad trailer	chybný trailer
-@msg	balance must be between 0 and 100	vyvážení musí být mezi 0 a 100
+@msg	balance must be between 0 and 100	balance musí být mezi 0 a 100
 @msg	batch step {_1} (`{id}`) failed: {e}	krok dávky {_1} (`{id}`) selhal: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	jas musí být dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness musí být dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	dokument nelze zakódovat: {0}
 @msg	can't parse shortcut `{c}`	klávesovou zkratku `{c}` nelze analyzovat
 @msg	can't parse shortcut `{s}` for `{k}`	klávesovou zkratku `{s}` pro `{k}` nelze analyzovat
@@ -4540,7 +4552,7 @@ imageTrace	Outline	Obrys
 @msg	compound paths can only contain paths	složené cesty mohou obsahovat jen cesty
 @msg	compressed (RLE) bitmaps can't be read yet	komprimované bitmapy (RLE) zatím nelze načíst
 @msg	damaged	poškozeno
-@msg	decimals must be {_1}–{_2} (got {_3})	počet desetinných míst musí být {_1}–{_2} (zadáno {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals musí být {_1}–{_2} (zadáno {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	rozdělit lze na 1 až {MAX_PIECES} řezů
 @msg	effect {k} is `{_1}`, not `{id}`	efekt {k} je `{_1}`, ne `{id}`
 @msg	empty brush stroke	prázdný tah štětcem
@@ -4665,6 +4677,8 @@ imageTrace	Outline	Obrys
 @msg	no such action set	taková sada akcí neexistuje
 @msg	the action sets changed; nothing was deleted	sady akcí se změnily; nic nebylo odstraněno
 @msg	no action set to save	žádná sada akcí k uložení
+@msg	the action set file can't be read in full	soubor sady akcí nelze přečíst celý
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Načteno „{name}“: vynechán {n} krok|Načteno „{name}“: vynechány {n} kroky|Načteno „{name}“: vynecháno {n} kroků
 @msg	not an action set file	není to soubor sady akcí
 @msg	the action set file is larger than 8 MiB	soubor sady akcí je větší než 8 MiB
 @msg	the action set file holds more than 1,000 actions	soubor sady akcí obsahuje více než 1 000 akcí
@@ -4738,9 +4752,9 @@ imageTrace	Outline	Obrys
 @msg	replace: the object to replace was changed or deleted	replace: objekt k nahrazení byl změněn nebo odstraněn
 @msg	pattern missing	chybí vzorek
 @msg	patterns nested too deeply are filled with mid-grey	příliš hluboko vnořené vzorky se vyplní středně šedou
-@msg	percent must be above 0 and at most 6400, not {p}	procento musí být větší než 0 a nejvýše 6400, ne {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent musí být větší než 0 a nejvýše 6400, ne {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	vyberte barvu, přechod nebo vzorek, který se má uložit do vzorníku
-@msg	plane must be left, right or ground	rovina musí být left, right nebo ground
+@msg	plane must be left, right or ground	plane musí být left, right nebo ground
 @msg	plug-in ABI: {0}	ABI zásuvného modulu: {0}
 @msg	plug-in exceeded its {0}	zásuvný modul překročil limit: {0}
 @msg	plug-in failed: {0}	zásuvný modul selhal: {0}
@@ -4759,8 +4773,8 @@ imageTrace	Outline	Obrys
 @msg	result would exceed the canvas (coordinates out of range)	výsledek by přesáhl plátno (souřadnice mimo rozsah)
 @msg	objects can't be nested more than 32 deep	objekty nelze vnořit hlouběji než do 32 úrovní
 @msg	the SVG's elements are nested more than {0} deep	prvky SVG jsou vnořeny hlouběji než do {0} úrovní
-@msg	scale must be a number from {_1} to {_2}, not {_3}	měřítko musí být číslo od {_1} do {_2}, ne {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	měřítko musí být číslo od {_1} do {_2}, ne {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale musí být číslo od {_1} do {_2}, ne {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale musí být číslo od {_1} do {_2}, ne {s}
 @msg	select (or target) objects whose appearance isn't basic	vyberte (nebo zacilte) objekty, jejichž vzhled není základní
 @msg	select a Live Paint group	vyberte skupinu živé malby
 @msg	select a blend	vyberte prolnutí
@@ -6408,6 +6422,7 @@ breakText	Glyphs	Glyfy
 	Reset Symbol Instance	Obnovit instanci symbolu
 @msg	type must be static or dynamic, not {v}	type musí být static nebo dynamic, ne {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` je statický symbol: nejprve nastavte jeho typ symbolu na Dynamický
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	U cesty, složené cesty nebo textu vybraného v instanci symbolu lze měnit jen plnou barvu výplně a tahu
 @msg	path must be a list of child indices	path musí být seznam indexů potomků
 @msg	no object at path {shown} in the symbol's art	v kresbě symbolu není na cestě {shown} žádný objekt
 @msg	give fill, stroke, opacity and/or blend	zadejte fill, stroke, opacity a/nebo blend
@@ -6505,3 +6520,25 @@ breakText	Glyphs	Glyfy
 # 3D Box add-on
 	3D Box	3D kvádr
 	3D Box Tool	Nástroj 3D kvádr
+
+# Safe Mode
+	Safe Mode…	Nouzový režim…
+	Safe Mode	Nouzový režim
+	Help › Safe Mode…	Nápověda › Nouzový režim…
+	Enable on Re-launch	Povolit při příštím spuštění
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Poslední spuštění aplikace VectorCraft se zastavilo během načítání zásuvného modulu {name}. Tento modul nemusí být příčinou.
+	Disable and Continue	Zakázat a pokračovat
+	Start Normally	Spustit normálně
+	Start in Safe Mode	Spustit v nouzovém režimu
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft je v nouzovém režimu: zásuvné moduly se nenačítají ani nespouštějí, dokud se aplikace nespustí normálně.
+	Disabled plug-ins	Zakázané zásuvné moduly
+	No plug-ins are disabled.	Žádné zásuvné moduly nejsou zakázány.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Nouzový režim je zapnutý: zásuvné moduly se nenačítají ani nespouštějí, dokud se VectorCraft nespustí normálně
+@msg	give `id` or `file` (see plugin.safeMode)	zadejte `id` nebo `file` (viz plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	tento zásuvný modul není zakázán (viz plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Zakázané zásuvné moduly nebylo možné uložit pro příští spuštění
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Rozložit vzhled: efekt zásuvného modulu ve výběru nelze v nouzovém režimu rozložit
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Zarovnat na mřížku obrazových bodů
+@msg	only paths and compound paths can be aligned to the pixel grid	na mřížku obrazových bodů lze zarovnat jen cesty a složené cesty
diff --git a/crates/ui-egui/src/i18n/da.tsv b/crates/ui-egui/src/i18n/da.tsv
index 978a0971a..22c0d19bd 100644
--- a/crates/ui-egui/src/i18n/da.tsv
+++ b/crates/ui-egui/src/i18n/da.tsv
@@ -135,6 +135,7 @@
 	Report copied	Rapporten er kopieret
 	Line {line}	Linje {line}
 	Line {line}: {name}: {status}	Linje {line}: {name}: {status}
+	Read Action Set File	Læs handlingssætfil
 	Read Shortcut Set File	Læs fil med genvejssæt
 	Import Matches	Importér match
 	Remember Import Matches	Husk importmatch
@@ -821,6 +822,9 @@
 	Stained Glass…	Blyindfattede ruder…
 	Texturizer…	Teksturér…
 	System Title Bar	Systemtitellinje
+	VectorCraft Title Bar on Every Desktop	VectorCrafts titellinje på alle skriveborde
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Miljøvariablen VECTORCRAFT_TITLEBAR vælger titellinjen, så længe den er angivet.
+	System Title Bar takes precedence over this option while it is on.	Systemtitellinje har forrang for denne indstilling, så længe den er slået til.
 	Exit	Afslut
 	Distort	Forvræng
 	Diffuse Glow…	Diffus glød…
@@ -2931,6 +2935,9 @@ theme	Appearance	Udseende
 	Asset Export Settings	Indstillinger for eksport af aktiver
 	Assets	Aktiver
 	Export Assets	Eksportér aktiver
+	Export 3D Object	Eksportér 3D-objekt
+	3D Export Format	3D-eksportformat
+	Export 3D Assets	Eksportér 3D-aktiver
 	Remove Asset	Fjern aktiv
 	Rename Asset	Omdøb aktiv
 	Fill Rule	Udfyldningsregel
@@ -4002,7 +4009,7 @@ imageTrace	Outline	Kontur
 @plural	{n} stroke|{n} strokes	{n} kontur|{n} konturer
 @msg	no library `{id}`	intet bibliotek `{id}`
 @msg	select some type first	markér først noget tekst
-@msg	kerning must be a number, "auto", or "optical"	Kerning skal være et tal, „auto“ eller „optical“
+@msg	kerning must be a number, "auto", or "optical"	kerning skal være et tal, „auto“ eller „optical“
 @msg	{_1} has no {_2} style	{_1} har ingen {_2}-stil
 @msg	a layer couldn't be read	et lag kunne ikke læses
 @msg	it has more than one artboard	den har mere end én tegneflade
@@ -4177,7 +4184,7 @@ imageTrace	Outline	Kontur
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art eller type
 @msg	artboard {0} does not exist	tegneflade {0} findes ikke
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	ved denne skala er tegningen {w} × {h} pt, mere end lærredet rummer: vælg en mindre skala, eller tilpas den til tegnefladen
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	aksen skal være "vertical", "horizontal" eller en vinkel i grader, ikke `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis skal være "vertical", "horizontal" eller en vinkel i grader, ikke `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	baggrund {other}: gennemsigtig, hvid, sort eller en farve som "#ff8800"
 @msg	bad color {v}	ugyldig farve {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio skal være et tal fra 0,1 til 10
@@ -4188,7 +4195,7 @@ imageTrace	Outline	Kontur
 @msg	bad trailer	ugyldig trailer
 @msg	balance must be between 0 and 100	balance skal være mellem 0 og 100
 @msg	batch step {_1} (`{id}`) failed: {e}	batchtrin {_1} (`{id}`) mislykkedes: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	lysstyrken skal være dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness skal være dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	kan ikke kode dokumentet: {0}
 @msg	can't parse shortcut `{c}`	kan ikke parse genvejen `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	kan ikke parse genvejen `{s}` for `{k}`
@@ -4211,7 +4218,7 @@ imageTrace	Outline	Kontur
 @msg	compound paths can only contain paths	sammensatte kurver kan kun indeholde kurver
 @msg	compressed (RLE) bitmaps can't be read yet	komprimerede (RLE) bitmaps kan endnu ikke læses
 @msg	damaged	beskadiget
-@msg	decimals must be {_1}–{_2} (got {_3})	decimaler skal være {_1}–{_2} (fik {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals skal være {_1}–{_2} (fik {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	opdel i 1 til {MAX_PIECES} udsnit
 @msg	effect {k} is `{_1}`, not `{id}`	effekten {k} er `{_1}`, ikke `{id}`
 @msg	empty brush stroke	tomt penselstrøg
@@ -4228,8 +4235,8 @@ imageTrace	Outline	Kontur
 @msg	an image has no pixels and was left out	et billede uden pixels blev udeladt
 @msg	image data `{_1}` is missing	billeddata `{_1}` mangler
 @msg	image would be too large; lower the resolution	billedet ville blive for stort; sænk opløsningen
-@msg	index must be a number or first, previous, next or last	indeks skal være et tal eller first, previous, next eller last
-@msg	index must be a number or first, previous, next or last, not `{other}`	indeks skal være et tal eller first, previous, next eller last, ikke `{other}`
+@msg	index must be a number or first, previous, next or last	index skal være et tal eller first, previous, next eller last
+@msg	index must be a number or first, previous, next or last, not `{other}`	index skal være et tal eller first, previous, next eller last, ikke `{other}`
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	installation fra en sti er ikke tilgængelig på webbet; overfør modulet som `dataBase64`
 @msg	internal error in `{cmd}`: {msg} (the document was left as it was before; please report this bug)	intern fejl i `{cmd}`: {msg} (dokumentet blev efterladt, som det var tidligere; meld venligst denne fejl)
 @msg	internal error: {msg} (please report this bug)	intern fejl: {msg} (meld venligst denne fejl)
@@ -4327,6 +4334,8 @@ imageTrace	Outline	Kontur
 @msg	no such action set	intet sådant handlingssæt
 @msg	the action sets changed; nothing was deleted	handlingssættene er ændret; intet blev slettet
 @msg	no action set to save	intet handlingssæt at gemme
+@msg	the action set file can't be read in full	handlingssætfilen kan ikke læses helt
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Indlæste »{name}«: {n} trin blev udeladt|Indlæste »{name}«: {n} trin blev udeladt
 @msg	not an action set file	ikke en handlingssætfil
 @msg	the action set file is larger than 8 MiB	handlingssætfilen er større end 8 MiB
 @msg	the action set file holds more than 1,000 actions	handlingssætfilen indeholder mere end 1.000 handlinger
@@ -4392,9 +4401,9 @@ imageTrace	Outline	Kontur
 @msg	replace: the object to replace was changed or deleted	erstat: objektet, der skulle erstattes, er ændret eller slettet
 @msg	pattern missing	mønster mangler
 @msg	patterns nested too deeply are filled with mid-grey	mønstre, der er indlejret for dybt, udfyldes med mellemgrå
-@msg	percent must be above 0 and at most 6400, not {p}	procent skal være over 0 og højst 6400, ikke {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent skal være over 0 og højst 6400, ikke {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	vælg en farve, en gradient eller et mønster, der skal gemmes som en farveprøve
-@msg	plane must be left, right or ground	planet skal være venstre, højre eller grund
+@msg	plane must be left, right or ground	plane skal være left, right eller ground
 @msg	plug-in ABI: {0}	plug-in-ABI: {0}
 @msg	plug-in exceeded its {0}	plug-in'et overskred sin {0}
 @msg	plug-in failed: {0}	plug-in fejlede: {0}
@@ -4413,8 +4422,8 @@ imageTrace	Outline	Kontur
 @msg	result would exceed the canvas (coordinates out of range)	resultatet ville gå ud over lærredet (koordinater uden for intervallet)
 @msg	objects can't be nested more than 32 deep	objekter kan ikke indlejres mere end 32 niveauer dybt
 @msg	the SVG's elements are nested more than {0} deep	SVG'ens elementer er indlejret mere end {0} niveauer dybt
-@msg	scale must be a number from {_1} to {_2}, not {_3}	skalaen skal være et tal fra {_1} til {_2}, ikke {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	skalaen skal være et tal fra {_1} til {_2}, ikke {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale skal være et tal fra {_1} til {_2}, ikke {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale skal være et tal fra {_1} til {_2}, ikke {s}
 @msg	select (or target) objects whose appearance isn't basic	markér (eller målret) objekter, hvis udseende ikke er grundlæggende
 @msg	select a Live Paint group	markér en Live Paint-gruppe
 @msg	select a blend	markér en blanding
@@ -4722,7 +4731,7 @@ imageTrace	Outline	Kontur
 @msg	before must name a panel	before skal angive et panel
 @msg	docking action contains an unknown panel or an excessive split path	dokningshandlingen indeholder et ukendt panel eller en overdreven opdelingssti
 @msg	group must be true or false	group skal være true eller false
-@msg	panel is not in a dock group	panelet er ikke i en dockgruppe
+@msg	panel is not in a dock group	panel er ikke i en dockgruppe
 @msg	only a dock group above or below others collapses, not one beside another	kun en dockgruppe over eller under andre kan skjules, ikke en ved siden af en anden
 @msg	icon must be true or false	icon skal være true eller false
 @msg	icon only docks a panel in the icon column, with no anchor	icon docker kun et panel i ikonkolonnen, uden anchor
@@ -6243,6 +6252,7 @@ breakText	Glyphs	Glyffer
 	Reset Symbol Instance	Nulstil symbolforekomst
 @msg	type must be static or dynamic, not {v}	type skal være static eller dynamic, ikke {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` er et statisk symbol: indstil først symboltypen til Dynamisk
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	For en kurve, sammensat kurve eller tekst, der er markeret i en symbolforekomst, kan kun ensfarvet fyld og streg ændres
 @msg	path must be a list of child indices	path skal være en liste over underordnede indekser
 @msg	no object at path {shown} in the symbol's art	intet objekt ved stien {shown} i symbolets grafik
 @msg	give fill, stroke, opacity and/or blend	angiv fill, stroke, opacity og/eller blend
@@ -6340,3 +6350,24 @@ breakText	Glyphs	Glyffer
 # 3D Box add-on
 	3D Box	3D-boks
 	3D Box Tool	3D-boksværktøj
+
+# Safe Mode
+	Safe Mode…	Sikker tilstand…
+	Safe Mode	Sikker tilstand
+	Help › Safe Mode…	Hjælp › Sikker tilstand…
+	Enable on Re-launch	Aktivér ved næste start
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Sidste start af VectorCraft stoppede, mens plug-in'et {name} blev indlæst. Det er måske ikke årsagen.
+	Disable and Continue	Deaktiver og fortsæt
+	Start Normally	Start normalt
+	Start in Safe Mode	Start i sikker tilstand
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft er i sikker tilstand: ingen plug-ins indlæses eller køres, før programmet startes normalt.
+	Disabled plug-ins	Deaktiverede plug-ins
+	No plug-ins are disabled.	Ingen plug-ins er deaktiveret.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Sikker tilstand er slået til: plug-ins indlæses og køres ikke, før VectorCraft startes normalt
+@msg	give `id` or `file` (see plugin.safeMode)	angiv `id` eller `file` (se plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	det plug-in er ikke deaktiveret (se plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	De deaktiverede plug-ins kunne ikke gemmes til næste start
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Udvid udseende: en plug-in-effekt i markeringen kan ikke udvides i sikker tilstand
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Juster efter pixelgitter
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index afadc6136..9f5367700 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -1057,6 +1057,14 @@ font-technology	Variable	Variabel
 	Export As SVG…	Als SVG exportieren…
 	Export Asset	Asset exportieren
 	Export Assets	Assets exportieren
+	Export 3D Object	3D-Objekt exportieren
+	3D Export Format	3D-Exportformat
+	Export 3D Assets	3D-Assets exportieren
+@msg	{what} can't be exported in 3D: {e}	{what} kann nicht als 3D exportiert werden: {e}
+@msg	asset {id} isn't a 3D asset	Asset {id} ist kein 3D-Asset
+@msg	asset {id} is a 3D asset: assets.export3D writes it	Asset {id} ist ein 3D-Asset: assets.export3D schreibt es
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	noch keine 3D-Assets: Sammeln Sie zuerst ein Objekt mit 3D-Effekt (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	wählen Sie ein Objekt mit 3D-Effekt aus (oder geben Sie seine IDs an)
 	Export As…	Exportieren als…
 	Export CSS	CSS exportieren
 	Export CSS…	CSS exportieren…
@@ -1714,6 +1722,7 @@ file-filter	Templates	Vorlagen
 	Line {line}	Zeile {line}
 	Line {line}: {name}: {status}	Zeile {line}: {name}: {status}
 	Imported. Press OK to keep the imported set.	Importiert. Klicken Sie auf „OK“, um den importierten Satz zu behalten.
+	Read Action Set File	Aktionssatzdatei lesen
 	Read Shortcut Set File	Tastaturbefehlssatz-Datei lesen
 	Import Matches	Import-Zuordnungen
 	Remember Import Matches	Import-Zuordnungen merken
@@ -3894,7 +3903,7 @@ theme	Appearance	Erscheinungsbild
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
 @msg	no library `{id}`	keine Bibliothek `{id}`
 @msg	select some type first	wählen Sie zuerst Text aus
-@msg	kerning must be a number, "auto", or "optical"	Kerning muss eine Zahl, „auto“ oder „optical“ sein
+@msg	kerning must be a number, "auto", or "optical"	kerning muss eine Zahl, „auto“ oder „optical“ sein
 @msg	the selection has no gradient fill	die Auswahl hat keinen Flächenverlauf
 @msg	the selection has no gradient stroke	die Auswahl hat keinen Konturverlauf
 @msg	the selection has no pattern fill	die Auswahl hat kein Flächenmuster
@@ -4274,6 +4283,8 @@ theme	Appearance	Erscheinungsbild
 @msg	no such action set	kein solcher Aktionssatz
 @msg	the action sets changed; nothing was deleted	die Aktionssätze haben sich geändert; nichts wurde gelöscht
 @msg	no action set to save	kein Aktionssatz zum Speichern
+@msg	the action set file can't be read in full	die Aktionssatzdatei kann nicht vollständig gelesen werden
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	„{name}“ geladen: {n} Schritt wurde ausgelassen|„{name}“ geladen: {n} Schritte wurden ausgelassen
 @msg	not an action set file	keine Aktionssatzdatei
 @msg	the action set file is larger than 8 MiB	die Aktionssatzdatei ist größer als 8 MiB
 @msg	the action set file holds more than 1,000 actions	die Aktionssatzdatei enthält mehr als 1.000 Aktionen
@@ -4771,6 +4782,9 @@ theme	Appearance	Erscheinungsbild
 @plural	{n} linked image changed on disk. Show the new version?|{n} linked images changed on disk. Show the new versions?	{n} verknüpftes Bild wurde auf dem Datenträger geändert. Neue Version anzeigen?|{n} verknüpfte Bilder wurden auf dem Datenträger geändert. Neue Versionen anzeigen?
 # Window: the system's title bar (Windows, Linux).
 	System Title Bar	Systemtitelleiste
+	VectorCraft Title Bar on Every Desktop	VectorCraft-Titelleiste auf jedem Desktop
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Solange die Umgebungsvariable VECTORCRAFT_TITLEBAR gesetzt ist, bestimmt sie die Titelleiste.
+	System Title Bar takes precedence over this option while it is on.	Solange Systemtitelleiste eingeschaltet ist, hat sie Vorrang vor dieser Option.
 # Brush Options: Scatter, Art and Pattern brushes.
 	Scatter Brush Options	Optionen für Spezialpinsel
 	Art Brush Options	Optionen für Bildpinsel
@@ -4915,12 +4929,12 @@ theme	Appearance	Erscheinungsbild
 	Resize panel window	Bedienfeldfenster skalieren
 	Resize panels	Bedienfelder skalieren
 @msg	Invalid panel layout; restored the default dock	Ungültige Bedienfeldanordnung; Standarddock wiederhergestellt
-@msg	action is required	Eine Aktion ist erforderlich
-@msg	anchor must name a registered panel	Der Anker muss ein registriertes Bedienfeld benennen
+@msg	action is required	action ist erforderlich
+@msg	anchor must name a registered panel	anchor muss ein registriertes Bedienfeld benennen
 @msg	before must name a panel	before muss ein Bedienfeld benennen
 @msg	docking action contains an unknown panel or an excessive split path	Die Docking-Aktion enthält ein unbekanntes Bedienfeld oder einen zu langen Teilungspfad
 @msg	group must be true or false	group muss true oder false sein
-@msg	panel is not in a dock group	Bedienfeld ist in keiner Dock-Gruppe
+@msg	panel is not in a dock group	panel ist in keiner Dock-Gruppe
 @msg	only a dock group above or below others collapses, not one beside another	nur eine Dock-Gruppe über oder unter anderen lässt sich minimieren, nicht eine daneben
 @msg	icon must be true or false	icon muss true oder false sein
 @msg	icon only docks a panel in the icon column, with no anchor	icon dockt ein Bedienfeld nur in der Symbolspalte an, ohne anchor
@@ -5994,6 +6008,7 @@ breakText	Glyphs	Glyphen
 	Reset Symbol Instance	Symbolinstanz zurücksetzen
 @msg	type must be static or dynamic, not {v}	type muss static oder dynamic sein, nicht {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` ist ein statisches Symbol: Stellen Sie zuerst den Symboltyp auf „Dynamisch“ ein
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Bei einem in einer Symbolinstanz ausgewählten Pfad, zusammengesetzten Pfad oder Text lässt sich nur die Vollfarbe von Fläche und Kontur ändern
 @msg	path must be a list of child indices	path muss eine Liste von Kindindizes sein
 @msg	no object at path {shown} in the symbol's art	kein Objekt am Pfad {shown} in der Grafik des Symbols
 @msg	give fill, stroke, opacity and/or blend	geben Sie fill, stroke, opacity und/oder blend an
@@ -6091,3 +6106,25 @@ breakText	Glyphs	Glyphen
 # 3D Box add-on
 	3D Box	3D-Quader
 	3D Box Tool	3D-Quader-Werkzeug
+
+# Safe Mode
+	Safe Mode…	Abgesicherter Modus…
+	Safe Mode	Abgesicherter Modus
+	Help › Safe Mode…	Hilfe › Abgesicherter Modus…
+	Enable on Re-launch	Beim nächsten Start aktivieren
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Der letzte Start von VectorCraft wurde beendet, während das Plug-in {name} geladen wurde. Es ist möglicherweise nicht die Ursache.
+	Disable and Continue	Deaktivieren und fortfahren
+	Start Normally	Normal starten
+	Start in Safe Mode	Im abgesicherten Modus starten
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft läuft im abgesicherten Modus: Plug-ins werden weder geladen noch ausgeführt, bis VectorCraft normal startet.
+	Disabled plug-ins	Deaktivierte Plug-ins
+	No plug-ins are disabled.	Keine Plug-ins sind deaktiviert.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Der abgesicherte Modus ist aktiv: Plug-ins werden weder geladen noch ausgeführt, bis VectorCraft normal startet
+@msg	give `id` or `file` (see plugin.safeMode)	`id` oder `file` angeben (siehe plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	dieses Plug-in ist nicht deaktiviert (siehe plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Die deaktivierten Plug-ins konnten nicht für den nächsten Start gespeichert werden
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Aussehen umwandeln: Ein Plug-in-Effekt in der Auswahl kann im abgesicherten Modus nicht umgewandelt werden
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Am Pixelraster ausrichten
+@msg	only paths and compound paths can be aligned to the pixel grid	nur Pfade und zusammengesetzte Pfade können am Pixelraster ausgerichtet werden
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index dd0090b5c..f05c3e86c 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -1030,6 +1030,14 @@ font-technology	Variable	Μεταβλητές
 	Export As SVG…	Εξαγωγή ως SVG…
 	Export Asset	Εξαγωγή στοιχείου
 	Export Assets	Εξαγωγή στοιχείων
+	Export 3D Object	Εξαγωγή αντικειμένου 3D
+	3D Export Format	Μορφή εξαγωγής 3D
+	Export 3D Assets	Εξαγωγή στοιχείων 3D
+@msg	{what} can't be exported in 3D: {e}	το {what} δεν μπορεί να εξαχθεί σε 3D: {e}
+@msg	asset {id} isn't a 3D asset	το στοιχείο {id} δεν είναι στοιχείο 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	το στοιχείο {id} είναι στοιχείο 3D: το γράφει η assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	δεν υπάρχουν ακόμη στοιχεία 3D: συγκεντρώστε πρώτα ένα αντικείμενο με εφέ 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	επιλέξτε ένα αντικείμενο με εφέ 3D (ή δώστε τα αναγνωριστικά του)
 	Export As…	Εξαγωγή ως…
 	Export CSS	Εξαγωγή CSS
 	Export CSS…	Εξαγωγή CSS…
@@ -1624,6 +1632,7 @@ font-technology	Variable	Μεταβλητές
 	Report copied	Η αναφορά αντιγράφηκε
 	Line {line}	Γραμμή {line}
 	Line {line}: {name}: {status}	Γραμμή {line}: {name}: {status}
+	Read Action Set File	Ανάγνωση αρχείου συνόλου ενεργειών
 	Read Shortcut Set File	Ανάγνωση αρχείου συνόλου συντομεύσεων
 	Import Matches	Αντιστοιχίσεις εισαγωγής
 	Remember Import Matches	Απομνημόνευση αντιστοιχίσεων εισαγωγής
@@ -2161,7 +2170,7 @@ axis	Both	Και τα δύο
 	Dock Control Bar	Αγκύρωση γραμμής ελέγχου
 @msg	no library `{id}`	Δεν υπάρχει βιβλιοθήκη με αναγνωριστικό `{id}`
 @msg	select some type first	Επιλέξτε πρώτα κάποιο κείμενο
-@msg	kerning must be a number, "auto", or "optical"	Η διαγραμμάτωση πρέπει να είναι αριθμός, «auto» ή «optical»
+@msg	kerning must be a number, "auto", or "optical"	το kerning πρέπει να είναι αριθμός, «auto» ή «optical»
 @msg	the selection has no gradient fill	η επιλογή δεν έχει ντεγκραντέ γεμίσματος
 @msg	the selection has no gradient stroke	η επιλογή δεν έχει ντεγκραντέ περιγράμματος
 @msg	the selection has no pattern fill	η επιλογή δεν έχει μοτίβο γεμίσματος
@@ -4152,7 +4161,7 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art ή type
 @msg	artboard {0} does not exist	ο πίνακας σχεδίασης {0} δεν υπάρχει
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	σε αυτήν την κλίμακα το σχέδιο είναι {w} × {h} pt και υπερβαίνει τον καμβά: επιλέξτε μικρότερη κλίμακα ή προσαρμόστε το στον πίνακα σχεδίασης
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	ο άξονας πρέπει να είναι "vertical", "horizontal" ή γωνία σε μοίρες, όχι `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	το axis πρέπει να είναι "vertical", "horizontal" ή γωνία σε μοίρες, όχι `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	φόντο {other}: transparent, white, black ή χρώμα όπως "#ff8800"
 @msg	bad color {v}	μη έγκυρο χρώμα {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	Το videoRulerPixelAspectRatio πρέπει να είναι αριθμός από 0,1 έως 10
@@ -4161,9 +4170,9 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	bad shortcut	μη έγκυρη συντόμευση
 @msg	bad stream length	μη έγκυρο μήκος ροής
 @msg	bad trailer	μη έγκυρο τελικό τμήμα
-@msg	balance must be between 0 and 100	η ισορροπία πρέπει να είναι μεταξύ 0 και 100
+@msg	balance must be between 0 and 100	το balance πρέπει να είναι μεταξύ 0 και 100
 @msg	batch step {_1} (`{id}`) failed: {e}	απέτυχε το βήμα {_1} της μαζικής επεξεργασίας (`{id}`): {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	η φωτεινότητα πρέπει να είναι dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	το brightness πρέπει να είναι dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	δεν είναι δυνατή η κωδικοποίηση εγγράφου: {0}
 @msg	can't parse shortcut `{c}`	δεν είναι δυνατή η ανάλυση της συντόμευσης `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	δεν είναι δυνατή η ανάλυση της συντόμευσης `{s}` για `{k}`
@@ -4188,7 +4197,7 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	compound paths can only contain paths	οι σύνθετες διαδρομές μπορούν να περιέχουν μόνο διαδρομές
 @msg	compressed (RLE) bitmaps can't be read yet	τα συμπιεσμένα (RLE) bitmap δεν μπορούν ακόμη να διαβαστούν
 @msg	damaged	κατεστραμμένο
-@msg	decimals must be {_1}–{_2} (got {_3})	τα δεκαδικά πρέπει να είναι {_1}–{_2} (δόθηκε {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	το decimals πρέπει να είναι {_1}–{_2} (δόθηκε {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	διαιρέστε σε 1 έως {MAX_PIECES} τομές
 @msg	effect {k} is `{_1}`, not `{id}`	το εφέ {k} είναι `{_1}`, όχι `{id}`
 @msg	empty brush stroke	κενό περίγραμμα πινέλου
@@ -4206,9 +4215,9 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	an image has no pixels and was left out	παραλείφθηκε εικόνα χωρίς εικονοστοιχεία
 @msg	image data `{_1}` is missing	λείπουν τα δεδομένα εικόνας `{_1}`
 @msg	image would be too large; lower the resolution	η εικόνα θα ήταν υπερβολικά μεγάλη· μειώστε την ανάλυση
-@msg	index must be a number or first, previous, next or last	ο δείκτης πρέπει να είναι αριθμός ή first, previous, next ή last
-@msg	index must be a number or first, previous, next or last, not `{other}`	ο δείκτης πρέπει να είναι αριθμός ή first, previous, next ή last, όχι `{other}`
-@msg	index must be ≥ 0	ο δείκτης δεν μπορεί να είναι αρνητικός
+@msg	index must be a number or first, previous, next or last	το index πρέπει να είναι αριθμός ή first, previous, next ή last
+@msg	index must be a number or first, previous, next or last, not `{other}`	το index πρέπει να είναι αριθμός ή first, previous, next ή last, όχι `{other}`
+@msg	index must be ≥ 0	το index πρέπει να είναι ≥ 0
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	η εγκατάσταση από διαδρομή δεν υποστηρίζεται στο web· περάστε το πρόσθετο ως `dataBase64`
 @msg	internal error in `{cmd}`: {msg} (the document was left as it was before; please report this bug)	εσωτερικό σφάλμα στην εντολή `{cmd}`: {msg} (το έγγραφο έμεινε αμετάβλητο· αναφέρετε το σφάλμα)
 @msg	internal error: {msg} (please report this bug)	εσωτερικό σφάλμα: {msg} (αναφέρετε το σφάλμα)
@@ -4221,7 +4230,7 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	its Windows metafile preview was opened instead, which may simplify the art	αντί γι' αυτό ανοίχτηκε η προεπισκόπηση μετααρχείου Windows, η οποία μπορεί να απλοποιεί το σχέδιο
 @msg	its preview was placed instead, at screen resolution	τοποθετήθηκε η προεπισκόπησή του σε ανάλυση οθόνης
 @msg	join needs open paths	η ένωση απαιτεί ανοιχτές διαδρομές
-@msg	lang must be one of {_1}	η γλώσσα πρέπει να είναι μία από τις {_1}
+@msg	lang must be one of {_1}	το lang πρέπει να είναι ένα από τα {_1}
 @msg	layers can't be wrap objects	τα επίπεδα δεν μπορούν να είναι αντικείμενα αναδίπλωσης
 @msg	line {line}: value for `{var}` must be true or false	γραμμή {line}: η τιμή για το `{var}` πρέπει να είναι true ή false
 @msg	line {line}: value for `{var}` is longer than {MAX_GRAPH_CSV} bytes	γραμμή {line}: η τιμή για το `{var}` είναι μεγαλύτερη από {MAX_GRAPH_CSV} byte
@@ -4313,6 +4322,8 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	no such action set	δεν υπάρχει τέτοιο σύνολο ενεργειών
 @msg	the action sets changed; nothing was deleted	τα σύνολα ενεργειών άλλαξαν· δεν διαγράφηκε τίποτα
 @msg	no action set to save	δεν υπάρχει σύνολο ενεργειών για αποθήκευση
+@msg	the action set file can't be read in full	το αρχείο συνόλου ενεργειών δεν μπορεί να διαβαστεί ολόκληρο
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Φορτώθηκε το «{name}»: παραλείφθηκε {n} βήμα|Φορτώθηκε το «{name}»: παραλείφθηκαν {n} βήματα
 @msg	not an action set file	δεν είναι αρχείο συνόλου ενεργειών
 @msg	the action set file is larger than 8 MiB	το αρχείο συνόλου ενεργειών είναι μεγαλύτερο από 8 MiB
 @msg	the action set file holds more than 1,000 actions	το αρχείο συνόλου ενεργειών περιέχει περισσότερες από 1.000 ενέργειες
@@ -4387,9 +4398,9 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	replace: the object to replace was changed or deleted	αντικατάσταση: το αντικείμενο προς αντικατάσταση άλλαξε ή διαγράφηκε
 @msg	pattern missing	λείπει το μοτίβο
 @msg	patterns nested too deeply are filled with mid-grey	τα πολύ βαθιά ένθετα μοτίβα γεμίζονται με μέτριο γκρι
-@msg	percent must be above 0 and at most 6400, not {p}	το ποσοστό πρέπει να είναι μεγαλύτερο από 0 και έως 6400, όχι {p}
+@msg	percent must be above 0 and at most 6400, not {p}	το percent πρέπει να είναι μεγαλύτερο από 0 και έως 6400, όχι {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	επιλέξτε χρώμα, ντεγκραντέ ή μοτίβο για αποθήκευση ως δείγμα
-@msg	plane must be left, right or ground	το επίπεδο πρέπει να είναι left, right ή ground
+@msg	plane must be left, right or ground	το plane πρέπει να είναι left, right ή ground
 @msg	plug-in ABI: {0}	ABI προσθέτου: {0}
 @msg	plug-in exceeded its {0}	το πρόσθετο υπερέβη το όριο {0}
 @msg	plug-in failed: {0}	το πρόσθετο απέτυχε: {0}
@@ -4408,8 +4419,8 @@ digits	Malayalam	Μαλαγιάλαμ
 @msg	result would exceed the canvas (coordinates out of range)	το αποτέλεσμα θα υπερέβαινε τον καμβά (συντεταγμένες εκτός εύρους)
 @msg	objects can't be nested more than 32 deep	τα αντικείμενα δεν μπορούν να έχουν ένθεση μεγαλύτερη των 32 επιπέδων
 @msg	the SVG's elements are nested more than {0} deep	τα στοιχεία SVG έχουν ένθεση μεγαλύτερη των {0} επιπέδων
-@msg	scale must be a number from {_1} to {_2}, not {_3}	η κλίμακα πρέπει να είναι αριθμός από {_1} έως {_2}, όχι {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	η κλίμακα πρέπει να είναι αριθμός από {_1} έως {_2}, όχι {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	το scale πρέπει να είναι αριθμός από {_1} έως {_2}, όχι {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	το scale πρέπει να είναι αριθμός από {_1} έως {_2}, όχι {s}
 @msg	select (or target) objects whose appearance isn't basic	επιλέξτε (ή στοχεύστε) αντικείμενα των οποίων η εμφάνιση δεν είναι βασική
 @msg	select a Live Paint group	επιλέξτε ομάδα δυναμικής βαφής
 @msg	select a blend	επιλέξτε ανάμειξη
@@ -4786,6 +4797,9 @@ digits	Malayalam	Μαλαγιάλαμ
 	RGB:	RGB:
 	CMYK:	CMYK:
 	System Title Bar	Γραμμή τίτλου συστήματος
+	VectorCraft Title Bar on Every Desktop	Γραμμή τίτλου του VectorCraft σε κάθε επιφάνεια εργασίας
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Όσο είναι ορισμένη, η μεταβλητή περιβάλλοντος VECTORCRAFT_TITLEBAR επιλέγει τη γραμμή τίτλου.
+	System Title Bar takes precedence over this option while it is on.	Όσο είναι ενεργή, η Γραμμή τίτλου συστήματος υπερισχύει αυτής της επιλογής.
 	Value Axis	Άξονας τιμών
 	On Left Side	Στην αριστερή πλευρά
 	On Right Side	Στη δεξιά πλευρά
@@ -4798,12 +4812,12 @@ digits	Malayalam	Μαλαγιάλαμ
 	Edit Data Set	Επεξεργασία συνόλου δεδομένων
 	Define a variable first	Ορίστε πρώτα μία μεταβλητή
 @msg	Invalid panel layout; restored the default dock	Μη έγκυρη διάταξη πινάκων· επανήλθε η προεπιλεγμένη περιοχή σύνδεσης
-@msg	action is required	απαιτείται ενέργεια
+@msg	action is required	απαιτείται το action
 @msg	anchor must name a registered panel	το anchor πρέπει να ορίζει καταχωρισμένο πίνακα
 @msg	before must name a panel	το before πρέπει να ορίζει πίνακα
 @msg	docking action contains an unknown panel or an excessive split path	η ενέργεια σύνδεσης περιέχει άγνωστο πίνακα ή υπερβολικά βαθιά διαδρομή διαίρεσης
 @msg	group must be true or false	το group πρέπει να είναι true ή false
-@msg	panel is not in a dock group	Το πάνελ δεν βρίσκεται σε ομάδα αγκύρωσης
+@msg	panel is not in a dock group	το panel δεν βρίσκεται σε ομάδα αγκύρωσης
 @msg	only a dock group above or below others collapses, not one beside another	συμπτύσσεται μόνο ομάδα αγκύρωσης πάνω ή κάτω από άλλες, όχι δίπλα σε άλλη
 @msg	icon must be true or false	το icon πρέπει να είναι true ή false
 @msg	icon only docks a panel in the icon column, with no anchor	το icon αγκυρώνει πάνελ μόνο στη στήλη εικονιδίων, χωρίς anchor
@@ -5260,7 +5274,7 @@ effect	Vertical	Κατακόρυφο
 effect	Points	Σημεία
 	Single Corner Radius	Ακτίνα μίας γωνίας
 	CMYK	CMYK
-@msg	control must be fillStroke, coloring, drawMode or screenMode	Το στοιχείο ελέγχου πρέπει να είναι fillStroke, coloring, drawMode ή screenMode
+@msg	control must be fillStroke, coloring, drawMode or screenMode	το control πρέπει να είναι fillStroke, coloring, drawMode ή screenMode
 	Draw Mode Controls	Στοιχεία ελέγχου λειτουργίας σχεδίασης
 	Hold	Κρατήστε πατημένο
 	Latin	Λατινικά
@@ -6360,6 +6374,7 @@ breakText	Glyphs	Γλύφοι
 	Reset Symbol Instance	Επαναφορά στιγμιότυπου συμβόλου
 @msg	type must be static or dynamic, not {v}	το type πρέπει να είναι static ή dynamic, όχι {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	το `{name}` είναι στατικό σύμβολο: ορίστε πρώτα τον τύπο συμβόλου σε Δυναμικό
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Σε διαδρομή, σύνθετη διαδρομή ή κείμενο που έχει επιλεγεί σε στιγμιότυπο συμβόλου αλλάζει μόνο το συμπαγές χρώμα του γεμίσματος και της πινελιάς
 @msg	path must be a list of child indices	το path πρέπει να είναι λίστα δεικτών θυγατρικών αντικειμένων
 @msg	no object at path {shown} in the symbol's art	δεν υπάρχει αντικείμενο στη διαδρομή {shown} στο γραφικό του συμβόλου
 @msg	give fill, stroke, opacity and/or blend	δώστε fill, stroke, opacity ή/και blend
@@ -6457,3 +6472,25 @@ breakText	Glyphs	Γλύφοι
 # 3D Box add-on
 	3D Box	Κουτί 3D
 	3D Box Tool	Εργαλείο κουτιού 3D
+
+# Safe Mode
+	Safe Mode…	Ασφαλής λειτουργία…
+	Safe Mode	Ασφαλής λειτουργία
+	Help › Safe Mode…	Βοήθεια › Ασφαλής λειτουργία…
+	Enable on Re-launch	Ενεργοποίηση στην επόμενη εκκίνηση
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Η τελευταία εκκίνηση του VectorCraft σταμάτησε ενώ φορτωνόταν το πρόσθετο {name}. Ίσως δεν είναι αυτό η αιτία.
+	Disable and Continue	Απενεργοποίηση και συνέχεια
+	Start Normally	Κανονική εκκίνηση
+	Start in Safe Mode	Εκκίνηση σε ασφαλή λειτουργία
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	Το VectorCraft είναι σε ασφαλή λειτουργία: κανένα πρόσθετο δεν φορτώνεται ούτε εκτελείται μέχρι να ξεκινήσει κανονικά.
+	Disabled plug-ins	Απενεργοποιημένα πρόσθετα
+	No plug-ins are disabled.	Δεν υπάρχουν απενεργοποιημένα πρόσθετα.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Η ασφαλής λειτουργία είναι ενεργή: τα πρόσθετα δεν φορτώνονται ούτε εκτελούνται μέχρι το VectorCraft να ξεκινήσει κανονικά
+@msg	give `id` or `file` (see plugin.safeMode)	δώστε `id` ή `file` (δείτε plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	αυτό το πρόσθετο δεν είναι απενεργοποιημένο (δείτε plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Δεν ήταν δυνατή η αποθήκευση των απενεργοποιημένων πρόσθετων για την επόμενη εκκίνηση
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Επέκταση εμφάνισης: ένα εφέ πρόσθετου στην επιλογή δεν μπορεί να επεκταθεί σε ασφαλή λειτουργία
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Στοίχιση στο πλέγμα εικονοστοιχείων
+@msg	only paths and compound paths can be aligned to the pixel grid	μόνο διαδρομές και σύνθετες διαδρομές μπορούν να στοιχιστούν στο πλέγμα εικονοστοιχείων
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 6e8e73c69..caa7eec7a 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -1086,6 +1086,14 @@ font-technology	Variable	Variables
 	Export As SVG…	Exportar como SVG…
 	Export Asset	Exportar recurso
 	Export Assets	Exportar recursos
+	Export 3D Object	Exportar objeto 3D
+	3D Export Format	Formato de exportación 3D
+	Export 3D Assets	Exportar recursos 3D
+@msg	{what} can't be exported in 3D: {e}	{what} no se puede exportar en 3D: {e}
+@msg	asset {id} isn't a 3D asset	el recurso {id} no es un recurso 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	el recurso {id} es un recurso 3D: lo escribe assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	todavía no hay recursos 3D: reúna primero un objeto con un efecto 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	seleccione un objeto con un efecto 3D (o indique sus id)
 	Export As…	Exportar como…
 	Export CSS	Exportar CSS
 	Export CSS…	Exportar CSS…
@@ -1717,6 +1725,7 @@ font-technology	Variable	Variables
 	Report copied	Informe copiado
 	Line {line}	Línea {line}
 	Line {line}: {name}: {status}	Línea {line}: {name}: {status}
+	Read Action Set File	Leer archivo de conjunto de acciones
 	Read Shortcut Set File	Leer archivo de conjunto de métodos abreviados
 	Import Matches	Asociaciones de importación
 	Remember Import Matches	Recordar asociaciones de importación
@@ -3979,7 +3988,7 @@ axis	Both	Ambos
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
 @msg	no library `{id}`	no hay ninguna biblioteca `{id}`
 @msg	select some type first	selecciona primero algún texto
-@msg	kerning must be a number, "auto", or "optical"	El interletraje debe ser un número, «auto» u «optical»
+@msg	kerning must be a number, "auto", or "optical"	kerning debe ser un número, «auto» u «optical»
 @msg	the selection has no gradient fill	la selección no tiene un degradado de relleno
 @msg	the selection has no gradient stroke	la selección no tiene un degradado de trazo
 @msg	the selection has no pattern fill	la selección no tiene un motivo de relleno
@@ -4206,9 +4215,9 @@ axis	Both	Ambos
 @msg	bad shortcut	atajo no válido
 @msg	bad stream length	longitud de flujo no válida
 @msg	bad trailer	trailer no válido
-@msg	balance must be between 0 and 100	el equilibrio debe estar entre 0 y 100
+@msg	balance must be between 0 and 100	balance debe estar entre 0 y 100
 @msg	batch step {_1} (`{id}`) failed: {e}	falló el paso {_1} del lote (`{id}`): {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	el brillo debe ser dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness debe ser dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	no se puede codificar el documento: {0}
 @msg	can't parse shortcut `{c}`	no se puede interpretar el atajo `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	no se puede interpretar el atajo `{s}` de `{k}`
@@ -4233,7 +4242,7 @@ axis	Both	Ambos
 @msg	compound paths can only contain paths	los trazados compuestos solo pueden contener trazados
 @msg	compressed (RLE) bitmaps can't be read yet	todavía no se pueden leer mapas de bits comprimidos (RLE)
 @msg	damaged	dañado
-@msg	decimals must be {_1}–{_2} (got {_3})	los decimales deben ser {_1}–{_2} (se recibió {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals debe ser {_1}–{_2} (se recibió {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	divide en 1 a {MAX_PIECES} sectores
 @msg	effect {k} is `{_1}`, not `{id}`	el efecto {k} es `{_1}`, no `{id}`
 @msg	empty brush stroke	trazo de pincel vacío
@@ -4358,6 +4367,8 @@ axis	Both	Ambos
 @msg	no such action set	no existe ese conjunto de acciones
 @msg	the action sets changed; nothing was deleted	los conjuntos de acciones han cambiado; no se ha eliminado nada
 @msg	no action set to save	no hay ningún conjunto de acciones que guardar
+@msg	the action set file can't be read in full	el archivo de conjunto de acciones no se puede leer completo
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Se cargó “{name}”: se omitió {n} paso|Se cargó “{name}”: se omitieron {n} pasos
 @msg	not an action set file	no es un archivo de conjunto de acciones
 @msg	the action set file is larger than 8 MiB	el archivo de conjunto de acciones supera los 8 MiB
 @msg	the action set file holds more than 1,000 actions	el archivo de conjunto de acciones contiene más de 1000 acciones
@@ -4432,7 +4443,7 @@ axis	Both	Ambos
 @msg	replace: the object to replace was changed or deleted	replace: se modificó o eliminó el objeto que se iba a reemplazar
 @msg	pattern missing	falta el motivo
 @msg	patterns nested too deeply are filled with mid-grey	los motivos anidados a demasiada profundidad se rellenan de gris medio
-@msg	percent must be above 0 and at most 6400, not {p}	el porcentaje debe ser mayor que 0 y como máximo 6400, no {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent debe ser mayor que 0 y como máximo 6400, no {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	elige un color, degradado o motivo para guardarlo como muestra
 @msg	plane must be left, right or ground	plane debe ser left, right o ground
 @msg	plug-in ABI: {0}	ABI del plugin: {0}
@@ -4453,8 +4464,8 @@ axis	Both	Ambos
 @msg	result would exceed the canvas (coordinates out of range)	el resultado excedería el lienzo (coordenadas fuera de rango)
 @msg	objects can't be nested more than 32 deep	los objetos no pueden anidarse a más de 32 niveles
 @msg	the SVG's elements are nested more than {0} deep	los elementos del SVG están anidados a más de {0} niveles
-@msg	scale must be a number from {_1} to {_2}, not {_3}	la escala debe ser un número de {_1} a {_2}, no {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	la escala debe ser un número de {_1} a {_2}, no {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale debe ser un número de {_1} a {_2}, no {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale debe ser un número de {_1} a {_2}, no {s}
 @msg	select (or target) objects whose appearance isn't basic	selecciona (o apunta a) objetos cuya apariencia no sea básica
 @msg	select a Live Paint group	selecciona un grupo de pintura interactiva
 @msg	select a blend	selecciona una fusión
@@ -4875,6 +4886,9 @@ axis	Both	Ambos
 	Bottom Right	Abajo a la derecha
 	Edge	Borde
 	System Title Bar	Barra de título del sistema
+	VectorCraft Title Bar on Every Desktop	Barra de título de VectorCraft en todos los escritorios
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Mientras está definida, la variable de entorno VECTORCRAFT_TITLEBAR elige la barra de título.
+	System Title Bar takes precedence over this option while it is on.	Mientras está activada, Barra de título del sistema tiene prioridad sobre esta opción.
 	Value Axis	Eje de valores
 	On Left Side	En el lado izquierdo
 	On Right Side	En el lado derecho
@@ -6350,6 +6364,7 @@ breakText	Glyphs	Glifos
 	Reset Symbol Instance	Restablecer instancia de símbolo
 @msg	type must be static or dynamic, not {v}	type debe ser static o dynamic, no {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` es un símbolo estático: primero establezca su tipo de símbolo en Dinámico
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	De un trazado, trazado compuesto o texto seleccionado en una instancia de símbolo solo se puede cambiar el color sólido del relleno y del trazo
 @msg	path must be a list of child indices	path debe ser una lista de índices de hijos
 @msg	no object at path {shown} in the symbol's art	no hay ningún objeto en la ruta {shown} del arte del símbolo
 @msg	give fill, stroke, opacity and/or blend	indique fill, stroke, opacity y/o blend
@@ -6447,3 +6462,25 @@ breakText	Glyphs	Glifos
 # 3D Box add-on
 	3D Box	Caja 3D
 	3D Box Tool	Herramienta Caja 3D
+
+# Safe Mode
+	Safe Mode…	Modo seguro…
+	Safe Mode	Modo seguro
+	Help › Safe Mode…	Ayuda › Modo seguro…
+	Enable on Re-launch	Activar en el próximo inicio
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	El último inicio de VectorCraft se detuvo mientras se cargaba el plugin {name}. Puede que no sea la causa.
+	Disable and Continue	Desactivar y continuar
+	Start Normally	Iniciar normalmente
+	Start in Safe Mode	Iniciar en modo seguro
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft está en modo seguro: ningún plugin se carga ni se ejecuta hasta que se inicie normalmente.
+	Disabled plug-ins	Plugins desactivados
+	No plug-ins are disabled.	No hay plugins desactivados.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	El modo seguro está activado: los plugins no se cargan ni se ejecutan hasta que VectorCraft se inicie normalmente
+@msg	give `id` or `file` (see plugin.safeMode)	indica `id` o `file` (consulta plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	ese plugin no está desactivado (consulta plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	No se pudieron guardar los plugins desactivados para el próximo inicio
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Expandir apariencia: un efecto de plugin de la selección no se puede expandir en modo seguro
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Alinear con cuadrícula de píxeles
+@msg	only paths and compound paths can be aligned to the pixel grid	solo los trazados y los trazados compuestos se pueden alinear con la cuadrícula de píxeles
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index 0574eca90..1e0216c18 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -157,6 +157,7 @@
 	Report copied	Raportti kopioitu
 	Line {line}	Rivi {line}
 	Line {line}: {name}: {status}	Rivi {line}: {name}: {status}
+	Read Action Set File	Lue toimintosarjatiedosto
 	Read Shortcut Set File	Lue pikanäppäinjoukkotiedosto
 	Import Matches	Tuonnin vastaavuudet
 	Remember Import Matches	Muista tuonnin vastaavuudet
@@ -878,6 +879,9 @@
 	Stained Glass…	Lasimaalaus…
 	Texturizer…	Teksturoija…
 	System Title Bar	Järjestelmän otsikkorivi
+	VectorCraft Title Bar on Every Desktop	VectorCraftin otsikkorivi kaikissa työpöytäympäristöissä
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Ympäristömuuttuja VECTORCRAFT_TITLEBAR valitsee otsikkorivin niin kauan kuin se on asetettu.
+	System Title Bar takes precedence over this option while it is on.	Järjestelmän otsikkorivi ohittaa tämän asetuksen niin kauan kuin se on käytössä.
 	Exit	Lopeta
 	Distort	Vääristä
 	Diffuse Glow…	Hajautettu hehku…
@@ -3126,6 +3130,14 @@ theme	Appearance	Ulkoasu
 	Asset Export Settings	Resurssien vientiasetukset
 	Assets	Resurssit
 	Export Assets	Vie resurssit
+	Export 3D Object	Vie 3D-objekti
+	3D Export Format	3D-vientimuoto
+	Export 3D Assets	Vie 3D-resurssit
+@msg	{what} can't be exported in 3D: {e}	kohdetta {what} ei voi viedä 3D-muodossa: {e}
+@msg	asset {id} isn't a 3D asset	resurssi {id} ei ole 3D-resurssi
+@msg	asset {id} is a 3D asset: assets.export3D writes it	resurssi {id} on 3D-resurssi: assets.export3D kirjoittaa sen
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	ei vielä 3D-resursseja: kerää ensin objekti, jossa on 3D-tehoste (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	valitse objekti, jossa on 3D-tehoste (tai anna sen tunnukset)
 	Remove Asset	Poista resurssi
 	Rename Asset	Nimeä resurssi uudelleen
 	Fill Rule	Täyttösääntö
@@ -4202,7 +4214,7 @@ imageTrace	Outline	Ääriviiva
 @plural	{n} stroke|{n} strokes	{n} viiva|{n} viivaa
 @msg	no library `{id}`	ei kirjastoa `{id}`
 @msg	select some type first	valitse ensin tekstiä
-@msg	kerning must be a number, "auto", or "optical"	Parivälistyksen on oltava luku, ”auto” tai ”optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning-arvon on oltava luku, ”auto” tai ”optical”
 @msg	the selection has no gradient fill	valinnalla ei ole liukuväritäyttöä
 @msg	the selection has no gradient stroke	valinnalla ei ole liukuväriviivaa
 @msg	the selection has no pattern fill	valinnalla ei ole kuviotäyttöä
@@ -4412,7 +4424,7 @@ imageTrace	Outline	Ääriviiva
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art tai type
 @msg	artboard {0} does not exist	piirtoalustaa {0} ei ole olemassa
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	tässä mittakaavassa piirustus on {w} × {h} pt, enemmän kuin kankaalle mahtuu: valitse pienempi mittakaava tai sovita se piirtoalustaan
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	akselin on oltava "vertical", "horizontal" tai kulma asteina, ei `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis-arvon on oltava "vertical", "horizontal" tai kulma asteina, ei `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	tausta {other}: transparent, white, black tai väri, kuten "#ff8800"
 @msg	bad color {v}	virheellinen väri {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio on oltava luku väliltä 0,1–10
@@ -4421,9 +4433,9 @@ imageTrace	Outline	Ääriviiva
 @msg	bad shortcut	virheellinen pikanäppäin
 @msg	bad stream length	virheellinen virran pituus
 @msg	bad trailer	virheellinen trailer
-@msg	balance must be between 0 and 100	tasapainon on oltava väliltä 0–100
+@msg	balance must be between 0 and 100	balance-arvon on oltava väliltä 0–100
 @msg	batch step {_1} (`{id}`) failed: {e}	erävaihe {_1} (`{id}`) epäonnistui: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	kirkkauden on oltava dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness-arvon on oltava dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	asiakirjaa ei voi koodata: {0}
 @msg	can't parse shortcut `{c}`	pikanäppäintä `{c}` ei voi jäsentää
 @msg	can't parse shortcut `{s}` for `{k}`	pikanäppäintä `{s}` kohteelle `{k}` ei voi jäsentää
@@ -4448,7 +4460,7 @@ imageTrace	Outline	Ääriviiva
 @msg	compound paths can only contain paths	yhdistelmäpolut voivat sisältää vain polkuja
 @msg	compressed (RLE) bitmaps can't be read yet	pakattuja (RLE) bittikarttoja ei voi vielä lukea
 @msg	damaged	vaurioitunut
-@msg	decimals must be {_1}–{_2} (got {_3})	desimaalien on oltava {_1}–{_2} (saatiin {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals-arvon on oltava {_1}–{_2} (saatiin {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	jaa 1–{MAX_PIECES} viipaleeseen
 @msg	effect {k} is `{_1}`, not `{id}`	tehoste {k} on `{_1}`, ei `{id}`
 @msg	empty brush stroke	tyhjä sivellinviiva
@@ -4466,9 +4478,9 @@ imageTrace	Outline	Ääriviiva
 @msg	an image has no pixels and was left out	kuva, jossa ei ole pikseleitä, jätettiin pois
 @msg	image data `{_1}` is missing	kuvan data `{_1}` puuttuu
 @msg	image would be too large; lower the resolution	kuvasta tulisi liian suuri; pienennä tarkkuutta
-@msg	index must be a number or first, previous, next or last	indeksin on oltava luku tai first, previous, next tai last
-@msg	index must be a number or first, previous, next or last, not `{other}`	indeksin on oltava luku tai first, previous, next tai last, ei `{other}`
-@msg	index must be ≥ 0	indeksi ei voi olla negatiivinen
+@msg	index must be a number or first, previous, next or last	index-arvon on oltava luku tai first, previous, next tai last
+@msg	index must be a number or first, previous, next or last, not `{other}`	index-arvon on oltava luku tai first, previous, next tai last, ei `{other}`
+@msg	index must be ≥ 0	index-arvon on oltava ≥ 0
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	polusta asentaminen ei ole käytettävissä verkossa; välitä moduuli muodossa `dataBase64`
 @msg	internal error in `{cmd}`: {msg} (the document was left as it was before; please report this bug)	sisäinen virhe kohteessa `{cmd}`: {msg} (asiakirja jätettiin ennalleen; ilmoita tästä virheestä)
 @msg	internal error: {msg} (please report this bug)	sisäinen virhe: {msg} (ilmoita tästä virheestä)
@@ -4573,6 +4585,8 @@ imageTrace	Outline	Ääriviiva
 @msg	no such action set	toimintosarjaa ei ole
 @msg	the action sets changed; nothing was deleted	toimintosarjat muuttuivat; mitään ei poistettu
 @msg	no action set to save	ei tallennettavaa toimintosarjaa
+@msg	the action set file can't be read in full	toimintosarjatiedostoa ei voi lukea kokonaan
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Ladattiin ”{name}”: jätettiin pois {n} vaihe|Ladattiin ”{name}”: jätettiin pois {n} vaihetta
 @msg	not an action set file	ei ole toimintosarjatiedosto
 @msg	the action set file is larger than 8 MiB	toimintosarjatiedosto on suurempi kuin 8 MiB
 @msg	the action set file holds more than 1,000 actions	toimintosarjatiedostossa on yli 1 000 toimintoa
@@ -4646,9 +4660,9 @@ imageTrace	Outline	Ääriviiva
 @msg	replace: the object to replace was changed or deleted	replace: korvattavaa objektia on muutettu tai se on poistettu
 @msg	pattern missing	kuvio puuttuu
 @msg	patterns nested too deeply are filled with mid-grey	liian syvälle sisäkkäiset kuviot täytetään keskiharmaalla
-@msg	percent must be above 0 and at most 6400, not {p}	prosenttiarvon on oltava yli 0 ja enintään 6400, ei {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent-arvon on oltava yli 0 ja enintään 6400, ei {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	valitse väri, liukuväri tai kuvio tallennettavaksi värimalliksi
-@msg	plane must be left, right or ground	tason on oltava left, right tai ground
+@msg	plane must be left, right or ground	plane-arvon on oltava left, right tai ground
 @msg	plug-in ABI: {0}	laajennuksen ABI: {0}
 @msg	plug-in exceeded its {0}	laajennus ylitti rajan: {0}
 @msg	plug-in failed: {0}	laajennus epäonnistui: {0}
@@ -4667,8 +4681,8 @@ imageTrace	Outline	Ääriviiva
 @msg	result would exceed the canvas (coordinates out of range)	tulos ylittäisi kankaan (koordinaatit alueen ulkopuolella)
 @msg	objects can't be nested more than 32 deep	objekteja ei voi sisäkkäistää yli 32 tason syvyyteen
 @msg	the SVG's elements are nested more than {0} deep	elementit ovat SVG-tiedostossa sisäkkäin yli {0} tason syvyydessä
-@msg	scale must be a number from {_1} to {_2}, not {_3}	mittakaavan on oltava luku väliltä {_1}–{_2}, ei {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	mittakaavan on oltava luku väliltä {_1}–{_2}, ei {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale-arvon on oltava luku väliltä {_1}–{_2}, ei {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale-arvon on oltava luku väliltä {_1}–{_2}, ei {s}
 @msg	select (or target) objects whose appearance isn't basic	valitse (tai kohdista) objektit, joiden ulkoasu ei ole perusulkoasu
 @msg	select a Live Paint group	valitse elävän maalauksen ryhmä
 @msg	select a blend	valitse sulautus
@@ -5009,7 +5023,7 @@ imageTrace	Outline	Ääriviiva
 @msg	before must name a panel	before-arvon on nimettävä paneeli
 @msg	docking action contains an unknown panel or an excessive split path	telakointitoiminto sisältää tuntemattoman paneelin tai liian pitkän jakopolun
 @msg	group must be true or false	group-arvon on oltava true tai false
-@msg	panel is not in a dock group	paneeli ei ole telakkaryhmässä
+@msg	panel is not in a dock group	panel ei ole telakkaryhmässä
 @msg	only a dock group above or below others collapses, not one beside another	vain muiden ylä- tai alapuolella oleva telakkaryhmä kutistuu, ei toisen vieressä oleva
 @msg	icon must be true or false	icon-arvon on oltava true tai false
 @msg	icon only docks a panel in the icon column, with no anchor	icon telakoi paneelin vain kuvakesarakkeeseen, ilman anchor-arvoa
@@ -6438,6 +6452,7 @@ breakText	Glyphs	Merkit
 	Reset Symbol Instance	Palauta symboli-ilmentymä
 @msg	type must be static or dynamic, not {v}	type-arvon on oltava static tai dynamic, ei {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` on staattinen symboli: aseta ensin sen symbolin tyypiksi Dynaaminen
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Symboli-ilmentymästä valitusta polusta, yhdistelmäpolusta tai tekstistä voi muuttaa vain täytön ja viivan yhtenäistä väriä
 @msg	path must be a list of child indices	path-arvon on oltava luettelo alikohteiden indeksejä
 @msg	no object at path {shown} in the symbol's art	symbolin kuvituksessa ei ole objektia polussa {shown}
 @msg	give fill, stroke, opacity and/or blend	anna fill, stroke, opacity ja/tai blend
@@ -6540,3 +6555,25 @@ breakText	Glyphs	Merkit
 # 3D Box add-on
 	3D Box	3D-laatikko
 	3D Box Tool	3D-laatikkotyökalu
+
+# Safe Mode
+	Safe Mode…	Vikasietotila…
+	Safe Mode	Vikasietotila
+	Help › Safe Mode…	Ohje › Vikasietotila…
+	Enable on Re-launch	Ota käyttöön seuraavassa käynnistyksessä
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	VectorCraftin edellinen käynnistys pysähtyi, kun laajennusta {name} ladattiin. Se ei välttämättä ole syy.
+	Disable and Continue	Poista käytöstä ja jatka
+	Start Normally	Käynnistä normaalisti
+	Start in Safe Mode	Käynnistä vikasietotilassa
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft on vikasietotilassa: laajennuksia ei ladata eikä suoriteta ennen kuin se käynnistetään normaalisti.
+	Disabled plug-ins	Käytöstä poistetut laajennukset
+	No plug-ins are disabled.	Yhtään laajennusta ei ole poistettu käytöstä.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Vikasietotila on käytössä: laajennuksia ei ladata eikä suoriteta ennen kuin VectorCraft käynnistetään normaalisti
+@msg	give `id` or `file` (see plugin.safeMode)	anna `id` tai `file` (ks. plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	laajennusta ei ole poistettu käytöstä (ks. plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Käytöstä poistettuja laajennuksia ei voitu tallentaa seuraavaa käynnistystä varten
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Laajenna ulkoasu: valinnan laajennustehostetta ei voi laajentaa vikasietotilassa
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Tasaa pikseliruudukkoon
+@msg	only paths and compound paths can be aligned to the pixel grid	vain polut ja yhdistelmäpolut voi tasata pikseliruudukkoon
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index f31dcd9cf..1f0d04de2 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -1081,6 +1081,14 @@ font-technology	Variable	Variables
 	Export As SVG…	Exporter au format SVG…
 	Export Asset	Exporter la ressource
 	Export Assets	Exporter les ressources
+	Export 3D Object	Exporter l’objet 3D
+	3D Export Format	Format d’exportation 3D
+	Export 3D Assets	Exporter les ressources 3D
+@msg	{what} can't be exported in 3D: {e}	impossible d’exporter {what} en 3D : {e}
+@msg	asset {id} isn't a 3D asset	la ressource {id} n’est pas une ressource 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	la ressource {id} est une ressource 3D : assets.export3D l’écrit
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	aucune ressource 3D pour l’instant : rassemblez d’abord un objet doté d’un effet 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	sélectionnez un objet doté d’un effet 3D (ou indiquez ses identifiants)
 	Export As…	Exporter sous…
 	Export CSS	Exporter le CSS
 	Export CSS…	Exporter le CSS…
@@ -1711,6 +1719,7 @@ font-technology	Variable	Variables
 	Report copied	Rapport copié
 	Line {line}	Ligne {line}
 	Line {line}: {name}: {status}	Ligne {line}, {name}, {status}
+	Read Action Set File	Lire un fichier de jeu de scripts
 	Read Shortcut Set File	Lire un fichier de jeu de raccourcis
 	Import Matches	Correspondances d’importation
 	Remember Import Matches	Mémoriser les correspondances d’importation
@@ -3969,7 +3978,7 @@ axis	Both	Les deux
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
 @msg	no library `{id}`	aucune bibliothèque `{id}`
 @msg	select some type first	sélectionnez d’abord du texte
-@msg	kerning must be a number, "auto", or "optical"	Le crénage doit être un nombre, « auto » ou « optical »
+@msg	kerning must be a number, "auto", or "optical"	kerning doit être un nombre, « auto » ou « optical »
 @msg	the selection has no gradient fill	la sélection n’a pas de dégradé de fond
 @msg	the selection has no gradient stroke	la sélection n’a pas de dégradé de contour
 @msg	the selection has no pattern fill	la sélection n’a pas de motif de fond
@@ -4196,9 +4205,9 @@ axis	Both	Les deux
 @msg	bad shortcut	raccourci non valide
 @msg	bad stream length	longueur de flux non valide
 @msg	bad trailer	trailer non valide
-@msg	balance must be between 0 and 100	l’équilibre doit être compris entre 0 et 100
+@msg	balance must be between 0 and 100	balance doit être compris entre 0 et 100
 @msg	batch step {_1} (`{id}`) failed: {e}	l’étape {_1} du lot (`{id}`) a échoué : {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	la luminosité doit valoir dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness doit valoir dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	impossible d’encoder le document : {0}
 @msg	can't parse shortcut `{c}`	impossible d’interpréter le raccourci `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	impossible d’interpréter le raccourci `{s}` pour `{k}`
@@ -4223,7 +4232,7 @@ axis	Both	Les deux
 @msg	compound paths can only contain paths	les tracés transparents ne peuvent contenir que des tracés
 @msg	compressed (RLE) bitmaps can't be read yet	les images bitmap compressées (RLE) ne peuvent pas encore être lues
 @msg	damaged	endommagé
-@msg	decimals must be {_1}–{_2} (got {_3})	le nombre de décimales doit être compris entre {_1} et {_2} (reçu : {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals doit être compris entre {_1} et {_2} (reçu : {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	divisez en 1 à {MAX_PIECES} tranches
 @msg	effect {k} is `{_1}`, not `{id}`	l’effet {k} est `{_1}`, pas `{id}`
 @msg	empty brush stroke	tracé de forme vide
@@ -4348,6 +4357,8 @@ axis	Both	Les deux
 @msg	no such action set	jeu de scripts inexistant
 @msg	the action sets changed; nothing was deleted	les jeux de scripts ont changé ; rien n’a été supprimé
 @msg	no action set to save	aucun jeu de scripts à enregistrer
+@msg	the action set file can't be read in full	le fichier de jeu de scripts ne peut pas être lu en entier
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	« {name} » chargé : {n} étape a été ignorée|« {name} » chargé : {n} étapes ont été ignorées
 @msg	not an action set file	ce n’est pas un fichier de jeu de scripts
 @msg	the action set file is larger than 8 MiB	le fichier de jeu de scripts dépasse 8 Mio
 @msg	the action set file holds more than 1,000 actions	le fichier de jeu de scripts contient plus de 1 000 scripts
@@ -4422,7 +4433,7 @@ axis	Both	Les deux
 @msg	replace: the object to replace was changed or deleted	replace : l’objet à remplacer a été modifié ou supprimé
 @msg	pattern missing	motif manquant
 @msg	patterns nested too deeply are filled with mid-grey	les motifs imbriqués trop profondément sont remplis de gris moyen
-@msg	percent must be above 0 and at most 6400, not {p}	le pourcentage doit être supérieur à 0 et au plus égal à 6400, pas {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent doit être supérieur à 0 et au plus égal à 6400, pas {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	choisissez une couleur, un dégradé ou un motif à enregistrer comme nuance
 @msg	plane must be left, right or ground	plane doit valoir left, right ou ground
 @msg	plug-in ABI: {0}	ABI du plug-in : {0}
@@ -4443,8 +4454,8 @@ axis	Both	Les deux
 @msg	result would exceed the canvas (coordinates out of range)	le résultat dépasserait la zone de travail (coordonnées hors limites)
 @msg	objects can't be nested more than 32 deep	les objets ne peuvent pas être imbriqués sur plus de 32 niveaux
 @msg	the SVG's elements are nested more than {0} deep	les éléments du SVG sont imbriqués sur plus de {0} niveaux
-@msg	scale must be a number from {_1} to {_2}, not {_3}	l’échelle doit être un nombre compris entre {_1} et {_2}, pas {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	l’échelle doit être un nombre compris entre {_1} et {_2}, pas {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale doit être un nombre compris entre {_1} et {_2}, pas {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale doit être un nombre compris entre {_1} et {_2}, pas {s}
 @msg	select (or target) objects whose appearance isn't basic	sélectionnez (ou ciblez) des objets dont l’aspect n’est pas basique
 @msg	select a Live Paint group	sélectionnez un groupe de peinture dynamique
 @msg	select a blend	sélectionnez un dégradé de formes
@@ -4884,6 +4895,9 @@ axis	Both	Les deux
 effect	Soft	Doux
 	Edge	Bord
 	System Title Bar	Barre de titre du système
+	VectorCraft Title Bar on Every Desktop	Barre de titre de VectorCraft sur tous les bureaux
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Tant qu’elle est définie, la variable d’environnement VECTORCRAFT_TITLEBAR choisit la barre de titre.
+	System Title Bar takes precedence over this option while it is on.	Tant qu’elle est activée, Barre de titre du système a priorité sur cette option.
 	Value Axis	Axe des valeurs
 	On Left Side	À gauche
 	On Right Side	À droite
@@ -4930,7 +4944,7 @@ effect	Soft	Doux
 @msg	before must name a panel	before doit désigner un panneau
 @msg	docking action contains an unknown panel or an excessive split path	L’action d’ancrage contient un panneau inconnu ou un chemin de divisions trop long
 @msg	group must be true or false	group doit être true ou false
-@msg	panel is not in a dock group	le panneau n’est dans aucun groupe du dock
+@msg	panel is not in a dock group	panel n’est dans aucun groupe du dock
 @msg	only a dock group above or below others collapses, not one beside another	seul un groupe du dock situé au-dessus ou au-dessous d’autres se réduit, pas un groupe à côté
 @msg	icon must be true or false	icon doit être true ou false
 @msg	icon only docks a panel in the icon column, with no anchor	icon ne fait qu’ancrer un panneau dans la colonne d’icônes, sans anchor
@@ -6403,6 +6417,7 @@ breakText	Glyphs	Glyphes
 	Reset Symbol Instance	Réinitialiser l'instance de symbole
 @msg	type must be static or dynamic, not {v}	type doit être static ou dynamic, et non {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` est un symbole statique : définissez d'abord son type de symbole sur Dynamique
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Seules les couleurs unies du fond et du contour d'un tracé, d'un tracé transparent ou d'un texte sélectionné dans une instance de symbole peuvent changer
 @msg	path must be a list of child indices	path doit être une liste d'indices d'enfants
 @msg	no object at path {shown} in the symbol's art	aucun objet au chemin {shown} dans l'illustration du symbole
 @msg	give fill, stroke, opacity and/or blend	indiquez fill, stroke, opacity et/ou blend
@@ -6500,3 +6515,25 @@ breakText	Glyphs	Glyphes
 # 3D Box add-on
 	3D Box	Boîte 3D
 	3D Box Tool	Outil Boîte 3D
+
+# Safe Mode
+	Safe Mode…	Mode sans échec…
+	Safe Mode	Mode sans échec
+	Help › Safe Mode…	Aide › Mode sans échec…
+	Enable on Re-launch	Activer au prochain lancement
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Le dernier lancement de VectorCraft s’est arrêté pendant le chargement du module externe {name}. Ce module n’en est peut-être pas la cause.
+	Disable and Continue	Désactiver et continuer
+	Start Normally	Démarrer normalement
+	Start in Safe Mode	Démarrer en mode sans échec
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft est en mode sans échec : aucun module externe n’est chargé ni exécuté avant un démarrage normal.
+	Disabled plug-ins	Modules externes désactivés
+	No plug-ins are disabled.	Aucun module externe n’est désactivé.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Le mode sans échec est activé : les modules externes ne sont ni chargés ni exécutés avant que VectorCraft démarre normalement
+@msg	give `id` or `file` (see plugin.safeMode)	indiquez `id` ou `file` (voir plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	ce module externe n’est pas désactivé (voir plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Impossible d’enregistrer les modules externes désactivés pour le prochain lancement
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Décomposer l’aspect : un effet de module externe de la sélection ne peut pas être décomposé en mode sans échec
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Aligner sur la grille de pixels
+@msg	only paths and compound paths can be aligned to the pixel grid	seuls les tracés et les tracés transparents peuvent être alignés sur la grille de pixels
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index d63c6c3b6..512de7564 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -1629,6 +1629,14 @@
 	Export As…	इस रूप में एक्सपोर्ट करें…
 	Export Asset	संपत्ति निर्यात करें
 	Export Assets	निर्यात परिसंपत्तियां
+	Export 3D Object	3D ऑब्जेक्ट निर्यात करें
+	3D Export Format	3D निर्यात फ़ॉर्मेट
+	Export 3D Assets	3D परिसंपत्तियां निर्यात करें
+@msg	{what} can't be exported in 3D: {e}	{what} को 3D में निर्यात नहीं किया जा सकता: {e}
+@msg	asset {id} isn't a 3D asset	परिसंपत्ति {id} 3D परिसंपत्ति नहीं है
+@msg	asset {id} is a 3D asset: assets.export3D writes it	परिसंपत्ति {id} एक 3D परिसंपत्ति है: इसे assets.export3D लिखता है
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	अभी तक कोई 3D परिसंपत्ति नहीं: पहले 3D प्रभाव वाला ऑब्जेक्ट इकट्ठा करें (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	3D प्रभाव वाला ऑब्जेक्ट चुनें (या उसकी आईडी दें)
 	Export CSS	CSS निर्यात करें
 	Export CSS…	CSS निर्यात करें…
 	Export Data Sets…	डेटा सेट निर्यात करें…
@@ -3509,6 +3517,7 @@
 	Rating:	रेटिंग:
 	Ratio	अनुपात
 	Rays	रे
+	Read Action Set File	एक्शन सेट फ़ाइल पढ़ें
 	Read Shortcut Set File	शॉर्टकट सेट फ़ाइल पढ़ें
 	Reads or sets environment variables	पर्यावरण चर पढ़ता है या सेट करता है
 	Ready	तैयार
@@ -4658,6 +4667,9 @@
 	System	सिस्टम
 	System Layout	सिस्टम लेआउट
 	System Title Bar	सिस्टम टाइटल बार
+	VectorCraft Title Bar on Every Desktop	हर डेस्कटॉप पर VectorCraft टाइटल बार
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	जब तक एनवायरनमेंट वेरिएबल VECTORCRAFT_TITLEBAR सेट है, टाइटल बार वही चुनता है।
+	System Title Bar takes precedence over this option while it is on.	जब तक सिस्टम टाइटल बार चालू है, उसे इस विकल्प पर प्राथमिकता मिलती है।
 	Tab	Tab
 	Tab Stops	टैब स्टॉप्स
 	Table	तालिका
@@ -5313,7 +5325,7 @@
 @msg	{k} must be a number or "auto"	{k} एक नंबर या "auto" होना चाहिए।
 @msg	{k} must be a string	{k} एक स्ट्रिंग होना चाहिए
 @msg	{k} must be text	{k} को टेक्स्ट होना चाहिए
-@msg	{k} must be true or false	{k} को सच या झूठा होना चाहिए
+@msg	{k} must be true or false	{k} को true या false होना चाहिए
 @msg	{k}: can't read `{s}` as a length	{k}: `{s}` को लंबाई के रूप में नहीं पढ़ा जा सकता
 @msg	{key} must be [x, y] with finite coordinates	{key} को [x, y] होना चाहिए, जिसमें परिमित निर्देशांक होंगे।
 @msg	{key} must be [x,y]	{key} होना चाहिए [x,y]]
@@ -5400,7 +5412,7 @@
 @msg	`{id}` isn't a loaded library	`{id}` एक लोड लाइब्रेरी नहीं है
 @msg	`{k}.family` is required	`{k}.family` की आवश्यकता है
 @msg	`{k}` is a number 0..1	`{k}` एक नंबर 0..1 है।
-@msg	`{k}` is true or false	`{k}` सही या झूठ है
+@msg	`{k}` is true or false	`{k}` true या false है
 @msg	`{k}` isn't an export setting: {_1}	`{k}` एक निर्यात सेटिंग नहीं है: {_1}
 @msg	`{k}` must be [x, y]	`{k}` होना चाहिए [x, y]
 @msg	`{k}` must be {what}	`{k}` होना चाहिए {what}
@@ -5444,7 +5456,7 @@
 @msg	`{key}` must be from {lo} to {hi}	`{key}` को {lo} से {hi} होना चाहिए।
 @msg	`{key}` must be from 0 to 180 degrees, not {a}	`{key}` 0 से 180 डिग्री तक होना चाहिए, नहीं {a}
 @msg	`{key}` must be one of {_1}	`{key}` को {_1} में से एक होना चाहिए
-@msg	`{key}` must be true or false	`{key}` को सच या झूठ होना चाहिए
+@msg	`{key}` must be true or false	`{key}` को true या false होना चाहिए
 @msg	`{key}`: not a colour: {v}	`{key}`: कोई रंग नहीं: {v}
 @msg	`{l}` isn't a global or spot colour	`{l}` एक वैश्विक या स्पॉट रंग नहीं है
 @msg	`{m}` isn't a bitmap: use clipboard.importSvg, importPdf or importText	`{m}` एक बिटमैप नहीं है: clipboard.importSvg, importPdf या importText का उपयोग करें
@@ -5475,6 +5487,7 @@
 @msg	`{name}` is a built-in workspace; choose another name	`{name}` एक अंतर्निहित वर्कस्पेस है; एक और नाम चुनें
 @msg	`{name}` is a process colour: tints apply to global and spot colours	`{name}` एक प्रक्रिया रंग है: टिंट वैश्विक और स्पॉट रंगों पर लागू होते हैं
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` एक स्थिर सिंबल है: अपने सिंबल प्रकार को पहले गतिशील करने के लिए सेट करें
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	सिंबल इंस्टेंस में चुने गए पाथ, कंपाउंड पाथ या टाइप का केवल ठोस रंग वाला फ़िल और स्ट्रोक बदला जा सकता है
 @msg	`{name}` is a tint of `{base}`: edit `{base}` (a tint swatch only takes a new name)	`{name}` `{base}` का एक टिंट है: `{base}` संपादित करें (केवल एक टिंट swatch केवल एक नया नाम लेता है)
 @msg	`{name}` is a working space: choose another with edit.colorSettings first	`{name}` वर्किंग स्पेस है: पहले edit.colorSettings से दूसरा चुनें
 @msg	`{name}` is built in and stays	`{name}` बनाया गया है और रहता है
@@ -5551,18 +5564,18 @@
 @msg	`diameter` must be from 0.1 to 2500 pt	`diameter` को 0.1 से 2500 pt होना चाहिए
 @msg	`diameter` must be from 0.25 to 200 pt	`diameter` को 0.25 से 200 pt होना चाहिए
 @msg	`digits` must be one of {_1}	`digits` को {_1} में से एक होना चाहिए
-@msg	`dimImages` is a percentage or false	`dimImages` एक प्रतिशत या झूठी है
+@msg	`dimImages` is a percentage or false	`dimImages` एक प्रतिशत या false है
 @msg	`direction` must be "auto", "leftToRight" or "rightToLeft"	`direction` को "auto", "leftToRight" या "rightToLeft" होना चाहिए
 @msg	`dither` applies to gradient fills (paint.setFill)	`dither` gradient fills (paint.setFill) पर लागू होता है
-@msg	`dither` applies to gradient fills (stroke: false)	`dither` gradient fills (स्ट्रोक: झूठी) पर लागू होता है
-@msg	`dither` must be true or false	`dither` को सच या झूठा होना चाहिए
+@msg	`dither` applies to gradient fills (stroke: false)	`dither` ग्रेडिएंट फ़िल (stroke: false) पर लागू होता है
+@msg	`dither` must be true or false	`dither` को true या false होना चाहिए
 @msg	`documentData` is {size} bytes (limit {MAX_DOCUMENT_DATA})	`documentData` {size} bytes (limit {MAX_DOCUMENT_DATA}) है।
 @msg	`each` is the value one design stands for, more than 0	`each` एक डिज़ाइन का मान है, जो 0 से अधिक होना चाहिए
 @msg	`end` must be "start" or "end"	`end` को "start" या "end" होना चाहिए।
 @msg	`ends` applies to joining exactly two paths	`ends` वास्तव में दो पाथ में शामिल होने के लिए लागू होता है
 @msg	`event` must be one of {_1}	`event` is one of the {_1}
 @msg	`every` must be "all", "odd" or "even", not {v}	`every` होना चाहिए "all", "odd" या "even", नहीं {v}
-@msg	`expand` must be true or false	`expand` को सच या झूठ होना चाहिए
+@msg	`expand` must be true or false	`expand` को true या false होना चाहिए
 @msg	`exportPreset` is the name of a preset of document.exportPresets.list	`exportPreset`, document.exportPresets.list के किसी प्रीसेट का नाम है
 @msg	`files` must be 1 to 1000 paths of font files the last text.findFontFiles search found	`files` में पिछली text.findFontFiles सर्च में मिली फ़ॉन्ट फ़ाइलों के 1 से 1000 पाथ होने चाहिए
 @msg	`folder` must be an absolute folder path	`folder` एक पूर्ण फ़ोल्डर पाथ होना चाहिए
@@ -5620,11 +5633,11 @@
 @msg	`kinsoku` must be "none", "hard" or "soft"	`kinsoku` "none", "hard" या "soft" होना चाहिए।
 @msg	`label` must be a non-empty name of at most 200 characters	`label` को 200 वर्णों में से एक गैर-खाली नाम होना चाहिए
 @msg	`language` must be a language name or tag, such as "Turkish" or "tr"	`language` एक भाषा का नाम या टैग होना चाहिए, जैसे "Turkish" या "tr"
-@msg	`leading` must be from 0.1 to 5000, or null for Auto	`leading` को 0.1 से 5000 तक होना चाहिए, या ऑटो के लिए शून्य होना चाहिए
+@msg	`leading` must be from 0.1 to 5000, or null for Auto	`leading` को 0.1 से 5000 तक होना चाहिए, या ऑटो के लिए null होना चाहिए
 @msg	`leadingModel` must be "romanBaseline" or "emBoxTop"	`leadingModel` को "romanBaseline" या "emBoxTop" होना चाहिए
 @msg	`length` must be a number of at most 1000000 pt either way	`length` को 1000000 pt में से एक होना चाहिए।
 @msg	`library` is a library id or name (see {list})	`library` एक लाइब्रेरी आईडी या नाम है ( {list} देखें)
-@msg	`line` must be true or false	`line` को सही या झूठा होना चाहिए
+@msg	`line` must be true or false	`line` को true या false होना चाहिए
 @msg	`method` must be classic or perceptual	`method` क्लासिक या अवधारणात्मक होना चाहिए
 @msg	`min` is greater than `max`	`min` अधिकतम `max` से अधिक है
 @msg	`minAnchors` and `maxAnchors` must be whole numbers	`minAnchors` और `maxAnchors` पूरे नंबर होना चाहिए
@@ -5662,7 +5675,7 @@
 @msg	`ratio` must be from 0.1 to 0.5	`ratio` को 0.1 से 0.5 तक होना चाहिए
 @msg	`rect` must be [x, y, width, height] with a positive size	`rect` होना चाहिए [x, y, चौड़ाई, ऊंचाई] एक सकारात्मक आकार के साथ
 @msg	`relation` must be overlap, inside or outside	`relation` को ओवरलैप, अंदर या बाहर होना चाहिए
-@msg	`reversed` must be true or false	`reversed` को सच या झूठ होना चाहिए
+@msg	`reversed` must be true or false	`reversed` को true या false होना चाहिए
 @msg	`rotate` must be a finite number	`rotate` एक परिमित संख्या होना चाहिए
 @msg	`rule` must be nonZero or evenOdd	`rule` होना चाहिए nonZero or evenOdd होना चाहिए
 @msg	`sampleSize` must be 1, 3 or 5	`sampleSize` होना चाहिए 1, 3 या 5
@@ -5674,7 +5687,7 @@
 @msg	`seriesIndexes` is a non-empty list of series indexes	`seriesIndexes` श्रृंखला सूचकांकों की एक गैर-खाली सूची है
 @msg	`seriesIndexes` needs a `type` or a `valueAxis`	`seriesIndexes` को `type` या `valueAxis` की आवश्यकता होती है
 @msg	`shift` must be a number of points	`shift` को कई अंक होना चाहिए
-@msg	`showCenter` must be true or false	`showCenter` को सच या झूठ होना चाहिए
+@msg	`showCenter` must be true or false	`showCenter` को true या false होना चाहिए
 @msg	`singleWordJustification` must be "fullJustify", "alignLeft", "alignCenter" or "alignRight"	`singleWordJustification` को "fullJustify", "alignLeft", "alignCenter" या "alignRight" होना चाहिए।
 @msg	`size` is a percentage of the base text's size, 1 to 100	`size` आधार टेक्स्ट के आकार का एक प्रतिशत है, 1 से 100
 @msg	`source` and `target` are the same object	`source` और `target` एक ही ऑब्जेक्ट है
@@ -5688,7 +5701,7 @@
 @msg	`stops` must be an array	`stops` एक सारणी होना चाहिए
 @msg	`story` styles the whole story: give no `start` or `end`	`story` पूरी स्टोरी को स्टाइल करता है: `start` या `end` न दें
 @msg	`story` takes the whole story: give no `start` or `end`	`story` पूरी स्टोरी लेता है: `start` या `end` न दें
-@msg	`strokeMode` applies to strokes (stroke: true)	`strokeMode` स्ट्रोक पर लागू होता है (स्ट्रोक: सच)
+@msg	`strokeMode` applies to strokes (stroke: true)	`strokeMode` स्ट्रोक पर लागू होता है (stroke: true)
 @msg	`style` must be roman or japanese	`style` को रोमन या जापानी होना चाहिए
 @msg	`subpaths` must be two integer indices	`subpaths` होना चाहिए दो पूर्णांक सूचकांक
 @msg	`svg` must be an object of SVG options (see document.formats)	`svg` को SVG ऑप्शन्स का ऑब्जेक्ट होना चाहिए (document.formats देखें)
@@ -5709,8 +5722,8 @@
 @msg	`to` takes the rows of one object's stack, not aligned rows	`to` एक ऑब्जेक्ट के स्टैक की पंक्तियों को लेता है, पंक्तियां संरेखित नहीं है
 @msg	`tolerance` must be from 0 to 3 pt	`tolerance` को 0 से 3 pt के बीच होना चाहिए
 @msg	`tolerance` must be from 1 to 100	`tolerance` को 1 से 100 के बीच होना चाहिए
-@msg	`top` and `below` can't both be true	`top` और `below` दोनों सच नहीं हो सकते
-@msg	`useLab` must be true or false	`useLab` को सही या झूठ होना चाहिए
+@msg	`top` and `below` can't both be true	`top` और `below` दोनों true नहीं हो सकते
+@msg	`useLab` must be true or false	`useLab` को true या false होना चाहिए
 @msg	`vAlign` must be default, top, middle, baseline or bottom	`vAlign` डिफ़ॉल्ट, शीर्ष, मध्य, बेसलाइन या नीचे होना चाहिए
 @msg	`values` must be a list	`values` एक सूची होना चाहिए
 @msg	`values` must be an object	`values` एक ऑब्जेक्ट होना चाहिए
@@ -5745,7 +5758,7 @@
 @msg	a document links at most {MAX_SVG_SCRIPTS} JavaScript files	अधिकांश {MAX_SVG_SCRIPTS} जावास्क्रिप्ट फ़ाइलों पर एक डॉक्यूमेंट लिंक
 @msg	a document needs at least one artboard	कम से कम एक आर्टबोर्ड की आवश्यकता होती है
 @msg	a document needs at least one layer	डॉक्यूमेंट की कम से कम एक लेयर की आवश्यकता होती है
-@msg	a DXF drawing has one origin: pass useArtboards: true for one drawing per artboard	एक DXF ड्राइंग एक मूल है: पास useArtboards: कलाबोर्ड प्रति एक ड्राइंग के लिए सच
+@msg	a DXF drawing has one origin: pass useArtboards: true for one drawing per artboard	एक DXF ड्राइंग का एक मूल होता है: हर आर्टबोर्ड के लिए एक ड्राइंग के लिए useArtboards: true दें
 @msg	a feConvolveMatrix filter's order is {x}×{y}, which overflows the kernel-size multiply usvg makes	एक feConvolveMatrix फिल्टर का आदेश {x} ×{y} है, जो कर्नेल-आकार की बहुप्लाई usvg को ओवरफ्लो करता है।
 @msg	a freeform gradient keeps at least one point	एक freeform ग्रेडिएंट कम से कम एक बिंदु रखता है
 @msg	a gradient needs at least two stops	कम से कम दो स्टॉप की आवश्यकता होती है
@@ -5768,7 +5781,7 @@
 @msg	a mask that covers several layers comes in as a clipping group in each layer it covers	एक मास्क जो कई लेयर्स को कवर करता है, प्रत्येक लेयर में एक क्लिपिंग समूह के रूप में आता है, यह कवर करता है
 @msg	a multi-layer mask needs one clipping path	बहुलेयर मास्क को एक क्लिपिंग पाथ की आवश्यकता होती है
 @msg	a multi-layer mask's operators are out of order	बहुलेयर मास्क ऑपरेटर क्रम से बाहर हैं
-@msg	a name names one asset: give multiple: false, or one object	नाम एक परिसंपत्ति: एकाधिक देना: झूठा, या एक ऑब्जेक्ट
+@msg	a name names one asset: give multiple: false, or one object	एक नाम एक ही एसेट को दर्शाता है: multiple: false दें, या एक ऑब्जेक्ट
 @msg	a new document refuses this file because of these variables: {names}	एक नया डॉक्यूमेंट इन चरों के कारण इस फ़ाइल को मना कर देता है: {names}
 @msg	a new document won't read these variables back with their kind: {names}	नया डॉक्यूमेंट इन वेरिएबल्स का प्रकार वापस नहीं पढ़ पाएगा: {names}
 @msg	a page can't be read	एक पेज पढ़ा नहीं जा सकता
@@ -5817,7 +5830,7 @@
 @msg	a symbol can't hold an instance of itself	एक सिंबल खुद का एक उदाहरण नहीं पकड़ सकता है
 @msg	a symbol named `{n}` already exists	पहले से ही `{n}` नाम का सिंबल मौजूद है
 @msg	a theme has 1 to {THEME_SIZE} colours	थीम में 1 से {THEME_SIZE} रंग होते हैं
-@msg	a theme is already called {name} (replace: "{name}" overwrites it)	एक विषय को पहले से ही {name} कहा जाता है (प्रतिस्थापन: "{name}" इसे ओवरराइट करता है)
+@msg	a theme is already called {name} (replace: "{name}" overwrites it)	{name} नाम की थीम पहले से है (replace: "{name}" उसे ओवरराइट करता है)
 @msg	a toolbar name has at most {MAX_NAME} characters	टूलबार नाम में सबसे {MAX_NAME} वर्ण हैं
 @msg	a value has the wrong type for the operator	एक मूल्य ऑपरेटर के लिए गलत प्रकार है
 @msg	a value is outside the range the operator takes	एक मूल्य सीमा के बाहर है जो ऑपरेटर लेता है
@@ -5827,7 +5840,7 @@
 @msg	a view named `{name}` exists	`{name}` नामक दृश्य मौजूद है
 @msg	a workspace keeps at most {MAX} toolbars	एक वर्कस्पेस सबसे {MAX} टूलबार में रहता है
 @msg	a wraparound group is inside a compound path	एक रैपराउंड समूह एक मिश्रित पाथ के अंदर है
-@msg	action is required	कार्रवाई की आवश्यकता है
+@msg	action is required	action आवश्यक है
 @msg	add a format to export	निर्यात करने के लिए एक फ़ॉर्मैट जोड़ें
 @msg	Add Points at Crossings: a path went missing	क्रॉसिंग्स में अंक जोड़ें: एक पाथ गायब हो गया
 @msg	aiVersion {v}: "pdf" (PDF-compatible, the default) or "7" (legacy .ai, version 7)	aiVersion {v}: "pdf" (PDF-संगत, डिफ़ॉल्ट) या "7" (पुरानी .ai, संस्करण 7)
@@ -6020,12 +6033,12 @@
 @msg	Choose two non-parallel straight segments	दो गैर-parallel सीधे खंड चुनें
 @msg	Choose two nonzero angle arms	दो nonzero कोण हथियार चुनें
 @msg	Click in type with a Type tool to split it	इसे विभाजित करने के लिए टाइप टूल के साथ टाइप करें
-@msg	clip must be true or false	clip: क्लिप को सच या झूठा होना चाहिए
+@msg	clip must be true or false	clip को true या false होना चाहिए
 @msg	clipboard is empty	क्लिपबोर्ड खाली है
 @msg	clippingMask must be true or false	clippingMask को true या false होना चाहिए
 @msg	closed must be a boolean	closed: बंद होना चाहिए एक boolean
 @msg	closing needs three anchors	closing: बंद करने की जरूरत है तीन एंकर
-@msg	collapsed must be true or false	collapsed: पतन सच होना चाहिए या गलत होना चाहिए
+@msg	collapsed must be true or false	collapsed को true या false होना चाहिए
 @msg	color.profile: no RGB or CMYK profile is called “{profile}”	Color.profile: कोई RGB या CMYK प्रोफ़ाइल को "{profile}" कहा जाता है।
 @msg	colorMode must be rgb or cmyk, not `{m}`	colorMode को rgb या cmyk होना चाहिए, `{m}` नहीं
 @msg	colorModel must be {own} (the document's mode), grayscale or bitmap	colorModel को {own} (डॉक्यूमेंट का मोड), grayscale या bitmap होना चाहिए
@@ -6038,8 +6051,8 @@
 @msg	column {column}: `{cell}` names no variable	कॉलम {column}: `{cell}` नाम कोई चर नहीं
 @msg	column {column}: the variable name is longer than {MAX_NAME} characters	कॉलम {column}: चर नाम {MAX_NAME} अक्षरों से लंबा है
 @msg	column docks a set as a dock column, with no anchor or icon	कॉलम एक डॉक कॉलम के रूप में सेट करता है, जिसमें कोई एंकर या आइकन नहीं होता है
-@msg	column must be true or a number from 1	column: कॉलम सही होना चाहिए या 1 से एक नंबर होना चाहिए
-@msg	column: true floats the whole column and takes no onto, above or below	स्तंभ: सच पूरे स्तंभ को तैरता है और ऊपर या नीचे नहीं लेता है
+@msg	column must be true or a number from 1	column को true या 1 या उससे बड़ी संख्या होना चाहिए
+@msg	column: true floats the whole column and takes no onto, above or below	column: true पूरे कॉलम को फ़्लोट करता है और onto, above या below नहीं लेता
 @msg	columns {first} and {column} both name the variable `{name}`	कॉलम {first} और {column} दोनों नाम चर `{name}`
 @msg	Combine Slices: the slices have no bounds	स्लाइस को मिलाएं: स्लाइस में कोई सीमा नहीं है
 @msg	command `{0}` is not available right now: {1}	आदेश `{0}` अभी उपलब्ध नहीं है: {1}
@@ -6115,7 +6128,7 @@
 @msg	decimals must be {_1}–{_2} (got {_3})	decimals: दशमलव होना चाहिए {_1}-{_2} ({_3})
 @msg	decoded data is too large	डीकोडेड डेटा बहुत बड़ा है
 @msg	define a variable first	पहले एक चर को परिभाषित करना
-@msg	detect must be true or false	detect: पता लगाना सही या गलत होना चाहिए
+@msg	detect must be true or false	detect को true या false होना चाहिए
 @msg	Dimension is locked or hidden	आयाम बंद या छिपा हुआ है
 @msg	Dimension mode does not match its source	आयाम मोड अपने स्रोत से मेल नहीं खाता है
 @msg	Dimension point is outside the canvas	आयाम बिंदु कैनवास के बाहर है
@@ -6276,7 +6289,7 @@
 @msg	give one of assets, layers, selection or fullDocument	assets, layers, selection या fullDocument में से एक दें
 @msg	give only one of onto, above, below, icon and a column place	केवल ऊपर, नीचे, आइकन और एक स्तंभ स्थान देने के लिए
 @msg	give only one of onto, below and above	नीचे और ऊपर केवल एक देना
-@msg	give origin: [x, y], or reset: true	मूल देना: [x, y], या रीसेट करें: सच
+@msg	give origin: [x, y], or reset: true	origin: [x, y] दें, या reset: true
 @msg	give overprintFill, overprintStroke, showCenter, imageMap, url or note	overprintFill, overprintStroke, showCenter, imageMap, url या नोट
 @msg	give path (a file) or folder	पाथ (एक फ़ाइल) या फ़ोल्डर देना
 @msg	give path, or name and dataBase64	path या name और dataBase64 दें
@@ -6297,7 +6310,7 @@
 @msg	give x, y, or a handle's length or angle	x, y, या एक हैंडल की लंबाई या कोण देना
 @msg	Global Edit is off	ग्लोबल एडिट बंद है
 @msg	Global Edit works on paths, compound paths, symbol instances and groups of them	ग्लोबल एडिट पाथ, मिश्रित पाथ, सिंबल उदाहरणों और उनके समूहों पर काम करता है
-@msg	global must be true or false	global: वैश्विक होना चाहिए या गलत होना चाहिए
+@msg	global must be true or false	global को true या false होना चाहिए
 @msg	glyph {_1} is not drawn for {ch} with the character's style (such as All Caps, Small Caps or a numeral system)	Glyph {_1} चरित्र की स्टाइल (जैसे सभी कैप्स, छोटे कैप्स या एक संख्यात्मक प्रणाली) के साथ {ch} के लिए तैयार नहीं है।
 @msg	glyph {g} is not an alternate of {ch} in {_1} {_2}	Glyph {g} {_1} {_2} में {ch} का एक वैकल्पिक नहीं है।
 @msg	gradient “{name}” isn't defined in the file: a plain colour stands in for it	ग्रेडिएंट "{name}" को फ़ाइल में परिभाषित नहीं किया गया है: इसके लिए एक सादे रंग खड़ा है
@@ -6307,7 +6320,7 @@
 @msg	gridColors must be a preset name or two colours	gridColors को प्रीसेट नाम या दो रंग होना चाहिए
 @msg	gridSize must be small, medium or large	gridSize को small, medium या large होना चाहिए
 @msg	group must be the id of a Shaper Group	group: समूह को एक शेपर ग्रुप का आईडी होना चाहिए
-@msg	group must be true or false	group: समूह को सच या झूठा होना चाहिए
+@msg	group must be true or false	group को true या false होना चाहिए
 @msg	guide {g} is not selected	गाइड {g} नहीं चुना गया है
 @msg	guides are locked	गाइड लॉक कर रहे हैं
 @msg	handle must be 0..3	handle को 0..3 होना चाहिए
@@ -6319,7 +6332,7 @@
 @msg	highlight two or more rows to merge	दो या अधिक पंक्तियों को मर्ज करने के लिए हाइलाइट करें
 @msg	HTML Text applies to object slices of type only	एचटीएमएल टेक्स्ट केवल टाइप के ऑब्जेक्ट स्लाइस पर लागू होता है
 @msg	icon docks a panel in the icon column: use window.panel.dock	आइकन कॉलम में एक पैनल डॉक करता है: विंडो का उपयोग करें.पैनल.dock
-@msg	icon must be true or false	icon: आइकन सही या झूठी होना चाहिए
+@msg	icon must be true or false	icon को true या false होना चाहिए
 @msg	icon only docks a panel in the icon column, with no anchor	आइकन केवल आइकन कॉलम में एक पैनल को डॉक करता है, जिसमें कोई एंकर नहीं होता है
 @msg	id {value} is a layer, not an object	Id {value} एक लेयर है, कोई ऑब्जेक्ट नहीं है
 @msg	id {value} is a layer, not an object; move layers with layer.move	Id {value} एक लेयर है, कोई ऑब्जेक्ट नहीं है; लेयर के साथ लेयर्स को स्थानांतरित करें।
@@ -6340,10 +6353,10 @@
 @msg	imageMap `{m}`: none, client or server	imageMap `{m}`: none, client या server
 @msg	Imported {what}: {_1}	आयात {what}: {_1}
 @msg	Imported library {name}	आयातित लाइब्रेरी {name}
-@msg	included must be true or false	included: इसमें सही या गलत होना चाहिए
+@msg	included must be true or false	included को true या false होना चाहिए
 @msg	index must be ≥ 0	index: सूचकांक होना चाहिए ≥ 0
-@msg	index must be a number or first, previous, next or last	index: सूचकांक एक नंबर या पहले होना चाहिए, पिछले, अगले या आखिरी
-@msg	index must be a number or first, previous, next or last, not `{other}`	index: सूचकांक एक नंबर या पहले होना चाहिए, पिछले, अगले या आखिरी, नहीं `{other}`
+@msg	index must be a number or first, previous, next or last	index को एक नंबर या first, previous, next या last होना चाहिए
+@msg	index must be a number or first, previous, next or last, not `{other}`	index को एक नंबर या first, previous, next या last होना चाहिए, `{other}` नहीं
 @msg	index out of range	रेंज से बाहर सूचकांक
 @msg	Installed plug-in {_1}	स्थापित प्लग-इन {_1}
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	एक पाथ से स्थापित वेब पर उपलब्ध नहीं है; मॉड्यूल को `dataBase64`` के रूप में पास करें
@@ -6435,7 +6448,7 @@
 @msg	layers can't be intertwined: select the objects in them	लेयर्स में हस्तक्षेप नहीं किया जा सकता है: उनमें ऑब्जेक्ट्स सिलेक्ट करें
 @msg	layers can't be wrap objects	लेयर्स को लपेटा नहीं जा सकता
 @msg	layers go only at the top level or in layers, objects in layers and groups	लेयरें केवल शीर्ष स्तर पर या लेयर्स में, लेयर्स और समूहों में ऑब्जेक्टएं
-@msg	layers must be true or false	layers: लेयरें सत्य या झूठी होनी चाहिए
+@msg	layers must be true or false	layers को true या false होना चाहिए
 @msg	layout must be gridByRow, gridByColumn, row or column	layout को gridByRow, gridByColumn, row या column होना चाहिए
 @msg	leading must be a number or "auto"	leading: अग्रणी एक नंबर या "auto" होना चाहिए
 @msg	left/right must be non-negative widths	बाएं / दाएं गैर-नकारात्मक चौड़ाई होना चाहिए
@@ -6445,7 +6458,7 @@
 @msg	line {line}: more than {MAX_CSV_COLS} columns	लाइन {line}: {MAX_CSV_COLS} कॉलम से अधिक
 @msg	line {line}: unclosed quote	लाइन {line}: unclosed उद्धरण
 @msg	line {line}: value for `{var}` is longer than {MAX_GRAPH_CSV} bytes	लाइन {line}: `{var}` के लिए मूल्य {MAX_GRAPH_CSV} बाइट्स से अधिक है
-@msg	line {line}: value for `{var}` must be true or false	लाइन {line}: `{var}` के लिए मान सही या झूठ होना चाहिए
+@msg	line {line}: value for `{var}` must be true or false	लाइन {line}: `{var}` के लिए मान true या false होना चाहिए
 @msg	line {line}: value for `{var}` must match its variable kind	लाइन {line}: `{var}` के लिए मान इसके परिवर्तनीय प्रकार से मेल खाता होना चाहिए
 @msg	lineEndings `{other}`: lf or crlf	lineEndings `{other}`: lf या crlf
 @msg	linked pictures show the low-resolution preview saved in the file until their files are found: relink them in the Links panel	लिंक किए गए चित्रों से पता चलता है कि फ़ाइल में सेव किए जाने वाले निम्न-रिज़ॉल्यूशन प्रीव्यू को उनकी फ़ाइलों को मिलने तक: लिंक पैनल में उन्हें फिर से लिंक करें
@@ -6469,7 +6482,7 @@
 @msg	matte: {e}	मैट: {e}
 @msg	Measured anchor no longer exists	मापने वाला एंकर अब मौजूद नहीं है
 @msg	Measured segment no longer exists	मापदंड अब मौजूद नहीं है
-@msg	member is for order front, forward, backward or back	सदस्य ऑर्डर फ्रंट, फॉरवर्ड, बैकवर्ड या बैक के लिए है
+@msg	member is for order front, forward, backward or back	member केवल order front, forward, backward या back के लिए है
 @msg	memory budget (the selection is too large to hand over)	स्मृति बजट (चुनाव बहुत बड़ा है)
 @msg	missing `{k}`	लापता `{k}`
 @msg	missing `{key}`	लापता `{key}`
@@ -6554,7 +6567,7 @@
 @msg	missing target	लापता लक्ष्य
 @msg	missing to	याद करना
 @msg	missing x, y	लापता xy
-@msg	mode is set, add or toggle, not `{other}`	मोड सेट, ऐड या टॉगल है, नहीं `{other}`
+@msg	mode is set, add or toggle, not `{other}`	mode set, add या toggle है, `{other}` नहीं
 @msg	mode must be "cmyk" or "rgb"	mode: मोड "cmyk" या "rgb" होना चाहिए
 @msg	mode must be area|onPath, got {o}	mode: मोड होना चाहिए क्षेत्रफल (onPath), {o} मिला
 @msg	module is {_1} bytes (limit {_2})	मॉड्यूल {_1} बाइट्स (सीम {_2}) है।
@@ -6578,7 +6591,7 @@
 @msg	name is empty	नाम खाली है
 @msg	name must be a toolbar's name	name: नाम एक टूलबार का नाम होना चाहिए
 @msg	name the file	फ़ाइल नाम
-@msg	names is empty	नाम खाली है
+@msg	names is empty	names खाली है
 @msg	names must be an array of symbol names	names: नाम सिंबल नामों की एक सरणी होना चाहिए
 @msg	need `anchor` or `segment` + `t`	की जरूरत `anchor` या `segment` + `t`
 @msg	need at least one anchor	कम से कम एक एंकर की जरूरत है
@@ -6855,6 +6868,8 @@
 @msg	not a Word document: its main part is not a WordprocessingML document	वर्ड डॉक्यूमेंट नहीं: इसका मुख्य हिस्सा वर्डप्रोसेसिंगएमएल डॉक्यूमेंट नहीं है
 @msg	not a Word document: its package has no main document part	नहीं एक वर्ड डॉक्यूमेंट: इसके पैकेज में कोई मुख्य डॉक्यूमेंट हिस्सा नहीं है
 @msg	not a Word document: its WordDocument stream doesn't start with a file information block	वर्ड डॉक्यूमेंट नहीं: इसकी WordDocument धारा फ़ाइल सूचना ब्लॉक के साथ शुरू नहीं होती है
+@msg	the action set file can't be read in full	एक्शन सेट फ़ाइल पूरी तरह नहीं पढ़ी जा सकती
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	“{name}” लोड किया गया: {n} चरण छोड़ा गया|“{name}” लोड किया गया: {n} चरण छोड़े गए
 @msg	not an action set file	एक एक्शन सेट फ़ाइल नहीं
 @msg	not an EMF or WMF file	नहीं एक EMF या WMF फ़ाइल
 @msg	not an export presets file (format `{_1}`)	नहीं निर्यात presets फ़ाइल (format `{_1}`)
@@ -6926,7 +6941,7 @@
 @msg	Offset Path: select paths	ऑफसेट पाथ: सिलेक्शन पाथ
 @msg	Offset Path: the offset leaves nothing of the selected paths (an inset larger than the shapes)	ऑफसेट पाथ: ऑफ़सेट सिलेक्टेड पाथ की कुछ भी नहीं छोड़ता है (आकार की तुलना में एक निर्धारित बड़ा)
 @msg	Offset Path: the path is too complex to offset	ऑफसेट पाथ: पाथ ऑफसेट करने के लिए बहुत जटिल है
-@msg	on must be true or false	on: पर सच होना चाहिए या गलत होना चाहिए
+@msg	on must be true or false	on को true या false होना चाहिए
 @msg	only a dock group above or below others collapses, not one beside another	केवल दूसरों के ऊपर या नीचे एक डॉक समूह गिर जाता है, एक दूसरे के बगल में नहीं
 @msg	only an exporter declares `extensions`	केवल निर्यातक `extensions` घोषित करता है
 @msg	only an object of the Global Edit other than the one it started from can be left out	केवल ग्लोबल एडिट का एक ऑब्जेक्ट, इसके अलावा इसे शुरू किया जा सकता है, छोड़ दिया जा सकता है
@@ -6948,7 +6963,7 @@
 @msg	options must be an object (see file.formatOptions)	options: ऑप्शन्स एक ऑब्जेक्ट होना चाहिए (file.formatOptions देखें)
 @msg	order must be leftToRight or rightToLeft	order को leftToRight या rightToLeft होना चाहिए
 @msg	orientation must be portrait or landscape, not `{o}`	orientation: अभिविन्यास चित्र या परिदृश्य होना चाहिए, नहीं `{o}`
-@msg	others must be true or false	others: दूसरों को सच होना चाहिए या गलत होना चाहिए
+@msg	others must be true or false	others को true या false होना चाहिए
 @msg	Outline Stroke: no stroked paths selected	आउटलाइन स्ट्रोक: सिलेक्टेड कोई स्ट्रोक पाथ नहीं
 @msg	outlineText {v}: true or false	outlineText {v}: true या false
 @msg	output intent profile: {e}	उत्पादन आशय प्रोफ़ाइल: {e}
@@ -7019,7 +7034,7 @@
 @msg	pins must be finite	pins: पिन परिमित होना चाहिए
 @msg	place is above, below or inside, not `{other}`	place: स्थान ऊपर, नीचे या अंदर है, नहीं `{other}`
 @msg	Placing {_1}	पतंग {_1}
-@msg	plane must be left, right or ground	plane: समतल बाएं, दाएं या जमीन होना चाहिए
+@msg	plane must be left, right or ground	plane को left, right या ground होना चाहिए
 @msg	plane must be left|right|ground	plane को left|right|ground होना चाहिए
 @msg	plane must be left|right|ground|none	plane को left|right|ground|none होना चाहिए
 @msg	plug-in ABI: {0}	प्लग-इन ABI: {0}
@@ -7070,7 +7085,7 @@
 @msg	recovery copy `{file}`: {e}	वसूली प्रतिलिपि `{file}`: {e}
 @msg	rect and {k} contradict each other: give the area or the artboards	सही और {k} एक दूसरे के विपरीत: क्षेत्र या आर्टबोर्ड देना
 @msg	rect applies to raster formats, not {_1}	सही रेस्टर फ़ॉर्मैट्स पर लागू होता है, न कि {_1}
-@msg	rect is [x, y, width, height] in points	सही [x, y, चौड़ाई, ऊंचाई] अंक में है
+@msg	rect is [x, y, width, height] in points	rect पॉइंट में [x, y, width, height] है
 @msg	rect must be [x, y, width, height]	rect: [x, y, चौड़ाई, ऊंचाई] होना चाहिए
 @msg	rect must be [x, y, width, height] with a positive width and height	rect: सही होना चाहिए [x, y, चौड़ाई, ऊंचाई] सकारात्मक चौड़ाई और ऊंचाई के साथ
 @msg	rect needs finite numbers and a positive width and height	rect: सही की जरूरत परिमित संख्या और सकारात्मक चौड़ाई और ऊंचाई
@@ -7238,7 +7253,7 @@
 @msg	shortcut for `{k}` must be a string	`{k}` के लिए शॉर्टकट एक स्ट्रिंग होना चाहिए
 @msg	show `{show}`: all, missing, modified or embedded	`{show}``: सभी, लापता, संशोधित या एम्बेडेड
 @msg	Show All Hidden Attributes: nothing is hidden	Show all Hidden Attributes: कुछ भी छिपा नहीं है
-@msg	show must be true or false	show: प्रदर्शन को सच या झूठा होना चाहिए
+@msg	show must be true or false	show को true या false होना चाहिए
 @msg	Simplify Anchors: the paths have too many anchors to simplify at once	एंकर को सरलीकृत करें: पाथ में एक बार में सरल बनाने के लिए कई एंकर हैं
 @msg	size must be "small", "medium", "large" or a number of points over 0 up to {_1}	size: आकार "small", "medium", "large" या 0 से अधिक अंक {_1} तक होना चाहिए
 @msg	size must be positive	size: आकार सकारात्मक होना चाहिए
@@ -7253,7 +7268,7 @@
 @msg	span must be "object" or "selection", got {v}	span: स्पैन को "object" या "selection" होना चाहिए, {v} मिला
 @msg	span: "selection" places a `gradient`, not a swatch	span: "selection" एक `gradient` रखता है, स्वॉच नहीं
 @msg	span: "selection" places a gradient: give `gradient`	span: "selection" ग्रेडिएंट रखता है: `gradient` दें
-@msg	span: "selection" places a linear or radial gradient, not a freeform one	स्पैन: "selection" एक रैखिक या रेडियल ग्रेडिएंट रखता है, एक फ्रीफॉर्म नहीं एक
+@msg	span: "selection" places a linear or radial gradient, not a freeform one	span: "selection" एक रैखिक या रेडियल ग्रेडिएंट रखता है, फ्रीफॉर्म ग्रेडिएंट नहीं
 @msg	span: "selection" places the gradient itself: leave out `start` and `end` (they already place it in document coordinates)	span: "selection" खुद ग्रेडिएंट रखता है: `start` और `end` न दें (वे उसे डॉक्यूमेंट निर्देशांकों पर रख देते हैं)
 @msg	speed must be accelerated, step or pause	speed: गति को तेज, कदम या रोकें होना चाहिए
 @msg	Split Into Grid: select paths large enough for the grid	स्प्लिट इनो ग्रिड: ग्रिड के लिए काफी बड़े पाथ सिलेक्ट करें
@@ -7594,7 +7609,7 @@
 @msg	tileRange of {what}: {e}	{what} का tileRange: {e}
 @msg	time budget	समय बजट
 @msg	tintReduction must be from 0 to 100 %	tintReduction 0 से 100 % तक होना चाहिए
-@msg	title can't be empty	शीर्षक खाली नहीं हो सकता है
+@msg	title can't be empty	title खाली नहीं हो सकता
 @msg	to (the new name) is required	(नया नाम) के लिए आवश्यक है
 @msg	to must be fill or stroke	to: होना चाहिए भरने या स्ट्रोक होना चाहिए
 @msg	to must be smooth or corner	to: होना चाहिए चिकनी या कोने होना
@@ -7759,7 +7774,7 @@
 @msg	VectorCraft's Fonts folder isn't set here: the desktop app and vectorcraft-cli set it	VectorCraft के फ़ॉन्ट फ़ोल्डर यहां सेट नहीं है: डेस्कटॉप ऐप और VectorCraft-क्लाई ने इसे सेट किया
 @msg	version {0} files can't be compressed: only version {COMPRESSED_SINCE} and later open compressed files	संस्करण {0} की फ़ाइलें संपीड़ित नहीं हो सकतीं: केवल संस्करण {COMPRESSED_SINCE} और बाद के संस्करण संपीड़ित फ़ाइलें खोलते हैं
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio को 0.1 से 10 के बीच संख्या होना चाहिए
-@msg	view is required	देखने की आवश्यकता है
+@msg	view is required	view आवश्यक है
 @msg	view must be one of {_1}	view: राय होना चाहिए {_1}
 @msg	warpStyle can only edit an applied Warp effect	warpStyle केवल लागू वार्प इफ़ेक्ट एडिट कर सकता है
 @msg	width and height are at least 1 pixel	चौड़ाई और ऊंचाई कम से कम 1 पिक्सेल हैं
@@ -7778,7 +7793,7 @@
 @msg	Your unsaved changes are kept in this browser: reload the page to get them back.	इस ब्राउज़र में आपके बिना सेव किए गए बदलाव को रखा गया है: उन्हें वापस पाने के लिए पेज को फिर से लोड करें।
 @msg	zipped 32-bit PSD image data with prediction can't be read	भविष्यवाणी के साथ 32-bit PSD इमेज डेटा zipped नहीं किया जा सकता
 @msg	zone must be a string	zone: क्षेत्र एक स्ट्रिंग होना चाहिए
-@msg	zone must be tab, center, left, right, top or bottom	zone: क्षेत्र टैब होना चाहिए, केंद्र, बाएं, दाएं, ऊपर या नीचे
+@msg	zone must be tab, center, left, right, top or bottom	zone को tab, center, left, right, top या bottom होना चाहिए
 @msg	zone needs an anchor: dock beside a panel with anchor, or in a new dock column with side (Start or End)	zone: जोन को एक एंकर की आवश्यकता होती है: एंकर के साथ एक पैनल के बगल में, या साइड (स्टार्ट या एंड) के साथ एक नए डॉक कॉलम में
 @msg	zoom must be positive	zoom: ज़ूम सकारात्मक होना चाहिए
 @msgplural	({n} linked file not found)|({n} linked files not found)	({n} लिंक्ड फ़ाइल नहीं मिली)|({n} लिंक्ड फ़ाइलें नहीं मिलीं)
@@ -7962,6 +7977,28 @@ swatch	White, Black	सफ़ेद, काला
 swatch	Yellow	पीला
 swatch	Yellow Green	पीला हरा
 theme	Appearance	अपीयरेंस
+
+# Safe Mode
+	Safe Mode…	सुरक्षित मोड…
+	Safe Mode	सुरक्षित मोड
+	Help › Safe Mode…	मदद › सुरक्षित मोड…
+	Enable on Re-launch	अगली बार शुरू होने पर सक्षम करें
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	VectorCraft का पिछला लॉन्च प्लग-इन {name} के लोड होते समय रुक गया। हो सकता है कि वह इसका कारण न हो।
+	Disable and Continue	अक्षम करें और जारी रखें
+	Start Normally	सामान्य रूप से शुरू करें
+	Start in Safe Mode	सुरक्षित मोड में शुरू करें
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft सुरक्षित मोड में है: जब तक यह सामान्य रूप से शुरू नहीं होता, कोई भी प्लग-इन लोड या चलाया नहीं जाता।
+	Disabled plug-ins	अक्षम प्लग-इन
+	No plug-ins are disabled.	कोई प्लग-इन अक्षम नहीं है।
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	सुरक्षित मोड चालू है: जब तक VectorCraft सामान्य रूप से शुरू नहीं होता, प्लग-इन लोड या चलाए नहीं जाते
+@msg	give `id` or `file` (see plugin.safeMode)	`id` या `file` दें (plugin.safeMode देखें)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	वह प्लग-इन अक्षम नहीं है (plugin.safeMode देखें)
+@msg	Couldn't save the disabled plug-ins for the next launch	अगली बार लॉन्च के लिए अक्षम प्लग-इन सहेजे नहीं जा सके
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	उपस्थिति का विस्तार: सिलेक्शन में किसी प्लग-इन इफ़ेक्ट का सुरक्षित मोड में विस्तार नहीं किया जा सकता
+
+# Align to Pixel Grid
+	Align to Pixel Grid	पिक्सेल ग्रिड से संरेखित करें
+@msg	only paths and compound paths can be aligned to the pixel grid	केवल पाथ और कंपाउंड पाथ को पिक्सेल ग्रिड से संरेखित किया जा सकता है
 	Start Lists From Typed Markers	टाइप किए गए चिह्नों से सूचियाँ शुरू करें
 	Marquee Selection	मार्की चयन
 	Touching	स्पर्श करते हुए
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 1aa771a42..16055debf 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -1368,6 +1368,14 @@ font-technology	Variable	Változó
 	Export As SVG…	Exportálás SVG-ként…
 	Export Asset	Elem exportálása
 	Export Assets	Elemek exportálása
+	Export 3D Object	3D objektum exportálása
+	3D Export Format	3D exportálási formátum
+	Export 3D Assets	3D elemek exportálása
+@msg	{what} can't be exported in 3D: {e}	{what} nem exportálható 3D-ben: {e}
+@msg	asset {id} isn't a 3D asset	a(z) {id} elem nem 3D elem
+@msg	asset {id} is a 3D asset: assets.export3D writes it	a(z) {id} elem 3D elem: az assets.export3D írja ki
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	még nincs 3D elem: előbb gyűjtsön össze egy 3D effektussal rendelkező objektumot (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	jelöljön ki egy 3D effektussal rendelkező objektumot (vagy adja meg az azonosítóit)
 	Export As…	Exportálás másként…
 	Export CSS	CSS exportálása
 	Export CSS…	CSS exportálása…
@@ -2156,6 +2164,7 @@ file-filter	Templates	Sablonok
 	Report copied	Jelentés másolva
 	Line {line}	{line}. sor
 	Line {line}: {name}: {status}	{line}. sor: {name}: {status}
+	Read Action Set File	Műveletkészlet beolvasása fájlból
 	Read Shortcut Set File	Billentyűparancs-készlet beolvasása fájlból
 	Import Matches	Importálási megfeleltetések
 	Remember Import Matches	Importálási megfeleltetések megjegyzése
@@ -4081,6 +4090,9 @@ mark-style	Japanese	Japán
 	Symbols	Szimbólumok
 	System Layout	Rendszerszintű elrendezés
 	System Title Bar	Rendszer címsora
+	VectorCraft Title Bar on Every Desktop	A VectorCraft címsora minden asztali környezetben
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Amíg a VECTORCRAFT_TITLEBAR környezeti változó be van állítva, az választja ki a címsort.
+	System Title Bar takes precedence over this option while it is on.	Amíg a Rendszer címsora be van kapcsolva, elsőbbséget élvez ezzel a beállítással szemben.
 	Tab	Tabulátor
 	Tab Stops	Tabulátorpontok
 	Table	Táblázat
@@ -4827,7 +4839,7 @@ imageTrace	Outline	Körvonal
 @msg	Data Recovery has nowhere to keep copies: set Preferences → File Handling → Data Recovery → Folder (recoveryFolder)	Az adat-helyreállításnak nincs hova mentenie a másolatokat: állítsd be a Beállítások → Fájlkezelés → Adat-helyreállítás → Mappa értéket (recoveryFolder)
 @msg	Data Recovery can't keep copies in {path}: {e}	Az adat-helyreállítás nem tud másolatokat menteni ide: {path}: {e}
 @msg	Plug-ins can't be loaded from {path}: {e}	Innen nem tölthetők be bővítmények: {path}: {e}
-@msg	decimals must be {_1}–{_2} (got {_3})	a tizedesjegyek száma {_1}–{_2} lehet (kapott érték: {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	a decimals értéke {_1}–{_2} lehet (kapott érték: {_3})
 @msg	direct-select anchor points to cut at (not the end points of open paths)	jelöld ki közvetlen kijelöléssel a vágási horgonypontokat (nyitott útvonal végpontja nem lehet)
 @msgplural	Discarded {n} recovered document|Discarded {n} recovered documents	Elvetett helyreállított dokumentumok: {n}
 @msg	divide into 1 to {MAX_PIECES} slices	a felosztás 1 és {MAX_PIECES} közötti szeletre lehetséges
@@ -5037,6 +5049,8 @@ imageTrace	Outline	Körvonal
 @msg	no such action set	nincs ilyen műveletkészlet
 @msg	the action sets changed; nothing was deleted	a műveletkészletek megváltoztak; semmi sem törlődött
 @msg	no action set to save	nincs menthető műveletkészlet
+@msg	the action set file can't be read in full	a műveletkészlet-fájl nem olvasható be teljesen
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	„{name}” betöltve; kihagyott lépések: {n}
 @msg	not an action set file	nem műveletkészlet-fájl
 @msg	the action set file is larger than 8 MiB	a műveletkészlet-fájl nagyobb 8 MiB-nál
 @msg	the action set file holds more than 1,000 actions	a műveletkészlet-fájl több mint 1000 műveletet tartalmaz
@@ -5198,8 +5212,8 @@ imageTrace	Outline	Körvonal
 @msg	Saving	Mentés
 @msg	Saving recovery data for {_1}	Helyreállítási adatok mentése: {_1}
 @msg	Saving {_1}	Mentés: {_1}
-@msg	scale must be a number from {_1} to {_2}, not {_3}	a méretarány {_1} és {_2} közötti szám lehet, ez nem az: {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	a méretarány {_1} és {_2} közötti szám lehet, ez nem az: {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	a scale {_1} és {_2} közötti szám lehet, ez nem az: {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	a scale {_1} és {_2} közötti szám lehet, ez nem az: {s}
 @msg	searching a folder isn't available on the web	a webes változatban nem lehet mappában keresni
 @msg	select (or target) objects whose appearance isn't basic	jelölj ki (vagy célozz meg) olyan objektumokat, amelyeknek nem alapmegjelenésük van
 @msg	select a blend	jelölj ki egy összemosást
@@ -5231,7 +5245,7 @@ imageTrace	Outline	Körvonal
 @msg	select paths or anchor points	jelölj ki útvonalakat vagy horgonypontokat
 @msg	select paths to join	jelöld ki az összekapcsolandó útvonalakat
 @msg	select some type first	előbb jelölj ki szöveget
-@msg	kerning must be a number, "auto", or "optical"	Az alávágás szám, „auto” vagy „optical” lehet
+@msg	kerning must be a number, "auto", or "optical"	a kerning szám, „auto” vagy „optical” lehet
 @msg	the selection has no gradient fill	a kijelölésnek nincs színátmenetes kitöltése
 @msg	the selection has no gradient stroke	a kijelölésnek nincs színátmenetes körvonala
 @msg	the selection has no pattern fill	a kijelölésnek nincs mintázatos kitöltése
@@ -6392,6 +6406,7 @@ breakText	Glyphs	Glifák
 	Reset Symbol Instance	Szimbólumpéldány visszaállítása
 @msg	type must be static or dynamic, not {v}	a type értéke static vagy dynamic lehet, nem {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` statikus szimbólum: előbb állítsa a szimbólum típusát Dinamikusra
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Egy szimbólumpéldányban kijelölt útvonalnak, összetett útvonalnak vagy szövegnek csak a kitöltés és a körvonal egyszínű színe módosítható
 @msg	path must be a list of child indices	a path gyermekindexek listája kell legyen
 @msg	no object at path {shown} in the symbol's art	a szimbólum grafikájában nincs objektum a(z) {shown} útvonalon
 @msg	give fill, stroke, opacity and/or blend	adja meg a fill, stroke, opacity és/vagy blend értékét
@@ -6489,3 +6504,25 @@ breakText	Glyphs	Glifák
 # 3D Box add-on
 	3D Box	3D doboz
 	3D Box Tool	3D doboz eszköz
+
+# Safe Mode
+	Safe Mode…	Csökkentett mód…
+	Safe Mode	Csökkentett mód
+	Help › Safe Mode…	Súgó › Csökkentett mód…
+	Enable on Re-launch	Engedélyezés a következő indításkor
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	A VectorCraft legutóbbi indítása leállt, miközben a(z) {name} bővítmény betöltődött. Lehet, hogy nem ez okozta.
+	Disable and Continue	Letiltás és folytatás
+	Start Normally	Normál indítás
+	Start in Safe Mode	Indítás csökkentett módban
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	A VectorCraft csökkentett módban fut: a bővítmények nem töltődnek be és nem futnak, amíg normál módban el nem indul.
+	Disabled plug-ins	Letiltott bővítmények
+	No plug-ins are disabled.	Nincs letiltott bővítmény.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	A csökkentett mód be van kapcsolva: a bővítmények nem töltődnek be és nem futnak, amíg a VectorCraft normál módban el nem indul
+@msg	give `id` or `file` (see plugin.safeMode)	adja meg: `id` vagy `file` (lásd: plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	ez a bővítmény nincs letiltva (lásd: plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	A letiltott bővítményeket nem sikerült menteni a következő indításhoz
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Megjelenés kibontása: a kijelölésben lévő bővítményeffektus csökkentett módban nem bontható ki
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Igazítás a pixelrácshoz
+@msg	only paths and compound paths can be aligned to the pixel grid	csak útvonalak és összetett útvonalak igazíthatók a pixelrácshoz
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index bffe798c5..dfb8ef46e 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -135,6 +135,7 @@
 	Report copied	Laporan disalin
 	Line {line}	Baris {line}
 	Line {line}: {name}: {status}	Baris {line}: {name}: {status}
+	Read Action Set File	Baca berkas set tindakan
 	Read Shortcut Set File	Baca berkas set pintasan
 	Import Matches	Impor kecocokan
 	Remember Import Matches	Ingat kecocokan impor
@@ -821,6 +822,9 @@
 	Stained Glass…	Kaca patri…
 	Texturizer…	Texturizer…
 	System Title Bar	Bilah judul sistem
+	VectorCraft Title Bar on Every Desktop	Bilah judul VectorCraft di setiap desktop
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Selama ditetapkan, variabel lingkungan VECTORCRAFT_TITLEBAR memilih bilah judul.
+	System Title Bar takes precedence over this option while it is on.	Selama aktif, Bilah judul sistem lebih diutamakan daripada opsi ini.
 	Exit	Keluar
 	Distort	Distorsi
 	Diffuse Glow…	Pendar difusi…
@@ -2931,6 +2935,9 @@ theme	Appearance	Tampilan
 	Asset Export Settings	Pengaturan ekspor aset
 	Assets	Aset
 	Export Assets	Ekspor aset
+	Export 3D Object	Ekspor objek 3D
+	3D Export Format	Format ekspor 3D
+	Export 3D Assets	Ekspor aset 3D
 	Remove Asset	Hapus aset
 	Rename Asset	Ganti nama aset
 	Fill Rule	Aturan isian
@@ -4002,7 +4009,7 @@ imageTrace	Outline	Kontur
 @plural	{n} stroke|{n} strokes	{n} goresan
 @msg	no library `{id}`	tidak ada pustaka `{id}`
 @msg	select some type first	pilih beberapa teks terlebih dahulu
-@msg	kerning must be a number, "auto", or "optical"	Kerning harus berupa angka, “auto”, atau “optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning harus berupa angka, “auto”, atau “optical”
 @msg	{_1} has no {_2} style	{_1} tidak memiliki gaya {_2}
 @msg	a layer couldn't be read	satu lapisan tidak dapat dibaca
 @msg	it has more than one artboard	memiliki lebih dari satu artboard
@@ -4177,7 +4184,7 @@ imageTrace	Outline	Kontur
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art, atau type
 @msg	artboard {0} does not exist	artboard {0} tidak ada
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	pada skala ini gambar berukuran {w} × {h} pt, melebihi kapasitas kanvas: pilih skala yang lebih kecil atau paskan ke artboard
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	sumbu harus "vertical", "horizontal", atau sudut dalam derajat, bukan `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis harus "vertical", "horizontal", atau sudut dalam derajat, bukan `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	background {other}: transparan, putih, hitam, atau warna seperti "#ff8800"
 @msg	bad color {v}	warna tidak valid {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio harus berupa angka dari 0,1 sampai 10
@@ -4327,6 +4334,8 @@ imageTrace	Outline	Kontur
 @msg	no such action set	tidak ada set tindakan seperti itu
 @msg	the action sets changed; nothing was deleted	set tindakan telah berubah; tidak ada yang dihapus
 @msg	no action set to save	tidak ada set tindakan untuk disimpan
+@msg	the action set file can't be read in full	file set tindakan tidak dapat dibaca seluruhnya
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	“{name}” dimuat: {n} langkah dilewati
 @msg	not an action set file	bukan file set tindakan
 @msg	the action set file is larger than 8 MiB	file set tindakan lebih besar dari 8 MiB
 @msg	the action set file holds more than 1,000 actions	file set tindakan berisi lebih dari 1.000 tindakan
@@ -4392,9 +4401,9 @@ imageTrace	Outline	Kontur
 @msg	replace: the object to replace was changed or deleted	ganti: objek yang akan diganti telah diubah atau dihapus
 @msg	pattern missing	pola hilang
 @msg	patterns nested too deeply are filled with mid-grey	pola yang bersarang terlalu dalam diisi dengan abu-abu tengah
-@msg	percent must be above 0 and at most 6400, not {p}	persen harus di atas 0 dan paling banyak 6400, bukan {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent harus di atas 0 dan paling banyak 6400, bukan {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	pilih warna, gradien, atau pola untuk disimpan sebagai swatch
-@msg	plane must be left, right or ground	bidang harus kiri, kanan, atau tanah
+@msg	plane must be left, right or ground	plane harus left, right, atau ground
 @msg	plug-in ABI: {0}	ABI plug-in: {0}
 @msg	plug-in exceeded its {0}	plug-in melampaui {0}-nya
 @msg	plug-in failed: {0}	plug-in gagal: {0}
@@ -4413,8 +4422,8 @@ imageTrace	Outline	Kontur
 @msg	result would exceed the canvas (coordinates out of range)	hasil akan melampaui kanvas (koordinat di luar rentang)
 @msg	objects can't be nested more than 32 deep	objek tidak dapat bersarang lebih dari 32 tingkat
 @msg	the SVG's elements are nested more than {0} deep	elemen SVG bersarang lebih dari {0} tingkat
-@msg	scale must be a number from {_1} to {_2}, not {_3}	skala harus berupa angka dari {_1} sampai {_2}, bukan {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	skala harus berupa angka dari {_1} sampai {_2}, bukan {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale harus berupa angka dari {_1} sampai {_2}, bukan {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale harus berupa angka dari {_1} sampai {_2}, bukan {s}
 @msg	select (or target) objects whose appearance isn't basic	pilih (atau jadikan target) objek yang penampilannya bukan dasar
 @msg	select a Live Paint group	pilih grup Live Paint
 @msg	select a blend	pilih blend
@@ -6243,6 +6252,7 @@ breakText	Glyphs	Glif
 	Reset Symbol Instance	Atur ulang instans simbol
 @msg	type must be static or dynamic, not {v}	type harus static atau dynamic, bukan {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` adalah simbol statis: setel dulu jenis simbolnya ke Dinamis
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Hanya warna solid isian dan goresan jalur, jalur majemuk, atau teks yang dipilih dalam instans simbol yang dapat diubah
 @msg	path must be a list of child indices	path harus berupa daftar indeks anak
 @msg	no object at path {shown} in the symbol's art	tidak ada objek di jalur {shown} dalam karya seni simbol
 @msg	give fill, stroke, opacity and/or blend	berikan fill, stroke, opacity dan/atau blend
@@ -6340,3 +6350,24 @@ breakText	Glyphs	Glif
 # 3D Box add-on
 	3D Box	Kotak 3D
 	3D Box Tool	Alat Kotak 3D
+
+# Safe Mode
+	Safe Mode…	Mode aman…
+	Safe Mode	Mode aman
+	Help › Safe Mode…	Bantuan › Mode aman…
+	Enable on Re-launch	Aktifkan saat dijalankan berikutnya
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Peluncuran terakhir VectorCraft berhenti saat plug-in {name} sedang dimuat. Plug-in itu mungkin bukan penyebabnya.
+	Disable and Continue	Nonaktifkan dan lanjutkan
+	Start Normally	Mulai secara normal
+	Start in Safe Mode	Mulai dalam mode aman
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft dalam mode aman: tidak ada plug-in yang dimuat atau dijalankan sampai aplikasi dimulai secara normal.
+	Disabled plug-ins	Plug-in yang dinonaktifkan
+	No plug-ins are disabled.	Tidak ada plug-in yang dinonaktifkan.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Mode aman aktif: plug-in tidak dimuat atau dijalankan sampai VectorCraft dimulai secara normal
+@msg	give `id` or `file` (see plugin.safeMode)	berikan `id` atau `file` (lihat plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	plug-in itu tidak dinonaktifkan (lihat plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Plug-in yang dinonaktifkan tidak dapat disimpan untuk peluncuran berikutnya
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Perluas tampilan: efek plug-in dalam seleksi tidak dapat diperluas dalam mode aman
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Sejajarkan ke grid piksel
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 3fe227ec7..f4b2bc65e 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -1087,6 +1087,14 @@ font-technology	Variable	Variabili
 	Export As SVG…	Esporta come SVG…
 	Export Asset	Esporta risorsa
 	Export Assets	Esporta risorse
+	Export 3D Object	Esporta oggetto 3D
+	3D Export Format	Formato di esportazione 3D
+	Export 3D Assets	Esporta risorse 3D
+@msg	{what} can't be exported in 3D: {e}	impossibile esportare {what} in 3D: {e}
+@msg	asset {id} isn't a 3D asset	la risorsa {id} non è una risorsa 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	la risorsa {id} è una risorsa 3D: la scrive assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	ancora nessuna risorsa 3D: raccogli prima un oggetto con un effetto 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	seleziona un oggetto con un effetto 3D (o indicane gli ID)
 	Export As…	Esporta come…
 	Export CSS	Esporta CSS
 	Export CSS…	Esporta CSS…
@@ -1746,6 +1754,7 @@ file-filter	Templates	Modelli
 	Line {line}	Riga {line}
 	Line {line}: {name}: {status}	Riga {line}: {name}: {status}
 	Imported. Press OK to keep the imported set.	Importato. Premi OK per mantenere il set importato.
+	Read Action Set File	Leggi file di set di azioni
 	Read Shortcut Set File	Leggi file di set di scelte rapide
 	Import Matches	Abbinamenti di importazione
 	Remember Import Matches	Ricorda abbinamenti di importazione
@@ -4021,7 +4030,7 @@ axis	Both	Entrambi
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
 @msg	no library `{id}`	nessuna libreria `{id}`
 @msg	select some type first	seleziona prima del testo
-@msg	kerning must be a number, "auto", or "optical"	La crenatura deve essere un numero, «auto» o «optical»
+@msg	kerning must be a number, "auto", or "optical"	kerning deve essere un numero, «auto» o «optical»
 @msg	the selection has no gradient fill	la selezione non ha una sfumatura di riempimento
 @msg	the selection has no gradient stroke	la selezione non ha una sfumatura di traccia
 @msg	the selection has no pattern fill	la selezione non ha un motivo di riempimento
@@ -4248,9 +4257,9 @@ axis	Both	Entrambi
 @msg	bad shortcut	scelta rapida non valida
 @msg	bad stream length	lunghezza dello stream non valida
 @msg	bad trailer	trailer non valido
-@msg	balance must be between 0 and 100	il bilanciamento deve essere compreso tra 0 e 100
+@msg	balance must be between 0 and 100	balance deve essere compreso tra 0 e 100
 @msg	batch step {_1} (`{id}`) failed: {e}	il passaggio {_1} del batch (`{id}`) non è riuscito: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	la luminosità deve essere dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness deve essere dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	impossibile codificare il documento: {0}
 @msg	can't parse shortcut `{c}`	impossibile interpretare la scelta rapida `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	impossibile interpretare la scelta rapida `{s}` per `{k}`
@@ -4275,7 +4284,7 @@ axis	Both	Entrambi
 @msg	compound paths can only contain paths	i tracciati composti possono contenere solo tracciati
 @msg	compressed (RLE) bitmaps can't be read yet	le bitmap compresse (RLE) non possono ancora essere lette
 @msg	damaged	danneggiato
-@msg	decimals must be {_1}–{_2} (got {_3})	i decimali devono essere {_1}–{_2} (ricevuto {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals deve essere {_1}–{_2} (ricevuto {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	dividi in un numero di sezioni da 1 a {MAX_PIECES}
 @msg	effect {k} is `{_1}`, not `{id}`	l'effetto {k} è `{_1}`, non `{id}`
 @msg	empty brush stroke	traccia di pennello vuota
@@ -4400,6 +4409,8 @@ axis	Both	Entrambi
 @msg	no such action set	set di azioni inesistente
 @msg	the action sets changed; nothing was deleted	i set di azioni sono cambiati; non è stato eliminato nulla
 @msg	no action set to save	nessun set di azioni da salvare
+@msg	the action set file can't be read in full	il file di set di azioni non può essere letto per intero
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Caricato “{name}”: {n} passaggio è stato omesso|Caricato “{name}”: {n} passaggi sono stati omessi
 @msg	not an action set file	non è un file di set di azioni
 @msg	the action set file is larger than 8 MiB	il file del set di azioni supera 8 MiB
 @msg	the action set file holds more than 1,000 actions	il file del set di azioni contiene più di 1.000 azioni
@@ -4474,7 +4485,7 @@ axis	Both	Entrambi
 @msg	replace: the object to replace was changed or deleted	replace: l’oggetto da sostituire è stato modificato o eliminato
 @msg	pattern missing	motivo mancante
 @msg	patterns nested too deeply are filled with mid-grey	i motivi annidati troppo in profondità vengono riempiti di grigio medio
-@msg	percent must be above 0 and at most 6400, not {p}	la percentuale deve essere maggiore di 0 e al massimo 6400, non {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent deve essere maggiore di 0 e al massimo 6400, non {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	scegli un colore, una sfumatura o un motivo da salvare come campione
 @msg	plane must be left, right or ground	plane deve essere left, right o ground
 @msg	plug-in ABI: {0}	ABI del plug-in: {0}
@@ -4495,8 +4506,8 @@ axis	Both	Entrambi
 @msg	result would exceed the canvas (coordinates out of range)	il risultato supererebbe l'area di disegno (coordinate fuori intervallo)
 @msg	objects can't be nested more than 32 deep	gli oggetti non possono essere nidificati oltre 32 livelli
 @msg	the SVG's elements are nested more than {0} deep	gli elementi dell'SVG sono nidificati oltre {0} livelli
-@msg	scale must be a number from {_1} to {_2}, not {_3}	la scala deve essere un numero da {_1} a {_2}, non {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	la scala deve essere un numero da {_1} a {_2}, non {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale deve essere un numero da {_1} a {_2}, non {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale deve essere un numero da {_1} a {_2}, non {s}
 @msg	select (or target) objects whose appearance isn't basic	seleziona (o imposta come destinazione) oggetti con un aspetto non di base
 @msg	select a Live Paint group	seleziona un gruppo di pittura dinamica
 @msg	select a blend	seleziona una fusione
@@ -4919,6 +4930,9 @@ effect	Soft	Morbido
 effect	Regular	Normale
 	Edge	Bordo
 	System Title Bar	Barra del titolo di sistema
+	VectorCraft Title Bar on Every Desktop	Barra del titolo di VectorCraft su ogni desktop
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Finché è impostata, la variabile d'ambiente VECTORCRAFT_TITLEBAR sceglie la barra del titolo.
+	System Title Bar takes precedence over this option while it is on.	Finché è attiva, Barra del titolo di sistema ha la precedenza su questa opzione.
 	Value Axis	Asse dei valori
 	On Left Side	Sul lato sinistro
 	On Right Side	Sul lato destro
@@ -4965,7 +4979,7 @@ effect	Regular	Normale
 @msg	before must name a panel	before deve indicare un pannello
 @msg	docking action contains an unknown panel or an excessive split path	L’azione di ancoraggio contiene un pannello sconosciuto o un percorso di divisioni troppo lungo
 @msg	group must be true or false	group deve essere true o false
-@msg	panel is not in a dock group	il pannello non è in un gruppo del dock
+@msg	panel is not in a dock group	panel non è in un gruppo del dock
 @msg	only a dock group above or below others collapses, not one beside another	si comprime solo un gruppo del dock sopra o sotto altri, non uno accanto
 @msg	icon must be true or false	icon deve essere true o false
 @msg	icon only docks a panel in the icon column, with no anchor	icon ancora un pannello solo nella colonna delle icone, senza anchor
@@ -6028,6 +6042,7 @@ breakText	Glyphs	Glifi
 	Reset Symbol Instance	Reimposta istanza di simbolo
 @msg	type must be static or dynamic, not {v}	type deve essere static o dynamic, non {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` è un simbolo statico: imposta prima il tipo di simbolo su Dinamico
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Di un tracciato, un tracciato composto o un testo selezionato in un'istanza di simbolo si può modificare solo il colore pieno di riempimento e traccia
 @msg	path must be a list of child indices	path deve essere un elenco di indici figlio
 @msg	no object at path {shown} in the symbol's art	nessun oggetto al percorso {shown} nella grafica del simbolo
 @msg	give fill, stroke, opacity and/or blend	specifica fill, stroke, opacity e/o blend
@@ -6125,3 +6140,25 @@ breakText	Glyphs	Glifi
 # 3D Box add-on
 	3D Box	Scatola 3D
 	3D Box Tool	Strumento Scatola 3D
+
+# Safe Mode
+	Safe Mode…	Modalità provvisoria…
+	Safe Mode	Modalità provvisoria
+	Help › Safe Mode…	Aiuto › Modalità provvisoria…
+	Enable on Re-launch	Attiva al prossimo avvio
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	L'ultimo avvio di VectorCraft si è interrotto durante il caricamento del plug-in {name}. Potrebbe non esserne la causa.
+	Disable and Continue	Disattiva e continua
+	Start Normally	Avvia normalmente
+	Start in Safe Mode	Avvia in modalità provvisoria
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft è in modalità provvisoria: nessun plug-in viene caricato o eseguito finché non si avvia normalmente.
+	Disabled plug-ins	Plug-in disattivati
+	No plug-ins are disabled.	Nessun plug-in disattivato.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	La modalità provvisoria è attiva: i plug-in non vengono caricati né eseguiti finché VectorCraft non si avvia normalmente
+@msg	give `id` or `file` (see plugin.safeMode)	indica `id` o `file` (vedi plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	quel plug-in non è disattivato (vedi plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Impossibile salvare i plug-in disattivati per il prossimo avvio
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Espandi aspetto: un effetto plug-in nella selezione non può essere espanso in modalità provvisoria
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Allinea alla griglia pixel
+@msg	only paths and compound paths can be aligned to the pixel grid	solo i tracciati e i tracciati composti possono essere allineati alla griglia pixel
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 6cfd36910..9a4f3232b 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -1589,6 +1589,14 @@ digits	Malayalam	マラヤーラム数字
 	PDF Print	印刷用 PDF
 	Export As	形式を指定して書き出し
 	Export Assets	アセットを書き出し
+	Export 3D Object	3D オブジェクトを書き出し
+	3D Export Format	3D 書き出し形式
+	Export 3D Assets	3D アセットを書き出し
+@msg	{what} can't be exported in 3D: {e}	{what} は 3D で書き出せません: {e}
+@msg	asset {id} isn't a 3D asset	アセット {id} は 3D アセットではありません
+@msg	asset {id} is a 3D asset: assets.export3D writes it	アセット {id} は 3D アセットです: assets.export3D で書き出します
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	3D アセットがまだありません: まず 3D 効果のあるオブジェクトを追加してください (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	3D 効果のあるオブジェクトを選択してください (または ID を指定)
 	Export CSS	CSS を書き出し
 	Export CSS…	CSS を書き出し…
 	Export DXF	DXF を書き出し
@@ -2008,6 +2016,7 @@ digits	Malayalam	マラヤーラム数字
 	Line {line}	{line} 行目
 	Line {line}: {name}: {status}	{line} 行目: {name}: {status}
 	Imported. Press OK to keep the imported set.	読み込みました。読み込んだセットを保持するには OK を押してください。
+	Read Action Set File	アクションセットファイルを読む
 	Read Shortcut Set File	ショートカットセットファイルを読む
 	Import Matches	読み込み時の対応付け
 	Remember Import Matches	読み込み時の対応付けを記憶
@@ -4115,14 +4124,14 @@ swatch	Bright Violet	ビビッドバイオレット
 @msg	The last start of VectorCraft ended on {name} before its window appeared, so it started on {summary}. To try that graphics processor again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	前回の VectorCraft の起動はウィンドウが表示される前に {name} で終了したため、{summary} で起動しました。このグラフィックプロセッサーをもう一度試すには、「環境設定 › パフォーマンス › グラフィックプロセッサー」を変更するか、WGPU_BACKEND を設定して起動してください
 @msg	The last start of VectorCraft ended while it listed the graphics processors, so it started on {summary} with OpenGL alone. To try the other graphics backends again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	前回の VectorCraft の起動はグラフィックプロセッサーの一覧を取得している間に終了したため、OpenGL のみを使って {summary} で起動しました。ほかのグラフィックバックエンドをもう一度試すには、「環境設定 › パフォーマンス › グラフィックプロセッサー」を変更するか、WGPU_BACKEND を設定して起動してください
 @msg	not a DXF drawing	DXF 図面ではありません
-@msg	scale must be a number from {_1} to {_2}, not {s}	縮尺は {_1} から {_2} までの数値にしてください ({s} は指定できません)
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale は {_1} から {_2} までの数値にしてください ({s} は指定できません)
 @msg	the artboard to fit must be a positive size up to {_1} pt	合わせる先のアートボードのサイズは 0 より大きく {_1} pt 以下にしてください
 @msg	the drawing has no layout `{_1}` (it has {_2})	図面にレイアウト `{_1}` はありません (含まれるレイアウト: {_2})
 @msg	this is a DWG drawing, which can't be read: save it from the CAD app as an ASCII DXF and open that	DWG 図面は読み込めません: CAD アプリで ASCII DXF として保存し、そのファイルを開いてください
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	この縮尺では図面が {w} × {h} pt になり、カンバスに収まりません: 縮尺を小さくするか、アートボードに合わせてください
 @msg	the scale is not a usable number	縮尺が有効な数値ではありません
 @msg	the drawing is too large to open	図面が大きすぎて開けません
-@msg	scale must be a number from {_1} to {_2}, not {_3}	縮尺は {_1} から {_2} までの数値にしてください ({_3} は指定できません)
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale は {_1} から {_2} までの数値にしてください ({_3} は指定できません)
 @msg	an image has no pixels and was left out	ピクセルがない画像を省略しました
 @msg	object {0} cannot have children	オブジェクト {0} には子オブジェクトを含められません
 @msg	range `{s}` is empty	範囲 `{s}` が空です
@@ -4240,7 +4249,7 @@ swatch	Bright Violet	ビビッドバイオレット
 @msg	{name}: no local header	{name}: ローカルヘッダーがありません
 @msg	Flatten Transparency: select objects to flatten	透明部分を分割・統合: 分割・統合するオブジェクトを選択してください
 @msg	Flatten Transparency: {e}	透明部分を分割・統合: {e}
-@msg	balance must be between 0 and 100	バランスは 0 から 100 までの値にしてください
+@msg	balance must be between 0 and 100	balance は 0 から 100 までの値にしてください
 @msg	resolutions must be between 1 and 2400 ppi	解像度は 1 から 2400 ppi までの値にしてください
 @msg	unknown preset `{name}` (high, medium, low or a saved one: see flattener.presets.list)	`{name}` は不明なプリセットです (high、medium、low、または保存したプリセット: flattener.presets.list を参照してください)
 @msg	`at` must be [x, y]	`at` は [x, y] の形式で指定してください
@@ -4410,7 +4419,7 @@ swatch	Bright Violet	ビビッドバイオレット
 @msg	no artboard {i} (0-based; the document has {_1})	アートボード {i} はありません (番号は 0 始まり、このドキュメントには {_1} 個あります)
 @msg	no selected slice in the image: select slices, or save all of them	画像内に選択されたスライスがありません: スライスを選択するか、すべてのスライスを保存してください
 @msg	nothing to save: the document has no visible art	保存するものがありません: ドキュメントに表示されているアートがありません
-@msg	percent must be above 0 and at most 6400, not {p}	パーセントは 0 より大きく 6400 以下にしてください ({p} は指定できません)
+@msg	percent must be above 0 and at most 6400, not {p}	percent は 0 より大きく 6400 以下にしてください ({p} は指定できません)
 @msg	unknown preset `{name}` (see webExport.presets.list)	`{name}` は不明なプリセットです (webExport.presets.list を参照してください)
 @msg	width and height are at least 1 pixel	幅と高さは 1 ピクセル以上にしてください
 @msg	`sampleSize` must be 1, 3 or 5	`sampleSize` は 1、3、5 のいずれかにしてください
@@ -4573,7 +4582,7 @@ swatch	Bright Violet	ビビッドバイオレット
 @msg	is not an image VectorCraft reads	VectorCraft で読み込める画像ではありません
 @msg	not found	見つかりません
 @msg	SVG parse error: {0}	SVG を解析できませんでした: {0}
-@msg	decimals must be {_1}–{_2} (got {_3})	小数点以下の桁数は {_1} から {_2} までにしてください (指定値: {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals は {_1} から {_2} までにしてください (指定値: {_3})
 @msg	Exporting {_1}	{_1} を書き出し中
 @msg	Packaging {_1}	{_1} をパッケージ中
 @msg	Placing {_1}	{_1} を配置中
@@ -4735,6 +4744,8 @@ swatch	Bright Violet	ビビッドバイオレット
 @msg	no such action set	指定されたアクションセットが見つかりません
 @msg	the action sets changed; nothing was deleted	アクションセットが変更されたため、何も削除しませんでした
 @msg	no action set to save	保存するアクションセットがありません
+@msg	the action set file can't be read in full	アクションセットファイルをすべて読み込めません
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	「{name}」を読み込みました。{n} 個のステップは省きました
 @msg	not an action set file	アクションセットファイルではありません
 @msg	the action set file is larger than 8 MiB	アクションセットファイルが 8 MiB を超えています
 @msg	the action set file holds more than 1,000 actions	アクションセットファイルのアクションが 1,000 個を超えています
@@ -4743,7 +4754,7 @@ swatch	Bright Violet	ビビッドバイオレット
 @msg	choose a folder to export to	書き出し先のフォルダーを選択してください
 @msg	the selection has no URL (or they differ)	選択したオブジェクトに URL がありません (または URL がそれぞれ異なります)
 @msg	select some type first	先にテキストを選択してください
-@msg	kerning must be a number, "auto", or "optical"	カーニングは数値、「auto」または「optical」にしてください
+@msg	kerning must be a number, "auto", or "optical"	kerning は数値、「auto」または「optical」にしてください
 @msg	the selection has no gradient fill	選択したオブジェクトに塗りのグラデーションがありません
 @msg	the selection has no gradient stroke	選択したオブジェクトに線のグラデーションがありません
 @msg	the selection has no pattern fill	選択したオブジェクトに塗りのパターンがありません
@@ -4961,6 +4972,9 @@ effect	Horizontal	水平
 effect	Vertical	垂直
 	Edge	エッジ
 	System Title Bar	システムのタイトルバー
+	VectorCraft Title Bar on Every Desktop	すべてのデスクトップで VectorCraft のタイトルバー
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	環境変数 VECTORCRAFT_TITLEBAR が設定されている間は、この変数でタイトルバーが決まります。
+	System Title Bar takes precedence over this option while it is on.	システムのタイトルバーがオンの間は、そちらがこのオプションより優先されます。
 	Value Axis	数値軸
 	On Left Side	左側
 	On Right Side	右側
@@ -5008,7 +5022,7 @@ effect	Vertical	垂直
 @msg	before must name a panel	before にパネルを指定してください
 @msg	docking action contains an unknown panel or an excessive split path	ドッキング操作に不明なパネルまたは長すぎる分割パスが含まれています
 @msg	group must be true or false	group は true または false にしてください
-@msg	panel is not in a dock group	パネルはドックのグループにありません
+@msg	panel is not in a dock group	panel はドックのグループにありません
 @msg	only a dock group above or below others collapses, not one beside another	折りたためるのは他のグループの上下にあるドックのグループだけで、横に並んだグループは折りたためません
 @msg	icon must be true or false	icon は true または false である必要があります
 @msg	icon only docks a panel in the icon column, with no anchor	icon はパネルをアイコン列にのみドッキングします（anchor なし）
@@ -6093,6 +6107,7 @@ breakText	Glyphs	字形
 	Reset Symbol Instance	シンボルインスタンスをリセット
 @msg	type must be static or dynamic, not {v}	type は static または dynamic にしてください({v} は無効です)
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` はスタティックシンボルです。先にシンボルの種類をダイナミックに設定してください
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	シンボルインスタンス内で選択したパス、複合パス、テキストは、塗りと線の単色のみ変更できます
 @msg	path must be a list of child indices	path は子のインデックスのリストにしてください
 @msg	no object at path {shown} in the symbol's art	シンボルのアートのパス {shown} にオブジェクトがありません
 @msg	give fill, stroke, opacity and/or blend	fill、stroke、opacity、blend のいずれかを指定してください
@@ -6190,3 +6205,25 @@ breakText	Glyphs	字形
 # 3D Box add-on
 	3D Box	3Dボックス
 	3D Box Tool	3Dボックスツール
+
+# Safe Mode
+	Safe Mode…	セーフモード…
+	Safe Mode	セーフモード
+	Help › Safe Mode…	ヘルプ › セーフモード…
+	Enable on Re-launch	次回起動時に有効にする
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	前回の VectorCraft の起動は、プラグイン {name} の読み込み中に停止しました。これが原因とは限りません。
+	Disable and Continue	無効にして続行
+	Start Normally	通常どおり起動
+	Start in Safe Mode	セーフモードで起動
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft はセーフモードです: 通常どおり起動するまで、プラグインは読み込まれず実行もされません。
+	Disabled plug-ins	無効なプラグイン
+	No plug-ins are disabled.	無効なプラグインはありません。
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	セーフモードがオンです: VectorCraft が通常どおり起動するまで、プラグインは読み込まれず実行もされません
+@msg	give `id` or `file` (see plugin.safeMode)	`id` または `file` を指定してください (plugin.safeMode を参照)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	そのプラグインは無効になっていません (plugin.safeMode を参照)
+@msg	Couldn't save the disabled plug-ins for the next launch	無効なプラグインを次回の起動用に保存できませんでした
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	アピアランスを分割: 選択範囲のプラグイン効果はセーフモードでは分割できません
+
+# Align to Pixel Grid
+	Align to Pixel Grid	ピクセルグリッドに整合
+@msg	only paths and compound paths can be aligned to the pixel grid	ピクセルグリッドに整合できるのはパスと複合パスのみです
diff --git a/crates/ui-egui/src/i18n/ka.tsv b/crates/ui-egui/src/i18n/ka.tsv
index b47e27cbd..4de7130cb 100644
--- a/crates/ui-egui/src/i18n/ka.tsv
+++ b/crates/ui-egui/src/i18n/ka.tsv
@@ -774,6 +774,9 @@
 	Stained Glass…	ვიტრაჟი…
 	Texturizer…	ტექსტურირება…
 	System Title Bar	სისტემის სათაურის ზოლი
+	VectorCraft Title Bar on Every Desktop	VectorCraft-ის სათაურის ზოლი ყველა სამუშაო მაგიდაზე
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	სანამ გარემოს ცვლადი VECTORCRAFT_TITLEBAR დაყენებულია, სათაურის ზოლს ის ირჩევს.
+	System Title Bar takes precedence over this option while it is on.	სანამ სისტემის სათაურის ზოლი ჩართულია, მას ამ პარამეტრზე უპირატესობა აქვს.
 	Exit	გასვლა
 	Distort	დეფორმაცია
 	Diffuse Glow…	გაბნეული ნათება…
@@ -2749,6 +2752,14 @@ theme	Appearance	იერსახე
 	Asset Export Settings	რესურსის ექსპორტის პარამეტრები
 	Assets	რესურსები
 	Export Assets	რესურსების ექსპორტირება
+	Export 3D Object	3D ობიექტის ექსპორტირება
+	3D Export Format	3D ექსპორტის ფორმატი
+	Export 3D Assets	3D რესურსების ექსპორტირება
+@msg	{what} can't be exported in 3D: {e}	{what} 3D-ში ვერ ექსპორტირდება: {e}
+@msg	asset {id} isn't a 3D asset	რესურსი {id} არ არის 3D რესურსი
+@msg	asset {id} is a 3D asset: assets.export3D writes it	რესურსი {id} 3D რესურსია: მას assets.export3D წერს
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	3D რესურსები ჯერ არ არის: ჯერ შეაგროვეთ 3D ეფექტის მქონე ობიექტი (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	აირჩიეთ 3D ეფექტის მქონე ობიექტი (ან მიუთითეთ მისი ID)
 	Remove Asset	რესურსის წაშლა
 	Rename Asset	რესურსის სახელის შეცვლა
 	Fill Rule	შევსების წესი
@@ -3773,7 +3784,7 @@ font-technology	Variable	ცვლადი
 @plural	{n} stroke|{n} strokes	კონტური: {n}
 @msg	no library `{id}`	ბიბლიოთეკა `{id}` არ არსებობს
 @msg	select some type first	ჯერ მონიშნეთ ტექსტი
-@msg	kerning must be a number, "auto", or "optical"	კერნინგი უნდა იყოს რიცხვი, „auto“ ან „optical“
+@msg	kerning must be a number, "auto", or "optical"	kerning უნდა იყოს რიცხვი, „auto“ ან „optical“
 @msg	the selection has no gradient fill	მონიშნულს შევსების გრადიენტი არ აქვს
 @msg	the selection has no gradient stroke	მონიშნულს კონტურის გრადიენტი არ აქვს
 @msg	the selection has no pattern fill	მონიშნულს შევსების პატერნი არ აქვს
@@ -4004,7 +4015,7 @@ font-technology	Variable	ცვლადი
 @msg	compound paths can only contain paths	შედგენილი ტრაექტორია მხოლოდ ტრაექტორიებს შეიძლება შეიცავდეს
 @msg	compressed (RLE) bitmaps can't be read yet	შეკუმშული (RLE) ბიტმაპების წაკითხვა ჯერ არ ხერხდება
 @msg	damaged	დაზიანებულია
-@msg	decimals must be {_1}–{_2} (got {_3})	ციფრები მძიმის შემდეგ უნდა იყოს {_1}–{_2} (მიღებულია {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals უნდა იყოს {_1}–{_2} (მიღებულია {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	დაყავით 1-დან {MAX_PIECES}-მდე ნაჭრად
 @msg	effect {k} is `{_1}`, not `{id}`	ეფექტი {k} არის `{_1}` და არა `{id}`
 @msg	empty brush stroke	ცარიელი ფუნჯის შტრიხი
@@ -4124,6 +4135,8 @@ font-technology	Variable	ცვლადი
 @msg	no such action set	ასეთი მოქმედებების ნაკრები არ არის
 @msg	the action sets changed; nothing was deleted	მოქმედებების ნაკრებები შეიცვალა; არაფერი წაშლილა
 @msg	no action set to save	შესანახი მოქმედებების ნაკრები არ არის
+@msg	the action set file can't be read in full	მოქმედებების ნაკრების ფაილის სრულად წაკითხვა შეუძლებელია
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	ჩაიტვირთა „{name}“; გამოტოვებული ნაბიჯები: {n}
 @msg	not an action set file	ეს არ არის მოქმედებების ნაკრების ფაილი
 @msg	the action set file is larger than 8 MiB	მოქმედებების ნაკრების ფაილი 8 MiB-ზე დიდია
 @msg	the action set file holds more than 1,000 actions	მოქმედებების ნაკრების ფაილი 1000-ზე მეტ მოქმედებას შეიცავს
@@ -4189,9 +4202,9 @@ font-technology	Variable	ცვლადი
 @msg	replace: the object to replace was changed or deleted	replace: ჩასანაცვლებელი ობიექტი შეიცვალა ან წაიშალა
 @msg	pattern missing	პატერნი აკლია
 @msg	patterns nested too deeply are filled with mid-grey	ზედმეტად ღრმად ჩადგმული პატერნები საშუალო ნაცრისფრით ივსება
-@msg	percent must be above 0 and at most 6400, not {p}	პროცენტი უნდა იყოს 0-ზე მეტი და არაუმეტეს 6400-ისა და არა {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent უნდა იყოს 0-ზე მეტი და არაუმეტეს 6400-ისა და არა {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	ფერის ნიმუშად შესანახად აირჩიეთ ფერი, გრადიენტი ან პატერნი
-@msg	plane must be left, right or ground	სიბრტყე უნდა იყოს left, right ან ground
+@msg	plane must be left, right or ground	plane უნდა იყოს left, right ან ground
 @msg	plug-in ABI: {0}	პლაგინის ABI: {0}
 @msg	plug-in exceeded its {0}	პლაგინმა გადააჭარბა ლიმიტს: {0}
 @msg	plug-in failed: {0}	პლაგინის შეცდომა: {0}
@@ -4208,8 +4221,8 @@ font-technology	Variable	ცვლადი
 @msg	recovery copy `{file}`: {e}	აღდგენის ასლი `{file}`: {e}
 @msg	resolutions must be between 1 and 2400 ppi	გარჩევადობა უნდა იყოს 1-დან 2400 ppi-მდე
 @msg	result would exceed the canvas (coordinates out of range)	შედეგი ტილოს გასცდება (კოორდინატები დიაპაზონს გარეთაა)
-@msg	scale must be a number from {_1} to {_2}, not {_3}	მასშტაბი უნდა იყოს რიცხვი {_1}-დან {_2}-მდე და არა {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	მასშტაბი უნდა იყოს რიცხვი {_1}-დან {_2}-მდე და არა {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale უნდა იყოს რიცხვი {_1}-დან {_2}-მდე და არა {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale უნდა იყოს რიცხვი {_1}-დან {_2}-მდე და არა {s}
 @msg	select (or target) objects whose appearance isn't basic	მონიშნეთ (ან მიზნად აირჩიეთ) ობიექტები, რომელთა იერსახე საბაზისო არ არის
 @msg	select a Live Paint group	მონიშნეთ ცოცხალი შეღებვის ჯგუფი
 @msg	select a blend	მონიშნეთ გადასვლა
@@ -4526,7 +4539,7 @@ font-technology	Variable	ცვლადი
 @msg	before must name a panel	before უნდა ასახელებდეს პანელს
 @msg	docking action contains an unknown panel or an excessive split path	მიმაგრების მოქმედება შეიცავს უცნობ პანელს ან ზედმეტად გრძელ გაყოფის გზას
 @msg	group must be true or false	group უნდა იყოს true ან false
-@msg	panel is not in a dock group	პანელი არ არის დოკის ჯგუფში
+@msg	panel is not in a dock group	panel არ არის დოკის ჯგუფში
 @msg	only a dock group above or below others collapses, not one beside another	იკეცება მხოლოდ სხვების ზემოთ ან ქვემოთ მდებარე დოკის ჯგუფი, არა სხვის გვერდით მდებარე
 @msg	icon must be true or false	icon უნდა იყოს true ან false
 @msg	icon only docks a panel in the icon column, with no anchor	icon პანელს მხოლოდ ხატულების სვეტში ამაგრებს, anchor-ის გარეშე
@@ -5101,6 +5114,7 @@ imageTrace	Outline	კონტური
 	Precise Cursors	ზუსტი კურსორები
 	Image Trace Preview	გამოსახულების ვექტორიზაციის წინასწარი ნახვა
 	Press a key…	დააჭირეთ კლავიშს…
+	Read Action Set File	მოქმედებების ნაკრების ფაილის წაკითხვა
 	Read Shortcut Set File	მალსახმობების ნაკრების ფაილის წაკითხვა
 	Ready	მზადაა
 	Remember Import Matches	იმპორტის შესაბამისობების დამახსოვრება
@@ -6405,6 +6419,7 @@ breakText	Glyphs	გლიფები
 	Reset Symbol Instance	სიმბოლოს ეგზემპლარის ჩამოყრა
 @msg	type must be static or dynamic, not {v}	type უნდა იყოს static ან dynamic და არა {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` სტატიკური სიმბოლოა: ჯერ სიმბოლოს ტიპად დააყენეთ „დინამიკური“
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	სიმბოლოს ეგზემპლარში მონიშნულ ტრაექტორიას, შედგენილ ტრაექტორიას ან ტექსტს მხოლოდ შევსებისა და კონტურის მთლიანი ფერი შეეცვლება
 @msg	path must be a list of child indices	path უნდა იყოს შვილობილი ინდექსების სია
 @msg	no object at path {shown} in the symbol's art	სიმბოლოს გრაფიკაში გზაზე {shown} ობიექტი არ არის
 @msg	give fill, stroke, opacity and/or blend	მიუთითეთ fill, stroke, opacity და/ან blend
@@ -6517,3 +6532,25 @@ font-script	Japanese	იაპონური
 # 3D Box add-on
 	3D Box	3D ყუთი
 	3D Box Tool	3D ყუთის ხელსაწყო
+
+# Safe Mode
+	Safe Mode…	უსაფრთხო რეჟიმი…
+	Safe Mode	უსაფრთხო რეჟიმი
+	Help › Safe Mode…	დახმარება › უსაფრთხო რეჟიმი…
+	Enable on Re-launch	ჩართვა შემდეგ გაშვებისას
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	VectorCraft-ის ბოლო გაშვება შეჩერდა, როცა პლაგინი {name} იტვირთებოდა. შესაძლოა, მიზეზი ის არ იყოს.
+	Disable and Continue	გამორთვა და გაგრძელება
+	Start Normally	ჩვეულებრივ გაშვება
+	Start in Safe Mode	უსაფრთხო რეჟიმში გაშვება
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft უსაფრთხო რეჟიმშია: პლაგინები არ იტვირთება და არ ეშვება, სანამ პროგრამა ჩვეულებრივ არ გაეშვება.
+	Disabled plug-ins	გამორთული პლაგინები
+	No plug-ins are disabled.	გამორთული პლაგინები არ არის.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	უსაფრთხო რეჟიმი ჩართულია: პლაგინები არ იტვირთება და არ ეშვება, სანამ VectorCraft ჩვეულებრივ არ გაეშვება
+@msg	give `id` or `file` (see plugin.safeMode)	მიუთითეთ `id` ან `file` (იხ. plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	ეს პლაგინი გამორთული არ არის (იხ. plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	გამორთული პლაგინების შენახვა შემდეგი გაშვებისთვის ვერ მოხერხდა
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	იერსახის გაშლა: მონიშნულში პლაგინის ეფექტის გაშლა უსაფრთხო რეჟიმში შეუძლებელია
+
+# Align to Pixel Grid
+	Align to Pixel Grid	პიქსელურ ბადეზე გასწორება
+@msg	only paths and compound paths can be aligned to the pixel grid	პიქსელურ ბადეზე მხოლოდ ტრაექტორიების და შედგენილი ტრაექტორიების გასწორებაა შესაძლებელი
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 667e93783..20855c036 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -1579,6 +1579,14 @@ digits	Malayalam	말라얄람어
 	PDF Print	인쇄용 PDF
 	Export As	다른 형식으로 내보내기
 	Export Assets	에셋 내보내기
+	Export 3D Object	3D 개체 내보내기
+	3D Export Format	3D 내보내기 형식
+	Export 3D Assets	3D 에셋 내보내기
+@msg	{what} can't be exported in 3D: {e}	{what}은(는) 3D로 내보낼 수 없습니다: {e}
+@msg	asset {id} isn't a 3D asset	에셋 {id}은(는) 3D 에셋이 아닙니다
+@msg	asset {id} is a 3D asset: assets.export3D writes it	에셋 {id}은(는) 3D 에셋입니다: assets.export3D로 내보냅니다
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	아직 3D 에셋이 없습니다: 먼저 3D 효과가 있는 개체를 수집하세요 (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	3D 효과가 있는 개체를 선택하세요 (또는 ID를 지정하세요)
 	Export CSS	CSS 내보내기
 	Export CSS…	CSS 내보내기…
 	Export DXF	DXF 내보내기
@@ -1954,6 +1962,7 @@ digits	Malayalam	말라얄람어
 	Line {line}	{line}행
 	Line {line}: {name}: {status}	{line}행: {name}: {status}
 	Imported. Press OK to keep the imported set.	가져왔습니다. 가져온 세트를 유지하려면 확인을 누르세요.
+	Read Action Set File	액션 세트 파일 읽기
 	Read Shortcut Set File	단축키 세트 파일 읽기
 	Import Matches	가져오기 대응
 	Remember Import Matches	가져오기 대응 기억
@@ -4042,14 +4051,14 @@ theme	Appearance	외관
 @msg	The last start of VectorCraft ended on {name} before its window appeared, so it started on {summary}. To try that graphics processor again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	지난번 VectorCraft 시작이 창이 나타나기 전에 {name}에서 끝나서 {summary}에서 시작했습니다. 이 그래픽 프로세서를 다시 시도하려면 환경 설정 › 성능 › 그래픽 프로세서를 변경하거나 WGPU_BACKEND를 설정하고 시작하세요
 @msg	The last start of VectorCraft ended while it listed the graphics processors, so it started on {summary} with OpenGL alone. To try the other graphics backends again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	지난번 VectorCraft 시작이 그래픽 프로세서 목록을 가져오는 중에 끝나서 OpenGL만 사용해 {summary}에서 시작했습니다. 다른 그래픽 백엔드를 다시 시도하려면 환경 설정 › 성능 › 그래픽 프로세서를 변경하거나 WGPU_BACKEND를 설정하고 시작하세요
 @msg	not a DXF drawing	DXF 도면이 아닙니다
-@msg	scale must be a number from {_1} to {_2}, not {s}	배율은 {_1}에서 {_2} 사이의 숫자여야 합니다: {s}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale은 {_1}에서 {_2} 사이의 숫자여야 합니다: {s}
 @msg	the artboard to fit must be a positive size up to {_1} pt	맞출 아트보드는 최대 {_1} pt까지의 양수 크기여야 합니다
 @msg	the drawing has no layout `{_1}` (it has {_2})	도면에 레이아웃 `{_1}`이(가) 없습니다(있는 레이아웃: {_2})
 @msg	this is a DWG drawing, which can't be read: save it from the CAD app as an ASCII DXF and open that	DWG 도면은 읽을 수 없습니다. CAD 앱에서 ASCII DXF로 저장한 후 여세요
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	이 배율에서는 도면이 {w} × {h} pt로 캔버스 크기를 넘습니다. 더 작은 배율을 고르거나 아트보드에 맞추세요
 @msg	the scale is not a usable number	배율이 사용할 수 없는 숫자입니다
 @msg	the drawing is too large to open	도면이 너무 커서 열 수 없습니다
-@msg	scale must be a number from {_1} to {_2}, not {_3}	배율은 {_1}에서 {_2} 사이의 숫자여야 합니다: {_3}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale은 {_1}에서 {_2} 사이의 숫자여야 합니다: {_3}
 @msg	an image has no pixels and was left out	픽셀이 없는 이미지를 제외했습니다
 @msg	object {0} cannot have children	개체 {0}에는 하위 항목을 둘 수 없습니다
 @msg	range `{s}` is empty	범위 `{s}`이(가) 비어 있습니다
@@ -4167,7 +4176,7 @@ theme	Appearance	외관
 @msg	{name}: no local header	{name}: 로컬 헤더가 없습니다
 @msg	Flatten Transparency: select objects to flatten	투명도 병합: 병합할 개체를 선택하세요
 @msg	Flatten Transparency: {e}	투명도 병합: {e}
-@msg	balance must be between 0 and 100	균형은 0에서 100 사이여야 합니다
+@msg	balance must be between 0 and 100	balance는 0에서 100 사이여야 합니다
 @msg	resolutions must be between 1 and 2400 ppi	해상도는 1에서 2400 ppi 사이여야 합니다
 @msg	unknown preset `{name}` (high, medium, low or a saved one: see flattener.presets.list)	알 수 없는 프리셋 `{name}`(high, medium, low 또는 저장된 프리셋: flattener.presets.list 참조)
 @msg	`at` must be [x, y]	`at`은 [x, y]여야 합니다
@@ -4242,7 +4251,7 @@ theme	Appearance	외관
 @msg	nothing to align	정렬할 항목이 없습니다
 @msg	select a clip group	클립 그룹을 선택하세요
 @msg	select two or more objects to distribute	분포할 개체를 두 개 이상 선택하세요
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	축은 "vertical", "horizontal" 또는 도 단위 각도여야 합니다: `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis는 "vertical", "horizontal" 또는 도 단위 각도여야 합니다: `{v}`
 @msg	give horizontal or vertical	horizontal 또는 vertical을 지정하세요
 @msg	selection has no bounds	선택 영역에 경계가 없습니다
 @msg	the top object must be a path, compound path or text object to use as a clipping mask	클리핑 마스크로 쓰려면 맨 위 개체가 패스, 컴파운드 패스 또는 텍스트 개체여야 합니다
@@ -4337,7 +4346,7 @@ theme	Appearance	외관
 @msg	no artboard {i} (0-based; the document has {_1})	아트보드 {i}이(가) 없습니다(0부터 시작, 문서의 아트보드 수: {_1})
 @msg	no selected slice in the image: select slices, or save all of them	이미지에 선택한 슬라이스가 없습니다. 슬라이스를 선택하거나 모두 저장하세요
 @msg	nothing to save: the document has no visible art	저장할 항목이 없습니다. 문서에 보이는 아트웍이 없습니다
-@msg	percent must be above 0 and at most 6400, not {p}	퍼센트는 0 초과 6400 이하여야 합니다: {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent는 0 초과 6400 이하여야 합니다: {p}
 @msg	unknown preset `{name}` (see webExport.presets.list)	알 수 없는 프리셋 `{name}`(webExport.presets.list 참조)
 @msg	width and height are at least 1 pixel	너비와 높이는 1픽셀 이상이어야 합니다
 @msg	`sampleSize` must be 1, 3 or 5	`sampleSize`는 1, 3 또는 5여야 합니다
@@ -4500,7 +4509,7 @@ theme	Appearance	외관
 @msg	is not an image VectorCraft reads	VectorCraft가 읽는 이미지가 아닙니다
 @msg	not found	찾을 수 없습니다
 @msg	SVG parse error: {0}	SVG 구문 분석 오류: {0}
-@msg	decimals must be {_1}–{_2} (got {_3})	소수 자릿수는 {_1}~{_2}이어야 합니다({_3} 입력됨)
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals는 {_1}~{_2}이어야 합니다({_3} 입력됨)
 @msg	Exporting {_1}	{_1} 내보내는 중
 @msg	Packaging {_1}	{_1} 패키지 만드는 중
 @msg	Placing {_1}	{_1} 가져오는 중
@@ -4558,7 +4567,7 @@ theme	Appearance	외관
 @msg	no preset editor	프리셋 편집기가 없습니다
 @msg	no perspective grid preset named `{name}`	`{name}`이라는 원근 격자 프리셋이 없습니다
 @msg	no active perspective plane	활성 원근 평면이 없습니다
-@msg	plane must be left, right or ground	평면은 왼쪽, 오른쪽 또는 바닥이어야 합니다
+@msg	plane must be left, right or ground	plane은 left, right 또는 ground여야 합니다
 @msg	missing `id` (see plugin.list)	`id`가 없습니다(plugin.list 참조)
 @msg	no plug-in {id} is installed	플러그인 {id}이(가) 설치되어 있지 않습니다
 @msg	{_1} is a live effect (Effect › Plug-ins)	{_1}은(는) 라이브 효과입니다(효과 › 플러그인)
@@ -4662,6 +4671,8 @@ theme	Appearance	외관
 @msg	no such action set	해당 액션 세트가 없습니다
 @msg	the action sets changed; nothing was deleted	액션 세트가 바뀌어 아무것도 삭제하지 않았습니다
 @msg	no action set to save	저장할 액션 세트가 없습니다
+@msg	the action set file can't be read in full	액션 세트 파일을 전부 읽을 수 없습니다
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	“{name}”을(를) 불러왔습니다. 단계 {n}개를 제외했습니다
 @msg	not an action set file	액션 세트 파일이 아닙니다
 @msg	the action set file is larger than 8 MiB	액션 세트 파일이 8 MiB보다 큽니다
 @msg	the action set file holds more than 1,000 actions	액션 세트 파일의 액션이 1,000개를 넘습니다
@@ -4670,7 +4681,7 @@ theme	Appearance	외관
 @msg	choose a folder to export to	내보낼 폴더를 선택하세요
 @msg	the selection has no URL (or they differ)	선택 항목에 URL이 없거나 서로 다릅니다
 @msg	select some type first	먼저 문자를 선택하세요
-@msg	kerning must be a number, "auto", or "optical"	커닝은 숫자, “auto” 또는 “optical”이어야 합니다
+@msg	kerning must be a number, "auto", or "optical"	kerning은 숫자, “auto” 또는 “optical”이어야 합니다
 @msg	the selection has no gradient fill	선택 항목에 칠 그레이디언트가 없습니다
 @msg	the selection has no gradient stroke	선택 항목에 선 그레이디언트가 없습니다
 @msg	the selection has no pattern fill	선택 항목에 칠 패턴이 없습니다
@@ -4888,6 +4899,9 @@ effect	Horizontal	가로
 effect	Vertical	세로
 	Edge	가장자리
 	System Title Bar	시스템 제목 표시줄
+	VectorCraft Title Bar on Every Desktop	모든 데스크톱에서 VectorCraft 제목 표시줄
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	환경 변수 VECTORCRAFT_TITLEBAR가 설정되어 있는 동안에는 이 변수가 제목 표시줄을 정합니다.
+	System Title Bar takes precedence over this option while it is on.	시스템 제목 표시줄이 켜져 있는 동안에는 그 설정이 이 옵션보다 우선합니다.
 	Value Axis	값 축
 	On Left Side	왼쪽
 	On Right Side	오른쪽
@@ -4933,7 +4947,7 @@ effect	Vertical	세로
 @msg	before must name a panel	before는 패널을 지정해야 합니다
 @msg	docking action contains an unknown panel or an excessive split path	도킹 동작에 알 수 없는 패널이나 지나치게 많은 분할 경로가 있습니다
 @msg	group must be true or false	group은 true 또는 false여야 합니다
-@msg	panel is not in a dock group	패널이 도크 그룹에 없습니다
+@msg	panel is not in a dock group	panel이 도크 그룹에 없습니다
 @msg	only a dock group above or below others collapses, not one beside another	다른 그룹의 위나 아래에 있는 도크 그룹만 접을 수 있으며, 옆에 있는 그룹은 접을 수 없습니다
 @msg	icon must be true or false	icon은 true 또는 false여야 합니다
 @msg	icon only docks a panel in the icon column, with no anchor	icon은 anchor 없이 패널을 아이콘 열에만 도킹합니다
@@ -5989,6 +6003,7 @@ breakText	Glyphs	글리프
 	Reset Symbol Instance	심볼 인스턴스 재설정
 @msg	type must be static or dynamic, not {v}	type은 static 또는 dynamic이어야 합니다({v}는 안 됨)
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}`은(는) 정적 심볼입니다. 먼저 심볼 유형을 동적으로 설정하세요
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	심볼 인스턴스에서 선택한 패스, 컴파운드 패스 또는 문자는 칠과 선의 단색만 변경할 수 있습니다
 @msg	path must be a list of child indices	path는 자식 인덱스 목록이어야 합니다
 @msg	no object at path {shown} in the symbol's art	심볼 아트의 경로 {shown}에 개체가 없습니다
 @msg	give fill, stroke, opacity and/or blend	fill, stroke, opacity 및/또는 blend를 지정하세요
@@ -6086,3 +6101,25 @@ breakText	Glyphs	글리프
 # 3D Box add-on
 	3D Box	3D 상자
 	3D Box Tool	3D 상자 도구
+
+# Safe Mode
+	Safe Mode…	안전 모드…
+	Safe Mode	안전 모드
+	Help › Safe Mode…	도움말 › 안전 모드…
+	Enable on Re-launch	다음 실행 시 활성화
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	지난번 VectorCraft 실행이 플러그인 {name}을(를) 불러오는 중에 중지되었습니다. 이 플러그인이 원인이 아닐 수도 있습니다.
+	Disable and Continue	비활성화하고 계속
+	Start Normally	정상적으로 시작
+	Start in Safe Mode	안전 모드로 시작
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft가 안전 모드입니다. 정상적으로 시작할 때까지 플러그인을 불러오거나 실행하지 않습니다.
+	Disabled plug-ins	비활성화된 플러그인
+	No plug-ins are disabled.	비활성화된 플러그인이 없습니다.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	안전 모드가 켜져 있습니다. VectorCraft가 정상적으로 시작할 때까지 플러그인을 불러오거나 실행하지 않습니다
+@msg	give `id` or `file` (see plugin.safeMode)	`id` 또는 `file`을 지정하세요(plugin.safeMode 참조)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	해당 플러그인은 비활성화되어 있지 않습니다(plugin.safeMode 참조)
+@msg	Couldn't save the disabled plug-ins for the next launch	비활성화된 플러그인을 다음 실행을 위해 저장할 수 없습니다
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	모양새 확장: 선택 항목의 플러그인 효과는 안전 모드에서 확장할 수 없습니다
+
+# Align to Pixel Grid
+	Align to Pixel Grid	픽셀 격자에 정렬
+@msg	only paths and compound paths can be aligned to the pixel grid	패스와 컴파운드 패스만 픽셀 격자에 정렬할 수 있습니다
diff --git a/crates/ui-egui/src/i18n/nl.tsv b/crates/ui-egui/src/i18n/nl.tsv
index bfbdef06c..b5affe48a 100644
--- a/crates/ui-egui/src/i18n/nl.tsv
+++ b/crates/ui-egui/src/i18n/nl.tsv
@@ -135,6 +135,7 @@
 	Report copied	Rapport gekopieerd
 	Line {line}	Regel {line}
 	Line {line}: {name}: {status}	Regel {line}: {name}: {status}
+	Read Action Set File	Actiesetbestand lezen
 	Read Shortcut Set File	Sneltoetsensetbestand lezen
 	Import Matches	Overeenkomsten importeren
 	Remember Import Matches	Importovereenkomsten onthouden
@@ -835,6 +836,9 @@
 	Stained Glass…	Glas in lood…
 	Texturizer…	Texturizer…
 	System Title Bar	Systeemtitelbalk
+	VectorCraft Title Bar on Every Desktop	VectorCraft-titelbalk op elk bureaublad
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Zolang de omgevingsvariabele VECTORCRAFT_TITLEBAR is ingesteld, kiest die de titelbalk.
+	System Title Bar takes precedence over this option while it is on.	Zolang Systeemtitelbalk is ingeschakeld, heeft die voorrang op deze optie.
 	Exit	Afsluiten
 	Distort	Vervormen
 	Diffuse Glow…	Diffuse gloed…
@@ -2945,6 +2949,9 @@ theme	Appearance	Vormgeving
 	Asset Export Settings	Exportinstellingen voor assets
 	Assets	Assets
 	Export Assets	Assets exporteren
+	Export 3D Object	3D-object exporteren
+	3D Export Format	3D-exportindeling
+	Export 3D Assets	3D-assets exporteren
 	Remove Asset	Asset verwijderen
 	Rename Asset	Asset hernoemen
 	Fill Rule	Vulregel
@@ -4016,7 +4023,7 @@ imageTrace	Outline	Contour
 @plural	{n} stroke|{n} strokes	{n} lijn|{n} lijnen
 @msg	no library `{id}`	geen bibliotheek `{id}`
 @msg	select some type first	selecteer eerst wat tekst
-@msg	kerning must be a number, "auto", or "optical"	Kerning moet een getal, ‘auto’ of ‘optical’ zijn
+@msg	kerning must be a number, "auto", or "optical"	kerning moet een getal, ‘auto’ of ‘optical’ zijn
 @msg	{_1} has no {_2} style	{_1} heeft geen {_2}stijl
 @msg	a layer couldn't be read	een laag kon niet worden gelezen
 @msg	it has more than one artboard	het heeft meer dan één tekengebied
@@ -4191,7 +4198,7 @@ imageTrace	Outline	Contour
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art of type
 @msg	artboard {0} does not exist	tekengebied {0} bestaat niet
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	bij deze schaal is de tekening {w} × {h} pt, meer dan het canvas kan bevatten: kies een kleinere schaal of pas de tekening aan op het tekengebied
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	as moet "vertical", "horizontal" of een hoek in graden zijn, niet `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis moet "vertical", "horizontal" of een hoek in graden zijn, niet `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	achtergrond {other}: transparant, wit, zwart of een kleur zoals "#ff8800"
 @msg	bad color {v}	onjuiste kleur {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio moet een getal van 0,1 tot 10 zijn
@@ -4200,9 +4207,9 @@ imageTrace	Outline	Contour
 @msg	bad shortcut	onjuiste sneltoets
 @msg	bad stream length	onjuiste streamlengte
 @msg	bad trailer	onjuiste trailer
-@msg	balance must be between 0 and 100	balans moet tussen 0 en 100 liggen
+@msg	balance must be between 0 and 100	balance moet tussen 0 en 100 liggen
 @msg	batch step {_1} (`{id}`) failed: {e}	batchstap {_1} (`{id}`) is mislukt: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	helderheid moet dark|mediumDark|mediumLight|light zijn
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness moet dark|mediumDark|mediumLight|light zijn
 @msg	can't encode the document: {0}	kan het document niet coderen: {0}
 @msg	can't parse shortcut `{c}`	kan sneltoets `{c}` niet parseren
 @msg	can't parse shortcut `{s}` for `{k}`	kan sneltoets `{s}` voor `{k}` niet parseren
@@ -4225,7 +4232,7 @@ imageTrace	Outline	Contour
 @msg	compound paths can only contain paths	samengestelde paden kunnen alleen paden bevatten
 @msg	compressed (RLE) bitmaps can't be read yet	gecomprimeerde (RLE) bitmaps kunnen nog niet gelezen worden
 @msg	damaged	beschadigd
-@msg	decimals must be {_1}–{_2} (got {_3})	decimalen moeten {_1}–{_2} zijn (kreeg {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals moet {_1}–{_2} zijn (kreeg {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	deel op in 1 tot {MAX_PIECES} slices
 @msg	effect {k} is `{_1}`, not `{id}`	effect {k} is `{_1}`, niet `{id}`
 @msg	empty brush stroke	lege penseelstreek
@@ -4339,6 +4346,8 @@ imageTrace	Outline	Contour
 @msg	no such action set	actieset bestaat niet
 @msg	the action sets changed; nothing was deleted	de actiesets zijn gewijzigd; er is niets verwijderd
 @msg	no action set to save	geen actieset om op te slaan
+@msg	the action set file can't be read in full	het actiesetbestand kan niet volledig worden gelezen
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	„{name}” geladen: {n} stap is weggelaten|„{name}” geladen: {n} stappen zijn weggelaten
 @msg	not an action set file	geen actiesetbestand
 @msg	the action set file is larger than 8 MiB	het actiesetbestand is groter dan 8 MiB
 @msg	the action set file holds more than 1,000 actions	het actiesetbestand bevat meer dan 1.000 acties
@@ -4404,9 +4413,9 @@ imageTrace	Outline	Contour
 @msg	replace: the object to replace was changed or deleted	vervangen: het te vervangen object is gewijzigd of verwijderd
 @msg	pattern missing	patroon ontbreekt
 @msg	patterns nested too deeply are filled with mid-grey	patronen die te diep genest zijn, worden gevuld met middelgrijs
-@msg	percent must be above 0 and at most 6400, not {p}	procent moet boven 0 en maximaal 6400 zijn, niet {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent moet boven 0 en maximaal 6400 zijn, niet {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	kies een kleur, verloop of patroon om als staal op te slaan
-@msg	plane must be left, right or ground	vlak moet links, rechts of grond zijn
+@msg	plane must be left, right or ground	plane moet left, right of ground zijn
 @msg	plug-in ABI: {0}	plug-in-ABI: {0}
 @msg	plug-in exceeded its {0}	plug-in overschreed zijn {0}
 @msg	plug-in failed: {0}	plug-in mislukt: {0}
@@ -4425,8 +4434,8 @@ imageTrace	Outline	Contour
 @msg	result would exceed the canvas (coordinates out of range)	het resultaat zou het canvas overschrijden (coördinaten buiten bereik)
 @msg	objects can't be nested more than 32 deep	objecten kunnen niet dieper dan 32 niveaus worden genest
 @msg	the SVG's elements are nested more than {0} deep	de elementen van de SVG zijn dieper dan {0} niveaus genest
-@msg	scale must be a number from {_1} to {_2}, not {_3}	schaal moet een getal van {_1} tot {_2} zijn, niet {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	schaal moet een getal van {_1} tot {_2} zijn, niet {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale moet een getal van {_1} tot {_2} zijn, niet {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale moet een getal van {_1} tot {_2} zijn, niet {s}
 @msg	select (or target) objects whose appearance isn't basic	selecteer (of richt je op) objecten waarvan de vormgeving niet basis is
 @msg	select a Live Paint group	selecteer een Live Paint-groep
 @msg	select a blend	selecteer een vermenging
@@ -4729,12 +4738,12 @@ imageTrace	Outline	Contour
 @msg	the PSD file's image data can't be read: {e}	de afbeeldingsgegevens van het PSD-bestand kunnen niet worden gelezen: {e}
 @msg	Imported library {name}	Bibliotheek {name} geïmporteerd
 @msg	Invalid panel layout; restored the default dock	Ongeldige paneelindeling; het standaarddok is hersteld
-@msg	action is required	actie is vereist
+@msg	action is required	action is vereist
 @msg	anchor must name a registered panel	anchor moet een geregistreerd paneel benoemen
 @msg	before must name a panel	before moet een paneel benoemen
 @msg	docking action contains an unknown panel or an excessive split path	dokactie bevat een onbekend paneel of een overmatig splitspad
 @msg	group must be true or false	group moet true of false zijn
-@msg	panel is not in a dock group	paneel staat niet in een dockgroep
+@msg	panel is not in a dock group	panel staat niet in een dockgroep
 @msg	only a dock group above or below others collapses, not one beside another	alleen een dockgroep boven of onder andere vouwt samen, niet een ernaast
 @msg	icon must be true or false	icon moet true of false zijn
 @msg	icon only docks a panel in the icon column, with no anchor	icon dockt een paneel alleen in de pictogramkolom, zonder anchor
@@ -6289,6 +6298,7 @@ breakText	Glyphs	Glyphs
 	Reset Symbol Instance	Symboolinstantie opnieuw instellen
 @msg	type must be static or dynamic, not {v}	type moet static of dynamic zijn, niet {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` is een statisch symbool: stel eerst het symbooltype in op Dynamisch
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Van een pad, samengesteld pad of tekst die in een symboolinstantie is geselecteerd, kan alleen de effen kleur van vulling en lijn veranderen
 @msg	path must be a list of child indices	path moet een lijst met onderliggende indexen zijn
 @msg	no object at path {shown} in the symbol's art	geen object op pad {shown} in de illustratie van het symbool
 @msg	give fill, stroke, opacity and/or blend	geef fill, stroke, opacity en/of blend op
@@ -6386,3 +6396,24 @@ breakText	Glyphs	Glyphs
 # 3D Box add-on
 	3D Box	3D-doos
 	3D Box Tool	3D-doosgereedschap
+
+# Safe Mode
+	Safe Mode…	Veilige modus…
+	Safe Mode	Veilige modus
+	Help › Safe Mode…	Help › Veilige modus…
+	Enable on Re-launch	Inschakelen bij volgende start
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	De laatste start van VectorCraft stopte terwijl de plug-in {name} werd geladen. Deze is mogelijk niet de oorzaak.
+	Disable and Continue	Uitschakelen en doorgaan
+	Start Normally	Normaal starten
+	Start in Safe Mode	Starten in veilige modus
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft is in veilige modus: er worden geen plug-ins geladen of uitgevoerd totdat het normaal start.
+	Disabled plug-ins	Uitgeschakelde plug-ins
+	No plug-ins are disabled.	Er zijn geen plug-ins uitgeschakeld.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Veilige modus is aan: plug-ins worden niet geladen of uitgevoerd totdat VectorCraft normaal start
+@msg	give `id` or `file` (see plugin.safeMode)	geef `id` of `file` op (zie plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	die plug-in is niet uitgeschakeld (zie plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	De uitgeschakelde plug-ins konden niet worden opgeslagen voor de volgende start
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Vormgeving uitbreiden: een plug-in-effect in de selectie kan niet worden uitgebreid in veilige modus
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Uitlijnen op pixelraster
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 7727b0c87..ffc9e7455 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -836,6 +836,9 @@
 	Stained Glass…	Witraż…
 	Texturizer…	Teksturowanie…
 	System Title Bar	Systemowy pasek tytułu
+	VectorCraft Title Bar on Every Desktop	Pasek tytułu VectorCraft na każdym pulpicie
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Dopóki zmienna środowiskowa VECTORCRAFT_TITLEBAR jest ustawiona, to ona wybiera pasek tytułu.
+	System Title Bar takes precedence over this option while it is on.	Dopóki Systemowy pasek tytułu jest włączony, ma pierwszeństwo przed tą opcją.
 	Exit	Zakończ
 	Distort	Zniekształcenie
 	Diffuse Glow…	Rozproszony blask…
@@ -3066,6 +3069,14 @@ theme	Appearance	Wygląd
 	Asset Export Settings	Ustawienia eksportu zasobów
 	Assets	Zasoby
 	Export Assets	Eksportuj zasoby
+	Export 3D Object	Eksportuj obiekt 3D
+	3D Export Format	Format eksportu 3D
+	Export 3D Assets	Eksportuj zasoby 3D
+@msg	{what} can't be exported in 3D: {e}	nie można wyeksportować {what} w 3D: {e}
+@msg	asset {id} isn't a 3D asset	zasób {id} nie jest zasobem 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	zasób {id} jest zasobem 3D: zapisuje go assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	brak zasobów 3D: najpierw zbierz obiekt z efektem 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	zaznacz obiekt z efektem 3D (lub podaj jego identyfikatory)
 	Remove Asset	Usuń zasób
 	Rename Asset	Zmień nazwę zasobu
 	Fill Rule	Reguła wypełniania
@@ -4110,7 +4121,7 @@ imageTrace	Outline	Kontur
 @plural	{n} stroke|{n} strokes	{n} obrys|{n} obrysy|{n} obrysów
 @msg	no library `{id}`	brak biblioteki `{id}`
 @msg	select some type first	najpierw zaznacz tekst
-@msg	kerning must be a number, "auto", or "optical"	Kerning musi być liczbą, „auto” lub „optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning musi być liczbą, „auto” lub „optical”
 @msg	the selection has no gradient fill	zaznaczenie nie ma gradientu wypełnienia
 @msg	the selection has no gradient stroke	zaznaczenie nie ma gradientu obrysu
 @msg	the selection has no pattern fill	zaznaczenie nie ma wzorka wypełnienia
@@ -4322,7 +4333,7 @@ imageTrace	Outline	Kontur
 @msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art lub type
 @msg	artboard {0} does not exist	obszar kompozycji {0} nie istnieje
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	w tej skali rysunek ma {w} × {h} pt, więcej niż mieści płótno: wybierz mniejszą skalę lub dopasuj go do obszaru kompozycji
-@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	oś musi mieć wartość "vertical", "horizontal" lub kąt w stopniach, nie `{v}`
+@msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis musi mieć wartość "vertical", "horizontal" lub kąt w stopniach, nie `{v}`
 @msg	background {other}: transparent, white, black or a colour such as "#ff8800"	tło {other}: transparent, white, black lub kolor, np. "#ff8800"
 @msg	bad color {v}	nieprawidłowy kolor {v}
 @msg	videoRulerPixelAspectRatio must be a number from 0.1 to 10	videoRulerPixelAspectRatio musi być liczbą od 0,1 do 10
@@ -4336,9 +4347,9 @@ imageTrace	Outline	Kontur
 @msg	bad shortcut	nieprawidłowy skrót
 @msg	bad stream length	nieprawidłowa długość strumienia
 @msg	bad trailer	nieprawidłowa sekcja trailer
-@msg	balance must be between 0 and 100	równowaga musi mieścić się w zakresie od 0 do 100
+@msg	balance must be between 0 and 100	balance musi mieścić się w zakresie od 0 do 100
 @msg	batch step {_1} (`{id}`) failed: {e}	krok wsadowy {_1} (`{id}`) nie powiódł się: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	jasność musi mieć wartość dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness musi mieć wartość dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	nie można zakodować dokumentu: {0}
 @msg	can't parse shortcut `{c}`	nie można przeanalizować skrótu `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	nie można przeanalizować skrótu `{s}` dla `{k}`
@@ -4363,7 +4374,7 @@ imageTrace	Outline	Kontur
 @msg	compound paths can only contain paths	ścieżki złożone mogą zawierać tylko ścieżki
 @msg	compressed (RLE) bitmaps can't be read yet	skompresowanych bitmap (RLE) nie można jeszcze odczytać
 @msg	damaged	uszkodzony
-@msg	decimals must be {_1}–{_2} (got {_3})	liczba miejsc dziesiętnych musi wynosić {_1}–{_2} (podano {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals musi wynosić {_1}–{_2} (podano {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	podziel na od 1 do {MAX_PIECES} plasterków
 @msg	effect {k} is `{_1}`, not `{id}`	efekt {k} to `{_1}`, nie `{id}`
 @msg	empty brush stroke	puste pociągnięcie pędzla
@@ -4381,9 +4392,9 @@ imageTrace	Outline	Kontur
 @msg	an image has no pixels and was left out	pominięto obraz bez pikseli
 @msg	image data `{_1}` is missing	brak danych obrazu `{_1}`
 @msg	image would be too large; lower the resolution	obraz byłby zbyt duży; zmniejsz rozdzielczość
-@msg	index must be a number or first, previous, next or last	indeks musi być liczbą lub first, previous, next albo last
-@msg	index must be a number or first, previous, next or last, not `{other}`	indeks musi być liczbą lub first, previous, next albo last, nie `{other}`
-@msg	index must be ≥ 0	indeks nie może być ujemny
+@msg	index must be a number or first, previous, next or last	index musi być liczbą lub first, previous, next albo last
+@msg	index must be a number or first, previous, next or last, not `{other}`	index musi być liczbą lub first, previous, next albo last, nie `{other}`
+@msg	index must be ≥ 0	index musi być ≥ 0
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	instalacja ze ścieżki nie jest dostępna w wersji webowej; przekaż moduł jako `dataBase64`
 @msg	internal error in `{cmd}`: {msg} (the document was left as it was before; please report this bug)	błąd wewnętrzny w `{cmd}`: {msg} (dokument pozostał bez zmian; zgłoś ten błąd)
 @msg	internal error: {msg} (please report this bug)	błąd wewnętrzny: {msg} (zgłoś ten błąd)
@@ -4488,6 +4499,8 @@ imageTrace	Outline	Kontur
 @msg	no such action set	brak takiego zestawu operacji
 @msg	the action sets changed; nothing was deleted	zestawy operacji się zmieniły; nic nie usunięto
 @msg	no action set to save	brak zestawu operacji do zapisania
+@msg	the action set file can't be read in full	nie można odczytać całego pliku zestawu operacji
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Wczytano „{name}”: pominięto {n} krok|Wczytano „{name}”: pominięto {n} kroki|Wczytano „{name}”: pominięto {n} kroków
 @msg	not an action set file	to nie jest plik zestawu operacji
 @msg	the action set file is larger than 8 MiB	plik zestawu operacji jest większy niż 8 MiB
 @msg	the action set file holds more than 1,000 actions	plik zestawu operacji zawiera ponad 1000 operacji
@@ -4563,9 +4576,9 @@ imageTrace	Outline	Kontur
 @msg	replace: the object to replace was changed or deleted	replace: obiekt do zastąpienia został zmieniony lub usunięty
 @msg	pattern missing	brak wzorka
 @msg	patterns nested too deeply are filled with mid-grey	zbyt głęboko zagnieżdżone wzorki są wypełniane średnią szarością
-@msg	percent must be above 0 and at most 6400, not {p}	procent musi być większy od 0 i nie większy niż 6400, nie {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent musi być większy od 0 i nie większy niż 6400, nie {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	wybierz kolor, gradient lub wzorek do zapisania jako próbka
-@msg	plane must be left, right or ground	płaszczyzna musi mieć wartość left, right lub ground
+@msg	plane must be left, right or ground	plane musi mieć wartość left, right lub ground
 @msg	plug-in ABI: {0}	ABI wtyczki: {0}
 @msg	plug-in exceeded its {0}	wtyczka przekroczyła swój limit: {0}
 @msg	plug-in failed: {0}	wtyczka zawiodła: {0}
@@ -4584,8 +4597,8 @@ imageTrace	Outline	Kontur
 @msg	result would exceed the canvas (coordinates out of range)	wynik wykroczyłby poza płótno (współrzędne poza zakresem)
 @msg	objects can't be nested more than 32 deep	obiektów nie można zagnieżdżać głębiej niż na 32 poziomy
 @msg	the SVG's elements are nested more than {0} deep	elementy SVG są zagnieżdżone głębiej niż na {0} poziomów
-@msg	scale must be a number from {_1} to {_2}, not {_3}	skala musi być liczbą od {_1} do {_2}, nie {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	skala musi być liczbą od {_1} do {_2}, nie {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale musi być liczbą od {_1} do {_2}, nie {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale musi być liczbą od {_1} do {_2}, nie {s}
 @msg	select (or target) objects whose appearance isn't basic	zaznacz (lub wskaż) obiekty, których wygląd nie jest podstawowy
 @msg	select a Live Paint group	zaznacz grupę aktywnego malowania
 @msg	select a blend	zaznacz przejście
@@ -5057,6 +5070,7 @@ imageTrace	Outline	Kontur
 	Report copied	Skopiowano raport
 	Line {line}	Wiersz {line}
 	Line {line}: {name}: {status}	Wiersz {line}: {name}: {status}
+	Read Action Set File	Odczytaj plik zestawu operacji
 	Read Shortcut Set File	Odczytaj plik zestawu skrótów
 	Import Matches	Dopasowania importu
 	Remember Import Matches	Zapamiętaj dopasowania importu
@@ -6263,6 +6277,7 @@ breakText	Glyphs	Glify
 	Reset Symbol Instance	Resetuj wystąpienie symbolu
 @msg	type must be static or dynamic, not {v}	type musi mieć wartość static lub dynamic, a nie {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` jest symbolem statycznym: najpierw ustaw jego typ symbolu na Dynamiczny
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	W ścieżce, ścieżce złożonej lub tekście zaznaczonym w wystąpieniu symbolu można zmienić tylko jednolity kolor wypełnienia i obrysu
 @msg	path must be a list of child indices	path musi być listą indeksów elementów podrzędnych
 @msg	no object at path {shown} in the symbol's art	brak obiektu w ścieżce {shown} w grafice symbolu
 @msg	give fill, stroke, opacity and/or blend	podaj fill, stroke, opacity i/lub blend
@@ -6360,3 +6375,25 @@ breakText	Glyphs	Glify
 # 3D Box add-on
 	3D Box	Bryła 3D
 	3D Box Tool	Narzędzie Bryła 3D
+
+# Safe Mode
+	Safe Mode…	Tryb awaryjny…
+	Safe Mode	Tryb awaryjny
+	Help › Safe Mode…	Pomoc › Tryb awaryjny…
+	Enable on Re-launch	Włącz przy następnym uruchomieniu
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Ostatnie uruchomienie programu VectorCraft zatrzymało się podczas wczytywania wtyczki {name}. Może ona nie być przyczyną.
+	Disable and Continue	Wyłącz i kontynuuj
+	Start Normally	Uruchom normalnie
+	Start in Safe Mode	Uruchom w trybie awaryjnym
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft działa w trybie awaryjnym: żadne wtyczki nie są wczytywane ani uruchamiane, dopóki program nie zostanie uruchomiony normalnie.
+	Disabled plug-ins	Wyłączone wtyczki
+	No plug-ins are disabled.	Żadna wtyczka nie jest wyłączona.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Tryb awaryjny jest włączony: wtyczki nie są wczytywane ani uruchamiane, dopóki VectorCraft nie zostanie uruchomiony normalnie
+@msg	give `id` or `file` (see plugin.safeMode)	podaj `id` lub `file` (patrz plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	ta wtyczka nie jest wyłączona (patrz plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Nie można zapisać wyłączonych wtyczek na następne uruchomienie
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Rozszerz wygląd: efektu wtyczki w zaznaczeniu nie można rozszerzyć w trybie awaryjnym
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Wyrównaj do siatki pikseli
+@msg	only paths and compound paths can be aligned to the pixel grid	do siatki pikseli można wyrównać tylko ścieżki i ścieżki złożone
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index df74f0a86..1bedaa9d6 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -974,6 +974,14 @@
 	Export As PNG…	Exportar Como PNG…
 	Export As SVG…	Exportar Como SVG…
 	Export Assets	Exportar Ativos
+	Export 3D Object	Exportar Objeto 3D
+	3D Export Format	Formato de Exportação 3D
+	Export 3D Assets	Exportar Ativos 3D
+@msg	{what} can't be exported in 3D: {e}	não é possível exportar {what} em 3D: {e}
+@msg	asset {id} isn't a 3D asset	o ativo {id} não é um ativo 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	o ativo {id} é um ativo 3D: assets.export3D o grava
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	ainda não há ativos 3D: colete primeiro um objeto com um efeito 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	selecione um objeto com um efeito 3D (ou informe seus ids)
 	Export As…	Exportar Como…
 	Export CSS	Exportar CSS
 	Export CSS…	Exportar CSS…
@@ -3272,6 +3280,9 @@ imageTrace	Outline	Contorno
 	Stained Glass…	Vitral…
 	Texturizer…	Texturizador…
 	System Title Bar	Barra de título do sistema
+	VectorCraft Title Bar on Every Desktop	Barra de título do VectorCraft em todas as áreas de trabalho
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Enquanto estiver definida, a variável de ambiente VECTORCRAFT_TITLEBAR escolhe a barra de título.
+	System Title Bar takes precedence over this option while it is on.	Enquanto estiver ativada, Barra de título do sistema tem prioridade sobre esta opção.
 	Exit	Sair
 	Distort	Distorcer
 	Diffuse Glow…	Brilho difuso…
@@ -3787,7 +3798,7 @@ axis	Both	Ambos
 @msg	bad shortcut	atalho inválido
 @msg	bad stream length	comprimento de fluxo inválido
 @msg	bad trailer	trailer inválido
-@msg	balance must be between 0 and 100	o equilíbrio deve estar entre 0 e 100
+@msg	balance must be between 0 and 100	balance deve estar entre 0 e 100
 @msg	batch step {_1} (`{id}`) failed: {e}	a etapa {_1} do lote (`{id}`) falhou: {e}
 @msg	brightness must be dark|mediumDark|mediumLight|light	brightness deve ser dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	não foi possível codificar o documento: {0}
@@ -3814,7 +3825,7 @@ axis	Both	Ambos
 @msg	compound paths can only contain paths	traçados compostos só podem conter traçados
 @msg	compressed (RLE) bitmaps can't be read yet	bitmaps compactados (RLE) ainda não podem ser lidos
 @msg	damaged	danificado
-@msg	decimals must be {_1}–{_2} (got {_3})	as casas decimais devem estar entre {_1} e {_2} (recebido {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals deve estar entre {_1} e {_2} (recebido {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	divida em 1 a {MAX_PIECES} fatias
 @msg	effect {k} is `{_1}`, not `{id}`	o efeito {k} é `{_1}`, não `{id}`
 @msg	empty brush stroke	traço de pincel vazio
@@ -3938,6 +3949,8 @@ axis	Both	Ambos
 @msg	no such action set	conjunto de ações inexistente
 @msg	the action sets changed; nothing was deleted	os conjuntos de ações mudaram; nada foi excluído
 @msg	no action set to save	nenhum conjunto de ações para salvar
+@msg	the action set file can't be read in full	o arquivo de conjunto de ações não pode ser lido por inteiro
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	“{name}” carregado: {n} etapa foi omitida|“{name}” carregado: {n} etapas foram omitidas
 @msg	not an action set file	não é um arquivo de conjunto de ações
 @msg	the action set file is larger than 8 MiB	o arquivo de conjunto de ações tem mais de 8 MiB
 @msg	the action set file holds more than 1,000 actions	o arquivo de conjunto de ações contém mais de 1.000 ações
@@ -4010,7 +4023,7 @@ axis	Both	Ambos
 @msg	replace: the object to replace was changed or deleted	replace: o objeto a ser substituído foi alterado ou excluído
 @msg	pattern missing	padrão ausente
 @msg	patterns nested too deeply are filled with mid-grey	padrões aninhados com profundidade excessiva são preenchidos com cinza médio
-@msg	percent must be above 0 and at most 6400, not {p}	a porcentagem deve ser maior que 0 e no máximo 6400, não {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent deve ser maior que 0 e no máximo 6400, não {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	escolha uma cor, gradiente ou padrão para salvar como amostra
 @msg	plane must be left, right or ground	plane deve ser left, right ou ground
 @msg	plug-in ABI: {0}	ABI do plug-in: {0}
@@ -4031,8 +4044,8 @@ axis	Both	Ambos
 @msg	result would exceed the canvas (coordinates out of range)	o resultado excederia a tela (coordenadas fora do intervalo)
 @msg	objects can't be nested more than 32 deep	os objetos não podem ser aninhados em mais de 32 níveis
 @msg	the SVG's elements are nested more than {0} deep	os elementos do SVG estão aninhados em mais de {0} níveis
-@msg	scale must be a number from {_1} to {_2}, not {_3}	a escala deve ser um número de {_1} a {_2}, não {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	a escala deve ser um número de {_1} a {_2}, não {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale deve ser um número de {_1} a {_2}, não {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale deve ser um número de {_1} a {_2}, não {s}
 @msg	select (or target) objects whose appearance isn't basic	selecione (ou direcione) objetos cuja aparência não seja básica
 @msg	select a Live Paint group	selecione um grupo de Pintura dinâmica
 @msg	select a blend	selecione uma mesclagem
@@ -4374,7 +4387,7 @@ axis	Both	Ambos
 @msg	before must name a panel	before deve nomear um painel
 @msg	docking action contains an unknown panel or an excessive split path	a ação de encaixe contém um painel desconhecido ou um caminho de divisão excessivo
 @msg	group must be true or false	group deve ser true ou false
-@msg	panel is not in a dock group	o painel não está em um grupo do encaixe
+@msg	panel is not in a dock group	panel não está em um grupo do encaixe
 @msg	only a dock group above or below others collapses, not one beside another	só um grupo do encaixe acima ou abaixo de outros é recolhido, não um ao lado
 @msg	icon must be true or false	icon deve ser true ou false
 @msg	icon only docks a panel in the icon column, with no anchor	icon apenas encaixa um painel na coluna de ícones, sem anchor
@@ -4695,6 +4708,7 @@ axis	Both	Ambos
 	Report copied	Relatório copiado
 	Line {line}	Linha {line}
 	Line {line}: {name}: {status}	Linha {line}: {name}: {status}
+	Read Action Set File	Ler Arquivo de Conjunto de Ações
 	Read Shortcut Set File	Ler Arquivo de Conjunto de Atalhos
 	Import Matches	Importar Correspondências
 	Remember Import Matches	Lembrar Correspondências de Importação
@@ -6326,6 +6340,7 @@ breakText	Glyphs	Glifos
 	Reset Symbol Instance	Redefinir instância de símbolo
 @msg	type must be static or dynamic, not {v}	type deve ser static ou dynamic, não {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` é um símbolo estático: defina primeiro o tipo de símbolo como Dinâmico
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	De um caminho, caminho composto ou texto selecionado em uma instância de símbolo só é possível alterar a cor sólida do preenchimento e do traçado
 @msg	path must be a list of child indices	path deve ser uma lista de índices de filhos
 @msg	no object at path {shown} in the symbol's art	nenhum objeto no caminho {shown} na arte do símbolo
 @msg	give fill, stroke, opacity and/or blend	informe fill, stroke, opacity e/ou blend
@@ -6578,3 +6593,25 @@ swatch	Yellow Green	Verde-amarelado
 # 3D Box add-on
 	3D Box	Caixa 3D
 	3D Box Tool	Ferramenta Caixa 3D
+
+# Safe Mode
+	Safe Mode…	Modo de Segurança…
+	Safe Mode	Modo de Segurança
+	Help › Safe Mode…	Ajuda › Modo de Segurança…
+	Enable on Re-launch	Ativar na Próxima Inicialização
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	A última inicialização do VectorCraft parou enquanto o plug-in {name} era carregado. Ele pode não ser a causa.
+	Disable and Continue	Desativar e Continuar
+	Start Normally	Iniciar Normalmente
+	Start in Safe Mode	Iniciar no Modo de Segurança
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	O VectorCraft está no Modo de Segurança: nenhum plug-in é carregado ou executado até que ele seja iniciado normalmente.
+	Disabled plug-ins	Plug-ins desativados
+	No plug-ins are disabled.	Nenhum plug-in está desativado.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	O Modo de Segurança está ativado: os plug-ins não são carregados nem executados até que o VectorCraft seja iniciado normalmente
+@msg	give `id` or `file` (see plugin.safeMode)	informe `id` ou `file` (veja plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	esse plug-in não está desativado (veja plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Não foi possível salvar os plug-ins desativados para a próxima inicialização
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Expandir aparência: um efeito de plug-in na seleção não pode ser expandido no Modo de Segurança
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Alinhar à Grade de Pixels
+@msg	only paths and compound paths can be aligned to the pixel grid	somente caminhos e caminhos compostos podem ser alinhados à grade de pixels
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 307113d4a..4e61dae5f 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -1084,6 +1084,14 @@ font-technology	Variable	Вариативные
 	Export As SVG…	Экспортировать как SVG…
 	Export Asset	Экспортировать ресурс
 	Export Assets	Экспортировать ресурсы
+	Export 3D Object	Экспортировать 3D-объект
+	3D Export Format	Формат 3D-экспорта
+	Export 3D Assets	Экспортировать 3D-ресурсы
+@msg	{what} can't be exported in 3D: {e}	{what} невозможно экспортировать в 3D: {e}
+@msg	asset {id} isn't a 3D asset	ресурс {id} не является 3D-ресурсом
+@msg	asset {id} is a 3D asset: assets.export3D writes it	ресурс {id} является 3D-ресурсом: его записывает assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	3D-ресурсов пока нет: сначала соберите объект с 3D-эффектом (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	выберите объект с 3D-эффектом (или укажите его идентификаторы)
 	Export As…	Экспортировать как…
 	Export CSS	Экспортировать CSS
 	Export CSS…	Экспортировать CSS…
@@ -1743,6 +1751,7 @@ file-filter	Templates	Шаблоны
 	Line {line}	Строка {line}
 	Line {line}: {name}: {status}	Строка {line}: {name}: {status}
 	Imported. Press OK to keep the imported set.	Импортировано. Нажмите «ОК», чтобы сохранить импортированный набор.
+	Read Action Set File	Прочитать файл набора действий
 	Read Shortcut Set File	Прочитать файл набора сочетаний клавиш
 	Import Matches	Сопоставления импорта
 	Remember Import Matches	Запомнить сопоставления импорта
@@ -4016,7 +4025,7 @@ axis	Both	Оба
 # names and values in backticks or code (`colorModel rgb`, `document.export`) stay as they are.
 @msg	no library `{id}`	нет библиотеки `{id}`
 @msg	select some type first	сначала выделите текст
-@msg	kerning must be a number, "auto", or "optical"	Кернинг должен быть числом, «auto» или «optical»
+@msg	kerning must be a number, "auto", or "optical"	kerning должен быть числом, «auto» или «optical»
 @msg	the selection has no gradient fill	у выделения нет градиентной заливки
 @msg	the selection has no gradient stroke	у выделения нет градиентной обводки
 @msg	the selection has no pattern fill	у выделения нет узорной заливки
@@ -4243,9 +4252,9 @@ axis	Both	Оба
 @msg	bad shortcut	недопустимое сочетание клавиш
 @msg	bad stream length	недопустимая длина потока
 @msg	bad trailer	недопустимый трейлер
-@msg	balance must be between 0 and 100	баланс должен быть от 0 до 100
+@msg	balance must be between 0 and 100	balance должен быть от 0 до 100
 @msg	batch step {_1} (`{id}`) failed: {e}	шаг пакета {_1} (`{id}`) не выполнен: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	яркость должна быть dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness должен быть dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	не удалось закодировать документ: {0}
 @msg	can't parse shortcut `{c}`	не удалось разобрать сочетание `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	не удалось разобрать сочетание `{s}` для `{k}`
@@ -4270,7 +4279,7 @@ axis	Both	Оба
 @msg	compound paths can only contain paths	составные контуры могут содержать только контуры
 @msg	compressed (RLE) bitmaps can't be read yet	сжатые (RLE) растровые изображения пока не читаются
 @msg	damaged	повреждено
-@msg	decimals must be {_1}–{_2} (got {_3})	число десятичных знаков должно быть {_1}–{_2} (получено {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals должен быть {_1}–{_2} (получено {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	разделите на 1–{MAX_PIECES} фрагментов
 @msg	effect {k} is `{_1}`, not `{id}`	эффект {k} — это `{_1}`, а не `{id}`
 @msg	empty brush stroke	пустой мазок кисти
@@ -4395,6 +4404,8 @@ axis	Both	Оба
 @msg	no such action set	такого набора действий нет
 @msg	the action sets changed; nothing was deleted	наборы действий изменились; ничего не удалено
 @msg	no action set to save	нет набора действий для сохранения
+@msg	the action set file can't be read in full	файл набора действий невозможно прочитать целиком
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Загружено «{name}»: пропущен {n} шаг|Загружено «{name}»: пропущено {n} шага|Загружено «{name}»: пропущено {n} шагов
 @msg	not an action set file	это не файл набора действий
 @msg	the action set file is larger than 8 MiB	файл набора действий больше 8 MiB
 @msg	the action set file holds more than 1,000 actions	файл набора действий содержит более 1000 действий
@@ -4469,9 +4480,9 @@ axis	Both	Оба
 @msg	replace: the object to replace was changed or deleted	replace: заменяемый объект был изменён или удалён
 @msg	pattern missing	узор отсутствует
 @msg	patterns nested too deeply are filled with mid-grey	слишком глубоко вложенные узоры заполняются серым
-@msg	percent must be above 0 and at most 6400, not {p}	процент должен быть больше 0 и не более 6400, а не {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent должен быть больше 0 и не более 6400, а не {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	выберите цвет, градиент или узор для сохранения в качестве образца
-@msg	plane must be left, right or ground	плоскость должна быть left, right или ground
+@msg	plane must be left, right or ground	plane должен быть left, right или ground
 @msg	plug-in ABI: {0}	ABI модуля: {0}
 @msg	plug-in exceeded its {0}	модуль превысил свой {0}
 @msg	plug-in failed: {0}	модуль завершился с ошибкой: {0}
@@ -4490,8 +4501,8 @@ axis	Both	Оба
 @msg	result would exceed the canvas (coordinates out of range)	результат превысил бы холст (координаты вне диапазона)
 @msg	objects can't be nested more than 32 deep	объекты нельзя вкладывать глубже 32 уровней
 @msg	the SVG's elements are nested more than {0} deep	элементы SVG вложены глубже {0} уровней
-@msg	scale must be a number from {_1} to {_2}, not {_3}	масштаб должен быть числом от {_1} до {_2}, а не {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	масштаб должен быть числом от {_1} до {_2}, а не {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale должен быть числом от {_1} до {_2}, а не {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale должен быть числом от {_1} до {_2}, а не {s}
 @msg	select (or target) objects whose appearance isn't basic	выделите (или укажите как объект) объекты, оформление которых не является основным
 @msg	select a Live Paint group	выделите группу быстрой заливки
 @msg	select a blend	выделите переход
@@ -4914,6 +4925,9 @@ axis	Both	Оба
 	Bottom Right	Снизу справа
 	Edge	Край
 	System Title Bar	Системная строка заголовка
+	VectorCraft Title Bar on Every Desktop	Строка заголовка VectorCraft на любом рабочем столе
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Пока переменная среды VECTORCRAFT_TITLEBAR задана, строку заголовка выбирает она.
+	System Title Bar takes precedence over this option while it is on.	Пока включена «Системная строка заголовка», она имеет приоритет над этим параметром.
 	Value Axis	Ось значений
 	On Left Side	Слева
 	On Right Side	Справа
@@ -4960,7 +4974,7 @@ axis	Both	Оба
 @msg	before must name a panel	before должен указывать панель
 @msg	docking action contains an unknown panel or an excessive split path	Действие прикрепления содержит неизвестную панель или слишком длинный путь разделений
 @msg	group must be true or false	group должен иметь значение true или false
-@msg	panel is not in a dock group	панель не находится в группе дока
+@msg	panel is not in a dock group	panel не находится в группе дока
 @msg	only a dock group above or below others collapses, not one beside another	свернуть можно только группу дока над или под другими, а не рядом с ними
 @msg	icon must be true or false	icon должен быть true или false
 @msg	icon only docks a panel in the icon column, with no anchor	icon только закрепляет панель в столбце значков, без anchor
@@ -6385,6 +6399,7 @@ breakText	Glyphs	Глифы
 	Reset Symbol Instance	Сбросить экземпляр символа
 @msg	type must be static or dynamic, not {v}	type должен быть static или dynamic, а не {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` — статический символ: сначала задайте для него тип символа «Динамический»
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	У контура, составного контура или текста, выделенного в экземпляре символа, можно изменить только сплошной цвет заливки и обводки
 @msg	path must be a list of child indices	path должен быть списком индексов дочерних объектов
 @msg	no object at path {shown} in the symbol's art	в графике символа нет объекта по пути {shown}
 @msg	give fill, stroke, opacity and/or blend	укажите fill, stroke, opacity и/или blend
@@ -6594,3 +6609,25 @@ shape	Open	Открытый
 # 3D Box add-on
 	3D Box	3D-параллелепипед
 	3D Box Tool	Инструмент «3D-параллелепипед»
+
+# Safe Mode
+	Safe Mode…	Безопасный режим…
+	Safe Mode	Безопасный режим
+	Help › Safe Mode…	Справка › Безопасный режим…
+	Enable on Re-launch	Включить при следующем запуске
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Последний запуск VectorCraft остановился во время загрузки модуля {name}. Возможно, причина не в нём.
+	Disable and Continue	Отключить и продолжить
+	Start Normally	Запустить в обычном режиме
+	Start in Safe Mode	Запустить в безопасном режиме
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft работает в безопасном режиме: модули не загружаются и не выполняются, пока программа не будет запущена в обычном режиме.
+	Disabled plug-ins	Отключённые модули
+	No plug-ins are disabled.	Нет отключённых модулей.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Безопасный режим включён: модули не загружаются и не выполняются, пока VectorCraft не будет запущен в обычном режиме
+@msg	give `id` or `file` (see plugin.safeMode)	укажите `id` или `file` (см. plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	этот модуль не отключён (см. plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Не удалось сохранить отключённые модули для следующего запуска
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Разбор оформления: эффект модуля в выделении нельзя разобрать в безопасном режиме
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Выровнять по пиксельной сетке
+@msg	only paths and compound paths can be aligned to the pixel grid	по пиксельной сетке можно выровнять только контуры и составные контуры
diff --git a/crates/ui-egui/src/i18n/sv.tsv b/crates/ui-egui/src/i18n/sv.tsv
index a05088165..4c887b9c0 100644
--- a/crates/ui-egui/src/i18n/sv.tsv
+++ b/crates/ui-egui/src/i18n/sv.tsv
@@ -1065,6 +1065,14 @@ font-technology	Variable	Variabla
 	Export As SVG…	Exportera som SVG…
 	Export Asset	Exportera resurs
 	Export Assets	Exportera resurser
+	Export 3D Object	Exportera 3D-objekt
+	3D Export Format	3D-exportformat
+	Export 3D Assets	Exportera 3D-resurser
+@msg	{what} can't be exported in 3D: {e}	{what} kan inte exporteras i 3D: {e}
+@msg	asset {id} isn't a 3D asset	resurs {id} är ingen 3D-resurs
+@msg	asset {id} is a 3D asset: assets.export3D writes it	resurs {id} är en 3D-resurs: assets.export3D skriver den
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	inga 3D-resurser än: samla först ett objekt med en 3D-effekt (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	markera ett objekt med en 3D-effekt (eller ange dess id:n)
 	Export As…	Exportera som…
 	Export CSS	Exportera CSS
 	Export CSS…	Exportera CSS…
@@ -1672,6 +1680,7 @@ font-technology	Variable	Variabla
 	Report copied	Rapporten har kopierats
 	Line {line}	Rad {line}
 	Line {line}: {name}: {status}	Rad {line}: {name}: {status}
+	Read Action Set File	Läs fil med åtgärdsuppsättning
 	Read Shortcut Set File	Läs fil med kortkommandon
 	Import Matches	Importera matchningar
 	Remember Import Matches	Kom ihåg importmatchningar
@@ -3891,7 +3900,7 @@ axis	Both	Båda
 	Float Tool Group	Gör verktygsgruppen flytande
 @msg	no library `{id}`	inget bibliotek `{id}`
 @msg	select some type first	markera någon text först
-@msg	kerning must be a number, "auto", or "optical"	Kerning måste vara ett tal, ”auto” eller ”optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning måste vara ett tal, ”auto” eller ”optical”
 @msg	the selection has no gradient fill	markeringen har ingen fyllnadsgradient
 @msg	the selection has no gradient stroke	markeringen har ingen konturgradient
 @msg	the selection has no pattern fill	markeringen har inget fyllnadsmönster
@@ -4111,7 +4120,7 @@ axis	Both	Båda
 @msg	bad shortcut	ogiltigt kortkommando
 @msg	bad stream length	ogiltig strömlängd
 @msg	bad trailer	ogiltig trailer
-@msg	balance must be between 0 and 100	balansen måste vara mellan 0 och 100
+@msg	balance must be between 0 and 100	balance måste vara mellan 0 och 100
 @msg	batch step {_1} (`{id}`) failed: {e}	batchsteg {_1} (`{id}`) misslyckades: {e}
 @msg	brightness must be dark|mediumDark|mediumLight|light	brightness måste vara dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	kan inte koda dokumentet: {0}
@@ -4138,7 +4147,7 @@ axis	Both	Båda
 @msg	compound paths can only contain paths	sammansatta banor kan bara innehålla banor
 @msg	compressed (RLE) bitmaps can't be read yet	komprimerade (RLE) bitmappar kan inte läsas än
 @msg	damaged	skadad
-@msg	decimals must be {_1}–{_2} (got {_3})	decimaler måste vara {_1}–{_2} (fick {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals måste vara {_1}–{_2} (fick {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	dela i 1 till {MAX_PIECES} skivor
 @msg	effect {k} is `{_1}`, not `{id}`	effekt {k} är `{_1}`, inte `{id}`
 @msg	empty brush stroke	tomt penseldrag
@@ -4263,6 +4272,8 @@ axis	Both	Båda
 @msg	no such action set	åtgärdsuppsättningen finns inte
 @msg	the action sets changed; nothing was deleted	åtgärdsuppsättningarna har ändrats; inget raderades
 @msg	no action set to save	ingen åtgärdsuppsättning att spara
+@msg	the action set file can't be read in full	filen med åtgärdsuppsättning kan inte läsas helt
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Läste in ”{name}”: {n} steg utelämnades|Läste in ”{name}”: {n} steg utelämnades
 @msg	not an action set file	inte en fil med åtgärdsuppsättning
 @msg	the action set file is larger than 8 MiB	filen med åtgärdsuppsättningen är större än 8 MiB
 @msg	the action set file holds more than 1,000 actions	filen med åtgärdsuppsättningen innehåller fler än 1 000 åtgärder
@@ -4337,7 +4348,7 @@ axis	Both	Båda
 @msg	replace: the object to replace was changed or deleted	replace: objektet som skulle ersättas har ändrats eller tagits bort
 @msg	pattern missing	mönster saknas
 @msg	patterns nested too deeply are filled with mid-grey	mönster som är kapslade för djupt fylls med mellangrått
-@msg	percent must be above 0 and at most 6400, not {p}	procent måste vara över 0 och högst 6400, inte {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent måste vara över 0 och högst 6400, inte {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	välj en färg, gradient eller ett mönster att spara som färgruta
 @msg	plane must be left, right or ground	plane måste vara left, right eller ground
 @msg	plug-in ABI: {0}	pluginets ABI: {0}
@@ -4358,8 +4369,8 @@ axis	Both	Båda
 @msg	result would exceed the canvas (coordinates out of range)	resultatet skulle hamna utanför arbetsytan (koordinater utanför intervallet)
 @msg	objects can't be nested more than 32 deep	objekt kan inte kapslas djupare än 32 nivåer
 @msg	the SVG's elements are nested more than {0} deep	SVG-filens element är nästlade mer än {0} nivåer djupt
-@msg	scale must be a number from {_1} to {_2}, not {_3}	skala måste vara ett tal från {_1} till {_2}, inte {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	skala måste vara ett tal från {_1} till {_2}, inte {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale måste vara ett tal från {_1} till {_2}, inte {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale måste vara ett tal från {_1} till {_2}, inte {s}
 @msg	select (or target) objects whose appearance isn't basic	markera (eller ange som mål) objekt vars utseende inte är grundläggande
 @msg	select a Live Paint group	markera en Live Paint-grupp
 @msg	select a blend	markera en blandning
@@ -4793,6 +4804,9 @@ axis	Both	Båda
 effect	Soft	Mjuk
 	Edge	Kant
 	System Title Bar	Systemets namnlist
+	VectorCraft Title Bar on Every Desktop	VectorCrafts namnlist på alla skrivbord
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Miljövariabeln VECTORCRAFT_TITLEBAR väljer namnlisten så länge den är angiven.
+	System Title Bar takes precedence over this option while it is on.	Systemets namnlist har företräde framför det här alternativet så länge den är på.
 	Value Axis	Värdeaxel
 	On Left Side	På vänster sida
 	On Right Side	På höger sida
@@ -4838,7 +4852,7 @@ effect	Soft	Mjuk
 @msg	before must name a panel	before måste ange en panel
 @msg	docking action contains an unknown panel or an excessive split path	dockningsåtgärden innehåller en okänd panel eller en alltför djup delningssökväg
 @msg	group must be true or false	group måste vara true eller false
-@msg	panel is not in a dock group	panelen ligger inte i en dockningsgrupp
+@msg	panel is not in a dock group	panel ligger inte i en dockningsgrupp
 @msg	only a dock group above or below others collapses, not one beside another	bara en dockningsgrupp ovanför eller under andra komprimeras, inte en bredvid en annan
 @msg	icon must be true or false	icon måste vara true eller false
 @msg	icon only docks a panel in the icon column, with no anchor	icon dockar bara en panel i ikonkolumnen, utan anchor
@@ -6460,6 +6474,7 @@ breakText	Glyphs	Glyfer
 	Reset Symbol Instance	Återställ symbolinstans
 @msg	type must be static or dynamic, not {v}	type måste vara static eller dynamic, inte {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` är en statisk symbol: ställ först in symboltypen på Dynamisk
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	För en bana, sammansatt bana eller text som är markerad i en symbolinstans kan bara enfärgad fyllning och linje ändras
 @msg	path must be a list of child indices	path måste vara en lista med underordnade index
 @msg	no object at path {shown} in the symbol's art	inget objekt vid sökvägen {shown} i symbolens bild
 @msg	give fill, stroke, opacity and/or blend	ange fill, stroke, opacity och/eller blend
@@ -7310,7 +7325,7 @@ digits	Hindi	Hindi
 @msg	margin: a {m} pt margin leaves no imageable area on the paper	margin: en marginal på {m} pt lämnar ingen tryckbar yta på papperet
 @msg	matrix must be finite and invertible, depth finite	matrix måste vara ändlig och inverterbar, depth ändligt
 @msg	matte: {e}	bakgrundsfärg: {e}
-@msg	member is for order front, forward, backward or back	member gäller ordningen front, forward, backward eller back
+@msg	member is for order front, forward, backward or back	member gäller order front, forward, backward eller back
 @msg	memory budget (the selection is too large to hand over)	minnesbudget (markeringen är för stor för att lämnas över)
 @msg	missing `{k}`	`{k}` saknas
 @msg	missing `{key}`	`{key}` saknas
@@ -7579,7 +7594,7 @@ digits	Hindi	Hindi
 @msg	page art is missing image data for {key}	sidans bildmaterial saknar bilddata för {key}
 @msg	page art is missing pattern {name}	sidans bildmaterial saknar mönstret {name}
 @msg	page art is missing swatch {name}	sidans bildmaterial saknar färgrutan {name}
-@msg	page must be a whole number from 1	sidan måste vara ett heltal från och med 1
+@msg	page must be a whole number from 1	page måste vara ett heltal från och med 1
 @msg	page thumbnail: {e}	sidminiatyr: {e}
 @msg	pages must be a range such as "2-3" or a page number, not {v}	pages måste vara ett intervall som "2-3" eller ett sidnummer, inte {v}
 @msg	pages: {e}	sidor: {e}
@@ -7589,7 +7604,7 @@ digits	Hindi	Hindi
 @msg	parameters must be an object	parametrarna måste vara ett objekt
 @msg	passwords can have up to {MAX_PASSWORD} bytes	lösenord får vara högst {MAX_PASSWORD} byte
 @msg	path has no open end	banan har ingen öppen ände
-@msg	paths must be strings	sökvägar måste vara strängar
+@msg	paths must be strings	paths måste vara strängar
 @msg	PDF content is incomplete or exceeds the reader's limits; no document was imported	PDF-innehållet är ofullständigt eller överskrider läsarens gränser; inget dokument importerades
 @msg	PDF flattener: {e}	PDF-plattning: {e}
 @msg	PDF options: {e}	PDF-alternativ: {e}
@@ -7878,7 +7893,7 @@ digits	Hindi	Hindi
 @msg	thumbnail: no page {v} (the {what} has {count})	miniatyr: ingen sida {v} ({what} har {count})
 @msg	tileRange of {what}: {e}	tileRange för {what}: {e}
 @msg	time budget	tidsbudget
-@msg	title can't be empty	titeln får inte vara tom
+@msg	title can't be empty	title får inte vara tom
 @msg	to (the new name) is required	to (det nya namnet) krävs
 @msg	to must be fill or stroke	to måste vara fill eller stroke
 @msg	to must be smooth or corner	to måste vara smooth eller corner
@@ -7984,7 +7999,7 @@ digits	Hindi	Hindi
 @msg	view must be one of {_1}	view måste vara något av {_1}
 @msg	warpStyle can only edit an applied Warp effect	warpStyle kan bara redigera en tillämpad Förvräng-effekt
 @msg	width factors must be finite	breddfaktorerna måste vara ändliga
-@msg	width must be positive	bredden måste vara positiv
+@msg	width must be positive	width måste vara positiv
 @msg	width out of range	bredden ligger utanför tillåtet omfång
 @msg	width/height must be > 0	bredd/höjd måste vara > 0
 @msg	width/height must be positive and within the canvas	bredd/höjd måste vara positiva och inom arbetsytan
@@ -7992,3 +8007,25 @@ digits	Hindi	Hindi
 @msg	x and y must be given together	x och y måste anges tillsammans
 @msg	zone needs an anchor: dock beside a panel with anchor, or in a new dock column with side (Start or End)	zone behöver ett ankare: docka bredvid en panel med anchor eller i en ny dockkolumn med side (Start eller End)
 @msg	zoom must be positive	zoom måste vara positiv
+
+# Safe Mode
+	Safe Mode…	Felsäkert läge…
+	Safe Mode	Felsäkert läge
+	Help › Safe Mode…	Hjälp › Felsäkert läge…
+	Enable on Re-launch	Aktivera vid nästa start
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Den senaste starten av VectorCraft stoppades medan pluginet {name} lästes in. Det är kanske inte orsaken.
+	Disable and Continue	Inaktivera och fortsätt
+	Start Normally	Starta normalt
+	Start in Safe Mode	Starta i felsäkert läge
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft är i felsäkert läge: inga plugins läses in eller körs förrän programmet startas normalt.
+	Disabled plug-ins	Inaktiverade plugins
+	No plug-ins are disabled.	Inga plugins är inaktiverade.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Felsäkert läge är på: plugins läses inte in eller körs förrän VectorCraft startas normalt
+@msg	give `id` or `file` (see plugin.safeMode)	ange `id` eller `file` (se plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	det pluginet är inte inaktiverat (se plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	De inaktiverade pluginen kunde inte sparas till nästa start
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Expandera utseende: en plugin-effekt i markeringen kan inte expanderas i felsäkert läge
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Justera mot pixelrutnät
+@msg	only paths and compound paths can be aligned to the pixel grid	bara banor och sammansatta banor kan justeras mot pixelrutnätet
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index 1ccbe1484..40dab2ea0 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -1674,9 +1674,10 @@ const COUNTED_STATUS_MESSAGES: &[(&str, &str)] = &[
     ("Copied the CSS of 1 object", "Copied the CSS of 2 objects"),
     ("Downloaded 1 file", "Downloaded 2 files"),
     ("Exported 1 file to /out", "Exported 2 files to /out"),
+    ("Loaded “Tidy”: 1 step was left out", "Loaded “Tidy”: 2 steps were left out"),
 ];
 
-/// The link, font and export status messages name a count of 1 in the singular and other counts in
+/// The link, font, export and action set status messages name a count of 1 in the singular and other counts in
 /// the plural, and every complete catalog translates both, in the form its plural rule picks.
 #[test]
 fn counted_status_messages_take_the_plural_form() {
@@ -2206,6 +2207,151 @@ fn translated_messages_keep_the_double_quoted_values_of_their_english() {
     assert!(missing.is_empty(), "{} rows drop a double-quoted value:\n{}", missing.len(), missing.join("\n"));
 }
 
+/// Whether `text` holds `word` with no ASCII letter, digit or underscore right before or after it,
+/// so `true` counts in `true이거나` but not in `untrue`.
+fn holds_ascii_word(text: &str, word: &str) -> bool {
+    let joins = |c: char| c.is_ascii_alphanumeric() || c == '_';
+    text.match_indices(word).any(|(at, _)| {
+        let before = text[..at].chars().next_back().is_none_or(|c| !joins(c));
+        let after = text[at + word.len()..].chars().next().is_none_or(|c| !joins(c));
+        before && after
+    })
+}
+
+/// The literal values `true`, `false` and `null` that `s` names outside its backticked and
+/// double-quoted spans.
+fn bare_literals(s: &str) -> Vec<&'static str> {
+    let mut outside = String::new();
+    let mut quoted = false;
+    for part in s.split('`').step_by(2) {
+        for (i, piece) in part.split('"').enumerate() {
+            if i > 0 {
+                quoted = !quoted;
+            }
+            if !quoted {
+                outside.push_str(piece);
+                outside.push(' ');
+            }
+        }
+    }
+    ["true", "false", "null"].into_iter().filter(|lit| holds_ascii_word(&outside, lit)).collect()
+}
+
+#[test]
+fn bare_literals_finds_true_false_and_null_outside_backticks_and_quotes() {
+    assert_eq!(bare_literals("clip must be true or false"), ["true", "false"]);
+    assert_eq!(bare_literals("`leading` must be from 0.1 to 5000, or null for Auto"), ["null"]);
+    assert_eq!(bare_literals(r#"`true` is "false", not untrue"#), Vec::<&str>::new());
+    assert!(holds_ascii_word("true이거나", "true"));
+    assert!(!holds_ascii_word("isTrue or falsey", "false"));
+}
+
+/// A translated status or error message keeps each `true`, `false` and `null` its English text
+/// names without backticks, spelled as the English spells it, since that is the value a command
+/// reads.
+#[test]
+fn translated_messages_keep_the_bare_literals_of_their_english() {
+    let mut missing = Vec::new();
+    for l in &LANGUAGES {
+        let (entries, _) = parse_entries(l.source);
+        for (ctx, src, tr) in entries.iter().filter(|(ctx, _, _)| ctx == "@msg" || ctx == "@msgplural") {
+            let plural = ctx == "@msgplural";
+            let english = if plural { src.rsplit('|').next().unwrap_or(src) } else { src.as_str() };
+            let forms: Vec<&str> = if plural { tr.split('|').collect() } else { vec![tr.as_str()] };
+            for form in forms {
+                for lit in bare_literals(english) {
+                    if !holds_ascii_word(form, lit) {
+                        missing.push(format!("{}: {lit} in {src:?} -> {form:?}", l.code));
+                    }
+                }
+            }
+        }
+    }
+    assert!(missing.is_empty(), "{} rows drop a bare true, false or null:\n{}", missing.len(), missing.join("\n"));
+}
+
+/// Messages that name parameter keys and values without backticks, each with the names a
+/// translation keeps as written in the English.
+const NAMED_KEYS: &[(&str, &[&str])] = &[
+    ("a DXF drawing has one origin: pass useArtboards: true for one drawing per artboard", &["useArtboards"]),
+    ("a name names one asset: give multiple: false, or one object", &["multiple"]),
+    ("a theme is already called {name} (replace: \"{name}\" overwrites it)", &["replace"]),
+    ("action is required", &["action"]),
+    ("anchor must name a registered panel", &["anchor"]),
+    ("antiAlias `{id}`: none, art or type", &["antiAlias", "none", "art", "type"]),
+    ("axis must be \"vertical\", \"horizontal\" or an angle in degrees, not `{v}`", &["axis"]),
+    ("balance must be between 0 and 100", &["balance"]),
+    ("before must name a panel", &["before"]),
+    ("brightness must be dark|mediumDark|mediumLight|light", &["brightness", "dark", "mediumDark", "mediumLight", "light"]),
+    ("clip must be true or false", &["clip"]),
+    ("collapsed must be true or false", &["collapsed"]),
+    ("column must be true or a number from 1", &["column"]),
+    ("column: true floats the whole column and takes no onto, above or below", &["column", "onto", "above", "below"]),
+    ("control must be fillStroke, coloring, drawMode or screenMode", &["control", "fillStroke", "coloring", "drawMode", "screenMode"]),
+    ("decimals must be {_1}–{_2} (got {_3})", &["decimals"]),
+    ("detect must be true or false", &["detect"]),
+    ("give origin: [x, y], or reset: true", &["origin", "reset"]),
+    ("global must be true or false", &["global"]),
+    ("group must be true or false", &["group"]),
+    ("icon must be true or false", &["icon"]),
+    ("included must be true or false", &["included"]),
+    ("index must be a number or first, previous, next or last", &["index", "first", "previous", "next", "last"]),
+    ("index must be a number or first, previous, next or last, not `{other}`", &["index", "first", "previous", "next", "last"]),
+    ("index must be ≥ 0", &["index"]),
+    ("kerning must be a number, \"auto\", or \"optical\"", &["kerning"]),
+    ("lang must be one of {_1}", &["lang"]),
+    ("layers must be true or false", &["layers"]),
+    ("member is for order front, forward, backward or back", &["member", "order", "front", "forward", "backward", "back"]),
+    ("mode is set, add or toggle, not `{other}`", &["mode", "set", "add", "toggle"]),
+    ("names is empty", &["names"]),
+    ("on must be true or false", &["on"]),
+    ("onto must name a floating panel", &["onto"]),
+    ("others must be true or false", &["others"]),
+    ("page must be a whole number from 1", &["page"]),
+    ("panel is not in a dock group", &["panel"]),
+    ("panel must name a registered panel", &["panel"]),
+    ("paths must be strings", &["paths"]),
+    ("percent must be above 0 and at most 6400, not {p}", &["percent"]),
+    ("plane must be left, right or ground", &["plane", "left", "right", "ground"]),
+    ("precision must be from 0.001 to 10 pt", &["precision"]),
+    ("rect is [x, y, width, height] in points", &["rect"]),
+    ("scale must be a number from {_1} to {_2}, not {_3}", &["scale"]),
+    ("scale must be a number from {_1} to {_2}, not {s}", &["scale"]),
+    ("show must be true or false", &["show"]),
+    ("span: \"selection\" places a linear or radial gradient, not a freeform one", &["span"]),
+    ("thickness must be from 0.01 to 5000 pt", &["thickness"]),
+    ("title can't be empty", &["title"]),
+    ("view is required", &["view"]),
+    ("width must be positive", &["width"]),
+    ("zone must be a string", &["zone"]),
+    ("zone must be tab, center, left, right, top or bottom", &["zone", "tab", "center", "left", "right", "top", "bottom"]),
+    ("`dither` applies to gradient fills (stroke: false)", &["stroke"]),
+    ("`strokeMode` applies to strokes (stroke: true)", &["stroke"]),
+];
+
+/// Every catalog's translation of a [`NAMED_KEYS`] message keeps each name the table lists, as
+/// a whole word, and every message in the table is still in a catalog.
+#[test]
+fn translated_messages_keep_the_keys_and_values_their_english_names() {
+    let mut missing = Vec::new();
+    let mut seen = vec![false; NAMED_KEYS.len()];
+    for l in &LANGUAGES {
+        let (entries, _) = parse_entries(l.source);
+        for (_, src, tr) in entries.iter().filter(|(ctx, _, _)| ctx == "@msg") {
+            let Some(at) = NAMED_KEYS.iter().position(|(english, _)| english == src) else { continue };
+            seen[at] = true;
+            for name in NAMED_KEYS[at].1 {
+                if !holds_ascii_word(tr, name) {
+                    missing.push(format!("{}: {name} in {src:?} -> {tr:?}", l.code));
+                }
+            }
+        }
+    }
+    let stale: Vec<&str> = NAMED_KEYS.iter().zip(&seen).filter(|(_, seen)| !**seen).map(|((english, _), _)| *english).collect();
+    assert!(stale.is_empty(), "no catalog translates {stale:?}");
+    assert!(missing.is_empty(), "{} rows drop a key or value their English names:\n{}", missing.len(), missing.join("\n"));
+}
+
 /// Languages whose catalogs translate status and error messages; [`untranslated_report`] lists
 /// the messages each one lacks.
 const COMPLETE_MESSAGES: &[&str] = &[
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index f43fe910d..e2bc40a6e 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -1057,6 +1057,14 @@ font-technology	Variable	Değişken
 	Export As SVG…	SVG Olarak Dışa Aktar…
 	Export Asset	Varlığı Dışa Aktar
 	Export Assets	Varlıkları Dışa Aktar
+	Export 3D Object	3D Nesneyi Dışa Aktar
+	3D Export Format	3D Dışa Aktarma Biçimi
+	Export 3D Assets	3D Varlıkları Dışa Aktar
+@msg	{what} can't be exported in 3D: {e}	{what} 3D olarak dışa aktarılamıyor: {e}
+@msg	asset {id} isn't a 3D asset	{id} varlığı bir 3D varlık değil
+@msg	asset {id} is a 3D asset: assets.export3D writes it	{id} varlığı bir 3D varlık: onu assets.export3D yazar
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	henüz 3D varlık yok: önce 3D efekti olan bir nesne toplayın (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	3D efekti olan bir nesne seçin (veya kimliklerini verin)
 	Export As…	Farklı Dışa Aktar…
 	Export CSS	CSS'yi dışa aktar
 	Export CSS…	CSS'yi dışa aktar…
@@ -1553,6 +1561,7 @@ font-technology	Variable	Değişken
 	Report copied	Rapor kopyalandı
 	Line {line}	{line} Hattı
 	Line {line}: {name}: {status}	Hat {line}: {name}: {status}
+	Read Action Set File	Eylem Seti Dosyasını Oku
 	Read Shortcut Set File	Kısayol Seti Dosyasını Oku
 	Import Matches	Eşleşmeleri İçe Aktar
 	Remember Import Matches	İçe Aktarılan Eşleşmeleri Hatırla
@@ -3956,7 +3965,7 @@ axis	Both	Her İkisi
 @msg	already editing a pattern	zaten bir desen düzenliyor
 @msg	an object can't be read	bir nesne okunamıyor
 @msg	an object in perspective would leave the edited grid	perspektifteki bir nesne düzenlenen ızgaradan ayrılır
-@msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: yok, resim veya tür
+@msg	antiAlias `{id}`: none, art or type	antiAlias `{id}`: none, art veya type
 @msg	artboard {0} does not exist	{0} çalışma yüzeyi mevcut değil
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	bu ölçekte çizim {w} × {h} nk, kanvasın sığabileceğinden daha fazladır: daha küçük bir ölçek seçin veya çalışma yüzeyine sığdırın
 @msg	axis must be "vertical", "horizontal" or an angle in degrees, not `{v}`	axis "vertical", "horizontal" veya derece cinsinden bir açı olmalıdır, `{v}` değil
@@ -4124,6 +4133,8 @@ axis	Both	Her İkisi
 @msg	no such action set	öyle bir eylem seti yok
 @msg	the action sets changed; nothing was deleted	eylem setleri değişti; hiçbir şey silinmedi
 @msg	no action set to save	kaydedilecek eylem seti yok
+@msg	the action set file can't be read in full	eylem seti dosyası tamamen okunamıyor
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	“{name}” yüklendi: {n} adım atlandı
 @msg	not an action set file	bir eylem seti dosyası değil
 @msg	the action set file is larger than 8 MiB	eylem seti dosyası 8 MiB'den büyük
 @msg	the action set file holds more than 1,000 actions	eylem seti dosyası 1.000'den fazla eylem içeriyor
@@ -4626,6 +4637,9 @@ axis	Both	Her İkisi
 effect	Soft	Yumuşak
 	Edge	Kenar
 	System Title Bar	Sistem Başlık Çubuğu
+	VectorCraft Title Bar on Every Desktop	Her Masaüstünde VectorCraft Başlık Çubuğu
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	VECTORCRAFT_TITLEBAR ortam değişkeni ayarlı olduğu sürece başlık çubuğunu o seçer.
+	System Title Bar takes precedence over this option while it is on.	Sistem Başlık Çubuğu açık olduğu sürece bu seçeneğe göre önceliklidir.
 	Value Axis	Değer Ekseni
 	On Left Side	Sol Tarafta
 	On Right Side	Sağ Tarafta
@@ -6365,6 +6379,7 @@ breakText	Glyphs	Glifler
 	Reset Symbol Instance	Sembol Örneğini Sıfırla
 @msg	type must be static or dynamic, not {v}	type static veya dynamic olmalıdır, {v} değil
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` statik bir semboldür: önce Sembol Türünü Dinamik olarak ayarlayın
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Bir sembol örneğinde seçilen yolun, bileşik yolun veya yazının yalnızca dolgu ve konturunun düz rengi değiştirilebilir
 @msg	path must be a list of child indices	path alt öğe dizinlerinden oluşan bir liste olmalıdır
 @msg	no object at path {shown} in the symbol's art	sembolün çiziminde {shown} yolunda nesne yok
 @msg	give fill, stroke, opacity and/or blend	fill, stroke, opacity ve/veya blend verin
@@ -6462,3 +6477,25 @@ breakText	Glyphs	Glifler
 # 3D Box add-on
 	3D Box	3B Kutu
 	3D Box Tool	3B Kutu Aracı
+
+# Safe Mode
+	Safe Mode…	Güvenli Mod…
+	Safe Mode	Güvenli Mod
+	Help › Safe Mode…	Yardım › Güvenli Mod…
+	Enable on Re-launch	Sonraki Başlatmada Etkinleştir
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	VectorCraft'ın son başlatılması, {name} eklentisi yüklenirken durdu. Nedeni bu eklenti olmayabilir.
+	Disable and Continue	Devre Dışı Bırak ve Devam Et
+	Start Normally	Normal Başlat
+	Start in Safe Mode	Güvenli Modda Başlat
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft Güvenli Mod'da: normal başlatılana kadar hiçbir eklenti yüklenmez veya çalıştırılmaz.
+	Disabled plug-ins	Devre dışı eklentiler
+	No plug-ins are disabled.	Devre dışı bırakılmış eklenti yok.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Güvenli Mod açık: VectorCraft normal başlatılana kadar eklentiler yüklenmez veya çalıştırılmaz
+@msg	give `id` or `file` (see plugin.safeMode)	`id` veya `file` belirtin (bkz. plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	bu eklenti devre dışı değil (bkz. plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Devre dışı eklentiler bir sonraki başlatma için kaydedilemedi
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Görünümü Genişlet: seçimdeki bir eklenti efekti Güvenli Mod'da genişletilemez
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Piksel Izgarasına Hizala
+@msg	only paths and compound paths can be aligned to the pixel grid	piksel ızgarasına yalnızca yollar ve bileşik yollar hizalanabilir
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index d2b31c943..48f8ede6f 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -1081,6 +1081,14 @@ font-technology	Variable	Варіативні
 	Export As SVG…	Експортувати як SVG…
 	Export Asset	Експортувати ресурс
 	Export Assets	Експортувати ресурси
+	Export 3D Object	Експортувати 3D-об’єкт
+	3D Export Format	Формат 3D-експорту
+	Export 3D Assets	Експортувати 3D-ресурси
+@msg	{what} can't be exported in 3D: {e}	{what} неможливо експортувати в 3D: {e}
+@msg	asset {id} isn't a 3D asset	ресурс {id} не є 3D-ресурсом
+@msg	asset {id} is a 3D asset: assets.export3D writes it	ресурс {id} є 3D-ресурсом: його записує assets.export3D
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	3D-ресурсів ще немає: спершу зберіть об’єкт із 3D-ефектом (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	виберіть об’єкт із 3D-ефектом (або вкажіть його ідентифікатори)
 	Export As…	Експортувати як…
 	Export CSS	Експортувати CSS
 	Export CSS…	Експортувати CSS…
@@ -1740,6 +1748,7 @@ file-filter	Templates	Шаблони
 	Line {line}	Рядок {line}
 	Line {line}: {name}: {status}	Рядок {line}: {name}: {status}
 	Imported. Press OK to keep the imported set.	Імпортовано. Натисніть «ОК», щоб зберегти імпортований набір.
+	Read Action Set File	Прочитати файл набору дій
 	Read Shortcut Set File	Прочитати файл набору сполучень клавіш
 	Import Matches	Зіставлення імпорту
 	Remember Import Matches	Запам’ятати зіставлення імпорту
@@ -4005,7 +4014,7 @@ axis	Both	Обидві
 	Float Tool Group	Від’єднати групу інструментів
 @msg	no library `{id}`	немає бібліотеки `{id}`
 @msg	select some type first	спочатку виділіть текст
-@msg	kerning must be a number, "auto", or "optical"	Кернінг має бути числом, «auto» або «optical»
+@msg	kerning must be a number, "auto", or "optical"	kerning має бути числом, «auto» або «optical»
 @msg	the selection has no gradient fill	виділення не має градієнтної заливки
 @msg	the selection has no gradient stroke	виділення не має градієнтного обведення
 @msg	the selection has no pattern fill	виділення не має візерункової заливки
@@ -4232,9 +4241,9 @@ axis	Both	Обидві
 @msg	bad shortcut	неприпустиме поєднання клавіш
 @msg	bad stream length	неприпустима довжина потоку
 @msg	bad trailer	неприпустимий трейлер
-@msg	balance must be between 0 and 100	баланс має бути від 0 до 100
+@msg	balance must be between 0 and 100	balance має бути від 0 до 100
 @msg	batch step {_1} (`{id}`) failed: {e}	крок пакету {_1} (`{id}`) не виконано: {e}
-@msg	brightness must be dark|mediumDark|mediumLight|light	яскравість має бути dark|mediumDark|mediumLight|light
+@msg	brightness must be dark|mediumDark|mediumLight|light	brightness має бути dark|mediumDark|mediumLight|light
 @msg	can't encode the document: {0}	не вдалося закодувати документ: {0}
 @msg	can't parse shortcut `{c}`	не вдалося розібрати поєднання `{c}`
 @msg	can't parse shortcut `{s}` for `{k}`	не вдалося розібрати поєднання `{s}` для `{k}`
@@ -4259,7 +4268,7 @@ axis	Both	Обидві
 @msg	compound paths can only contain paths	складені контури можуть містити лише контури
 @msg	compressed (RLE) bitmaps can't be read yet	стислі (RLE) растрові зображення поки не читаються
 @msg	damaged	пошкоджено
-@msg	decimals must be {_1}–{_2} (got {_3})	число десяткових знаків має бути {_1}–{_2} (отримано {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals має бути {_1}–{_2} (отримано {_3})
 @msg	divide into 1 to {MAX_PIECES} slices	розділіть на 1–{MAX_PIECES} фрагментів
 @msg	effect {k} is `{_1}`, not `{id}`	ефект {k} - це `{_1}`, а не `{id}`
 @msg	empty brush stroke	порожній мазок пензля
@@ -4384,6 +4393,8 @@ axis	Both	Обидві
 @msg	no such action set	такого набору дій немає
 @msg	the action sets changed; nothing was deleted	набори дій змінилися; нічого не видалено
 @msg	no action set to save	немає набору дій для збереження
+@msg	the action set file can't be read in full	файл набору дій неможливо прочитати повністю
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Завантажено «{name}»: пропущено {n} крок|Завантажено «{name}»: пропущено {n} кроки|Завантажено «{name}»: пропущено {n} кроків
 @msg	not an action set file	це не файл набору дій
 @msg	the action set file is larger than 8 MiB	файл набору дій більший за 8 MiB
 @msg	the action set file holds more than 1,000 actions	файл набору дій містить понад 1000 дій
@@ -4458,9 +4469,9 @@ axis	Both	Обидві
 @msg	replace: the object to replace was changed or deleted	replace: об’єкт для заміни було змінено або видалено
 @msg	pattern missing	візерунок відсутній
 @msg	patterns nested too deeply are filled with mid-grey	надто глибоко вкладені візерунки заповнюються сірим
-@msg	percent must be above 0 and at most 6400, not {p}	відсоток має бути більше 0 і не більше 6400, а не {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent має бути більше 0 і не більше 6400, а не {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	виберіть колір, градієнт або візерунок, щоб зберегти як зразок
-@msg	plane must be left, right or ground	площина повинна бути left, right або ground
+@msg	plane must be left, right or ground	plane має бути left, right або ground
 @msg	plug-in ABI: {0}	ABI модуля: {0}
 @msg	plug-in exceeded its {0}	модуль перевищив свій {0}
 @msg	plug-in failed: {0}	модуль завершився помилково: {0}
@@ -4479,8 +4490,8 @@ axis	Both	Обидві
 @msg	result would exceed the canvas (coordinates out of range)	результат перевищив би полотно (координати поза діапазоном)
 @msg	objects can't be nested more than 32 deep	об’єкти не можна вкладати глибше ніж на 32 рівні
 @msg	the SVG's elements are nested more than {0} deep	елементи SVG вкладено глибше ніж на {0} рівнів
-@msg	scale must be a number from {_1} to {_2}, not {_3}	масштаб має бути числом від {_1} до {_2}, а не {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	масштаб має бути числом від {_1} до {_2}, а не {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale має бути числом від {_1} до {_2}, а не {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale має бути числом від {_1} до {_2}, а не {s}
 @msg	select (or target) objects whose appearance isn't basic	виділіть (або вкажіть як об’єкт) об’єкти, оформлення яких не є основним
 @msg	select a Live Paint group	виділіть групу швидкої заливки
 @msg	select a blend	виділіть перехід
@@ -4901,6 +4912,9 @@ axis	Both	Обидві
 	Bottom Right	Знизу праворуч
 	Edge	Край
 	System Title Bar	Системний рядок заголовка
+	VectorCraft Title Bar on Every Desktop	Рядок заголовка VectorCraft на будь-якій стільниці
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Поки змінну середовища VECTORCRAFT_TITLEBAR задано, рядок заголовка вибирає вона.
+	System Title Bar takes precedence over this option while it is on.	Поки ввімкнено «Системний рядок заголовка», він має пріоритет над цим параметром.
 	Value Axis	Вісь значень
 	On Left Side	Ліворуч
 	On Right Side	Праворуч
@@ -4947,7 +4961,7 @@ axis	Both	Обидві
 @msg	before must name a panel	before має вказувати панель
 @msg	docking action contains an unknown panel or an excessive split path	Дія прикріплення містить невідому панель або надто довгий шлях поділів
 @msg	group must be true or false	group має мати значення true або false
-@msg	panel is not in a dock group	панель не входить до групи дока
+@msg	panel is not in a dock group	panel не входить до групи дока
 @msg	only a dock group above or below others collapses, not one beside another	згорнути можна лише групу дока над або під іншими, а не поруч з ними
 @msg	icon must be true or false	icon має бути true або false
 @msg	icon only docks a panel in the icon column, with no anchor	icon лише закріплює панель у стовпці значків, без anchor
@@ -6008,6 +6022,7 @@ breakText	Glyphs	Гліфи
 	Reset Symbol Instance	Скинути екземпляр символу
 @msg	type must be static or dynamic, not {v}	type має бути static або dynamic, а не {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` — статичний символ: спершу встановіть для нього тип символу «Динамічний»
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	У контуру, складеного контуру або тексту, виділеного в екземплярі символу, можна змінити лише суцільний колір заливки й обведення
 @msg	path must be a list of child indices	path має бути списком індексів дочірніх об’єктів
 @msg	no object at path {shown} in the symbol's art	у графіці символу немає об’єкта за шляхом {shown}
 @msg	give fill, stroke, opacity and/or blend	вкажіть fill, stroke, opacity та/або blend
@@ -6105,3 +6120,25 @@ breakText	Glyphs	Гліфи
 # 3D Box add-on
 	3D Box	3D-паралелепіпед
 	3D Box Tool	Інструмент «3D-паралелепіпед»
+
+# Safe Mode
+	Safe Mode…	Безпечний режим…
+	Safe Mode	Безпечний режим
+	Help › Safe Mode…	Довідка › Безпечний режим…
+	Enable on Re-launch	Увімкнути під час наступного запуску
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Останній запуск VectorCraft зупинився під час завантаження модуля {name}. Можливо, причина не в ньому.
+	Disable and Continue	Вимкнути й продовжити
+	Start Normally	Запустити у звичайному режимі
+	Start in Safe Mode	Запустити в безпечному режимі
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft працює в безпечному режимі: модулі не завантажуються й не виконуються, доки програму не буде запущено у звичайному режимі.
+	Disabled plug-ins	Вимкнені модулі
+	No plug-ins are disabled.	Немає вимкнених модулів.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Безпечний режим увімкнено: модулі не завантажуються й не виконуються, доки VectorCraft не буде запущено у звичайному режимі
+@msg	give `id` or `file` (see plugin.safeMode)	укажіть `id` або `file` (див. plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	цей модуль не вимкнено (див. plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Не вдалося зберегти вимкнені модулі для наступного запуску
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Розбір оформлення: ефект модуля у виділенні не можна розібрати в безпечному режимі
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Вирівняти за піксельною сіткою
+@msg	only paths and compound paths can be aligned to the pixel grid	за піксельною сіткою можна вирівняти лише контури і складені контури
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 0863e3c97..49e3f1117 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -1245,6 +1245,14 @@ font-technology	Variable	Biến thiên
 	Export As SVG…	Xuất thành SVG…
 	Export Asset	Xuất asset
 	Export Assets	Xuất asset
+	Export 3D Object	Xuất đối tượng 3D
+	3D Export Format	Định dạng xuất 3D
+	Export 3D Assets	Xuất asset 3D
+@msg	{what} can't be exported in 3D: {e}	không thể xuất {what} dưới dạng 3D: {e}
+@msg	asset {id} isn't a 3D asset	asset {id} không phải là asset 3D
+@msg	asset {id} is a 3D asset: assets.export3D writes it	asset {id} là asset 3D: assets.export3D sẽ ghi nó
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	chưa có asset 3D nào: hãy thu thập trước một đối tượng có hiệu ứng 3D (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	hãy chọn một đối tượng có hiệu ứng 3D (hoặc cung cấp id của nó)
 	Export As…	Xuất thành…
 	Export CSS	Xuất CSS
 	Export CSS…	Xuất CSS…
@@ -1891,6 +1899,7 @@ digits	Hindi	Hindi
 	Line {line}	Dòng {line}
 	Line {line}: {name}: {status}	Dòng {line}: {name}: {status}
 	Imported. Press OK to keep the imported set.	Đã nhập. Nhấn OK để giữ bộ đã nhập.
+	Read Action Set File	Đọc tệp bộ hành động
 	Read Shortcut Set File	Đọc tệp bộ phím tắt
 	Import Matches	Cặp ghép khi nhập
 	Remember Import Matches	Ghi nhớ cặp ghép khi nhập
@@ -3799,6 +3808,9 @@ mark-style	Japanese	Kiểu Nhật
 	Symbols	Ký hiệu
 	System Layout	Bố cục hệ thống
 	System Title Bar	Thanh tiêu đề hệ thống
+	VectorCraft Title Bar on Every Desktop	Thanh tiêu đề VectorCraft trên mọi màn hình nền
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	Khi biến môi trường VECTORCRAFT_TITLEBAR được đặt, biến này chọn thanh tiêu đề.
+	System Title Bar takes precedence over this option while it is on.	Khi Thanh tiêu đề hệ thống được bật, tùy chọn đó được ưu tiên hơn tùy chọn này.
 	Tab	Tab
 	Tab Stops	Vị trí tab
 	Table	Bảng
@@ -4420,7 +4432,7 @@ theme	Appearance	Giao diện
 @msg	bad shortcut	phím tắt không hợp lệ
 @msg	bad stream length	độ dài luồng không hợp lệ
 @msg	bad trailer	trailer không hợp lệ
-@msg	balance must be between 0 and 100	cân bằng phải nằm trong khoảng 0 đến 100
+@msg	balance must be between 0 and 100	balance phải nằm trong khoảng 0 đến 100
 @msg	batch step {_1} (`{id}`) failed: {e}	bước hàng loạt {_1} (`{id}`) thất bại: {e}
 @msg	before must name a panel	before phải đặt tên bảng
 @msg	below and above must name a panel floating in another group	below và above phải đặt tên bảng đang thả nổi trong nhóm khác
@@ -4475,7 +4487,7 @@ theme	Appearance	Giao diện
 @msg	Data Recovery has nowhere to keep copies: set Preferences → File Handling → Data Recovery → Folder (recoveryFolder)	Phục hồi dữ liệu không có nơi lưu bản sao: đặt Tùy chọn → Xử lý tệp → Phục hồi dữ liệu → Thư mục (recoveryFolder)
 @msg	Data Recovery can't keep copies in {path}: {e}	Phục hồi dữ liệu không thể lưu bản sao vào {path}: {e}
 @msg	Plug-ins can't be loaded from {path}: {e}	Không thể tải plug-in từ {path}: {e}
-@msg	decimals must be {_1}–{_2} (got {_3})	số thập phân phải từ {_1}–{_2} (nhận được {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals phải từ {_1}–{_2} (nhận được {_3})
 @msg	direct-select anchor points to cut at (not the end points of open paths)	chọn trực tiếp các điểm neo để cắt (không phải điểm cuối của đường dẫn mở)
 @msgplural	Discarded {n} recovered document|Discarded {n} recovered documents	Đã loại bỏ {n} tài liệu đã phục hồi
 @msg	divide into 1 to {MAX_PIECES} slices	chia thành 1 đến {MAX_PIECES} lát cắt
@@ -4515,7 +4527,7 @@ theme	Appearance	Giao diện
 @msg	icon must be true or false	icon phải là true hoặc false
 @msg	icon only docks a panel in the icon column, with no anchor	icon chỉ neo bảng vào cột biểu tượng, không có anchor
 @msg	column docks a set as a dock column, with no anchor or icon	column neo một bộ thành cột neo, không có anchor hay icon
-@msg	panel is not in a dock group	bảng không thuộc nhóm nào của dock
+@msg	panel is not in a dock group	panel không thuộc nhóm nào của dock
 @msg	only a dock group above or below others collapses, not one beside another	chỉ thu gọn được nhóm dock nằm trên hoặc dưới các nhóm khác, không phải nhóm nằm cạnh
 @msg	guides are locked	đường căn bị khóa
 @msg	handle must be in or out	handle phải là in hoặc out
@@ -4526,9 +4538,9 @@ theme	Appearance	Giao diện
 @msg	image would be too large; lower the resolution	ảnh sẽ quá lớn; hãy giảm độ phân giải
 @msg	Imported library {name}	Đã nhập thư viện {name}
 @msg	Imported {what}: {_1}	Đã nhập {what}: {_1}
-@msg	index must be a number or first, previous, next or last	chỉ mục phải là số hoặc first, previous, next hoặc last
-@msg	index must be a number or first, previous, next or last, not `{other}`	chỉ mục phải là số hoặc first, previous, next hoặc last, không phải `{other}`
-@msg	index must be ≥ 0	chỉ mục không được âm
+@msg	index must be a number or first, previous, next or last	index phải là số hoặc first, previous, next hoặc last
+@msg	index must be a number or first, previous, next or last, not `{other}`	index phải là số hoặc first, previous, next hoặc last, không phải `{other}`
+@msg	index must be ≥ 0	index phải ≥ 0
 @msg	Installed plug-in {_1}	Đã cài đặt plug-in {_1}
 @msg	installing from a path is not available on the web; pass the module as `dataBase64`	cài đặt từ đường dẫn không khả dụng trên web; hãy truyền mô-đun dưới dạng `dataBase64`
 @msg	internal error in `{cmd}`: {msg} (the document was left as it was before; please report this bug)	lỗi nội bộ trong `{cmd}`: {msg} (tài liệu được giữ nguyên; vui lòng báo cáo lỗi này)
@@ -4689,6 +4701,8 @@ theme	Appearance	Giao diện
 @msg	no such action set	không có bộ hành động như vậy
 @msg	the action sets changed; nothing was deleted	các bộ hành động đã thay đổi; không có gì bị xóa
 @msg	no action set to save	không có bộ hành động nào để lưu
+@msg	the action set file can't be read in full	không thể đọc hết tệp bộ hành động
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	Đã tải “{name}”: bỏ qua {n} bước
 @msg	not an action set file	không phải tệp bộ hành động
 @msg	the action set file is larger than 8 MiB	tệp bộ hành động lớn hơn 8 MiB
 @msg	the action set file holds more than 1,000 actions	tệp bộ hành động chứa hơn 1.000 hành động
@@ -4788,9 +4802,9 @@ theme	Appearance	Giao diện
 @msg	PDF settings are not an object	Cài đặt PDF không phải là đối tượng
 @msg	PDF security settings are not an object	Cài đặt bảo mật PDF không phải là đối tượng
 @msg	PDF writer error: {0}	Lỗi ghi PDF: {0}
-@msg	percent must be above 0 and at most 6400, not {p}	phần trăm phải lớn hơn 0 và tối đa 6400, không phải {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent phải lớn hơn 0 và tối đa 6400, không phải {p}
 @msg	pick a colour, gradient or pattern to save as a swatch	hãy chọn màu, chuyển sắc hoặc họa tiết để lưu làm mẫu màu
-@msg	plane must be left, right or ground	mặt phẳng phải là left, right hoặc ground
+@msg	plane must be left, right or ground	plane phải là left, right hoặc ground
 @msg	plug-in ABI: {0}	ABI plug-in: {0}
 @msg	plug-in exceeded its {0}	plug-in đã vượt quá {0}
 @msg	plug-in failed: {0}	plug-in thất bại: {0}
@@ -4852,8 +4866,8 @@ theme	Appearance	Giao diện
 @msg	Saving	Đang lưu
 @msg	Saving recovery data for {_1}	Đang lưu dữ liệu phục hồi cho {_1}
 @msg	Saving {_1}	Đang lưu {_1}
-@msg	scale must be a number from {_1} to {_2}, not {_3}	tỷ lệ phải là số từ {_1} đến {_2}, không phải {_3}
-@msg	scale must be a number from {_1} to {_2}, not {s}	tỷ lệ phải là số từ {_1} đến {_2}, không phải {s}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale phải là số từ {_1} đến {_2}, không phải {_3}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale phải là số từ {_1} đến {_2}, không phải {s}
 @msg	searching a folder isn't available on the web	tìm kiếm trong thư mục không khả dụng trên web
 @msg	select (or target) objects whose appearance isn't basic	chọn (hoặc đặt mục tiêu) đối tượng có diện mạo không cơ bản
 @msg	select a blend	hãy chọn một đối tượng hòa trộn
@@ -4885,7 +4899,7 @@ theme	Appearance	Giao diện
 @msg	select paths or anchor points	chọn đường dẫn hoặc điểm neo
 @msg	select paths to join	hãy chọn đường dẫn để nối
 @msg	select some type first	hãy chọn chữ trước
-@msg	kerning must be a number, "auto", or "optical"	Kerning phải là số, “auto” hoặc “optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning phải là số, “auto” hoặc “optical”
 @msg	the selection has no gradient fill	vùng chọn không có tô chuyển sắc
 @msg	the selection has no gradient stroke	vùng chọn không có nét chuyển sắc
 @msg	the selection has no pattern fill	vùng chọn không có tô họa tiết
@@ -6009,6 +6023,7 @@ breakText	Glyphs	Glyph
 	Reset Symbol Instance	Đặt lại đối tượng ký hiệu
 @msg	type must be static or dynamic, not {v}	type phải là static hoặc dynamic, không phải {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` là ký hiệu tĩnh: trước tiên hãy đặt Kiểu ký hiệu thành Động
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	Chỉ có thể thay đổi màu đặc của màu tô và nét của đường dẫn, đường dẫn phức hoặc chữ được chọn trong một đối tượng ký hiệu
 @msg	path must be a list of child indices	path phải là danh sách chỉ số con
 @msg	no object at path {shown} in the symbol's art	không có đối tượng tại đường dẫn {shown} trong hình của ký hiệu
 @msg	give fill, stroke, opacity and/or blend	hãy cung cấp fill, stroke, opacity và/hoặc blend
@@ -6106,3 +6121,25 @@ breakText	Glyphs	Glyph
 # 3D Box add-on
 	3D Box	Hộp 3D
 	3D Box Tool	Công cụ Hộp 3D
+
+# Safe Mode
+	Safe Mode…	Chế độ an toàn…
+	Safe Mode	Chế độ an toàn
+	Help › Safe Mode…	Trợ giúp › Chế độ an toàn…
+	Enable on Re-launch	Bật ở lần khởi chạy tiếp theo
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	Lần khởi chạy VectorCraft trước đã dừng khi đang tải plug-in {name}. Có thể plug-in đó không phải là nguyên nhân.
+	Disable and Continue	Tắt và tiếp tục
+	Start Normally	Khởi động bình thường
+	Start in Safe Mode	Khởi động ở chế độ an toàn
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft đang ở chế độ an toàn: không plug-in nào được tải hay chạy cho đến khi ứng dụng khởi động bình thường.
+	Disabled plug-ins	Plug-in đã tắt
+	No plug-ins are disabled.	Không có plug-in nào bị tắt.
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	Chế độ an toàn đang bật: plug-in không được tải hay chạy cho đến khi VectorCraft khởi động bình thường
+@msg	give `id` or `file` (see plugin.safeMode)	cung cấp `id` hoặc `file` (xem plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	plug-in đó không bị tắt (xem plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	Không thể lưu các plug-in đã tắt cho lần khởi chạy tiếp theo
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	Mở rộng diện mạo: không thể mở rộng hiệu ứng plug-in trong vùng chọn ở chế độ an toàn
+
+# Align to Pixel Grid
+	Align to Pixel Grid	Căn theo lưới pixel
+@msg	only paths and compound paths can be aligned to the pixel grid	chỉ đường dẫn và đường dẫn phức mới căn theo lưới pixel được
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 920a637a3..b706fc524 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -1027,6 +1027,14 @@
 	Export As SVG…	导出为 SVG…
 	Export Asset	导出资源
 	Export Assets	导出资源
+	Export 3D Object	导出 3D 对象
+	3D Export Format	3D 导出格式
+	Export 3D Assets	导出 3D 资源
+@msg	{what} can't be exported in 3D: {e}	无法将 {what} 导出为 3D：{e}
+@msg	asset {id} isn't a 3D asset	资源 {id} 不是 3D 资源
+@msg	asset {id} is a 3D asset: assets.export3D writes it	资源 {id} 是 3D 资源：由 assets.export3D 写入
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	还没有 3D 资源：请先收集带有 3D 效果的对象 (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	请选择带有 3D 效果的对象 (或提供其 ID)
 	Export As…	导出为…
 	Export CSS	导出 CSS
 	Export CSS…	导出 CSS…
@@ -3859,14 +3867,14 @@ imageTrace	Outline	轮廓
 @msg	The last start of VectorCraft ended on {name} before its window appeared, so it started on {summary}. To try that graphics processor again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	VectorCraft 上次启动时在其窗口出现之前于 {name} 上终止，因此本次在 {summary} 上启动。要再次尝试该图形处理器，请更改“首选项 › 性能 › 图形处理器”，或在设置 WGPU_BACKEND 后启动
 @msg	The last start of VectorCraft ended while it listed the graphics processors, so it started on {summary} with OpenGL alone. To try the other graphics backends again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	VectorCraft 上次启动时在列出图形处理器期间终止，因此本次仅使用 OpenGL 在 {summary} 上启动。要再次尝试其他图形后端，请更改“首选项 › 性能 › 图形处理器”，或在设置 WGPU_BACKEND 后启动
 @msg	not a DXF drawing	不是 DXF 图纸
-@msg	scale must be a number from {_1} to {_2}, not {s}	比例必须是 {_1} 到 {_2} 之间的数字，而不是 {s}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale 必须是 {_1} 到 {_2} 之间的数字，而不是 {s}
 @msg	the artboard to fit must be a positive size up to {_1} pt	要适合的画板尺寸必须为正数，且不超过 {_1} pt
 @msg	the drawing has no layout `{_1}` (it has {_2})	图纸中没有布局 `{_1}` (它包含 {_2})
 @msg	this is a DWG drawing, which can't be read: save it from the CAD app as an ASCII DXF and open that	这是 DWG 图纸，无法读取：请在 CAD 应用中将其保存为 ASCII DXF，然后打开该文件
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	按此比例，图纸为 {w} × {h} pt，超出画布的容量：请选择较小的比例，或使其适合画板
 @msg	the scale is not a usable number	比例不是可用的数字
 @msg	the drawing is too large to open	图纸过大，无法打开
-@msg	scale must be a number from {_1} to {_2}, not {_3}	比例必须是 {_1} 到 {_2} 之间的数字，而不是 {_3}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale 必须是 {_1} 到 {_2} 之间的数字，而不是 {_3}
 @msg	an image has no pixels and was left out	已略去没有像素的图像
 @msg	object {0} cannot have children	对象 {0} 不能包含子对象
 @msg	range `{s}` is empty	范围 `{s}` 为空
@@ -3969,7 +3977,7 @@ imageTrace	Outline	轮廓
 @msg	{name}: no local header	{name}：没有本地文件头
 @msg	Flatten Transparency: select objects to flatten	拼合透明度：请选择要拼合的对象
 @msg	Flatten Transparency: {e}	拼合透明度：{e}
-@msg	balance must be between 0 and 100	平衡必须介于 0 到 100 之间
+@msg	balance must be between 0 and 100	balance 必须介于 0 到 100 之间
 @msg	resolutions must be between 1 and 2400 ppi	分辨率必须介于 1 到 2400 ppi 之间
 @msg	unknown preset `{name}` (high, medium, low or a saved one: see flattener.presets.list)	未知预设 `{name}` (high、medium、low 或已保存的预设：请参阅 flattener.presets.list)
 @msg	`at` must be [x, y]	`at` 必须是 [x, y]
@@ -4135,7 +4143,7 @@ imageTrace	Outline	轮廓
 @msg	no artboard {i} (0-based; the document has {_1})	没有画板 {i} (从 0 开始计数；文档有 {_1} 个)
 @msg	no selected slice in the image: select slices, or save all of them	图像中没有选中的切片：请选择切片，或全部保存
 @msg	nothing to save: the document has no visible art	没有可保存的内容：文档中没有可见的图稿
-@msg	percent must be above 0 and at most 6400, not {p}	百分比必须大于 0 且不超过 6400，而不是 {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent 必须大于 0 且不超过 6400，而不是 {p}
 @msg	unknown preset `{name}` (see webExport.presets.list)	未知预设 `{name}` (请参阅 webExport.presets.list)
 @msg	width and height are at least 1 pixel	宽度和高度至少为 1 像素
 @msg	`sampleSize` must be 1, 3 or 5	`sampleSize` 必须是 1、3 或 5
@@ -4292,7 +4300,7 @@ imageTrace	Outline	轮廓
 @msg	is not an image VectorCraft reads	不是 VectorCraft 可读取的图像
 @msg	not found	未找到
 @msg	SVG parse error: {0}	SVG 解析错误：{0}
-@msg	decimals must be {_1}–{_2} (got {_3})	小数位数必须为 {_1}–{_2} (实际为 {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals 必须为 {_1}–{_2} (实际为 {_3})
 @msg	Exporting {_1}	正在导出 {_1}
 @msg	Packaging {_1}	正在打包 {_1}
 @msg	Placing {_1}	正在置入 {_1}
@@ -4448,6 +4456,8 @@ imageTrace	Outline	轮廓
 @msg	no such action set	没有此动作组
 @msg	the action sets changed; nothing was deleted	动作组已更改；未删除任何内容
 @msg	no action set to save	没有要存储的动作组
+@msg	the action set file can't be read in full	无法完整读取动作组文件
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	已载入“{name}”：已略过 {n} 个步骤
 @msg	not an action set file	不是动作组文件
 @msg	the action set file is larger than 8 MiB	动作组文件大于 8 MiB
 @msg	the action set file holds more than 1,000 actions	动作组文件包含超过 1,000 个动作
@@ -4456,7 +4466,7 @@ imageTrace	Outline	轮廓
 @msg	choose a folder to export to	请选择要导出到的文件夹
 @msg	the selection has no URL (or they differ)	所选对象没有 URL (或其 URL 各不相同)
 @msg	select some type first	请先选择一些文字
-@msg	kerning must be a number, "auto", or "optical"	字偶距必须是数字、“auto”或“optical”
+@msg	kerning must be a number, "auto", or "optical"	kerning 必须是数字、“auto”或“optical”
 @msg	the selection has no gradient fill	所选对象没有渐变填色
 @msg	the selection has no gradient stroke	所选对象没有渐变描边
 @msg	the selection has no pattern fill	所选对象没有图案填色
@@ -4621,7 +4631,7 @@ imageTrace	Outline	轮廓
 @msg	before must name a panel	before 必须指定面板
 @msg	docking action contains an unknown panel or an excessive split path	停靠操作包含未知面板或过长的拆分路径
 @msg	group must be true or false	group 必须是 true 或 false
-@msg	panel is not in a dock group	面板不在停放组中
+@msg	panel is not in a dock group	panel 不在停放组中
 @msg	only a dock group above or below others collapses, not one beside another	只有位于其他组上方或下方的停放组可以折叠，并排的不行
 @msg	icon must be true or false	icon 必须为 true 或 false
 @msg	icon only docks a panel in the icon column, with no anchor	icon 只会把面板停放到图标栏中，不能带 anchor
@@ -4715,6 +4725,7 @@ imageTrace	Outline	轮廓
 	Report copied	已复制报告
 	Line {line}	第 {line} 行
 	Line {line}: {name}: {status}	第 {line} 行：{name}：{status}
+	Read Action Set File	读取动作组文件
 	Read Shortcut Set File	读取快捷键组文件
 	Import Matches	导入对应
 	Remember Import Matches	记住导入对应
@@ -5213,6 +5224,9 @@ effect	Horizontal	水平
 effect	Vertical	垂直
 	Edge	边缘
 	System Title Bar	系统标题栏
+	VectorCraft Title Bar on Every Desktop	在所有桌面上使用 VectorCraft 标题栏
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	设置了环境变量 VECTORCRAFT_TITLEBAR 时，由它选择标题栏。
+	System Title Bar takes precedence over this option while it is on.	开启系统标题栏时，它优先于此选项。
 	Value Axis	数值轴
 	On Left Side	左侧
 	On Right Side	右侧
@@ -6249,6 +6263,7 @@ breakText	Glyphs	字形
 	Reset Symbol Instance	重置符号实例
 @msg	type must be static or dynamic, not {v}	type 必须是 static 或 dynamic,而不是 {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` 是静态符号:请先将其符号类型设为动态
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	在符号实例中选中的路径、复合路径或文字只能更改填色和描边的纯色
 @msg	path must be a list of child indices	path 必须是子项索引列表
 @msg	no object at path {shown} in the symbol's art	符号图稿中路径 {shown} 处没有对象
 @msg	give fill, stroke, opacity and/or blend	请提供 fill、stroke、opacity 和/或 blend
@@ -6346,3 +6361,25 @@ breakText	Glyphs	字形
 # 3D Box add-on
 	3D Box	3D 盒子
 	3D Box Tool	3D 盒子工具
+
+# Safe Mode
+	Safe Mode…	安全模式…
+	Safe Mode	安全模式
+	Help › Safe Mode…	帮助 › 安全模式…
+	Enable on Re-launch	下次启动时启用
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	VectorCraft 上次启动时在载入增效工具 {name} 期间停止。该增效工具不一定是原因。
+	Disable and Continue	停用并继续
+	Start Normally	正常启动
+	Start in Safe Mode	以安全模式启动
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft 处于安全模式：在正常启动之前，不会载入或运行任何增效工具。
+	Disabled plug-ins	已停用的增效工具
+	No plug-ins are disabled.	没有停用的增效工具。
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	安全模式已开启：在 VectorCraft 正常启动之前，增效工具不会载入或运行
+@msg	give `id` or `file` (see plugin.safeMode)	请提供 `id` 或 `file` (请参阅 plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	该增效工具未停用 (请参阅 plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	无法为下次启动保存已停用的增效工具
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	扩展外观：在安全模式下无法扩展所选对象中的增效工具效果
+
+# Align to Pixel Grid
+	Align to Pixel Grid	对齐像素网格
+@msg	only paths and compound paths can be aligned to the pixel grid	只有路径和复合路径可以对齐像素网格
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 112de5957..813b6a224 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -1051,6 +1051,14 @@ font-technology	Variable	可變
 	Export As SVG…	匯出為 SVG…
 	Export Asset	匯出資產
 	Export Assets	匯出資產
+	Export 3D Object	匯出 3D 物件
+	3D Export Format	3D 匯出格式
+	Export 3D Assets	匯出 3D 資產
+@msg	{what} can't be exported in 3D: {e}	無法將 {what} 匯出為 3D：{e}
+@msg	asset {id} isn't a 3D asset	資產 {id} 不是 3D 資產
+@msg	asset {id} is a 3D asset: assets.export3D writes it	資產 {id} 是 3D 資產：由 assets.export3D 寫入
+@msg	no 3D assets yet: collect an object with a 3D effect first (assets.add3D)	尚無 3D 資產：請先收集具有 3D 效果的物件 (assets.add3D)
+@msg	select an object with a 3D effect (or give its ids)	請選取具有 3D 效果的物件 (或提供其 ID)
 	Export As…	匯出為…
 	Export CSS	匯出 CSS
 	Export CSS…	匯出 CSS…
@@ -1713,14 +1721,14 @@ file-filter	Templates	範本
 @msg	The last start of VectorCraft ended on {name} before its window appeared, so it started on {summary}. To try that graphics processor again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	VectorCraft 上次啟動時在 {name} 上於視窗出現前結束，因此這次在 {summary} 上啟動。若要再次嘗試該圖形處理器，請變更「偏好設定 › 效能 › 圖形處理器」，或設定 WGPU_BACKEND 後再啟動
 @msg	The last start of VectorCraft ended while it listed the graphics processors, so it started on {summary} with OpenGL alone. To try the other graphics backends again, change Preferences › Performance › Graphics Processor or start with WGPU_BACKEND set	VectorCraft 上次啟動時在列出圖形處理器期間結束，因此這次只以 OpenGL 在 {summary} 上啟動。若要再次嘗試其他圖形後端，請變更「偏好設定 › 效能 › 圖形處理器」，或設定 WGPU_BACKEND 後再啟動
 @msg	not a DXF drawing	不是 DXF 圖面
-@msg	scale must be a number from {_1} to {_2}, not {s}	比例必須是 {_1} 到 {_2} 之間的數字，而非 {s}
+@msg	scale must be a number from {_1} to {_2}, not {s}	scale 必須是 {_1} 到 {_2} 之間的數字，而非 {s}
 @msg	the artboard to fit must be a positive size up to {_1} pt	要符合的工作區域尺寸必須為正數，且不超過 {_1} pt
 @msg	the drawing has no layout `{_1}` (it has {_2})	圖面中沒有配置 `{_1}` (它有 {_2})
 @msg	this is a DWG drawing, which can't be read: save it from the CAD app as an ASCII DXF and open that	這是 DWG 圖面，無法讀取：請在 CAD 應用程式中將其儲存為 ASCII DXF，再開啟該檔案
 @msg	at this scale the drawing is {w} × {h} pt, more than the canvas holds: choose a smaller scale or fit it to the artboard	以此比例，圖面為 {w} × {h} pt，超過畫布所能容納：請選擇較小的比例，或使其符合工作區域
 @msg	the scale is not a usable number	比例不是可用的數字
 @msg	the drawing is too large to open	圖面過大，無法開啟
-@msg	scale must be a number from {_1} to {_2}, not {_3}	比例必須是 {_1} 到 {_2} 之間的數字，而非 {_3}
+@msg	scale must be a number from {_1} to {_2}, not {_3}	scale 必須是 {_1} 到 {_2} 之間的數字，而非 {_3}
 @msg	an image has no pixels and was left out	已略過沒有像素的影像
 @msg	object {0} cannot have children	物件 {0} 不能有子物件
 @msg	range `{s}` is empty	範圍 `{s}` 是空的
@@ -1823,7 +1831,7 @@ file-filter	Templates	範本
 @msg	{name}: no local header	{name}：沒有區域檔頭
 @msg	Flatten Transparency: select objects to flatten	透明度平面化：請選取要平面化的物件
 @msg	Flatten Transparency: {e}	透明度平面化：{e}
-@msg	balance must be between 0 and 100	平衡必須介於 0 到 100 之間
+@msg	balance must be between 0 and 100	balance 必須介於 0 到 100 之間
 @msg	resolutions must be between 1 and 2400 ppi	解析度必須介於 1 到 2400 ppi 之間
 @msg	unknown preset `{name}` (high, medium, low or a saved one: see flattener.presets.list)	未知的預設集 `{name}` (high、medium、low 或已儲存的預設集：請參閱 flattener.presets.list)
 @msg	`at` must be [x, y]	`at` 必須是 [x, y]
@@ -1987,7 +1995,7 @@ file-filter	Templates	範本
 @msg	no artboard {i} (0-based; the document has {_1})	沒有工作區域 {i} (從 0 起算；文件有 {_1} 個)
 @msg	no selected slice in the image: select slices, or save all of them	影像中沒有已選取的切片：請選取切片，或全部儲存
 @msg	nothing to save: the document has no visible art	沒有可儲存的內容：文件中沒有可見的圖稿
-@msg	percent must be above 0 and at most 6400, not {p}	百分比必須大於 0 且不超過 6400，而非 {p}
+@msg	percent must be above 0 and at most 6400, not {p}	percent 必須大於 0 且不超過 6400，而非 {p}
 @msg	unknown preset `{name}` (see webExport.presets.list)	未知的預設集 `{name}` (請參閱 webExport.presets.list)
 @msg	width and height are at least 1 pixel	寬度和高度至少為 1 像素
 @msg	`sampleSize` must be 1, 3 or 5	`sampleSize` 必須是 1、3 或 5
@@ -2147,7 +2155,7 @@ file-filter	Templates	範本
 @msg	is not an image VectorCraft reads	不是 VectorCraft 可讀取的影像
 @msg	not found	找不到
 @msg	SVG parse error: {0}	SVG 剖析錯誤：{0}
-@msg	decimals must be {_1}–{_2} (got {_3})	小數位數必須為 {_1}–{_2} (收到 {_3})
+@msg	decimals must be {_1}–{_2} (got {_3})	decimals 必須為 {_1}–{_2} (收到 {_3})
 @msg	Exporting {_1}	正在匯出 {_1}
 @msg	Packaging {_1}	正在封裝 {_1}
 @msg	Placing {_1}	正在置入 {_1}
@@ -2303,6 +2311,8 @@ file-filter	Templates	範本
 @msg	no such action set	沒有這個動作組
 @msg	the action sets changed; nothing was deleted	動作組已變更；未刪除任何內容
 @msg	no action set to save	沒有要儲存的動作組
+@msg	the action set file can't be read in full	無法完整讀取動作組檔案
+@msgplural	Loaded “{name}”: {n} step was left out|Loaded “{name}”: {n} steps were left out	已載入「{name}」：已略過 {n} 個步驟
 @msg	not an action set file	不是動作組檔案
 @msg	the action set file is larger than 8 MiB	動作組檔案大於 8 MiB
 @msg	the action set file holds more than 1,000 actions	動作組檔案包含超過 1,000 個動作
@@ -2311,7 +2321,7 @@ file-filter	Templates	範本
 @msg	choose a folder to export to	請選擇要匯出至的資料夾
 @msg	the selection has no URL (or they differ)	選取範圍沒有 URL (或其 URL 各不相同)
 @msg	select some type first	請先選取一些文字
-@msg	kerning must be a number, "auto", or "optical"	字距微調必須是數字、「auto」或「optical」
+@msg	kerning must be a number, "auto", or "optical"	kerning 必須是數字、「auto」或「optical」
 @msg	the selection has no gradient fill	選取範圍沒有漸層填色
 @msg	the selection has no gradient stroke	選取範圍沒有漸層筆畫
 @msg	the selection has no pattern fill	選取範圍沒有圖樣填色
@@ -2471,7 +2481,7 @@ file-filter	Templates	範本
 @msg	before must name a panel	before 必須指定面板
 @msg	docking action contains an unknown panel or an excessive split path	停駐動作包含未知的面板或過長的分割路徑
 @msg	group must be true or false	group 必須是 true 或 false
-@msg	panel is not in a dock group	面板不在停駐群組中
+@msg	panel is not in a dock group	panel 不在停駐群組中
 @msg	only a dock group above or below others collapses, not one beside another	只有位於其他群組上方或下方的停駐群組可以摺疊，並排的不行
 @msg	icon must be true or false	icon 必須為 true 或 false
 @msg	icon only docks a panel in the icon column, with no anchor	icon 只會將面板停駐到圖示欄中，不能帶 anchor
@@ -2597,6 +2607,7 @@ file-filter	Templates	範本
 	Line {line}	第 {line} 行
 	Line {line}: {name}: {status}	第 {line} 行：{name}：{status}
 	Imported. Press OK to keep the imported set.	已匯入。按一下「確定」以保留匯入的快速鍵組。
+	Read Action Set File	讀取動作組檔案
 	Read Shortcut Set File	讀取快速鍵組檔案
 	Import Matches	匯入對應
 	Remember Import Matches	記住匯入對應
@@ -5030,6 +5041,9 @@ axis	Both	兩者
 effect	Soft	柔和
 	Edge	邊緣
 	System Title Bar	系統標題列
+	VectorCraft Title Bar on Every Desktop	在所有桌面上使用 VectorCraft 標題列
+	The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.	設定了環境變數 VECTORCRAFT_TITLEBAR 時，由它選擇標題列。
+	System Title Bar takes precedence over this option while it is on.	開啟系統標題列時，它優先於此選項。
 	Value Axis	數值軸
 	On Left Side	左側
 	On Right Side	右側
@@ -6046,6 +6060,7 @@ breakText	Glyphs	字符
 	Reset Symbol Instance	重設符號實體
 @msg	type must be static or dynamic, not {v}	type 必須是 static 或 dynamic,而不是 {v}
 @msg	`{name}` is a static symbol: set its Symbol Type to Dynamic first	`{name}` 是靜態符號:請先將其符號類型設為動態
+@msg	Only the solid color fill and stroke of a path, compound path or type selected in a symbol instance can change	在符號實體中選取的路徑、複合路徑或文字只能變更填色和筆畫的純色
 @msg	path must be a list of child indices	path 必須是子項索引清單
 @msg	no object at path {shown} in the symbol's art	符號圖稿中路徑 {shown} 處沒有物件
 @msg	give fill, stroke, opacity and/or blend	請提供 fill、stroke、opacity 和/或 blend
@@ -6143,3 +6158,25 @@ breakText	Glyphs	字符
 # 3D Box add-on
 	3D Box	3D 盒子
 	3D Box Tool	3D 盒子工具
+
+# Safe Mode
+	Safe Mode…	安全模式…
+	Safe Mode	安全模式
+	Help › Safe Mode…	說明 › 安全模式…
+	Enable on Re-launch	下次啟動時啟用
+	The last launch of VectorCraft stopped while the plug-in {name} was loading. It may not be what stopped it.	VectorCraft 上次啟動時在載入增效模組 {name} 期間停止。該增效模組不一定是原因。
+	Disable and Continue	停用並繼續
+	Start Normally	正常啟動
+	Start in Safe Mode	以安全模式啟動
+	VectorCraft is in Safe Mode: no plug-ins load or run until it starts normally.	VectorCraft 處於安全模式：在正常啟動之前，不會載入或執行任何增效模組。
+	Disabled plug-ins	已停用的增效模組
+	No plug-ins are disabled.	沒有停用的增效模組。
+@msg	Safe Mode is on: plug-ins don't load or run until VectorCraft starts normally	安全模式已開啟：在 VectorCraft 正常啟動之前，增效模組不會載入或執行
+@msg	give `id` or `file` (see plugin.safeMode)	請提供 `id` 或 `file` (請參閱 plugin.safeMode)
+@msg	that plug-in isn't disabled (see plugin.safeMode)	該增效模組未停用 (請參閱 plugin.safeMode)
+@msg	Couldn't save the disabled plug-ins for the next launch	無法為下次啟動儲存已停用的增效模組
+@msg	Expand Appearance: a plug-in effect in the selection can't be expanded in Safe Mode	展開外觀：在安全模式下無法展開選取範圍中的增效模組效果
+
+# Align to Pixel Grid
+	Align to Pixel Grid	對齊像素格點
+@msg	only paths and compound paths can be aligned to the pixel grid	只有路徑和複合路徑可以對齊像素格點
diff --git a/crates/ui-egui/src/io/export.rs b/crates/ui-egui/src/io/export.rs
index 1b438adf9..52ce3677c 100644
--- a/crates/ui-egui/src/io/export.rs
+++ b/crates/ui-egui/src/io/export.rs
@@ -244,7 +244,8 @@ pub fn export_for_screens(app: &mut VectorcraftApp, params: Value) -> Result<Val
     export_files(app, "document.exportForScreens", params)
 }
 
-/// [`export_for_screens`] through command `id` (`document.exportForScreens` or `assets.export`).
+/// [`export_for_screens`] through command `id` (`document.exportForScreens` or `assets.export`; or
+/// `assets.export3D`, whose reply takes the same form and which always runs at once).
 /// On the desktop with Background Export on, an export into a folder is checked, journaled and
 /// prepared from the document as it is now, and the files are encoded and written on the
 /// background thread ([`background`]): this returns `{background: true, status}` at once, with the
@@ -253,7 +254,8 @@ pub(crate) fn export_files(app: &mut VectorcraftApp, id: &str, params: Value) ->
     let open_location = params.get("openLocation").and_then(Value::as_bool).unwrap_or(false);
     let folder = params.get("folder").and_then(Value::as_str).unwrap_or_default().to_string();
     // Without a folder the files come back in the reply, which the caller waits for.
-    let in_background = app.session.prefs.background_export && app.services.write_shared.is_some() && !is_web(app) && !folder.is_empty();
+    let in_background =
+        app.session.prefs.background_export && app.services.write_shared.is_some() && !is_web(app) && !folder.is_empty() && id != "assets.export3D";
     if !in_background {
         // Made at once, after the exports and saves started before it.
         background::wait_all(app);
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 0402d6627..1e7a8551c 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -195,6 +195,10 @@ pub struct VectorcraftApp {
     clipboard_publishing: sysclip::Publishing,
     /// A URL to open through egui next frame (when the host has no `open_url` service).
     pending_url: Option<String>,
+    /// `VECTORCRAFT_TITLEBAR` chose this window's frame (Linux and the BSDs), so Preferences › User
+    /// Interface › VectorCraft Title Bar on Every Desktop does not apply while it is set. `false`
+    /// unless the host sets it.
+    pub titlebar_from_env: bool,
     /// Windows and Linux: the window has no OS decorations, so the app bar is the title bar (drag,
     /// double-click to maximize, caption buttons) and invisible edge zones resize the window.
     pub custom_titlebar: bool,
diff --git a/crates/ui-egui/src/menus/invoke.rs b/crates/ui-egui/src/menus/invoke.rs
index 073b1130e..a29714b1a 100644
--- a/crates/ui-egui/src/menus/invoke.rs
+++ b/crates/ui-egui/src/menus/invoke.rs
@@ -347,10 +347,12 @@ fn open_object_dialog(app: &mut VectorcraftApp, id: &str, p: &Value) -> bool {
         }
         return true;
     }
-    // Export Assets, Remove, Rename and Asset Export Settings with no params, as the command
-    // palette runs them (#4864): the Asset Export panel, where each one is done. A panel that already
-    // shows stays open.
-    if matches!(id, "assets.export" | "assets.remove" | "assets.rename" | "assets.settings.set") && p.as_object().is_none_or(|o| o.is_empty()) {
+    // Export Assets, Remove, Rename, Asset Export Settings, Export 3D Assets and 3D Export Format
+    // with no params, as the command palette runs them (#4864): the Asset Export panel, where each
+    // one is done. A panel that already shows stays open.
+    if matches!(id, "assets.export" | "assets.remove" | "assets.rename" | "assets.settings.set" | "assets.export3D" | "assets.set3DFormat")
+        && p.as_object().is_none_or(|o| o.is_empty())
+    {
         if let Err(e) = crate::panel_docking::reveal_panel(app, crate::panels::asset_export::ID) {
             app.status(e);
         }
diff --git a/crates/ui-egui/src/menus/labels.rs b/crates/ui-egui/src/menus/labels.rs
index b8d314346..3c3b06425 100644
--- a/crates/ui-egui/src/menus/labels.rs
+++ b/crates/ui-egui/src/menus/labels.rs
@@ -123,7 +123,7 @@ fn command_label(app: &VectorcraftApp, id: &str, label: &str) -> Option<String>
 
 /// Does the menu item `id` show a name that is user, file or system data rather than an interface
 /// label: a recent file, a saved view, a font, a user library or preset, a custom workspace, a
-/// plug-in? Such names are shown as they are, never translated (a workspace the user calls
+/// plug-in, an SVG filter? Such names are shown as they are, never translated (a workspace the user calls
 /// "Layers" stays "Layers").
 pub(super) fn shows_a_name(id: &str, label: &str) -> bool {
     const SLOTS: [&str; 8] = [
@@ -138,7 +138,7 @@ pub(super) fn shows_a_name(id: &str, label: &str) -> bool {
     ];
     SLOTS.iter().any(|s| id.starts_with(s))
         || saved_selection_slot(id).is_some()
-        || matches!(id, "text.setStyle" | "plugin.dialog" | "window.toolbar.custom")
+        || matches!(id, "text.setStyle" | "plugin.dialog" | "window.toolbar.custom" | "svgFilter.apply")
         || (id == "window.workspace" && !crate::workspaces::is_builtin(label))
         || (matches!(id, "effect.apply" | "effect.dialog") && vectorcraft_effects::plugin_effects().iter().any(|e| e.label == label))
 }
diff --git a/crates/ui-egui/src/menus/run.rs b/crates/ui-egui/src/menus/run.rs
index 10a0015fe..2e71f9873 100644
--- a/crates/ui-egui/src/menus/run.rs
+++ b/crates/ui-egui/src/menus/run.rs
@@ -638,6 +638,7 @@ fn run_ui_part7(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
             Ok(Value::Null)
         }
         "help.checkForUpdates" => crate::updates_ui::check(app),
+        "help.safeMode" => crate::dialogs::safe_mode::open(app),
         "help.commandPalette" => {
             app.ui.palette_open = !app.ui.palette_open;
             app.ui.palette_query.clear();
@@ -804,6 +805,8 @@ fn run_ui_part10(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result
         "ui.dialogReset" => crate::dialogs::reset(app),
         "attributes.openUrl" => crate::panels::attributes::open_url(app, p),
         "ui.javascriptFilesDialog" => crate::panels::svg_interactivity::files_dialog(app, p),
+        "ui.svgFilterDialog" => crate::dialogs::svg_filter::open(app, p),
+        "ui.importSvgFilter" => crate::dialogs::svg_filter::import_file(app),
         "ui.spotColors" => crate::dialogs::spot_colors::open(app),
         "ui.menuDialog" => match s("command").as_deref() {
             Some(c) if crate::dialogs::envelope::opens(c) => crate::dialogs::envelope::open(app, c),
diff --git a/crates/ui-egui/src/menus/state.rs b/crates/ui-egui/src/menus/state.rs
index 0c392d191..ff5ccda13 100644
--- a/crates/ui-egui/src/menus/state.rs
+++ b/crates/ui-egui/src/menus/state.rs
@@ -175,7 +175,7 @@ pub(crate) fn waits_for_ime(app: &VectorcraftApp, id: &str) -> bool {
 /// targeted layer, group or object, else the selection). Without `ids` (or with an empty list) and
 /// without a subject they are off, as the panel's buttons are: in menus, in the command palette and
 /// on their keys.
-pub(super) const SUBJECT_COMMANDS: [&str; 2] = ["appearance.addFill", "appearance.addStroke"];
+pub(super) const SUBJECT_COMMANDS: [&str; 3] = ["appearance.addFill", "appearance.addStroke", "svgFilter.apply"];
 
 /// Is there an Appearance panel subject: a targeted layer, group or object, or a selected one?
 pub(super) fn has_subject(app: &VectorcraftApp) -> bool {
@@ -246,7 +246,12 @@ pub fn enabled(app: &VectorcraftApp, id: &str) -> bool {
             let min = crate::panels::pathfinder::minimum_operands(op);
             crate::panels::pathfinder::operands(app) >= min
         }),
-        "file.export.pdf" | "ui.savePdfDialog" | "ui.fileInfoDialog" | "ui.rasterEffectsSettingsDialog" => app.session.active().is_some(),
+        "file.export.pdf" | "ui.savePdfDialog" | "ui.fileInfoDialog" | "ui.rasterEffectsSettingsDialog" | "ui.svgFilterDialog" => {
+            app.session.active().is_some()
+        }
+        "ui.importSvgFilter" => {
+            app.session.active().is_some() && crate::picks::can(app, &crate::picks::PickRequest::Open(crate::dialogs::svg_filter::pick()))
+        }
         "ui.missingFontsDialog" => !cfg!(target_arch = "wasm32") && app.session.active().is_some(),
         "ui.findFontsInFolder" => crate::picks::can(app, &crate::picks::PickRequest::Folder) && app.session.active().is_some(),
         "ui.swatchOptions" | "ui.newSwatch" | "ui.newColorGroup" => app.session.active().is_some(),
diff --git a/crates/ui-egui/src/menus/submenus.rs b/crates/ui-egui/src/menus/submenus.rs
index a878f7f0c..21985a117 100644
--- a/crates/ui-egui/src/menus/submenus.rs
+++ b/crates/ui-egui/src/menus/submenus.rs
@@ -172,11 +172,15 @@ pub(super) fn effect_menu() -> Vec<Item> {
             out.push(item(e));
             continue;
         }
+        // Apply SVG Filter…, Import SVG Filter… and the document's filters.
+        if sub_name == "SVG Filters" {
+            out.push(sub(sub_name, crate::dialogs::svg_filter::menu_items()));
+            continue;
+        }
         let items = items_at(&["Effect", sub_name], true);
         if items.is_empty() {
             let placeholder = match sub_name {
                 "3D and Materials" => vec![todo("Extrude & Bevel…"), todo("Revolve…"), todo("Inflate…"), todo("Rotate…"), todo("Materials…")],
-                "SVG Filters" => vec![todo("Apply SVG Filter…")],
                 _ => continue,
             };
             out.push(sub(sub_name, placeholder));
diff --git a/crates/ui-egui/src/menus/tree.rs b/crates/ui-egui/src/menus/tree.rs
index 752901c04..0df18da50 100644
--- a/crates/ui-egui/src/menus/tree.rs
+++ b/crates/ui-egui/src/menus/tree.rs
@@ -702,6 +702,7 @@ pub fn menu_tree_named(english_names: bool) -> Vec<(&'static str, Vec<Item>)> {
                 Sep,
                 c("Search Commands…", "help.commandPalette"),
                 todos("VectorCraft Help…", "F1"),
+                c("Safe Mode…", "help.safeMode"),
                 Sep,
                 c("Check for Updates…", "help.checkForUpdates"),
                 c("About VectorCraft", "help.about"),
diff --git a/crates/ui-egui/src/menus/ui_commands.rs b/crates/ui-egui/src/menus/ui_commands.rs
index 2dca2b16d..789f8851b 100644
--- a/crates/ui-egui/src/menus/ui_commands.rs
+++ b/crates/ui-egui/src/menus/ui_commands.rs
@@ -718,6 +718,12 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
     ("help.about", "About VectorCraft", "", "{}"),
     ("help.checkForUpdates", "Check for Updates…", "", "{}"),
     ("help.commandPalette", "Search Commands…", "Cmd+Shift+/", "{}"),
+    (
+        "help.safeMode",
+        "Safe Mode…",
+        "",
+        "{} open the Safe Mode dialog (dialog `safeMode`): whether VectorCraft is in Safe Mode, and the disabled plug-ins, each with Enable on Re-launch (engine: plugin.setEnabled). Closing it leaves Safe Mode as it is; Safe Mode is chosen at launch (--safe-mode, or the choice after a launch that stopped while a plug-in was loading, dialog `pluginStopped`)",
+    ),
     ("app.quit", "Quit VectorCraft", "Cmd+Q", "{}"),
     (
         "ui.swatchOptions",
@@ -1076,6 +1082,18 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
         "",
         "{} open JavaScript Files for the active document (dialog `javascriptFiles`, fields `file`: a path or URL and `selected`: a linked file; the SVG Interactivity panel's Link JavaScript Files button): its list shows svgInteractivity.info's files, Add runs svgInteractivity.addFile with file and Remove runs svgInteractivity.removeFile with selected",
     ),
+    (
+        "ui.svgFilterDialog",
+        "Apply SVG Filter…",
+        "",
+        "{index?, item?} open Apply SVG Filter for the active document (dialog `svgFilter`, fields `selected`: a filter's name, `code`: the code being edited, `editing`: \"\", \"new\" or the name of the filter being edited; with index, for the applied svg.filter effect at index of item, as effect.dialog opens it): its list shows svgFilter.list's filters; OK runs svgFilter.apply with selected, or effect.setParams on the applied effect; New and Edit open the code, Save runs svgFilter.define, Delete runs svgFilter.delete and Import… svgFilter.import with a picked SVG file",
+    ),
+    (
+        "ui.importSvgFilter",
+        "Import SVG Filter…",
+        "",
+        "{} pick an SVG file and add its filters to the active document's SVG filters (svgFilter.import) → svgFilter.import's result",
+    ),
     (
         "ui.spotColors",
         "Spot Colors…",
@@ -1245,7 +1263,7 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
         "ui.dxfOptionsDialog",
         "DXF Options Dialog",
         "",
-        "{path?, useArtboards?, range?, …document.exportDxf options} open DXF Options (dialog `dxfOptions`: fields = these options over the ones used last); OK checks them, remembers them and writes path (else asks). Export As… → DXF opens it too",
+        "{path?, useArtboards?, range?, …document.exportDxf options} open DXF Options (dialog `dxfOptions`: fields = these options over the ones used last, a dxfPreset's options under them; the dxfPreset field shows cnc while every field it sets matches, else custom); OK checks them, remembers them and writes path (else asks). Export As… → DXF opens it too",
     ),
     (
         "links.editOriginal",
@@ -1365,7 +1383,7 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
         crate::panels::actions::LOAD_SET,
         "Load Actions…",
         "",
-        "{path? | data?: the file's text} read an action set file (.vcactions) at path, else a picked one, and add its set after the Actions panel's sets; a set named like one in the panel gets the next free number (Print 2), and the other sets stay. Files of another version, over 8 MiB, with more than 1,000 actions or with an action of more than 10,000 steps are refused; the panel menu's Load Actions… (disabled where there is no open dialog, the web) → {set: index, name, actions: n}",
+        "{path? | data?: the file's text} read an action set file (.vcactions) at path, else a picked one, and add its set after the Actions panel's sets; a set named like one in the panel gets the next free number (Print 2), and the other sets stay. Files of another version, over 8 MiB, with more than 1,000 actions or with an action of more than 10,000 steps are refused; the panel menu's Load Actions… (disabled where there is no open dialog, the web) → {set: index, name, actions: n}. An action set another app saved as text (.aia, starting /version; read with actionSet.read) comes in with its actions. A step with a label and no recorded values comes in when exactly one menu command has that label (in English or the interface language, any case, no final …), and that command is directly in a top menu, can be recorded in actions, is what its menu bar item runs with no values and opens no dialog (never a submenu's item, a file or document command, Paste, Undo, Redo or an add-on's command), with no params and excluded from playback when it is off in the file; the other steps, every step with no label and every step recorded with values (a recorded menu item too) among them, are left out → {set, name, actions, skipped: [{action, step: its label, else its name}] (the first 1,000), leftOut: n}, and the status bar says how many were left out; a set with no name takes the file's name, else Actions; a file actionSet.read marks truncated is refused, and text that starts /version and isn't an action set gives \"not an action set file\"",
     ),
     (
         crate::panels::actions::DELETE_SETS,
diff --git a/crates/ui-egui/src/palette.rs b/crates/ui-egui/src/palette.rs
index fda2e1f7f..4f893e686 100644
--- a/crates/ui-egui/src/palette.rs
+++ b/crates/ui-egui/src/palette.rs
@@ -222,7 +222,7 @@ mod tests {
     /// Asset Export panel instead of failing on the missing params or exporting nowhere.
     #[test]
     fn a_pick_of_an_asset_export_command_opens_its_panel() {
-        let ids = ["assets.export", "assets.remove", "assets.rename", "assets.settings.set"];
+        let ids = ["assets.export", "assets.remove", "assets.rename", "assets.settings.set", "assets.export3D", "assets.set3DFormat"];
         for id in ids {
             assert!(items().iter().any(|(_, item, _)| item == id), "{id} is in the palette");
             let mut app = VectorcraftApp::new(vectorcraft_engine::Session::new(), crate::Services::default());
diff --git a/crates/ui-egui/src/panel_docking.rs b/crates/ui-egui/src/panel_docking.rs
index a0205be88..9f75168ec 100644
--- a/crates/ui-egui/src/panel_docking.rs
+++ b/crates/ui-egui/src/panel_docking.rs
@@ -1136,7 +1136,8 @@ pub(crate) fn show(app: &mut VectorcraftApp, ui: &mut egui::Ui) {
     }
     let modal = modal_open(app, &ctx);
     // Palette windows are OS windows of their own, held above the app's window while it is active,
-    // so a dialog, a menu or a tool flyout drawn in the main window would be covered by them.
+    // so a dialog, a menu, a tool flyout or the All Tools drawer drawn in the main window would be
+    // covered by them.
     #[cfg(not(target_arch = "wasm32"))]
     palette_window_levels(&ctx, &layout, modal, egui::Popup::is_any_open(&ctx) || crate::menus::menu_open(&ctx) || crate::toolbar::flyout_open(&ctx));
     let mut blocked = Vec::new();
diff --git a/crates/ui-egui/src/panel_docking/native_tests.rs b/crates/ui-egui/src/panel_docking/native_tests.rs
index 784b86fcf..5e72e61af 100644
--- a/crates/ui-egui/src/panel_docking/native_tests.rs
+++ b/crates/ui-egui/src/panel_docking/native_tests.rs
@@ -750,7 +750,38 @@ fn a_flyout_or_drawer_of_a_hidden_toolbar_leaves_the_palette_windows_shown() {
     h.app.run("window.panels", json!({})).unwrap();
     h.frames(1);
     assert!(!h.app.ui.toolbar && h.app.ui.flyout.is_some(), "the flyout is left set with the Tools panel hidden");
-    assert_eq!(take_palette_commands(&h, viewport).0.last(), Some(&true), "shown again: the flyout does not draw");
+    assert_eq!(take_palette_commands(&h, viewport).0, [true], "shown again: the flyout does not draw");
+}
+
+/// A strip torn off a flyout and a toolbar made with New Toolbar stay on screen like panels, so the
+/// palette windows stay shown beside them.
+#[test]
+fn a_torn_off_strip_or_a_new_toolbar_leaves_the_palette_windows_shown() {
+    let mut h = Harness::new();
+    let viewport = h.float("navigator");
+    h.host.borrow_mut().focus = ViewportId::ROOT;
+    h.frames(2);
+    take_palette_commands(&h, viewport);
+    // The commands go only on a change, so the drawer opening and closing shows the palette windows
+    // were on screen before the strip and the toolbar.
+    h.app.run("window.editToolbar", json!({"open": true})).unwrap();
+    h.frames(2);
+    assert_eq!(take_palette_commands(&h, viewport).0, [false], "hidden under the drawer");
+    h.app.run("window.editToolbar", json!({"open": false})).unwrap();
+    h.frames(2);
+    assert_eq!(take_palette_commands(&h, viewport).0, [true], "shown when the drawer closes");
+    h.app.run("window.floatTools", json!({"tool": "pen"})).unwrap();
+    h.app.run("window.toolbar.new", json!({"name": "Mine"})).unwrap();
+    h.frames(2);
+    let strips: Vec<&str> = h.app.ui.floating_flyouts.iter().filter_map(|strip| strip.tools.first().map(String::as_str)).collect();
+    assert_eq!(strips, ["pen"], "the Pen strip floats");
+    let toolbars: Vec<(&str, bool)> = h.app.ui.custom_toolbars.iter().map(|toolbar| (toolbar.name.as_str(), toolbar.shown)).collect();
+    assert_eq!(toolbars, [("Mine", true)], "the new toolbar shows");
+    assert_eq!(h.app.ui.flyout, None, "no flyout is open");
+    assert_eq!(take_palette_commands(&h, viewport), (vec![], vec![]), "the palette windows are left as they were");
+    h.app.run("window.editToolbar", json!({"open": true})).unwrap();
+    h.frames(2);
+    assert_eq!(take_palette_commands(&h, viewport).0, [false], "still shown: the drawer hides them again");
 }
 
 /// The frame in which a click elsewhere closes a flyout or the drawer shows the palette windows, as
diff --git a/crates/ui-egui/src/panels/actions.rs b/crates/ui-egui/src/panels/actions.rs
index 64c8e6fbc..93d781e5a 100644
--- a/crates/ui-egui/src/panels/actions.rs
+++ b/crates/ui-egui/src/panels/actions.rs
@@ -2680,6 +2680,191 @@ mod tests {
         assert_eq!(*asked.borrow(), [files::MAX_SET_FILE + 1; 2], "each read stops one byte past the limit");
     }
 
+    /// An action set as another app saves it as text, written from scratch: the set `name` (none
+    /// when empty) and actions of steps, each a label and whether it is on, with no recorded values.
+    fn aia_text(name: &str, actions: &[(&str, &[(&str, bool)])]) -> String {
+        let hex = |t: &str| format!("[ {} {} ]", t.len(), t.bytes().map(|b| format!("{b:02x}")).collect::<String>());
+        let mut out = String::from("/version 3\n");
+        if !name.is_empty() {
+            out += &format!("/name {}\n", hex(name));
+        }
+        out += &format!("/isOpen 1\n/actionCount {}\n", actions.len());
+        for (i, (action, steps)) in actions.iter().enumerate() {
+            out += &format!("/action-{} {{\n\t/name {}\n\t/eventCount {}\n", i + 1, hex(action), steps.len());
+            for (j, (label, on)) in steps.iter().enumerate() {
+                out += &format!(
+                    "\t/event-{} {{\n\t\t/internalName (sample_step_{j})\n\t\t/localizedName {}\n\t\t/isOn {}\n\t\t/parameterCount 0\n\t}}\n",
+                    j + 1,
+                    hex(label),
+                    u8::from(*on)
+                );
+            }
+            out += "}\n";
+        }
+        out
+    }
+
+    /// Load Actions… reads an action set another app saved as text: its actions come in with the
+    /// steps with no recorded values whose label is a VectorCraft command's that takes no values and
+    /// has no dialog, a step that is off stays excluded from playback, the other steps are left out
+    /// and listed, and the status bar says how many. An action plays the steps that are on.
+    #[test]
+    fn load_actions_reads_another_apps_action_set() {
+        let mut app = app_with_sets();
+        let text = aia_text(
+            "Tidy Up",
+            &[("Group Them", &[("group", true), ("Move", true), ("Ungroup", false)]), ("Nothing", &[]), ("", &[("Ungroup", true)])],
+        );
+        let r = app.run(LOAD_SET, json!({ "data": text })).unwrap();
+        let skipped = json!([{"action": "Group Them", "step": "Move"}]);
+        assert_eq!(r, json!({"set": 3, "name": "Tidy Up", "actions": 3, "skipped": skipped, "leftOut": 1}));
+        let set = &app.ui.action_sets[3];
+        assert_eq!(set.actions[0].name, "Group Them");
+        assert_eq!(set.actions[0].steps, [("object.group".to_string(), json!({})), ("object.ungroup".to_string(), json!({}))]);
+        assert_eq!(set.actions[0].excluded_steps, [1].into());
+        assert!(set.actions[1].steps.is_empty());
+        assert_eq!(set.actions[2].name, "Action 3", "an action with no name");
+        assert_eq!(app.ui.status, "Loaded “Tidy Up”: 1 step was left out");
+        app.run("file.new", json!({"width": 200, "height": 100})).unwrap();
+        for x in [0, 50] {
+            app.run("shape.rectangle", json!({"x": x, "y": 0, "width": 20, "height": 20})).unwrap();
+        }
+        app.run("select.all", json!({})).unwrap();
+        assert_eq!(app.session.active().unwrap().selection.objects.len(), 2);
+        play(&mut app, 3, 0).unwrap();
+        assert_eq!(app.session.active().unwrap().selection.objects.len(), 1, "the action grouped the rectangles and did not ungroup them");
+    }
+
+    /// A step recorded with values is left out even when a command has its label: a step that set an
+    /// opacity does not select by opacity. A step whose values name a menu command, in two or three
+    /// values, is left out too. The status bar counts the steps left out.
+    #[test]
+    fn recorded_values_keep_a_step_out() {
+        let hex = |t: &str| format!("[ {} {} ]", t.len(), t.bytes().map(|b| format!("{b:02x}")).collect::<String>());
+        let text = |t: &str| format!("/type (ustring) /value {}", hex(t));
+        let number = || "/type (real) /value 60.0".to_string();
+        let menu = |shown: &str| vec![text("some_command"), text(shown), number()];
+        let steps = [
+            ("Opacity", vec![number()]),
+            ("Stroke Weight", vec![number()]),
+            ("A Menu Step", menu("Group")),
+            ("A Menu Step", vec![text("some_command"), text("Ungroup")]),
+            ("Rename", vec![text("OldLayer"), text("Group")]),
+            ("Group", vec![number(), text("Group"), number()]),
+            ("Group", vec![]),
+        ];
+        let events: String = steps
+            .iter()
+            .enumerate()
+            .map(|(i, (label, values))| {
+                let params: String = values.iter().enumerate().map(|(n, v)| format!("/parameter-{} {{ {v} }} ", n + 1)).collect();
+                format!("/event-{} {{ /localizedName {} /parameterCount {} {params} }} ", i + 1, hex(label), values.len())
+            })
+            .collect();
+        let set = format!("/version 3 /name {} /action-1 {{ /name {} {events} }}", hex("Values"), hex("A"));
+        let mut app = app_with_sets();
+        let r = app.run(LOAD_SET, json!({ "data": set })).unwrap();
+        assert_eq!(app.ui.action_sets[3].actions[0].steps, [("object.group".to_string(), json!({}))]);
+        assert_eq!(r["leftOut"], 6);
+        let left_out: Vec<&str> = r["skipped"].as_array().unwrap().iter().map(|s| s["step"].as_str().unwrap()).collect();
+        assert_eq!(left_out, ["Opacity", "Stroke Weight", "A Menu Step", "A Menu Step", "Rename", "Group"]);
+        assert_eq!(app.ui.status, "Loaded “Values”: 6 steps were left out");
+    }
+
+    /// A step with no label, or a blank one, is left out and listed by its internal name, even when
+    /// that name is a command's label.
+    #[test]
+    fn a_step_with_no_label_is_left_out() {
+        let set = "/version 3 /name [ 4 4e6f6e65 ] /action-1 { /name [ 1 41 ] \
+                   /event-1 { /internalName (group) /parameterCount 0 } \
+                   /event-2 { /internalName (Ungroup) /localizedName [ 1 20 ] /parameterCount 0 } \
+                   /event-3 { /internalName (x) /localizedName [ 5 47726f7570 ] /parameterCount 0 } }";
+        let mut app = app_with_sets();
+        let r = app.run(LOAD_SET, json!({ "data": set })).unwrap();
+        assert_eq!(app.ui.action_sets[3].actions[0].steps, [("object.group".to_string(), json!({}))]);
+        assert_eq!(r["skipped"], json!([{"action": "A", "step": "group"}, {"action": "A", "step": "Ungroup"}]));
+        assert_eq!(r["leftOut"], 2);
+    }
+    /// Load Actions… picks action set files of both kinds, and a set another app saved without a
+    /// name takes the file's name, or `Actions` when there is no file; one named like a set in the
+    /// panel gets the next free number. A file that isn't UTF-8 still reads. A set past the reader's
+    /// caps, one whose text ends inside a block, one whose counts differ from what follows and one
+    /// with a damaged name are refused, and text that isn't an action set is not read.
+    #[test]
+    fn load_actions_names_another_apps_set_after_its_file() {
+        let mut app = app_with_sets();
+        let files = with_files(&mut app, "/sets/Mine.aia");
+        let mut bytes = aia_text("", &[("One", &[("Ungroup", true)])]).into_bytes();
+        bytes.extend(b"/note (\xFF)\n");
+        files.borrow_mut().insert("/sets/Mine.aia".into(), bytes);
+        let r = app.run(LOAD_SET, json!({})).unwrap();
+        assert_eq!((r["name"].clone(), r["leftOut"].clone()), (json!("Mine 2"), json!(0)));
+        assert_eq!(app.ui.action_sets[3].actions[0].steps, [("object.ungroup".to_string(), json!({}))]);
+        let actions = vec![("A", [("Group", true)].as_slice()); 1001];
+        let r = app.run(LOAD_SET, json!({ "data": aia_text("Big", &actions) }));
+        assert_eq!(r.unwrap_err(), "the action set file can't be read in full");
+        let cut = aia_text("Cut", &[("A", &[("Group", true)])]);
+        let cut = cut.trim_end().strip_suffix('}').unwrap().to_string();
+        assert_eq!(app.run(LOAD_SET, json!({ "data": cut })).unwrap_err(), "the action set file can't be read in full");
+        let counts = aia_text("Counts", &[("A", &[]), ("B", &[])]).replace("/actionCount 2", "/actionCount 1");
+        assert_eq!(app.run(LOAD_SET, json!({ "data": counts })).unwrap_err(), "the action set file can't be read in full");
+        for damaged in ["/version 3 /action-1 { /name [ 3 41 ] }", "/version 3 /name [ 3 41 ]"] {
+            assert_eq!(app.run(LOAD_SET, json!({ "data": damaged })).unwrap_err(), "the action set file can't be read in full");
+        }
+        for not_a_set in ["/version three", "/versionX 3"] {
+            assert_eq!(app.run(LOAD_SET, json!({ "data": not_a_set })).unwrap_err(), "not an action set file");
+        }
+        assert_eq!(app.ui.action_sets.len(), 4, "no set added");
+        let r = app.run(LOAD_SET, json!({ "data": aia_text("", &[]) })).unwrap();
+        assert_eq!(r["name"], "Actions");
+    }
+
+    /// A step stands for a command only when no other menu command has its label, and the command is
+    /// recordable, runs with no values, has no dialog and sits directly in a top menu. The item of a
+    /// submenu stands for nothing: its label alone does not say which command it is.
+    #[test]
+    fn steps_stand_for_commands_that_run_with_no_values() {
+        assert_eq!(files::step_command("Group"), Some("object.group"));
+        assert_eq!(files::step_command(" GROUP... "), Some("object.group"));
+        for label in ["Move", "Move…", "", "No Such Command"] {
+            assert_eq!(files::step_command(label), None, "{label}");
+        }
+        let submenu_items = ["Opacity", "Stroke Weight", "Fill Color", "Blending Mode", "Grid", "Radial", "Create", "Delete All"];
+        let matched: Vec<&str> = submenu_items.into_iter().filter(|label| files::step_command(label).is_some()).collect();
+        assert!(matched.is_empty(), "{matched:?}");
+        // The menu bar's Crop Image item runs another command, which opens the crop tool.
+        let not_on_the_menu_bar = ["Crop Image", "Expand Gradient Mesh", "Duplicate"];
+        let matched: Vec<&str> = not_on_the_menu_bar.into_iter().filter(|label| files::step_command(label).is_some()).collect();
+        assert!(matched.is_empty(), "{matched:?}");
+    }
+
+    /// A step does not stand for a command that closes, reverts or writes documents, for Paste, for
+    /// Undo or Redo, or for an add-on's command: such a step is left out, and nothing is closed on
+    /// playback.
+    #[test]
+    fn steps_do_not_stand_for_file_commands_paste_undo_or_add_ons() {
+        let labels = ["Close", "Close All", "Revert", "Export for Screens", "Paste", "Undo", "Redo", "Close Path", "Save a Timestamped Copy"];
+        let matched: Vec<&str> = labels.into_iter().filter(|label| files::step_command(label).is_some()).collect();
+        assert!(matched.is_empty(), "{matched:?}");
+        let mut app = app_with_sets();
+        let r = app.run(LOAD_SET, json!({ "data": aia_text("Closes", &[("A", &[("Close", true), ("Group", true)])]) })).unwrap();
+        assert_eq!(r["leftOut"], 1);
+        assert_eq!(app.ui.action_sets[3].actions[0].steps, [("object.group".to_string(), json!({}))]);
+    }
+
+    /// A set loaded from another app's file saves to VectorCraft's own file with its excluded steps,
+    /// and loads back the same.
+    #[test]
+    fn another_apps_set_saves_and_loads_back_with_its_excluded_steps() {
+        let mut app = app_with_sets();
+        let text = aia_text("Tidy", &[("A", &[("Group", true), ("Ungroup", false)])]);
+        app.run(LOAD_SET, json!({ "data": text })).unwrap();
+        let saved = files::write_set(&app.ui.action_sets[3]);
+        let r = app.run(LOAD_SET, json!({ "data": saved })).unwrap();
+        assert_eq!(r, json!({"set": 4, "name": "Tidy 2", "actions": 1}));
+        assert_eq!(app.ui.action_sets[4].actions[0].excluded_steps, [1].into());
+    }
+
     /// Save Actions… does not write a set that Load Actions… would refuse: more than 1,000 actions.
     #[test]
     fn save_actions_does_not_write_a_set_load_actions_refuses() {
diff --git a/crates/ui-egui/src/panels/actions/files.rs b/crates/ui-egui/src/panels/actions/files.rs
index 4e5092cef..f7df78ee9 100644
--- a/crates/ui-egui/src/panels/actions/files.rs
+++ b/crates/ui-egui/src/panels/actions/files.rs
@@ -9,6 +9,8 @@
 //! playback. Sets with exclusions use version 2 so older builds refuse them rather than replay
 //! excluded steps, and sets with stops use version 3 so older builds refuse them rather than fail
 //! at a stop. Other sets use version 1, and earlier version 1 and 2 files still work.
+//! Load Actions… also reads the action sets another app saves as text (`.aia`, through
+//! `actionSet.read`).
 
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
@@ -34,6 +36,9 @@ const MAX_SET_ACTIONS: usize = 1000;
 /// The most steps [`read_set`] reads in one action.
 const MAX_ACTION_STEPS: usize = 10_000;
 
+/// The most left-out steps that Load Actions… lists for an action set another app saved.
+const MAX_SKIPPED: usize = 1000;
+
 /// An action set file: a header, the set's name and its actions.
 #[derive(Serialize, Deserialize)]
 struct SetFile {
@@ -201,12 +206,158 @@ pub(crate) fn can_load(app: &VectorcraftApp) -> bool {
     crate::picks::can(app, &crate::picks::PickRequest::Open(crate::FilePick::default()))
 }
 
+/// The bytes start with `/version`, as the action sets another app saves as text (`.aia`) do.
+fn is_aia(bytes: &[u8]) -> bool {
+    bytes.strip_prefix(b"\xEF\xBB\xBF").unwrap_or(bytes).trim_ascii_start().starts_with(b"/version")
+}
+
+/// `label` in any case, without a final `…` or `...`.
+fn bare_label(label: &str) -> String {
+    label.trim().trim_end_matches("...").trim_end_matches('…').trim().to_lowercase()
+}
+
+/// Whether a step of another app's action set may stand for command `id`. `command.batch` runs a
+/// step without the app's handling of it, so a file or document command would close, revert or write
+/// documents without asking, and a Paste would skip the view's center and the swatch conflict
+/// question. Undo and Redo would act on the action's own undo step, and an add-on command with a
+/// label a file also uses is not what the file recorded.
+fn may_stand_for(id: &str) -> bool {
+    !(id.starts_with("file.")
+        || id.starts_with("document.")
+        || id.starts_with("addon.")
+        || id.starts_with("edit.paste")
+        || matches!(id, "edit.undo" | "edit.redo"))
+}
+
+/// The name of a step of `actionSet.read`'s answer, and whether the step can stand for a command. A
+/// step goes by its label. Only a step with a label and no recorded values can stand for a command;
+/// a step recorded with values, a recorded menu item included, is left out. A step with no label is
+/// listed by its name.
+fn step_name(step: &Value) -> (String, bool) {
+    let label = step.get("label").and_then(Value::as_str);
+    let params = step.get("params").and_then(Value::as_u64).unwrap_or_default();
+    match label {
+        Some(label) => (label.to_string(), params == 0),
+        None => (step.get("name").and_then(Value::as_str).unwrap_or_default().to_string(), false),
+    }
+}
+
+/// The commands a step of another app's action set can stand for, by label, in English and in the
+/// interface language ([`bare_label`]). A label stands for a command when no other menu command has
+/// it, and the command is recordable, is run by a menu bar item with no params
+/// ([`runs_with_no_values`](crate::shortcut_editor::runs_with_no_values)), has no `…` in its label,
+/// sits directly in a top menu and is one [`may_stand_for`] allows. The
+/// label of a submenu's item does not say which command it is: Select › Same › Opacity is "Opacity".
+fn step_commands() -> std::collections::HashMap<String, Option<&'static str>> {
+    let mut by_label = std::collections::HashMap::new();
+    for c in vectorcraft_engine::command_specs().iter().filter(|c| !c.menu.is_empty()) {
+        let can_stand =
+            may_stand_for(c.id) && c.journal && c.menu.len() == 1 && !c.label.contains('…') && crate::shortcut_editor::runs_with_no_values(c);
+        let mut labels = vec![bare_label(c.label), bare_label(crate::i18n::t_id(c.id, c.label))];
+        labels.dedup();
+        for label in labels.into_iter().filter(|l| !l.is_empty()) {
+            by_label
+                .entry(label)
+                .and_modify(|id: &mut Option<&'static str>| *id = id.filter(|id| can_stand && *id == c.id))
+                .or_insert(can_stand.then_some(c.id));
+        }
+    }
+    by_label
+}
+
+/// The command a step of another app's action set stands for ([`step_commands`]).
+#[cfg(test)]
+pub(super) fn step_command(label: &str) -> Option<&'static str> {
+    step_commands().get(&bare_label(label)).copied().flatten()
+}
+
+/// What Load Actions… made of an action set another app saved as text.
+struct AiaLoad {
+    set: ActionSet,
+    /// The first [`MAX_SKIPPED`] steps left out: `[{action, step}]`.
+    skipped: Vec<Value>,
+    /// How many steps were left out.
+    left_out: usize,
+}
+
+/// The set of `read`, `actionSet.read`'s answer, named `name` when the file gives none. A step comes
+/// in as the command it stands for ([`step_name`], [`step_commands`]), with no params, and excluded
+/// from playback when it is off in the file. An action with no name is called `Action N`.
+fn aia_set(read: &Value, name: &str) -> AiaLoad {
+    let (mut skipped, mut left_out) = (vec![], 0usize);
+    let commands = step_commands();
+    let text = |v: &Value, key: &str| v.get(key).and_then(Value::as_str).unwrap_or_default().to_string();
+    let actions = read
+        .get("actions")
+        .and_then(Value::as_array)
+        .map(Vec::as_slice)
+        .unwrap_or_default()
+        .iter()
+        .enumerate()
+        .map(|(i, a)| {
+            let action = Some(text(a, "name")).filter(|n| !n.trim().is_empty()).unwrap_or_else(|| format!("Action {}", i + 1));
+            let (mut steps, mut excluded_steps) = (vec![], std::collections::BTreeSet::new());
+            for s in a.get("steps").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default() {
+                let (name, can_stand) = step_name(s);
+                let Some(id) = commands.get(&bare_label(&name)).copied().flatten().filter(|_| can_stand) else {
+                    left_out += 1;
+                    if skipped.len() < MAX_SKIPPED {
+                        skipped.push(json!({ "action": action, "step": name }));
+                    }
+                    continue;
+                };
+                if s.get("on").and_then(Value::as_bool) == Some(false) {
+                    excluded_steps.insert(steps.len());
+                }
+                steps.push((id.to_string(), json!({})));
+            }
+            Action { excluded_steps, ..Action::new(action, steps) }
+        })
+        .collect();
+    let set = text(read, "set");
+    AiaLoad { set: ActionSet::new(if set.trim().is_empty() { name.to_string() } else { set }, actions), skipped, left_out }
+}
+
+/// [`load_set`] of an action set another app saved as text, which `actionSet.read` reads with
+/// `params`.
+fn load_aia(app: &mut VectorcraftApp, params: Value) -> Result<Value, String> {
+    // Text that starts `/version` and no number is not an action set either.
+    let read = app.run("actionSet.read", params).map_err(|_| "not an action set file")?;
+    // A set read only in part would play actions that differ from the file's.
+    if read.get("truncated").and_then(Value::as_bool).unwrap_or(false) {
+        return Err("the action set file can't be read in full".into());
+    }
+    let AiaLoad { mut set, skipped, left_out } = aia_set(&read, "Actions");
+    set.name = free_set_name(&app.ui.action_sets, &set.name);
+    let (name, actions) = (set.name.clone(), set.actions.len());
+    app.ui.action_sets.push(set);
+    if left_out > 0 {
+        app.status(crate::i18n::msg_n(
+            left_out as u64,
+            "Loaded “{name}”: {n} step was left out",
+            "Loaded “{name}”: {n} steps were left out",
+            &[("name", &name)],
+        ));
+    }
+    Ok(json!({
+        "set": app.ui.action_sets.len() - 1, "name": name, "actions": actions,
+        "skipped": skipped, "leftOut": left_out,
+    }))
+}
+
 /// `ui.actionSet.load {path? | data?}`: reads the action set file at `path` (else a picked one), or
 /// the file's text `data`, and adds its set after the others, with its actions. A set with the
 /// same name as one in the panel gets the next free number (`Print 2`). Loaded actions keep their
 /// function keys. The current set and the other sets stay as they are →
 /// `{set: index, name, actions: n}`. Where the host can read part of a file (the desktop), a file
 /// larger than 8 MiB is refused after its first 8 MiB and one byte are read.
+///
+/// An action set another app saved as text (`.aia`, read with `actionSet.read`) comes in with its
+/// actions and the steps that stand for a VectorCraft command ([`step_name`], [`step_commands`]),
+/// with no params; a step that is off in the file is excluded from playback. A set with no name is
+/// called after the file, else `Actions`. The other steps are left out and listed, and the status
+/// bar says how many → `{set, name, actions, skipped: [{action, step}] (at most 1,000), leftOut: n}`.
+/// Such a file that `actionSet.read` marks `truncated` is refused, and no set is added.
 pub fn load_set(app: &mut VectorcraftApp, p: &Value) -> Result<Value, String> {
     let (text, stem) = match p.get("data") {
         Some(Value::String(data)) => {
@@ -214,6 +365,9 @@ pub fn load_set(app: &mut VectorcraftApp, p: &Value) -> Result<Value, String> {
             if data.len() > MAX_SET_FILE {
                 return Err("the action set file is larger than 8 MiB".into());
             }
+            if is_aia(data.as_bytes()) {
+                return load_aia(app, json!({ "data": data }));
+            }
             (data.clone(), String::new())
         }
         Some(_) => return Err("not an action set file".into()),
@@ -221,7 +375,8 @@ pub fn load_set(app: &mut VectorcraftApp, p: &Value) -> Result<Value, String> {
             let path = match p.get("path").and_then(Value::as_str) {
                 Some(path) => path.to_string(),
                 None => {
-                    let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Action sets", &[ACTIONS_EXT])], ..Default::default() };
+                    let exts = [&[ACTIONS_EXT], vectorcraft_engine::cmd::actionset::EXTS].concat();
+                    let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Action sets", &exts)], ..Default::default() };
                     crate::picks::open(app, &pick).ok_or("cancelled")?
                 }
             };
@@ -234,6 +389,9 @@ pub fn load_set(app: &mut VectorcraftApp, p: &Value) -> Result<Value, String> {
             if bytes.len() > MAX_SET_FILE {
                 return Err("the action set file is larger than 8 MiB".into());
             }
+            if is_aia(&bytes) {
+                return load_aia(app, json!({ "name": path, "dataBase64": vectorcraft_format::base64_encode(&bytes) }));
+            }
             let stem = std::path::Path::new(&path).file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default();
             (String::from_utf8(bytes).map_err(|_| "not an action set file")?, stem)
         }
diff --git a/crates/ui-egui/src/panels/appearance.rs b/crates/ui-egui/src/panels/appearance.rs
index 1cb2ede41..ca1f3c28f 100644
--- a/crates/ui-egui/src/panels/appearance.rs
+++ b/crates/ui-egui/src/panels/appearance.rs
@@ -251,6 +251,21 @@ pub(crate) fn shown_effect_label(id: &str) -> String {
     }
 }
 
+/// An effect row's name: [`shown_effect_label`], followed by "(Safe Mode)" for a plug-in effect
+/// Safe Mode skips (the object keeps it and draws without it).
+pub fn effect_row_label(id: &str) -> String {
+    let label = shown_effect_label(id);
+    if vectorcraft_plugins::effect::skipped(id) { format!("{label} ({})", tl!("Safe Mode")) } else { label }
+}
+
+/// The tooltip of an effect row Safe Mode skips: why it draws nothing, and its plug-in's id;
+/// `None` for an effect that draws.
+pub fn skipped_effect_tip(id: &str) -> Option<String> {
+    let plugin = vectorcraft_plugins::effect::plugin_id(id).filter(|_| vectorcraft_plugins::effect::skipped(id))?;
+    let why = crate::i18n::msg(&vectorcraft_plugins::Error::SafeMode.to_string());
+    Some(format!("{why}\n{}", vectorcraft_plugins::safe_mode::display_name(plugin)))
+}
+
 /// "Opacity: Default" or "Opacity: 50% Multiply".
 pub fn opacity_text(opacity: f32, blend: BlendMode) -> String {
     if (opacity - 1.0).abs() < 1e-4 && blend == BlendMode::Normal {
@@ -582,7 +597,7 @@ fn default_stack(app: &mut VectorcraftApp, ui: &mut Ui) {
     let fx = |ui: &mut Ui, e: &Effect, id: (Option<usize>, usize)| {
         let (r, _) = row(ui, false);
         eye(ui, r, ("ap-def-fx", id), e.visible, false);
-        text(ui, pos2(r.left() + EYE_W + 24.0 + if id.0.is_some() { 12.0 } else { 0.0 }, r.center().y), &shown_effect_label(&e.id), false);
+        text(ui, pos2(r.left() + EYE_W + 24.0 + if id.0.is_some() { 12.0 } else { 0.0 }, r.center().y), &effect_row_label(&e.id), false);
         icons::paint(ui, "dc-fx", Rect::from_center_size(r.right_center() - vec2(14.0, 0.0), vec2(16.0, 16.0)), t.icon);
     };
     for (i, it) in ap.items.iter().enumerate().rev() {
@@ -856,7 +871,7 @@ fn drag_ghost(app: &VectorcraftApp, ui: &Ui, n: &Node, what: Dragged, order: &[u
             Dragged::Effect(item, k) => {
                 let Some(e) = n.appearance.effects_at(item).and_then(|fx| fx.get(k)) else { return };
                 let indent = if item.is_some() { 12.0 } else { 0.0 };
-                text(ui, pos2(r.left() + indent + EYE_W + 24.0, y), &shown_effect_label(&e.id), false);
+                text(ui, pos2(r.left() + indent + EYE_W + 24.0, y), &effect_row_label(&e.id), false);
             }
             Dragged::Contents => {
                 if let Some(label) = n.contents_label() {
@@ -1128,7 +1143,11 @@ fn effect_row(app: &mut VectorcraftApp, ui: &mut Ui, item: Option<usize>, k: usi
     // The name edits the effect on a click; the empty space takes the click rules (in `stack`)
     // and edits it on a double-click: its settings dialog, or the inline editor of an effect
     // without settings.
-    let name = name_link(ui, pos2(lx, r.center().y), ("ap-fx-link", item, k), &shown_effect_label(&e.id));
+    let name = name_link(ui, pos2(lx, r.center().y), ("ap-fx-link", item, k), &effect_row_label(&e.id));
+    let name = match skipped_effect_tip(&e.id) {
+        Some(tip) => name.on_hover_text(tip),
+        None => name,
+    };
     let resp = edit_tip(resp, &name);
     let edit = name.clicked() || resp.double_clicked();
     if edit {
diff --git a/crates/ui-egui/src/panels/asset_export.rs b/crates/ui-egui/src/panels/asset_export.rs
index 872bcc0d6..f5fc9b0b9 100644
--- a/crates/ui-egui/src/panels/asset_export.rs
+++ b/crates/ui-egui/src/panels/asset_export.rs
@@ -7,6 +7,10 @@
 //! desktop with Background Export on, on the background thread); the web downloads them. The
 //! screen button opens Export for Screens on its Assets tab.
 //!
+//! Export 3D Object (the panel menu) collects the selected objects with a 3D effect as 3D assets,
+//! marked 3D on their tiles. While the panel's assets include 3D assets, a Format row picks their
+//! mesh format (USDA, USDZ, glTF or OBJ), and Export writes them as mesh files beside the pictures.
+//!
 //! Everything runs through the `assets.*` commands.
 
 use std::cell::RefCell;
@@ -17,7 +21,7 @@ use egui::{Color32, Rect, Sense, Stroke, StrokeKind, Ui, vec2};
 use serde_json::{Value, json};
 use vectorcraft_doc::{ExportAsset, Node, NodeId};
 use vectorcraft_engine::DocState;
-use vectorcraft_engine::cmd::fileio::{SCREEN_SETTINGS_KEYS, screen_export_preset_list};
+use vectorcraft_engine::cmd::fileio::{FORMATS_3D, SCREEN_SETTINGS_KEYS, format_3d_label, screen_export_preset_list};
 
 use super::{pstate, set_pstate};
 use crate::dialogs::{
@@ -131,6 +135,11 @@ fn tiles(ui: &mut Ui, st: &DocState, sel: &[u64], ev: &mut Events) {
             let th = Rect::from_min_size(egui::pos2(r.center().x - THUMB / 2.0, r.top() + 4.0), vec2(THUMB, THUMB));
             paint_thumb(ui, st, a, th);
             ui.painter().rect_stroke(th, 0.0, Stroke::new(if on { 2.0 } else { 1.0 }, if on { t.accent } else { t.border }), StrokeKind::Outside);
+            if a.format_3d.is_some() {
+                let badge = Rect::from_min_size(th.left_top() + vec2(2.0, 2.0), vec2(18.0, 12.0));
+                ui.painter().rect_filled(badge, 2.0, t.accent);
+                ui.painter().text(badge.center(), egui::Align2::CENTER_CENTER, "3D", egui::FontId::proportional(9.0), Color32::WHITE);
+            }
             let name_rect = Rect::from_min_max(egui::pos2(r.left() + 2.0, th.bottom() + 3.0), egui::pos2(r.right() - 2.0, r.bottom() - 1.0));
             match &renaming {
                 Some((id, buf)) if *id == a.id => {
@@ -214,6 +223,12 @@ fn export(app: &mut VectorcraftApp, ids: Vec<u64>, files_each: usize) {
 }
 
 fn export_now(app: &mut VectorcraftApp, ids: Vec<u64>, files_each: usize) {
+    // 3D assets are written as mesh files (`assets.export3D`), the others as pictures.
+    let Some(st) = app.session.active() else { return };
+    let format = |id: &u64| st.doc.asset(*id).and_then(|a| a.format_3d.clone());
+    let (three_d, ids): (Vec<u64>, Vec<u64>) = ids.into_iter().partition(|id| format(id).is_some());
+    // An OBJ is two files.
+    let mesh_files: usize = three_d.iter().map(|id| if format(id).as_deref() == Some("obj") { 2 } else { 1 }).sum();
     let mut p = json!({ "assets": ids });
     // Match the shared dialog's TIFF defaults, retaining saved choices and other formats.
     if let Some(st) = app.session.active()
@@ -251,7 +266,23 @@ fn export_now(app: &mut VectorcraftApp, ids: Vec<u64>, files_each: usize) {
         p["folder"] = json!(folder);
         p["openLocation"] = json!(saved.get("openLocation").and_then(Value::as_bool).unwrap_or(true));
     }
-    if let Err(e) = io::export_files(app, "assets.export", p) {
+    let mut meshes = json!({ "assets": three_d });
+    if io::is_web(app) {
+        meshes["zip"] = json!(mesh_files > 1);
+    } else {
+        meshes["folder"] = p["folder"].clone();
+        meshes["openLocation"] = p["openLocation"].clone();
+    }
+    // The meshes are written at once, before the pictures start on the background thread. When
+    // they fail, the pictures are not exported and the status bar shows the error.
+    if !three_d.is_empty()
+        && let Err(e) = io::export_files(app, "assets.export3D", meshes)
+    {
+        return app.status(e);
+    }
+    if !ids.is_empty()
+        && let Err(e) = io::export_files(app, "assets.export", p)
+    {
         app.status(e);
     }
 }
@@ -264,6 +295,21 @@ enum Settings {
     Format(String),
 }
 
+/// The Format of the 3D assets among `ids`: a row shown only when there are some, set to their
+/// format (blank when they differ). Returns those assets and the format picked for them.
+fn format_3d(ui: &mut Ui, st: &DocState, ids: &[u64]) -> Option<(Vec<u64>, &'static str)> {
+    let three_d: Vec<(u64, &str)> = ids.iter().filter_map(|id| Some((*id, st.doc.asset(*id)?.format_3d.as_deref()?))).collect();
+    let first = three_d.first()?.1;
+    let current = if three_d.iter().all(|(_, f)| *f == first) { format_3d_label(first) } else { "" };
+    let labels: Vec<&str> = FORMATS_3D.iter().map(|f| format_3d_label(f)).collect();
+    let mut picked = None;
+    ui.horizontal(|ui| {
+        widgets::dim_label(ui, &format!("3D {}", tl!("Format:")));
+        picked = widgets::dropdown_names(ui, "asset-export-3d-format", current, &labels, 90.0).and_then(|i| FORMATS_3D.get(i).copied());
+    });
+    picked.map(|f| (three_d.into_iter().map(|(id, _)| id).collect(), f))
+}
+
 /// The document's shared export format rows. Returns the change asked for and how many files one asset makes.
 fn settings(ui: &mut Ui, st: &DocState) -> (Option<Settings>, usize) {
     let (rows, preset) = screen_saved_rows(&st.doc.export_settings);
@@ -316,6 +362,8 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     ui.add_space(6.0);
     widgets::section_header(ui, tl!("Export Settings"));
     let (change, files_each) = settings(ui, st);
+    let all_ids: Vec<u64> = st.doc.assets.iter().map(|a| a.id).collect();
+    let format_change = format_3d(ui, st, &sel_or_all(&sel, &all_ids));
     let doc = st.uid;
     let mut save_name = pstate::<Option<String>>(&ctx, SAVING);
     let mut save_pick = None;
@@ -392,6 +440,9 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     if let Some(pick) = save_pick {
         preset(app, &ctx, doc, pick);
     }
+    if let Some((assets, format)) = format_change {
+        run(app, "assets.set3DFormat", json!({ "assets": assets, "format": format }));
+    }
     if add {
         collect(app, &ctx, None, alt);
     }
@@ -525,6 +576,12 @@ pub fn menu(app: &mut VectorcraftApp, ui: &mut Ui) {
     if menu_item(ui, tl!("Add Selected Artwork as Multiple Assets"), has_art, false) {
         collect(app, &ctx, None, false);
     }
+    if menu_item(ui, tl!("Export 3D Object"), has_art, false)
+        && let Some(r) = run(app, "assets.add3D", json!({}))
+    {
+        let ids: Vec<u64> = r["assets"].as_array().into_iter().flatten().filter_map(Value::as_u64).collect();
+        set_pstate(&ctx, SELECTED, ids);
+    }
     ui.separator();
     if menu_item(ui, tl!("Select All Assets"), !all.is_empty(), false) {
         set_pstate(&ctx, SELECTED, all.clone());
diff --git a/crates/ui-egui/src/panels/layers/thumbs.rs b/crates/ui-egui/src/panels/layers/thumbs.rs
index 49ce4b61b..4fcdc03e4 100644
--- a/crates/ui-egui/src/panels/layers/thumbs.rs
+++ b/crates/ui-egui/src/panels/layers/thumbs.rs
@@ -266,18 +266,17 @@ impl Thumbs {
             return;
         }
         let open: HashSet<u64> = uids.iter().copied().collect();
-        let closed = self.open_docs.as_ref().is_some_and(|before| before.iter().any(|uid| !open.contains(uid)));
+        let closed: HashSet<u64> = self.open_docs.as_ref().map(|before| before.difference(&open).copied().collect()).unwrap_or_default();
         let stale =
             self.entries.keys().chain(self.pending.keys()).any(|key| !open.contains(&key.0)) || self.showing.is_some_and(|uid| !open.contains(&uid));
         self.entries.retain(|key, _| open.contains(&key.0));
         self.pending.retain(|key, _| open.contains(&key.0));
         self.showing = self.showing.filter(|uid| open.contains(uid));
-        if closed {
+        if !closed.is_empty() {
             // Images finished before now are dropped with the rest of the queue: the open
-            // documents' rows are asked for again.
+            // documents' rows are asked for again. Documents opened later keep their jobs.
             if let Some(w) = &self.worker {
-                let open = open.clone();
-                w.forget(move |key| !open.contains(&key.0));
+                w.forget(move |key| closed.contains(&key.0));
                 if w.poll().is_none() {
                     self.worker = None;
                 }
@@ -536,6 +535,37 @@ mod tests {
         assert_eq!(done.key.0, next, "no worker keeps the closed document's image");
     }
 
+    #[test]
+    fn a_document_opened_while_a_job_runs_after_a_close_gets_its_thumbnails() {
+        let ctx = egui::Context::default();
+        let Some(worker) = ThumbWorker::start(&ctx, "test") else { return };
+        let mut thumbs = Thumbs { worker: Some(worker), worker_started: true, ..Default::default() };
+        thumbs.retain_open(&[1, 2]);
+        // A job of document 2 is running.
+        let (started, running) = std::sync::mpsc::channel::<()>();
+        let (release, held) = std::sync::mpsc::channel::<()>();
+        let blocker = (2, NodeId(1));
+        let job: crate::thumb_worker::JobFn = Box::new(move |_| {
+            started.send(()).ok();
+            held.recv().ok();
+            None
+        });
+        assert!(thumbs.worker.as_ref().is_some_and(|w| w.submit(blocker, (blocker, Weak::new(), 1), job)));
+        running.recv().expect("the job starts");
+        // Document 1 closes, then document 3 opens and one of its rows is queued.
+        thumbs.retain_open(&[2]);
+        thumbs.retain_open(&[2, 3]);
+        let opened = (3, NodeId(2));
+        assert!(thumbs.worker.as_ref().is_some_and(|w| w.submit(opened, (opened, Weak::new(), 1), Box::new(|_| None))));
+        // A job of document 2 queued after it marks the end of the queue.
+        let last = (2, NodeId(3));
+        assert!(thumbs.worker.as_ref().is_some_and(|w| w.submit(last, (last, Weak::new(), 1), Box::new(|_| None))));
+        release.send(()).ok();
+        let worker = thumbs.worker.as_ref().expect("the worker is kept");
+        let order: Vec<(u64, NodeId)> = (0..3).map_while(|_| worker.wait().map(|d| d.key.0)).take_while(|key| *key != last).collect();
+        assert_eq!(order, [blocker, opened], "document 3's job comes back before the last one");
+    }
+
     /// An open zigzag of `anchors` anchors.
     fn line(anchors: usize) -> PathData {
         let pts: Vec<Point> = (0..anchors).map(|i| Point::new(i as f64 * 0.01, (i % 2) as f64 * 50.0)).collect();
diff --git a/crates/ui-egui/src/panels/tests_asset_export.rs b/crates/ui-egui/src/panels/tests_asset_export.rs
index 3c686d335..ad8ec702c 100644
--- a/crates/ui-egui/src/panels/tests_asset_export.rs
+++ b/crates/ui-egui/src/panels/tests_asset_export.rs
@@ -743,3 +743,78 @@ fn tiff_saved_aliases_use_document_defaults_and_explicit_rgb() {
     }
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// Export 3D Object in the panel menu collects the selected 3D object; its tile is marked 3D, the
+/// Format row sets its mesh format, and Export writes it as a mesh file beside the pictures.
+#[test]
+fn a_3d_asset_takes_its_format_from_the_row_and_exports_as_a_mesh() {
+    let (mut app, log, [a, b]) = app(true);
+    app.run("select.set", json!({"ids": [a]})).unwrap();
+    app.run("effect.apply", json!({"effect": "threeD.extrude", "params": {"depth": 20}})).unwrap();
+    app.run("layer.setProps", json!({"id": a, "name": "Box"})).unwrap();
+    app.run("assets.add", json!({"ids": [b], "name": "Flat"})).unwrap();
+    let ctx = egui::Context::default();
+    crate::theme::install_fonts(&ctx);
+    // Without a 3D asset there is no 3D Format row.
+    frame(&ctx, &mut app, vec![], false);
+    assert!(!has(&frame(&ctx, &mut app, vec![], false), "3D Format:"));
+    menu_frame(&ctx, &mut app, vec![]);
+    let items = menu_frame(&ctx, &mut app, vec![]);
+    menu_frame(&ctx, &mut app, click(at(&items, "   Export 3D Object")));
+    let list = assets(&mut app);
+    assert_eq!((list[1]["name"].clone(), list[1]["format3D"].clone()), (json!("Box"), json!("usda")));
+    let texts = frame(&ctx, &mut app, vec![], false);
+    let texts = if has(&texts, "3D Format:") { texts } else { frame(&ctx, &mut app, vec![], false) };
+    assert!(has(&texts, "3D") && has(&texts, "3D Format:"), "{:?}", texts.iter().map(|t| &t.0).collect::<Vec<_>>());
+    frame(&ctx, &mut app, click(at(&texts, "USDA")), false);
+    let texts = frame(&ctx, &mut app, vec![], false);
+    frame(&ctx, &mut app, click(at(&texts, "OBJ")), false);
+    assert_eq!(assets(&mut app)[1]["format3D"], "obj");
+    // The menu left the new 3D asset selected: Export writes its OBJ and MTL alone, as one zip.
+    let texts = frame(&ctx, &mut app, vec![], false);
+    frame(&ctx, &mut app, click(at(&texts, "Export 1 Selected")), false);
+    {
+        let log = log.borrow();
+        let [(name, zip)] = log.as_slice() else { panic!("{:?} {}", log.iter().map(|f| &f.0).collect::<Vec<_>>(), app.ui.status) };
+        assert!(name.ends_with(".zip"), "{name}");
+        let has_name = |n: &str| zip.windows(n.len()).any(|w| w == n.as_bytes());
+        assert!(has_name("Box.obj") && has_name("Box.mtl"));
+    }
+    // Every asset: the 3D asset's files first, since they are written at once, then the picture
+    // asset as before.
+    log.borrow_mut().clear();
+    menu_frame(&ctx, &mut app, vec![]);
+    let items = menu_frame(&ctx, &mut app, vec![]);
+    menu_frame(&ctx, &mut app, click(at(&items, "   Select All Assets")));
+    frame(&ctx, &mut app, vec![], false);
+    let texts = frame(&ctx, &mut app, vec![], false);
+    frame(&ctx, &mut app, click(at(&texts, "Export")), false);
+    let log = log.borrow();
+    assert_eq!(log.iter().map(|f| f.0.ends_with(".zip")).collect::<Vec<_>>(), [true, false], "{:?}", log.iter().map(|f| &f.0).collect::<Vec<_>>());
+    assert!(log[1].0.starts_with("Flat"), "{}", log[1].0);
+}
+
+/// When the 3D assets fail to export, Export leaves the picture assets unexported and the status
+/// bar keeps the 3D error.
+#[test]
+fn a_failed_3d_export_stops_the_picture_export() {
+    let (mut app, log, [a, b]) = app(true);
+    app.run("select.set", json!({"ids": [a]})).unwrap();
+    app.run("effect.apply", json!({"effect": "threeD.extrude", "params": {"depth": 20}})).unwrap();
+    app.run("layer.setProps", json!({"id": a, "name": "Box"})).unwrap();
+    app.run("assets.add3D", json!({"ids": [a]})).unwrap();
+    app.run("select.set", json!({"ids": [a]})).unwrap();
+    app.run("effect.remove", json!({"index": 0})).unwrap();
+    app.run("assets.add", json!({"ids": [b], "name": "Flat"})).unwrap();
+    let ctx = egui::Context::default();
+    crate::theme::install_fonts(&ctx);
+    frame(&ctx, &mut app, vec![], false);
+    menu_frame(&ctx, &mut app, vec![]);
+    let items = menu_frame(&ctx, &mut app, vec![]);
+    menu_frame(&ctx, &mut app, click(at(&items, "   Select All Assets")));
+    frame(&ctx, &mut app, vec![], false);
+    let texts = frame(&ctx, &mut app, vec![], false);
+    frame(&ctx, &mut app, click(at(&texts, "Export")), false);
+    assert!(log.borrow().is_empty(), "{:?}", log.borrow().iter().map(|f| &f.0).collect::<Vec<_>>());
+    assert!(app.ui.status.contains("Box"), "{}", app.ui.status);
+}
diff --git a/crates/ui-egui/src/panels/transform.rs b/crates/ui-egui/src/panels/transform.rs
index ee3ce335c..b1f8322fd 100644
--- a/crates/ui-egui/src/panels/transform.rs
+++ b/crates/ui-egui/src/panels/transform.rs
@@ -1,8 +1,8 @@
 //! Transform panel: reference point, X/Y/W/H with the constrain link, rotate and shear, flips,
-//! live-shape properties and the Scale Corners / Scale Strokes & Effects options. While the
-//! Artboard tool is in use it shows and edits the active artboard's X/Y/W/H instead (a new W or H
-//! resizes every selected artboard), and with only ruler guides selected their X (vertical guides)
-//! and Y (horizontal ones).
+//! live-shape properties and the Scale Corners / Scale Strokes & Effects / Align to Pixel Grid
+//! options. While the Artboard tool is in use it shows and edits the active artboard's X/Y/W/H
+//! instead (a new W or H resizes every selected artboard), and with only ruler guides selected
+//! their X (vertical guides) and Y (horizontal ones).
 
 use egui::Ui;
 use serde_json::json;
@@ -363,6 +363,32 @@ pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     if widgets::check(ui, tl!("Scale Strokes & Effects"), ss, true) {
         set_pref(app, "scaleStrokes", !ss);
     }
+    pixel_grid_check(app, ui);
+}
+
+/// The selected objects' Align to Pixel Grid: on or off when they agree, `None` when they differ,
+/// with whether every one can be aligned (a path that is not a guide and not inside a compound path,
+/// or a compound path) and their ids. `None` with nothing selected.
+fn pixel_aligned_state(app: &VectorcraftApp) -> Option<(Option<bool>, bool, Vec<u64>)> {
+    let st = app.session.active()?;
+    let nodes: Vec<&Node> = st.selection.objects.iter().filter_map(|id| st.doc.node(*id)).collect();
+    let first = nodes.first()?.extras().pixel_aligned;
+    let value = nodes.iter().all(|n| n.extras().pixel_aligned == first).then_some(first);
+    let in_compound = |n: &Node| st.doc.parent_of(n.id).and_then(|p| st.doc.node(p)).is_some_and(|p| matches!(p.kind, NodeKind::Compound { .. }));
+    let alignable = nodes.iter().all(|n| matches!(n.kind, NodeKind::Path { guide: false, .. } | NodeKind::Compound { .. }) && !in_compound(n));
+    Some((value, alignable, nodes.iter().map(|n| n.id.0).collect()))
+}
+
+/// The Align to Pixel Grid checkbox (`object.setPixelAligned`): a dash when the selected objects
+/// differ, and unavailable unless every selected object can be aligned. A click turns it on for
+/// them all, or off when it is on for them all.
+fn pixel_grid_check(app: &mut VectorcraftApp, ui: &mut Ui) {
+    let (value, alignable, ids) = pixel_aligned_state(app).unwrap_or((Some(false), false, vec![]));
+    if widgets::check3(ui, tl!("Align to Pixel Grid"), value, alignable)
+        && let Err(e) = app.run("object.setPixelAligned", json!({"ids": ids, "on": value != Some(true)}))
+    {
+        app.status(e);
+    }
 }
 
 /// A live rectangle's, polygon's or ellipse's properties (Transform and Properties panels, and the
diff --git a/crates/ui-egui/src/panels/transform/tests.rs b/crates/ui-egui/src/panels/transform/tests.rs
index a945f9ec1..b5598689a 100644
--- a/crates/ui-egui/src/panels/transform/tests.rs
+++ b/crates/ui-egui/src/panels/transform/tests.rs
@@ -503,3 +503,47 @@ fn rotate_and_shear_fields_are_named() {
     let _ = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Rotate");
     let _ = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Shear");
 }
+
+/// The Align to Pixel Grid checkbox turns the selected paths' pixel-aligned property on, shows a
+/// dash when they differ (a click then turns it on for both), turns it off when it is on for all,
+/// and is unavailable with type selected.
+#[test]
+fn align_to_pixel_grid_shows_and_sets_the_property() {
+    use crate::panels::tests_appearance::{click, frame_events, text_rect};
+    let mut app = VectorcraftApp::new(vectorcraft_engine::Session::new(), Default::default());
+    app.run("file.new", json!({"width": 300, "height": 300})).unwrap();
+    let a = app.run("shape.rectangle", json!({"x": 10.3, "y": 20.6, "width": 30.4, "height": 9.7})).unwrap()["id"].as_u64().unwrap();
+    let b = app.run("shape.rectangle", json!({"x": 60.3, "y": 20.6, "width": 30.4, "height": 9.7})).unwrap()["id"].as_u64().unwrap();
+    app.run("select.set", json!({"ids": [a, b]})).unwrap();
+    let aligned = |app: &VectorcraftApp, id: u64| app.session.active().unwrap().doc.node(vectorcraft_doc::NodeId(id)).unwrap().extras().pixel_aligned;
+    let ctx = egui::Context::default();
+    crate::theme::install_fonts(&ctx);
+    let toggle = |ctx: &egui::Context, app: &mut VectorcraftApp| {
+        let texts = frame_events(ctx, app, vec![], show);
+        click(ctx, app, text_rect(&texts, "Align to Pixel Grid").center(), show);
+    };
+    assert_eq!(pixel_aligned_state(&app).map(|s| (s.0, s.1)), Some((Some(false), true)));
+    toggle(&ctx, &mut app);
+    assert!(aligned(&app, a) && aligned(&app, b));
+    let x0 = app.session.active().unwrap().doc.node(vectorcraft_doc::NodeId(a)).unwrap().geometric_bounds().unwrap().x0;
+    // The default 1 pt stroke is odd and centered: the edges go to half points.
+    assert_eq!(x0, 10.5);
+    app.run("object.setPixelAligned", json!({"ids": [b], "on": false})).unwrap();
+    assert_eq!(pixel_aligned_state(&app).map(|s| s.0), Some(None));
+    toggle(&ctx, &mut app);
+    assert!(aligned(&app, a) && aligned(&app, b));
+    toggle(&ctx, &mut app);
+    assert!(!aligned(&app, a) && !aligned(&app, b));
+    let t = app.run("text.create", json!({"x": 10, "y": 100, "text": "Hi"})).unwrap()["id"].as_u64().unwrap();
+    app.run("select.set", json!({"ids": [a, t]})).unwrap();
+    assert_eq!(pixel_aligned_state(&app).map(|s| s.1), Some(false));
+    toggle(&ctx, &mut app);
+    assert!(!aligned(&app, a));
+    // A path inside a compound path snaps with the compound path, so it cannot be aligned alone.
+    app.run("select.set", json!({"ids": [a, b]})).unwrap();
+    let c = app.run("object.compoundPath.make", json!({})).unwrap()["id"].as_u64().unwrap();
+    assert_eq!(pixel_aligned_state(&app).map(|s| s.1), Some(true));
+    let member = app.session.active().unwrap().doc.node(vectorcraft_doc::NodeId(c)).unwrap().children().unwrap()[0].id.0;
+    app.run("select.set", json!({"ids": [member]})).unwrap();
+    assert_eq!(pixel_aligned_state(&app).map(|s| s.1), Some(false));
+}
diff --git a/crates/ui-egui/src/prefs_dialog.rs b/crates/ui-egui/src/prefs_dialog.rs
index 8c3fa35d6..8822dc69e 100644
--- a/crates/ui-egui/src/prefs_dialog.rs
+++ b/crates/ui-egui/src/prefs_dialog.rs
@@ -19,6 +19,10 @@ pub const UI_FIELDS: &[(&str, &str, &str)] = &[
     ("__taskBar", "General", "Enable Contextual Task Bar"),
 ];
 
+/// Whether User Interface shows VectorCraft Title Bar on Every Desktop (`appTitleBar`): Linux and the
+/// BSDs, where the desktop may draw the window's frame. macOS and Windows never read it.
+const APP_TITLE_BAR_SHOWN: bool = cfg!(not(any(target_arch = "wasm32", target_os = "macos", target_os = "windows")));
+
 pub fn open(app: &mut VectorcraftApp, category: Option<&str>) {
     // One field per preference key or group (the flattener presets have commands of their own).
     let mut fields: Map<String, Value> = app.session.prefs.to_json().as_object().cloned().unwrap_or_default();
@@ -32,6 +36,9 @@ pub fn open(app: &mut VectorcraftApp, category: Option<&str>) {
     fields.insert("__smartGuides".into(), json!(app.ui.view.smart_guides));
     fields.insert("__snapToGrid".into(), json!(app.ui.view.snap_to_grid));
     fields.insert("__taskBar".into(), json!(app.ui.task_bar));
+    // Read-only: whether VECTORCRAFT_TITLEBAR chose this window's frame (VectorCraft Title Bar on
+    // Every Desktop's note).
+    fields.insert("__titlebarFromEnv".into(), json!(app.titlebar_from_env));
     fields.insert("__search".into(), json!(""));
     fields.insert("__focusSearch".into(), json!(true));
     app.ui.dialog = Some(Dialog { kind: "preferences".into(), fields });
@@ -52,6 +59,7 @@ fn settings() -> impl Iterator<Item = Setting> {
     let ui_fields = UI_FIELDS.iter().map(|&(key, category, label)| Setting { key, category, section: "", label });
     let shown = |key: &str| match key {
         "systemTitleBar" => cfg!(all(not(target_arch = "wasm32"), not(target_os = "macos"))),
+        "appTitleBar" => APP_TITLE_BAR_SHOWN,
         "linuxDisplayServer" => cfg!(target_os = "linux"),
         _ => true,
     };
@@ -474,8 +482,31 @@ fn category_fields(ui: &mut egui::Ui, app: &mut VectorcraftApp, d: &mut Dialog,
             PrefKind::Bool if sp.key == "systemTitleBar" => {
                 if cfg!(all(not(target_arch = "wasm32"), not(target_os = "macos"))) {
                     bool_row(ui, d, sp.key, sp.label);
-                    // The window's decorations are chosen once, when the app starts.
-                    ui.label(egui::RichText::new(tl!("Applies the next time VectorCraft starts.")).color(t.text_dim).size(11.0));
+                    // The window's decorations are chosen once, when the app starts. On Linux and the
+                    // BSDs the note goes under the next row, which also applies at the next start.
+                    if !APP_TITLE_BAR_SHOWN {
+                        ui.label(egui::RichText::new(tl!("Applies the next time VectorCraft starts.")).color(t.text_dim).size(11.0));
+                    }
+                }
+            }
+            // Linux and the BSDs only, where the desktop may draw the frame: dimmed while System
+            // Title Bar is on or VECTORCRAFT_TITLEBAR is set, which take precedence over it. A note
+            // names each one that is in effect.
+            PrefKind::Bool if sp.key == "appTitleBar" => {
+                if APP_TITLE_BAR_SHOWN {
+                    let from_env = d.bool("__titlebarFromEnv");
+                    let system = d.bool("systemTitleBar");
+                    ui.add_enabled_ui(!from_env && !system, |ui| bool_row(ui, d, sp.key, sp.label));
+                    if system {
+                        let note = tl!("System Title Bar takes precedence over this option while it is on.");
+                        ui.label(egui::RichText::new(note).color(t.text_dim).size(11.0));
+                    }
+                    let note = if from_env {
+                        tl!("The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.")
+                    } else {
+                        tl!("Applies the next time VectorCraft starts.")
+                    };
+                    ui.label(egui::RichText::new(note).color(t.text_dim).size(11.0));
                 }
             }
             PrefKind::Bool => bool_row(ui, d, sp.key, sp.label),
diff --git a/crates/ui-egui/src/prefs_dialog/tests.rs b/crates/ui-egui/src/prefs_dialog/tests.rs
index 8e0db81d9..99bc68c6b 100644
--- a/crates/ui-egui/src/prefs_dialog/tests.rs
+++ b/crates/ui-egui/src/prefs_dialog/tests.rs
@@ -301,6 +301,97 @@ fn system_title_bar_preference_shows_and_persists() {
     assert_eq!(saved["engine_prefs"]["systemTitleBar"], json!(true));
 }
 
+/// User Interface › VectorCraft Title Bar on Every Desktop: shown on Linux and the BSDs only, under
+/// System Title Bar with the next-launch note once, and saved under the key the desktop app reads
+/// before the window opens.
+#[test]
+fn app_title_bar_preference_shows_and_persists() {
+    fn texts(s: &egui::Shape, out: &mut Vec<String>) {
+        match s {
+            egui::Shape::Text(t) => out.push(t.galley.text().to_string()),
+            egui::Shape::Vec(v) => v.iter().for_each(|s| texts(s, out)),
+            _ => {}
+        }
+    }
+    let mut a = app();
+    open(&mut a, Some("User Interface"));
+    let ctx = egui::Context::default();
+    crate::theme::install_fonts(&ctx);
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| show(&mut a, ui.ctx()));
+    out.textures_delta.clear();
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| show(&mut a, ui.ctx()));
+    out.textures_delta.clear();
+    let mut shown = vec![];
+    out.shapes.iter().for_each(|c| texts(&c.shape, &mut shown));
+    let supported = cfg!(not(any(target_arch = "wasm32", target_os = "macos", target_os = "windows")));
+    assert_eq!(shown.iter().any(|t| t == "VectorCraft Title Bar on Every Desktop"), supported, "{shown:?}");
+    let notes = shown.iter().filter(|t| *t == "Applies the next time VectorCraft starts.").count();
+    assert_eq!(notes, usize::from(cfg!(all(not(target_arch = "wasm32"), not(target_os = "macos")))), "{shown:?}");
+    a.ui.dialog.as_mut().unwrap().fields.insert("appTitleBar".into(), json!(true));
+    confirm(&mut a).unwrap();
+    assert!(a.session.prefs.app_title_bar);
+    let saved: Value = serde_json::from_slice(&serde_json::to_vec(&a.ui).unwrap()).unwrap();
+    assert_eq!(saved["engine_prefs"]["appTitleBar"], json!(true));
+}
+
+/// VectorCraft Title Bar on Every Desktop does not take clicks while System Title Bar is on or
+/// VECTORCRAFT_TITLEBAR is set. With the variable set its note names the variable in place of the
+/// next-launch note, and with System Title Bar on a note says that System Title Bar takes precedence.
+#[test]
+fn app_title_bar_is_dimmed_while_something_takes_precedence() {
+    fn texts(s: &egui::Shape, out: &mut Vec<String>) {
+        match s {
+            egui::Shape::Text(t) => out.push(t.galley.text().to_string()),
+            egui::Shape::Vec(v) => v.iter().for_each(|s| texts(s, out)),
+            _ => {}
+        }
+    }
+    let note = "The VECTORCRAFT_TITLEBAR environment variable chooses the title bar while it is set.";
+    let system_note = "System Title Bar takes precedence over this option while it is on.";
+    let restart_note = "Applies the next time VectorCraft starts.";
+    let supported = cfg!(not(any(target_arch = "wasm32", target_os = "macos", target_os = "windows")));
+    for (from_env, system) in [(false, false), (true, false), (false, true), (true, true)] {
+        let mut a = app();
+        a.titlebar_from_env = from_env;
+        open(&mut a, Some("User Interface"));
+        a.ui.dialog.as_mut().unwrap().fields.insert("systemTitleBar".into(), json!(system));
+        let ctx = egui::Context::default();
+        crate::theme::install_fonts(&ctx);
+        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| show(&mut a, ui.ctx()));
+        out.textures_delta.clear();
+        let mut out = ctx.run_ui(egui::RawInput::default(), |ui| show(&mut a, ui.ctx()));
+        out.textures_delta.clear();
+        let mut shown = vec![];
+        out.shapes.iter().for_each(|c| texts(&c.shape, &mut shown));
+        assert_eq!(shown.iter().any(|t| t == note), supported && from_env, "{shown:?}");
+        assert_eq!(shown.iter().any(|t| t == system_note), supported && system, "{shown:?}");
+        // The next-launch note stays under this row on Linux and the BSDs, where it also covers
+        // System Title Bar, and under System Title Bar on Windows.
+        let restart_shown = if supported { !from_env } else { cfg!(all(not(target_arch = "wasm32"), not(target_os = "macos"))) };
+        assert_eq!(shown.iter().filter(|t| *t == restart_note).count(), usize::from(restart_shown), "{shown:?}");
+        // A click on the checkbox's label turns the preference on only when nothing takes precedence.
+        let label = out.shapes.iter().find_map(|c| match &c.shape {
+            egui::Shape::Text(t) if t.galley.text() == "VectorCraft Title Bar on Every Desktop" => Some(t.visual_bounding_rect()),
+            _ => None,
+        });
+        assert_eq!(label.is_some(), supported);
+        if let Some(r) = label {
+            for pressed in [true, false] {
+                let input = egui::RawInput {
+                    events: vec![
+                        egui::Event::PointerMoved(r.center()),
+                        egui::Event::PointerButton { pos: r.center(), button: egui::PointerButton::Primary, pressed, modifiers: Default::default() },
+                    ],
+                    ..Default::default()
+                };
+                let mut out = ctx.run_ui(input, |ui| show(&mut a, ui.ctx()));
+                out.textures_delta.clear();
+            }
+            assert_eq!(a.ui.dialog.as_ref().unwrap().bool("appTitleBar"), !from_env && !system, "variable {from_env}, System Title Bar {system}");
+        }
+    }
+}
+
 /// Performance › Linux Display Server (#2028): on Linux it shows the drawing-tablet note, and
 /// X11 (XWayland) When a Pen Is Attached is applied by OK and saved under the key the desktop
 /// app reads before the window opens.
diff --git a/crates/ui-egui/src/recovery.rs b/crates/ui-egui/src/recovery.rs
index 5287a4b6a..443d4aad3 100644
--- a/crates/ui-egui/src/recovery.rs
+++ b/crates/ui-egui/src/recovery.rs
@@ -28,10 +28,11 @@ pub struct Timer {
     beat: f64,
 }
 
-/// Each frame: the startup question once, the timer and the heartbeat (`now`: app time in
-/// seconds) → in how many seconds they want the next frame (none while Data Recovery is off).
+/// Each frame: the startup question once no other dialog is open, the timer and the heartbeat
+/// (`now`: app time in seconds) → in how many seconds they want the next frame (none while Data Recovery is off).
 pub fn frame(app: &mut VectorcraftApp, now: f64) -> Option<f64> {
-    if !app.recovery.checked {
+    // A dialog already open at launch (the Safe Mode choice) is answered first.
+    if !app.recovery.checked && app.ui.dialog.is_none() {
         app.recovery.checked = true;
         offer(app);
     }
diff --git a/crates/ui-egui/src/shortcut_editor.rs b/crates/ui-egui/src/shortcut_editor.rs
index 01deb3be8..2bee024da 100644
--- a/crates/ui-egui/src/shortcut_editor.rs
+++ b/crates/ui-egui/src/shortcut_editor.rs
@@ -453,8 +453,9 @@ fn listed(overrides: &Overrides, e: &Entry) -> bool {
 /// Commands whose params are all optional that do nothing, or fail, when a key press runs them
 /// with none, and that no item of the menu bar runs: Transparency and Opacity Mask Options need
 /// a value to set, Align and Distribute a direction, Delete Swatch and Move Swatch a swatch name,
-/// and the library, data set and text style loaders a file, which their panel menu items ask for.
-const NEEDS_A_PARAM: [&str; 19] = [
+/// and the library, data set, text style and SVG filter loaders a file, which their menu items ask
+/// for.
+const NEEDS_A_PARAM: [&str; 20] = [
     "transparency.set",
     "transparency.setOpacityMask",
     "stroke.set",
@@ -474,6 +475,7 @@ const NEEDS_A_PARAM: [&str; 19] = [
     "charStyle.load",
     "paraStyle.load",
     "textStyle.loadAll",
+    "svgFilter.import",
 ];
 
 /// The (label, params) of each menu bar item, by command id.
@@ -539,6 +541,17 @@ fn needs_a_value(key: &str) -> bool {
     .contains(key)
 }
 
+/// Does a menu bar item run the command with no params, so that it does what its label says and opens
+/// no dialog? A command no menu bar item runs (the Crop Image item runs `ui.cropImage`), a menu item
+/// that gives it params, a [`NEEDS_A_PARAM`] command and a field a call must give each rule it out.
+pub(crate) fn runs_with_no_values(c: &vectorcraft_engine::CommandSpec) -> bool {
+    menu_bar_items().contains_key(c.id)
+        && menu_target(c.id).is_none()
+        && !NEEDS_A_PARAM.contains(&c.id)
+        && !crate::dialogs::variables::opens(c.id)
+        && !names_a_required_field(c.params)
+}
+
 /// Does a params doc name a field a call must give? Its fields are the top-level parts of its
 /// first `{…}`. A field is optional when it is empty, starts with `…`, gives a default (`rows=10`)
 /// or each of its names ends with `?` (`id?|ids?: [id…]`); `{index | indices}` names a required
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index 64ead689f..72b5e56f1 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -633,6 +633,11 @@ pub struct UiState {
     /// place, [`crate::dialogs::settle`] puts the document back at the front of `pending_fonts`.
     #[serde(skip)]
     pub fonts_dialog: Option<u64>,
+    /// The plug-in (`{id, file, name, label}`) the last launch was loading when it stopped, while
+    /// the user has not chosen what to do about it. When another dialog takes the choice's place,
+    /// [`crate::dialogs::settle`] opens the choice again once no dialog is open.
+    #[serde(skip)]
+    pub stopped_plugin: Option<Value>,
     /// The search the Missing Fonts dialog started (`text.findFontFiles`'s `id`), stopped once the
     /// dialog is gone.
     #[serde(skip)]
@@ -1049,6 +1054,7 @@ impl Default for UiState {
             made_text_style: vec![],
             pending_fonts: vec![],
             fonts_dialog: None,
+            stopped_plugin: None,
             dialog_search: None,
             links_search: None,
             dxf_options: Value::Null,
diff --git a/crates/ui-egui/src/tests/automation.rs b/crates/ui-egui/src/tests/automation.rs
index 5af13624b..e665f515b 100644
--- a/crates/ui-egui/src/tests/automation.rs
+++ b/crates/ui-egui/src/tests/automation.rs
@@ -159,6 +159,28 @@ fn shortcut_sets_are_read_only_inside_the_read_root() {
     let _ = std::fs::remove_dir_all(base);
 }
 
+/// An action set another app saved (`.aia`) is read only from inside the read root, whichever way a
+/// control request names it: `actionSet.read` and Load Actions….
+#[test]
+fn action_sets_are_read_only_inside_the_read_root() {
+    let (mut app, tx, base) = confined("aia");
+    let set = "/version 3\n/name [ 4 4d696e65 ]\n/action-1 { /name [ 1 41 ] }\n";
+    std::fs::write(base.join("in/a.aia"), set).unwrap();
+    std::fs::write(base.join("outside/b.aia"), set).unwrap();
+    let execute = |command: &str, path: PathBuf| json!({"command": command, "params": {"path": s(path)}});
+    let r = request(&mut app, &tx, "engine.execute", execute("actionSet.read", base.join("in/a.aia")));
+    assert_eq!(r["result"]["set"], "Mine", "{r}");
+    let r = request(&mut app, &tx, "engine.execute", execute(crate::panels::actions::LOAD_SET, base.join("in/a.aia")));
+    assert_eq!(r["result"]["name"], "Mine", "{r}");
+    let sets = app.ui.action_sets.len();
+    for command in ["actionSet.read", crate::panels::actions::LOAD_SET] {
+        let r = request(&mut app, &tx, "engine.execute", execute(command, base.join("outside/b.aia")));
+        assert!(r["error"].as_str().is_some_and(|e| e.contains("outside the read root")), "{command}: {r}");
+    }
+    assert_eq!(app.ui.action_sets.len(), sets, "no set added");
+    let _ = std::fs::remove_dir_all(base);
+}
+
 /// `ui.render` (MCP's `render_preview` and `screenshot` in the app) draws the artboard pixel for
 /// pixel as `app.export` writes a PNG on white: two rectangles that meet at x 40.3 and a diagonal
 /// edge.
diff --git a/crates/ui-egui/src/tests/nativeoptions.rs b/crates/ui-egui/src/tests/nativeoptions.rs
index 59b8c91de..5f136d514 100644
--- a/crates/ui-egui/src/tests/nativeoptions.rs
+++ b/crates/ui-egui/src/tests/nativeoptions.rs
@@ -32,7 +32,7 @@ fn save_as_native_asks_for_its_options_and_writes_every_artboard() {
     let d = app.ui.dialog.as_ref().unwrap();
     assert_eq!(
         (d.str("format").as_str(), d.bool("separateArtboards"), d.bool("embedProfiles"), d.bool("pdfCompatible")),
-        ("vectorcraft", false, true, false)
+        ("vectorcraft", false, true, true)
     );
     assert!(written.borrow().is_empty(), "nothing is written before OK");
     frame(&mut app);
diff --git a/crates/ui-egui/tests/safe_mode.rs b/crates/ui-egui/tests/safe_mode.rs
new file mode 100644
index 000000000..e47ef9bbe
--- /dev/null
+++ b/crates/ui-egui/tests/safe_mode.rs
@@ -0,0 +1,327 @@
+//! Safe Mode in the app: the choice after a launch that stopped while a plug-in was loading
+//! (Disable and Continue, Start Normally, Start in Safe Mode), Help › Safe Mode with Enable on
+//! Re-launch, and Safe Mode in the window title. Safe Mode and installed plug-ins are
+//! process-wide, so these tests run in their own test binary, one at a time.
+// Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md › Robustness).
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+use serde_json::json;
+use vectorcraft_engine::Session;
+use vectorcraft_plugins::safe_mode::{self, Item};
+use vectorcraft_plugins::{registry, wat as tpl};
+use vectorcraft_ui_egui::dialogs::safe_mode as ui;
+use vectorcraft_ui_egui::panels::appearance;
+use vectorcraft_ui_egui::{Services, VectorcraftApp, chrome, dialogs, theme};
+
+static LOCK: Mutex<()> = Mutex::new(());
+
+/// Safe Mode off, no launch marker, nothing pending, disabled or installed.
+fn reset() {
+    ui::end_launch();
+    safe_mode::set_active(None);
+    safe_mode::forget_previous();
+    safe_mode::set_disabled(vec![]);
+    for p in registry::list() {
+        registry::remove(p.id());
+    }
+}
+
+/// Holds the lock for one test and resets the process-wide state when the test starts and when it
+/// ends, so a test that fails leaves the next one as it would find a new process.
+struct Fresh {
+    _guard: std::sync::MutexGuard<'static, ()>,
+}
+
+fn fresh() -> Fresh {
+    let guard = LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    reset();
+    Fresh { _guard: guard }
+}
+
+impl Drop for Fresh {
+    fn drop(&mut self) {
+        reset();
+    }
+}
+
+fn filter(id: &str) -> Vec<u8> {
+    wat::parse_str(tpl::returning(&tpl::manifest(id, "filter", "{}"), r#"{"objects":[]}"#)).unwrap()
+}
+
+fn tmp_dir(tag: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("vc-ui-safe-mode-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+/// A plug-in folder holding x and y, as `plugin.install` keeps them.
+fn store_with_two(tag: &str) -> PathBuf {
+    let dir = tmp_dir(tag);
+    let mut s = Session::new();
+    s.attach_plugin_store(dir.clone());
+    for id in ["test.ui.x", "test.ui.y"] {
+        s.execute("plugin.install", &json!({"dataBase64": vectorcraft_format::base64_encode(&filter(id))})).unwrap();
+    }
+    dir
+}
+
+/// A launch of the app after one that stopped while `stopped` was loading (none: Safe Mode from
+/// `--safe-mode` when `flag`), with the plug-in folder `dir` and the launch marker folder `launch`.
+fn launch(dir: &Path, launch: &Path, flag: bool) -> VectorcraftApp {
+    for p in registry::list() {
+        registry::remove(p.id());
+    }
+    let stopped = ui::begin_launch(Some(launch), flag);
+    let mut session = Session::new();
+    session.attach_plugin_store(dir.to_path_buf());
+    let mut app = VectorcraftApp::new(session, Services::default());
+    ui::after_start(&mut app, stopped);
+    app
+}
+
+/// A marker left by a launch that stopped while the stored plug-in x was loading.
+fn stopped_while_loading_x(launch: &Path, dir: &Path) {
+    let x = std::fs::read_dir(dir).unwrap().flatten().map(|e| e.path()).find(|p| p.to_string_lossy().contains("test_ui_x")).unwrap();
+    let item = json!({"format": "vectorcraft-launch", "version": 1, "item": {"file": x.display().to_string()}});
+    std::fs::create_dir_all(launch).unwrap();
+    std::fs::write(launch.join("launch-1-dead.json"), item.to_string()).unwrap();
+}
+
+/// One headless frame of the dialog layer.
+fn frame(app: &mut VectorcraftApp) {
+    let ctx = egui::Context::default();
+    theme::install_fonts(&ctx);
+    let mut out = ctx.run_ui(egui::RawInput::default(), |ui| dialogs::show(app, ui.ctx()));
+    out.textures_delta.clear();
+}
+
+fn done(launch: &Path) {
+    ui::end_launch();
+    safe_mode::set_active(None);
+    safe_mode::forget_previous();
+    safe_mode::set_disabled(vec![]);
+    let _ = std::fs::remove_dir_all(launch);
+}
+
+fn kind(app: &VectorcraftApp) -> Option<&str> {
+    app.ui.dialog.as_ref().map(|d| d.kind.as_str())
+}
+
+#[test]
+fn disable_and_continue_loads_every_plug_in_but_the_one_that_was_loading() {
+    let _f = fresh();
+    let dir = store_with_two("disable");
+    let launch_dir = dir.join("Launch");
+    stopped_while_loading_x(&launch_dir, &dir);
+    let mut app = launch(&dir, &launch_dir, false);
+    assert_eq!(kind(&app), Some(ui::STOPPED));
+    assert!(safe_mode::active() && registry::list().is_empty(), "nothing loads until the user chooses");
+    assert!(chrome::window_title(&app).ends_with("(Safe Mode)"));
+    frame(&mut app);
+    dialogs::confirm(&mut app).unwrap();
+    assert!(!safe_mode::active() && kind(&app).is_none());
+    assert!(registry::get("test.ui.x").is_none() && registry::get("test.ui.y").is_some(), "only the one that was loading is off");
+    assert_eq!(chrome::window_title(&app), "VectorCraft");
+    assert!(dir.join("disabled.json").is_file(), "kept off at later launches");
+    ui::end_launch();
+
+    // The next launch, which quit normally before: nothing is asked, and x stays off.
+    let app = launch(&dir, &launch_dir, false);
+    assert!(kind(&app).is_none() && !safe_mode::active());
+    assert!(registry::get("test.ui.x").is_none() && registry::get("test.ui.y").is_some());
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn start_normally_loads_everything_and_start_in_safe_mode_loads_nothing() {
+    let _f = fresh();
+    let dir = store_with_two("normal");
+    let launch_dir = dir.join("Launch");
+    stopped_while_loading_x(&launch_dir, &dir);
+    let mut app = launch(&dir, &launch_dir, false);
+    app.ui.dialog.as_mut().unwrap().fields.insert("normal".into(), json!(true));
+    dialogs::confirm(&mut app).unwrap();
+    assert!(!ui::choosing(&app) && !ui::staying_on(&app), "Start Normally ends Safe Mode");
+    assert!(registry::get("test.ui.x").is_some() && registry::get("test.ui.y").is_some());
+    assert!(safe_mode::disabled().is_empty() && !dir.join("disabled.json").exists(), "Start Normally changes no setting");
+    ui::end_launch();
+
+    stopped_while_loading_x(&launch_dir, &dir);
+    let mut app = launch(&dir, &launch_dir, false);
+    assert!(ui::choosing(&app) && !ui::staying_on(&app), "Safe Mode until the user chooses");
+    dialogs::cancel(&mut app);
+    assert!(!ui::choosing(&app) && ui::staying_on(&app), "Safe Mode for the rest of the launch");
+    assert!(safe_mode::active() && registry::list().is_empty(), "Start in Safe Mode");
+    assert_eq!(safe_mode::source(), Some(safe_mode::Source::Startup));
+    assert!(safe_mode::disabled().is_empty(), "nothing turned off");
+    ui::end_launch();
+    safe_mode::set_active(None);
+    let app = launch(&dir, &launch_dir, false);
+    assert_eq!(kind(&app), Some(ui::STOPPED), "Start in Safe Mode leaves the choice to the next launch");
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_disabled_list_that_cannot_be_saved_says_so() {
+    let _f = fresh();
+    let dir = store_with_two("unsaved");
+    let launch_dir = dir.join("Launch");
+    stopped_while_loading_x(&launch_dir, &dir);
+    // A later version's list, which a save keeps as it is.
+    let later = r#"{"format": "vectorcraft-disabled-plugins", "version": 2, "items": []}"#;
+    std::fs::write(dir.join("disabled.json"), later).unwrap();
+    let unsaved = "Couldn't save the disabled plug-ins for the next launch";
+    let mut app = launch(&dir, &launch_dir, false);
+    dialogs::confirm(&mut app).unwrap();
+    assert_eq!(app.ui.status, unsaved, "Disable and Continue");
+    assert!(safe_mode::previous().is_some(), "the next launch asks again");
+    assert!(registry::get("test.ui.x").is_none(), "this launch still skips it");
+    app.ui.status.clear();
+    app.run("help.safeMode", json!({})).unwrap();
+    app.ui.dialog.as_mut().unwrap().fields["items"][0]["enable"] = json!(true);
+    dialogs::confirm(&mut app).unwrap();
+    assert_eq!(app.ui.status, unsaved, "Enable on Re-launch");
+    assert_eq!(std::fs::read_to_string(dir.join("disabled.json")).unwrap(), later);
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn the_safe_mode_label_leaves_the_menus_their_room() {
+    let _f = fresh();
+    safe_mode::set_active(Some(safe_mode::Source::Flag));
+    let menu_names = ["File", "Edit", "Object", "Type", "Select", "Effect", "View", "Window", "Help"];
+    for width in [560.0, 720.0, 1280.0] {
+        let ctx = egui::Context::default();
+        theme::install_fonts(&ctx);
+        let mut app = VectorcraftApp::new(Session::new(), Services::default());
+        let input = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(width, 400.0))), ..Default::default() };
+        let mut out = ctx.run_ui(input, |ui| chrome::app_bar(&mut app, ui));
+        out.textures_delta.clear();
+        let texts: Vec<_> = out
+            .shapes
+            .iter()
+            .filter_map(|s| match &s.shape {
+                egui::Shape::Text(t) => Some((t.galley.job.text.clone(), t.visual_bounding_rect())),
+                _ => None,
+            })
+            .collect();
+        let menus: Vec<egui::Rect> = texts.iter().filter(|(t, _)| menu_names.contains(&t.as_str())).map(|(_, r)| *r).collect();
+        assert!(!menus.is_empty(), "{width}: the menus are drawn: {texts:?}");
+        let (start, end) = menus.iter().fold((f32::MAX, f32::MIN), |(a, b), r| (a.min(r.left()), b.max(r.right())));
+        assert!(texts.iter().any(|(t, _)| t == "Safe Mode"), "{width}: the label is drawn");
+        for (t, r) in texts.iter().filter(|(t, _)| !menu_names.contains(&t.as_str())) {
+            assert!(r.left() >= end || r.right() <= start, "{width}: {t:?} at {r:?} overlaps the menus from {start} to {end}");
+        }
+    }
+}
+
+#[test]
+fn a_dialog_that_replaces_the_choice_leaves_it_waiting() {
+    let _f = fresh();
+    let dir = store_with_two("replaced");
+    let launch_dir = dir.join("Launch");
+    stopped_while_loading_x(&launch_dir, &dir);
+    let mut app = launch(&dir, &launch_dir, false);
+    // Help › Safe Mode (or any other dialog) takes the choice's place before it is answered.
+    app.run("help.safeMode", json!({})).unwrap();
+    assert_eq!(kind(&app), Some(ui::KIND));
+    assert!(ui::choosing(&app) && !ui::staying_on(&app), "still waiting for the choice");
+    dialogs::cancel(&mut app);
+    assert_eq!(kind(&app), Some(ui::STOPPED), "the choice opens again once no dialog is open");
+    assert!(ui::choosing(&app) && registry::list().is_empty());
+    dialogs::confirm(&mut app).unwrap();
+    assert!(!ui::choosing(&app) && !safe_mode::active());
+    assert!(registry::get("test.ui.x").is_none() && registry::get("test.ui.y").is_some());
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn the_safe_mode_flag_asks_nothing_and_loads_nothing() {
+    let _f = fresh();
+    let dir = store_with_two("flag");
+    let launch_dir = dir.join("Launch");
+    let app = launch(&dir, &launch_dir, true);
+    assert!(kind(&app).is_none() && ui::staying_on(&app));
+    assert_eq!((safe_mode::source(), registry::list().len()), (Some(safe_mode::Source::Flag), 0));
+    assert_eq!(app.ui.status, vectorcraft_plugins::Error::SafeMode.to_string());
+    assert!(chrome::window_title(&app).ends_with("(Safe Mode)"));
+    // An object's plug-in effect stays in its Appearance list, marked as skipped.
+    assert!(appearance::effect_row_label("plugin.org.example.glow").ends_with("(Safe Mode)"));
+    assert!(!appearance::effect_row_label("stylize.dropShadow").contains("Safe Mode"), "built-in effects still draw");
+    // Two plug-ins' effects with the same row name: the tooltip names each one's plug-in.
+    let (a, b) = (appearance::skipped_effect_tip("plugin.com.a.blur").unwrap(), appearance::skipped_effect_tip("plugin.com.b.blur").unwrap());
+    assert!(a.ends_with("\ncom.a.blur") && b.ends_with("\ncom.b.blur"), "{a:?} {b:?}");
+    assert_eq!(appearance::skipped_effect_tip("stylize.dropShadow"), None);
+    safe_mode::set_active(None);
+    assert!(!appearance::effect_row_label("plugin.org.example.glow").contains("Safe Mode"));
+    assert_eq!(appearance::skipped_effect_tip("plugin.com.a.blur"), None);
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_safe_mode_flag_launch_leaves_the_stopped_plug_in_to_the_next_launch() {
+    let _f = fresh();
+    let dir = store_with_two("flag-pending");
+    let launch_dir = dir.join("Launch");
+    stopped_while_loading_x(&launch_dir, &dir);
+    let app = launch(&dir, &launch_dir, true);
+    assert!(kind(&app).is_none() && registry::list().is_empty(), "--safe-mode asks nothing");
+    assert!(safe_mode::previous().is_some(), "the plug-in is still pending");
+    ui::end_launch();
+    safe_mode::set_active(None);
+
+    // The next launch, without the flag, asks about it before anything loads.
+    let mut app = launch(&dir, &launch_dir, false);
+    assert_eq!(kind(&app), Some(ui::STOPPED));
+    assert!(registry::list().is_empty());
+    dialogs::confirm(&mut app).unwrap();
+    assert!(registry::get("test.ui.x").is_none() && registry::get("test.ui.y").is_some());
+    ui::end_launch();
+
+    // A launch after the choice asks nothing.
+    let app = launch(&dir, &launch_dir, false);
+    assert!(kind(&app).is_none() && !safe_mode::active());
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn help_safe_mode_enables_a_plug_in_for_the_next_launch_only() {
+    let _f = fresh();
+    let dir = store_with_two("help");
+    let launch_dir = dir.join("Launch");
+    let x = Item { id: Some("test.ui.x".into()), name: Some("X\u{202E}gnp".into()), file: None };
+    let mut s = Session::new();
+    s.attach_plugin_store(dir.clone());
+    assert!(safe_mode::set_enabled(&x, false));
+    assert!(s.store_disabled_plugins());
+    let mut app = launch(&dir, &launch_dir, false);
+    assert!(registry::get("test.ui.x").is_none());
+    app.run("help.safeMode", json!({})).unwrap();
+    assert_eq!(kind(&app), Some(ui::KIND));
+    let d = app.ui.dialog.as_mut().unwrap();
+    assert_eq!(d.fields["items"][0]["label"], "Xgnp", "a name can't reorder the dialog's text");
+    frame(&mut app);
+    // Close keeps everything as it was.
+    dialogs::cancel(&mut app);
+    assert_eq!(safe_mode::disabled(), std::slice::from_ref(&x));
+    app.run("help.safeMode", json!({})).unwrap();
+    app.ui.dialog.as_mut().unwrap().fields["items"][0]["enable"] = json!(true);
+    dialogs::confirm(&mut app).unwrap();
+    assert!(safe_mode::disabled().is_empty());
+    assert!(registry::get("test.ui.x").is_none(), "not loaded during this launch");
+    ui::end_launch();
+    launch(&dir, &launch_dir, false);
+    assert!(registry::get("test.ui.x").is_some(), "loaded at the next launch");
+    done(&launch_dir);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index f759782a0..6802b9e63 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -332,6 +332,13 @@ instead: the OS title then shows the active document (`*name — VectorCraft` wi
 drops its brand mark. On Linux the app bar also drops its brand mark whenever the desktop draws the window's frame, with
 System Title Bar on or off. On macOS the window buttons are centred on the app bar; the web build is unchanged.
 
+On Linux and the BSDs, Preferences › User Interface › VectorCraft Title Bar on Every Desktop (`appTitleBar`, read
+when the app starts, off by default) turns off the desktop's frame and uses the app bar as the title bar in the
+sessions where the desktop would draw the frame: X11 sessions, Wayland compositors that draw server-side decorations
+such as KDE Plasma, and a window opened through XWayland. System Title Bar and `VECTORCRAFT_TITLEBAR` (`app`, or
+`system` or `desktop`) take precedence over it. The checkbox is dimmed while either applies, and a note under it names
+each one that applies.
+
 Fill/Stroke chips and panel shortcuts: the Control bar's and Properties' Fill and Stroke chips bring their proxy
 forward (`paint.toggleActive {fill}`) and open a popover with the Swatches panel (Shift-click: the Color panel's mixer);
 a swatch clicked there runs `paint.setFill` / `paint.setStroke`. The Properties panel has them with nothing selected
@@ -670,9 +677,11 @@ with.
 
 DXF Options: Export As… with the DXF format (`file.exportAs {format: "dxf"}`, then the save dialog), or
 `ui.dxfOptionsDialog {path?, …document.exportDxf options}` for agents, opens the `dxfOptions` dialog. Its fields are
-`document.export` params: `version`, `unit` (a unit name such as `Millimeters`), `scale`, `scaleLineweights`, `colors`
-(`8`, `16`, `256`, `true`), `rasterFormat` (`png`, `jpeg`), `preserve` (`appearance`, `editability`), `selectedOnly`,
-`alterPaths`, `outlineText`, plus `path` and the artboard choice. `ui.dialog.confirm` checks them (a bad value, or
+`document.export` params: `dxfPreset` (`custom`, `cnc`), `version`, `unit` (a unit name such as `Millimeters`), `scale`,
+`scaleLineweights`, `colors` (`8`, `16`, `256`, `true`), `rasterFormat` (`png`, `jpeg`), `preserve` (`appearance`,
+`editability`), `selectedOnly`, `alterPaths`, `outlineText`, plus `path` and the artboard choice. Setting `dxfPreset` to
+`cnc` sets the fields it sets (see `document.exportDxf`), and `dxfPreset` reads `custom` again once one of them is
+changed; setting it to `custom` puts back the defaults. `ui.dialog.confirm` checks them (a bad value, or
 Export Selected Art Only with nothing selected, keeps the dialog open), remembers them for the next DXF Options and
 writes the file (asking for a path when there is none). Export As also lists DWG, greyed out: setting its `format` to
 `dwg` shows, and on confirm answers, the hint to export DXF instead.
diff --git a/docs/development.md b/docs/development.md
index f7dd5ac59..3204c445b 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -118,7 +118,7 @@ A file opened from the file manager (double-click, Open With, a drop on the exec
 
 ## Linux: Wayland and X11
 
-On GNOME/Wayland, enable **Preferences › User Interface › System Title Bar** and restart to use winit's font-free Adwaita window controls (`wayland-csd-adwaita-notitle`); the existing custom title bar remains the Linux default.
+On GNOME/Wayland, enable **Preferences › User Interface › System Title Bar** and restart to use winit's font-free Adwaita window controls (`wayland-csd-adwaita-notitle`); the existing custom title bar remains the Linux default. On X11, on a Wayland compositor that draws server-side decorations such as KDE Plasma, and in a window opened through XWayland, enable **Preferences › User Interface › VectorCraft Title Bar on Every Desktop** and restart to use the app bar as the title bar instead of the desktop's frame. `VECTORCRAFT_TITLEBAR=app`, `=system` or `=desktop` chooses the frame for one run and takes precedence over VectorCraft Title Bar on Every Desktop.
 
 The window runs natively on Wayland (eframe's `wayland` feature) and on X11. On machines with two GPUs it renders on the one the desktop runs on unless Preferences say otherwise; see [Desktop graphics processor](#desktop-graphics-processor) (#502). The system clipboard (`apps/vectorcraft/src/clipboard.rs`) is arboard with its `wayland-data-control` feature:
 
diff --git a/docs/effects-parity.md b/docs/effects-parity.md
index 6fe07e086..7ca183813 100644
--- a/docs/effects-parity.md
+++ b/docs/effects-parity.md
@@ -11,7 +11,7 @@ Part of [target-app-parity.md](target-app-parity.md); open work is in [gaps.md](
 
 | Group | Illustrator | VectorCraft | % | Remaining (h) |
 |---|---:|---:|---:|---:|
-| Illustrator effects (vector and stylize) | 50 | 49 | 98% | 4–8 |
+| Illustrator effects (vector and stylize) | 50 | 50 | 100% | — |
 | Photoshop effects (raster, Effect Gallery) | 57 | 57 | 100% | 1–2 (Effect Gallery thumbnails and in-dialog preview) |
 | 3D and Materials | 4 (+3 Classic) | 4 (initial: Extrude & Bevel, Revolve, Inflate, Rotate) | ~25% | 25–45 |
 | Beyond Illustrator: Effect › Color Adjustments (6), effect plug-ins (WebAssembly) | — | 6 + plug-ins | — | — |
@@ -27,7 +27,7 @@ Part of [target-app-parity.md](target-app-parity.md); open work is in [gaps.md](
 | Pathfinder | Add, Intersect, Exclude, Subtract, Minus Back, Divide, Trim, Merge, Crop, Outline, Hard Mix, Soft Mix, Trap | 13/13 | Trap traps only solid fills (gradients and patterns hide what is below them but don't trap) and spreads each colour's visible area as a whole; the public page gives no default values, so Trap's 0.25 pt, 100% and 40% are VectorCraft's own |
 | Rasterize | Rasterize… (as a live effect) | 1/1 | — |
 | Stylize | Drop Shadow, Feather, Inner Glow, Outer Glow, Round Corners, Scribble | 6/6 | Scribble Options' Settings presets |
-| SVG Filters | Apply SVG Filter… and the filter list | 0/1 | the whole submenu (SVG filters on import round-trip already) |
+| SVG Filters | Apply SVG Filter… and the filter list | 1/1 | The submenu lists the document's own filters: VectorCraft ships no default filters. A filter that is the object's last effect is written to SVG as a `<filter>` element; otherwise SVG export draws the object as an image. A filter on a turned or skewed object in an imported SVG is left out with a warning |
 | Warp | Arc, Arc Lower, Arc Upper, Arch, Bulge, Shell Lower, Shell Upper, Flag, Wave, Fish, Rise, Fisheye, Inflate, Squeeze, Twist | 15/15 | warp point editing in envelopes; Arc is a circular arc in the object's own proportions (#1578) |
 
 Document Raster Effects Settings exists. When the 64 million pixel cap on an effect image lowers
@@ -183,11 +183,11 @@ VectorCraft choices; an original approximation, never compared with another appl
 | Materials panel, lighting, ray-traced render | Window › 3D and Materials panel with the object types (Plane, Extrude, Revolve, Inflate) and the Object, Rotation and Lighting settings of the applied effect ([three-d.md](three-d.md#3d-and-materials-panel)); one to ten directional lights with per-light Color (opaque RGB, white by default), Intensity, Rotation, Height, Softness and neutral Ambient Light, Revolve and colored Inflate use smooth vector shading; Extrude & Bevel and Rotate retain planar shading; original Standard, Diffuse, Top Left and Right lighting rigs; no materials, shadows or ray tracing |
 | 3D (Classic): Extrude & Bevel, Revolve, Rotate | none |
 | Turntable (30.0 beta) | none |
-| Export 3D objects (OBJ, USDA, glTF) | none |
+| Export 3D objects (OBJ, USDA, glTF) | initial: Asset Export's Export 3D Object collects an object with Extrude & Bevel, Revolve, Inflate or Rotate as a 3D asset, and Export writes its solids as a USDA (the default), USDZ, glTF or OBJ mesh with a material in each solid's paint color (`assets.add3D`, `assets.set3DFormat`, `assets.export3D`); no textures, map art or shading ([3D export help](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/create-3d-graphics/export-3d-vector-artwork.html)) |
 
 The `three-d` crate (depends on `geom` and `pathops`, with no UI or GPU dependencies) builds, rotates, projects, shades and depth-sorts the surfaces;
 the effects crate turns them into art. What's left (materials and shadows, ray-traced rendering,
-angular cut caps, exact visibility, 3D Classic, Turntable, 3D export) is 25–45 h.
+angular cut caps, exact visibility, 3D Classic, Turntable) is 25–45 h.
 
 ## Revision history
 
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index f716d693b..108d2b9bd 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -21,7 +21,7 @@ from the public specifications, and users' own `.ai` files are used locally only
 | Formats saved (Save As) | 6 (AI, AIT, PDF, EPS, SVG, SVGZ) | 6 + native | `.ai` written PDF-compatible (with an editing copy of the art: layers, groups, paths, colors, artboards) or as legacy version 7 (layers and groups, one artboard per file) |
 | Formats opened or placed | ~30 | 29 | missing: FreeHand, CorelDRAW, DWG, HEIC/HEIF, PICT, PS |
 | Formats saved (Save As) | 6 (AI, AIT, PDF, EPS, SVG, SVGZ) | 6 + native | `.ai` written PDF-compatible (with an editing copy of the art: layers, groups, paths, colors, gradients, patterns, images, type, symbols, artboards, transparency, opacity masks, clipping) or as legacy version 7 (layers and groups, one artboard per file) |
-| Formats exported | ~16 | 17 | missing: DWG, 3D (OBJ/USDA/glTF); extra: GIF/PNG-8 palette export, DXF up to 2018, layered PSD |
+| Formats exported | ~16 | 18 | missing: DWG; extra: GIF/PNG-8 palette export, DXF up to 2018, layered PSD |
 | **Overall (weighted by use)** | | **~75%** | `.ai` and PDF dominate the weighting |
 
 EPS editing-data follow-up (2026-10-16): both mesh-corner layouts (with and without opacity)
@@ -102,7 +102,10 @@ private editing data. VectorCraft:
   gutters and first baseline, threaded frames included) and type on a path are written as text: a text object for
   each, naming its story in the text document, with the characters, fonts, sizes, leading, tracking, baseline shift,
   scales, solid fills and strokes, capitals and paragraph alignment, indents, spacing and direction; other character
-  and paragraph attributes are left out with a warning. Type in opacity masks, pattern tiles, symbols and art cut to a
+  and paragraph attributes are left out with a warning. Each run's baseline direction is written in the form the reader
+  below reads it: 1 when Standard Vertical Roman Alignment is on, 2 when it is off and 3 for Tate-chu-yoko; the
+  document's defaults and the normal character style carry 1. A run with both Tate-chu-yoko and Standard Vertical Roman
+  Alignment is written as Tate-chu-yoko, with the type attributes warning. Type in opacity masks, pattern tiles, symbols and art cut to a
   clipping object, mirrored type, turned or unevenly scaled area type and type on a path, area type in an open frame,
   type on an open path whose ends meet, area type that flows around a text wrap, type of only white space, threads of
   type on a path, threads whose frames differ in orientation, type and stories past the sizes VectorCraft's reader reads, and
@@ -215,6 +218,7 @@ private editing data. VectorCraft:
 
 ### Illustrator's private editing data
 
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips, except the path of a mask that covers several layers, whose fill is read as a path of its own in the layer that holds the mask's path, and a compound clipping path whose subpaths paint differently, whose filled subpaths are read as a compound path of their own under the art it clips; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. When the file opens from its layers, the spot colors in the art of each brush that comes in become swatches, and that art's colors count toward the document's color mode, as a pattern's do. The swatches take at most 20,000 color names in all across the brush art, and each brush-art section keeps at most 20,000 names. Each name keeps its first definition, with the color operators' names before the gradient stops' names. A spot color past those limits makes no swatch, and its color still counts toward the color mode. A spot color that the page's art, a pattern or a symbol also defines keeps the value defined there. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip (a frame whose options set key 6 to true keeps their defaults), and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the distance from the path under Align to Path comes from VectorCraft's font metrics, and on Arial at 24 pt it differs from the distance the file keeps by 1.1 pt (Ascender), 0.3 pt (Center) and 2.7 pt (Descender); the fit under Gravity does not reproduce the file's layout, and its glyphs can lie up to 7.4 pt from the positions the file keeps; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). In a PDF saved with some of its artboards, the type on each page after the first goes to an artboard of that page's size after the previous page's artboard, and only to one that leaves an artboard for each later page; the first page's artboard also leaves one for each later page. When several artboards fit a later page, VectorCraft takes the one whose art draws most like the page, and compares at most 16 artboards for all the later pages together. Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). In a PDF saved with some of its artboards, the type on each page after the first goes to an artboard of that page's size after the previous page's artboard, and only to one that leaves an artboard for each later page; the first page's artboard also leaves one for each later page. When several artboards fit a later page, VectorCraft takes the one whose art draws most like the page, and compares at most 16 artboards for all the later pages together. Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). In a PDF saved with some of its artboards, the type on each page after the first goes to an artboard of that page's size after the previous page's artboard, and only to one that leaves an artboard for each later page; the first page's artboard also leaves one for each later page. When several artboards fit a later page, VectorCraft takes the one whose art draws most like the page, and compares at most 16 artboards for all the later pages together. Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips, except the path of a mask that covers several layers, whose fill is read as a path of its own in the layer that holds the mask's path, and a compound clipping path whose subpaths paint differently, whose filled subpaths are read as a compound path of their own under the art it clips; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
@@ -231,10 +235,30 @@ the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPri
 the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip, and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the distance from the path under Align to Path comes from VectorCraft's font metrics, and on Arial at 24 pt it differs from the distance the file keeps by 1.1 pt (Ascender), 0.3 pt (Center) and 2.7 pt (Descender); the fit under Gravity does not reproduce the file's layout, and its glyphs can lie up to 7.4 pt from the positions the file keeps; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip, and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
-the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, placed PDF and `.ai` pages as placed documents of the [page and Crop to box](https://helpx.adobe.com/illustrator/desktop/add-and-import-files/import-other-file-types/adobe-pdf-placement-options.html) their dictionary names (`AI11 PlacedPDFPageIndex`, `AI11 PlacedPDFCropTo`; a value VectorCraft doesn't read, or a binding to an image variable, leaves a linked image), guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). In a PDF saved with some of its artboards, the type on each page after the first goes to an artboard of that page's size after the previous page's artboard, and only to one that leaves an artboard for each later page; the first page's artboard also leaves one for each later page. When several artboards fit a later page, VectorCraft takes the one whose art draws most like the page, and compares at most 16 artboards for all the later pages together. Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). In a PDF saved with some of its artboards, the type on each page after the first goes to an artboard of that page's size after the previous page's artboard, and only to one that leaves an artboard for each later page; the first page's artboard also leaves one for each later page. When several artboards fit a later page, VectorCraft takes the one whose art draws most like the page, and compares at most 16 artboards for all the later pages together. Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips, except the path of a mask that covers several layers, whose fill is read as a path of its own in the layer that holds the mask's path, and a compound clipping path whose subpaths paint differently, whose filled subpaths are read as a compound path of their own under the art it clips; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips, except the path of a mask that covers several layers, whose fill is read as a path of its own in the layer that holds the mask's path, and a compound clipping path whose subpaths paint differently, whose filled subpaths are read as a compound path of their own under the art it clips; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips, except the path of a mask that covers several layers, whose fill is read as a path of its own in the layer that holds the mask's path; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips, except the path of a mask that covers several layers, whose fill is read as a path of its own in the layer that holds the mask's path; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; a filled clipping path keeps its fill, which paints under the art it clips; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. When the file opens from its layers, the spot colors in the art of each brush that comes in become swatches, and that art's colors count toward the document's color mode, as a pattern's do. The swatches take at most 20,000 color names in all across the brush art, and each brush-art section keeps at most 20,000 names. Each name keeps its first definition, with the color operators' names before the gradient stops' names. A spot color past those limits makes no swatch, and its color still counts toward the color mode. A spot color that the page's art, a pattern or a symbol also defines keeps the value defined there. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. When the file opens from its layers, the spot colors in the art of each brush that comes in become swatches, and that art's colors count toward the document's color mode, as a pattern's do; a spot color that the page's art, a pattern or a symbol also defines keeps the value defined there. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. When the file opens from its layers, the spot colors in the art of each brush that comes in become swatches, and that art's colors count toward the document's color mode, as a pattern's do; a spot color that the page's art, a pattern or a symbol also defines keeps the value defined there. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip (a frame whose options set key 6 to true keeps their defaults), and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the distance from the path under Align to Path comes from VectorCraft's font metrics, and on Arial at 24 pt it differs from the distance the file keeps by 1.1 pt (Ascender), 0.3 pt (Center) and 2.7 pt (Descender); the fit under Gravity does not reproduce the file's layout, and its glyphs can lie up to 7.4 pt from the positions the file keeps; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip (a frame whose options set key 6 to true keeps their defaults), and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the distance from the path under Align to Path comes from VectorCraft's font metrics, and on Arial at 24 pt it differs from the distance the file keeps by 1.1 pt (Ascender), 0.3 pt (Center) and 2.7 pt (Descender); the fit under Gravity does not reproduce the file's layout, and its glyphs can lie up to 7.4 pt from the positions the file keeps; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip, and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the distance from the path under Align to Path comes from VectorCraft's font metrics, and on Arial at 24 pt it differs from the distance the file keeps by 1.1 pt (Ascender), 0.3 pt (Center) and 2.7 pt (Descender); the fit under Gravity does not reproduce the file's layout, and its glyphs can lie up to 7.4 pt from the positions the file keeps; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; type on a path keeps its frame's Type on a Path effect, Align to Path and Flip, and the first frame's Spacing is fitted from the file's layout, not read from the dialog's value; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). Objects in a symbol defined before the file's art styles section, as newer files write it, take the same styles as the layers' objects. A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
+the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing), Pucker & Bloat at 0 or Bas Relief (read from its settings block: [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646)) comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic or Art one, a Calligraphic brush with settings of its own or an angle that follows the path, or an Art brush other than the ones described next comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372), and so does a path with an Art brush, whose weight scales the art across the path, when all of these hold: the brush stretches its art along the path, unflipped, at 100% in Tints; the path's settings are the brush's own, with no entry that isn't read, no variable width and no effects; its stroke isn't a swatch; and the art is paths, compound paths and groups in solid fills, with no strokes, masks or effects, and has some length along the path. A stroke takes the brush the Brushes panel keeps under its name, and one whose name the panel doesn't keep comes in as its drawn look. Type with an Art brush keeps its drawn look under the type. A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack (an Art brush aside), so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its detail, smoothness and light direction from its settings block, or the effect's defaults when the style holds no settings block; a settings block that isn't read keeps the drawn look) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`<Layer>` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard.
 
+A run of type in the editing data whose baseline direction is 1 opens with Standard Vertical Roman Alignment (https://helpx.adobe.com/illustrator/using/formatting-asian-characters.html) on, which is VectorCraft's own mapping: its half-width characters stand upright in vertical type, and horizontal type keeps the mark with no change to its layout. A run whose baseline direction is 2 or 3 (Tate-chu-yoko), or that names none in the run, its character style or the document's defaults, opens with it off. The scripting reference lists 1, 2 and 3 as the Standard, vertical rotated and Tate-chu-yoko baseline directions (https://web.archive.org/web/20170621180804/https://wwwimages.adobe.com/content/dam/Adobe/en/devnet/illustrator/sdk/CC2015_3/Illustrator%20VBScript%20Reference.pdf, page 256).
 A Scatter brush in the editing data whose last 15 numbers start with 1 comes into the Brushes panel in Tints. Each brush art section is read without its frame: an unnamed, unpainted rectangle with no settings of its own at the art's bounds (within 1/1000 pt), closed, or open with its first corner again at the end. A wider frame stays in the art, and an art group with a state or look of its own (hidden, locked, isolated, knockout, an opacity, a blend mode, a name, a mask, a note or an appearance) stays a group.
 
+An object in a pattern's art or in a brush's art takes the file's art styles in the same way as an object on a layer: with a style VectorCraft reads, it comes in as itself with its effects live, not as the look it draws. An object in a pattern's art with a style in the file's style list keeps that graphic style's id. An art styles section inside a symbol's, a pattern's or a brush's art is skipped.
+
 ## Format by format
 
 | Format | Illustrator | Ours: open/place | Ours: save/export | Fidelity and tests |
@@ -265,7 +289,7 @@ A Scatter brush in the editing data whose last 15 numbers start with 1 comes int
 | Word `.docx` | place | place (area type with the document's styles and its fonts, size, bold, italic, underline, strikethrough, caps, superscript and subscript, color, alignment, indents and paragraph spacing) | no | `tests/textimport.rs`, `place/docx.rs`; fuzzed (`text_import_fuzz.rs`); list numbers, pictures and text boxes are left out |
 | Word `.doc` | place | place (area type with the same formatting as `.docx`, from the style sheet's styles and direct formatting; Word 97 and later) | no | `tests/textimport.rs`, `place/doc.rs`; fuzzed (`text_import_fuzz.rs`); pictures, headers, footers, notes, comments and text boxes are left out with a warning; encrypted and fast-saved documents are refused |
 | CSS | export (CSS Properties) | — | yes | |
-| OBJ / USDA / glTF | 3D export | — | no | needs 3D (gap G3) |
+| OBJ / USDA / glTF | 3D export | — | yes, also USDZ (a 3D asset of Asset Export: `assets.add3D`, `assets.export3D`) | each solid of an object with Extrude & Bevel, Revolve, Inflate or Rotate is a triangle mesh of its faces before projection, at the object's 3D rotation, y up, with a two-sided material in its paint's color; glTF 2.0 is one `.gltf` with its buffer embedded, in meters; USDA and OBJ are in points (USDA says its `metersPerUnit`), OBJ with an `.mtl`; USDZ stores the USDA uncompressed on a 64-byte boundary; tests in `crates/three-d/src/mesh/tests.rs`, `crates/engine/src/cmd/fileio/mesh3d/tests.rs` and `crates/engine/src/tests/assets_3d.rs` |
 | Affinity `.af`, `.afdesign`, `.afpub` | no | yes (beyond Illustrator) | no (#665) | 51 pinned files, [affinity-validation.md](affinity-validation.md) |
 | Clipboard: PDF, SVG, PNG, EMF, text | yes | yes | yes | copied files paste as art; cells copied from a spreadsheet (tab-separated text) paste as a table of point type over gridlines, at most 1000 rows, 256 columns and 20,000 cells (#5296) |
 
diff --git a/docs/gaps.md b/docs/gaps.md
index a73d82c73..40626920f 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -624,9 +624,9 @@ from G14 and the budget run of G15: **~170–270 h** one agent, ~50–80 h wall
   as a `.vectorcraft` library into the user library folder (listed under User Defined) or a file
   (`brush.libraries`, `brush.addFromLibrary`, `brush.saveLibrary`, `brush.loadLibrary`).
 - **Missing:** the Art brush's Overlap; more built-in brush, symbol and graphic-style libraries (original,
-  generated in code, never Adobe's); dynamic symbols' on-canvas editing (Direct Selection of an object inside a
-  dynamic instance, with the Fill/Stroke controls and Appearance panel then setting its change) and their `.ai`
-  read and write; Global Edit of groups holding type or
+  generated in code, never Adobe's); dynamic symbols' on-canvas editing beyond a solid fill and stroke on a path,
+  compound path or type object inside a dynamic instance (Direct Selection selects it, and the Fill/Stroke controls set
+  its change) and their `.ai` read and write; Global Edit of groups holding type or
   images, rotated copies as matches, Shift-click to leave a match out and highlighting matches before the start;
   9-slice guides outside the symbol's art (a dragged guide stops at the art's edge).
 - **Estimate:** 14–24 h.
@@ -637,7 +637,7 @@ from G14 and the budget run of G15: **~170–270 h** one agent, ~50–80 h wall
   Extrude & Bevel, Inflate and Rotate with Position presets ([three-d.md](three-d.md), #1407). Colored Inflate has automatic smooth vector lighting from shared membrane normals. White-light Inflate keeps its existing appearance. All four take one to ten colored directional lights, with neutral ambient applied once, a light list and independent previewing controls. Standard, Diffuse, Top Left and Right select original rigs, shared with commands; manual settings show Custom.
 - **Missing:** materials (base, Substance, graphics), shadows,
   ray-traced rendering, angular cut caps, exact visibility for intersecting and concave surfaces, 3D Classic,
-  Turntable, 3D export (OBJ, USDA, glTF).
+  Turntable, textures, map art and shading in 3D export.
 - **Impact:** specialist; Materials is the one menu stub left.
 - **Estimate:** 25–45 h; plan in `plan/` before coding.
 
diff --git a/docs/mcp.md b/docs/mcp.md
index 539cf7b72..38feff6f4 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -106,7 +106,7 @@ the suite) keep the agent to the folders you give it:
 
 - Every file a command reads must lie inside a **read root**: `open_file`, `file.place`, relinking and
   updating links, the images an SVG links to, swatch library, graphic style library, symbol library, brush library and colour-profile loads, plug-ins,
-  `file.newFromTemplate`, preset imports, shortcut sets (`shortcutSet.read`), the folders `text.findFontFiles` and `links.findFiles` search, the
+  `file.newFromTemplate`, preset imports, shortcut sets (`shortcutSet.read`), action sets (`actionSet.read`), the folders `text.findFontFiles` and `links.findFiles` search, the
   scripts `script.check` reads and the files they include.
 - Every file a command writes must lie inside a **write root**: `save_file`, `export`, the save and
   export commands, Export for Screens, Package, Export for Web, print to file, `screenshot {path}`,
@@ -464,7 +464,7 @@ opens the picker through `run_command` with the remote backend.
 | `open_file` | `{path}` | Opens any readable file as a new active document: `.vectorcraft`/`.drawcraft`, `.vctemplate`, `.svg`/`.svgz`, `.pdf`/`.ai`, `.ait`, `.eps`/`.epsf`, `.ps`, `.dxf`, `.emf`, `.wmf`, PNG (`.png`/`.pns`), JPEG, GIF, WebP, TIFF, BMP (`.bmp`/`.dib`/`.rle`), Targa (`.tga`/`.vda`/`.icb`/`.vst`), PCX, Pixar (`.pxr`), JPEG 2000 (`.jpf`/`.jpx`/`.jp2`/`.j2k`/`.j2c`/`.jpc`), PSD (`.psd`/`.pdd`)/PSB (an image opens as a document of its pixel size; a Photoshop file as its merged image). Templates (`.vctemplate`, `.ait`) open as a new untitled document. PDF, `.ai` and SVG files saved with Preserve Editing reopen as the document they carry. The reply is `document.open`'s: its `warnings` say what didn't come in as it was (an EPS whose PostScript can't be read opens as its preview, and the warning names the PostScript error, the operator and the procedure). `run_command document.formats` lists the formats. |
 | `save_file` | `{path?, compress?, version?, preview?, precision?, options?}` | Runs `document.save`: the document's own file in its own format (native `.vectorcraft` unless it was opened from or saved as SVG, PDF or a restorable `.ai`; then `warnings` say what that format loses). A path's extension picks the format (`.vectorcraft`, `.vctemplate`, `.pdf`, `.svg`, `.svgz`, `.ai`: a PDF carrying the native document, which reopens editable). For a native file, `compress: true` gzips it (default: the `useCompression` preference, Preferences › File Handling › Use Compression), `version` (1 to 4) writes it for an older VectorCraft (1 and 2 are never compressed, and `version: 2` with `compress: true` is an error), `preview: true` embeds a PNG of the first artboard, and `precision` (0 to 9) rounds path anchors and handles to that many decimal places for that save only (colors, transforms and type stay exact). `options` passes the format's save options as `run_command document.formats` lists them. When `compress`, `version`, `preview` or `precision` is given both at the top level and in `options` with different values, the call is an error (`` `compress: true` and `options.compress: false` disagree: give the option once ``) and nothing is written. The save drops each option the written format doesn't read. The reply's `warnings` then name each such option given (for example `` `compress` was not used: SVG files don't read it `` for an `.svg` path, and `` `options.preview` was not used: … `` for a key in `options`; a `.ai` file reads `compress` but not `version`, `preview` or `precision`). For a `.ai` file, these warnings name the kind of `.ai` written: a legacy .ai (version 7) for `aiVersion: "7"`, a non-PDF-compatible .ai for `pdfCompatible: false`, and a PDF-compatible .ai otherwise, including a save that reuses the options the document was last saved with. `run_command document.save` and the other save commands refuse any option given beside the path and in `options` with different values, and give the same warnings for a top-level `compress`, `version`, `preview` or `precision` and for each key in `options` that the format doesn't read. The headless session and the app receive the same `app.save` params, and the app is also sent `wait: true`: the call returns once the file is written, or with the error (such as a path outside the write root), even with Background Save on. When the save asks first (the question before replacing a file that opened with losses, or on macOS and Linux the file dialog for an untitled document without `path`), the reply is `{pending}` or `"cancelled"` as before, and the save that runs after the answer uses the Background Save preference. |
 | `export` | `{path?, format?, scale?, artboard?, range?, selection?, outlineText?, options?}` | `svg`, `svgz`, `pdf`, `ai` (the PDF-compatible `.ai` that Save writes, which carries the document when every artboard is written in order), `eps`, `dxf`, `emf`, `wmf`, `png`, `jpg`, `webp`, `gif`, `png8` (an indexed `.png`), `tiff`, `bmp`, `tga`, `psd` (layered), `txt` (the document's text), `vectorcraft` or `template` (a native template). The tool's `format` enum and `document.formats` list them, generated from the engine's format table. When `format` is omitted, it comes from the path's extension. PDF and `.ai` write one page per artboard: all of them, or `artboard` (0-based) / `range` (`"1-3, 5"`, 1-based). SVG and SVGZ write one file per chosen artboard. EPS writes one file of the visible art; with `artboard`, `range`, `options.artboards` or `options: {"useArtboards": true}` it writes one file per chosen artboard, after a central file of the visible art when there are two or more, and `useArtboards: false` keeps the one file. Rasters, DXF, EMF and WMF write one artboard, or one file per chosen artboard with `options: {"useArtboards": true}`. Rasters also take `options: {"rect": [x, y, width, height]}` (page points, y down): that area of the page at the given `ppi`/`scale`, without an artboard and without changing the document; it is refused with `artboard`, `artboards`, `range` or `useArtboards`, with a non-positive or non-finite size, and for non-raster formats. `options` carries more format options (e.g. `{"quality": 80}` for JPEG). `selection: true` exports the selected objects cropped to their bounds (the reply adds their `bounds`, and reports `format` and the encoder's `warnings` as a whole-document export does); `outlineText: true` writes SVG text as paths. Template layers are left out, live effects are kept, and exporting `vectorcraft` never changes the document's path. Without `path` the bytes come back as `dataBase64`. Both backends run the same `document.export` call. |
-| `add_text` | `{text, x?, y?, width?, height?, fit?, fitMinPercent?, path?, mode?, pathEffect?, size?, font?, color?, justify?, vertical?}` | Point type at (x, y) (`justify`: `left`, `center` or `right` starts, centres or ends each line on x); area type with `width`/`height` (`fit`: `none`, `autoHeight`, `shrinkText`, as `text.areaOptions`); or `path` + `mode` (`area`/`onPath`) to flow text in or along a path, with `pathEffect` (`rainbow`, `skew`, `3dRibbon`, `stairStep`, `gravity`); `justify` (also `auto`, `justifyAll`) aligns the paragraphs of every kind, as `text.setStyle` does later. `vertical: true` uses the existing vertical writing mode for every kind (default `false`, horizontal). Returns `{id}`, with `overflow: true` when the text doesn't fit its frame or path. |
+| `add_text` | `{text, x?, y?, width?, height?, fit?, fitMinPercent?, path?, mode?, pathEffect?, size?, font?, color?, justify?, vertical?}` | Point type at (x, y) (`justify`: `left`, `center` or `right` starts, centres or ends each line on x); area type with `width`/`height` (`fit`: `none`, `autoHeight`, `shrinkText`, as `text.areaOptions`); or `path` + `mode` (`area`/`onPath`) to flow text in or along a path, with `pathEffect` (`rainbow`, `skew`, `3dRibbon`, `stairStep`, `gravity`; SVG export writes type on a path with any effect other than `rainbow` as outlines, with a warning); `justify` (also `auto`, `justifyAll`) aligns the paragraphs of every kind, as `text.setStyle` does later. `vertical: true` uses the existing vertical writing mode for every kind (default `false`, horizontal). Returns `{id}`, with `overflow: true` when the text doesn't fit its frame or path. |
 | `apply_effect` | `{effect?, params?, ids?}` | Appends a live effect. Without `effect`, returns the effect catalogue with parameters and defaults. |
 | `pathfinder` | `{operation, ids?}` | `unite`, `minusFront`, `intersect`, `exclude`, `divide`, `trim`, `merge`, `crop`, `outline`, `minusBack`. For a live version, apply the `pathfinder.*` effect to a group (`effect.apply` groups several loose selected objects first). In remote desktop mode, `run_command` and `invoke_menu` can both call `pathfinder.repeat` with `{}`. Successful panel operations, direct `object.pathfinder.*` commands, and `command.batch` steps (including Actions panel playback) set its history. Repeat applies it to the current selection using current Pathfinder Options. Trap, compound-shape edits, live effects and `action.batch` do not set history. With no history it returns "no Pathfinder operation applied yet". |
 | `transform` | `{ids?, dx?, dy?, rotate?, scale?, scaleX?, scaleY?, reflect?, shear?, origin?, copy?}` | Runs move, rotate, scale, reflect, shear in that order. With `copy`, the first step duplicates. |
@@ -566,18 +566,23 @@ stroke instead of the whole object: `run_command effect.apply {"effect": "path.o
 
 On a path directly inside a graph series, `appearance.setItem`, `appearance.addFill`, `appearance.addStroke`,
 `appearance.removeItem`, `appearance.moveItem`, `appearance.duplicateItem`, `appearance.clear`,
-`appearance.reduceToBasic`, `appearance.showAllHidden`, `appearance.transfer` and `appearance.copyFrom` store the paint,
-weight and opacity of the topmost visible fill and stroke on the graph. When the graph is drawn again, columns, bars,
-wedges, areas, markers and legend swatches take the stored fill and stroke. A thin line takes the stored stroke and has
-no fill. A Filled Lines band takes the stored fill, or the stored stroke when no fill is stored and that stroke has
-paint, and has a 0.25 pt black outline, so these commands do not store a stroke paint or weight for a series that
-draws a band. They still store a stroke opacity set on a band, and the band's outline takes it. Graph
-designs keep their own paint. A row that had no paint before the command and has none after it does not change what the
-graph stores. `paint.setFill`, `paint.setStroke`, `paint.none` and the commands that apply one paint kind to the other
-store the topmost row of the kind even when it is hidden, and store a stroke set on a band.
-`stroke.set`, `paint.editGradient`, `paint.swap`, `paint.default`, graphic styles and the recolor commands do not store a
-series' paint. An `appearance.*` command given a series group's id edits the group's own rows, and the graph does not
-store them.
+`appearance.reduceToBasic`, `appearance.showAllHidden`, `appearance.transfer`, `appearance.copyFrom`, `paint.default`,
+`graphicStyle.apply` and `graphicStyle.redefine` (on the marks still linked to the style) store the paint, weight and
+opacity of the topmost visible fill and stroke on the graph. `graphicStyle.apply` with `add` stores only the kinds of row
+that are visible in the style. `paint.swap` stores the swapped paints and the stroke weight, keeps the stored opacity,
+and does not store a hidden topmost row that it swaps. The graph does not store the rest of a graphic style's look (more
+fill and stroke rows, effects, the object's opacity and blend mode, and the link to the style), and a mark loses it when
+the graph is drawn again. When the graph is drawn again, columns, bars, wedges, areas, markers and legend swatches take
+the stored fill and stroke. A thin line takes the stored stroke and has no fill. A Filled Lines band takes the stored
+fill, or the stored stroke when no fill is stored and that stroke has paint, and has a 0.25 pt black outline, so these
+commands do not store a stroke paint or weight for a series that draws a band. Except for `paint.swap`, they still store
+a stroke opacity set on a band, and the band's outline takes it. Graph designs keep their own paint. A row that had no
+paint before the command and has none after it does not change what the graph stores. `paint.setFill`,
+`paint.setStroke`, `paint.none` and the commands that apply one paint kind to the other store the topmost row of the kind
+even when it is hidden, and store a stroke set on a band. `stroke.set`, `paint.editGradient` and the recolor commands do
+not store a series' paint. An `appearance.*` command or `graphicStyle.apply` given a series group's id, and
+`graphicStyle.redefine` on a series group linked to the style, edit the group's own rows, and the graph does not store
+them.
 
 `effect.apply {"effect": "path.outlineObject"}` (Effect › Path › Outline Object) takes no parameters. Type that carries
 it is drawn, exported and expanded as its glyph outlines and stays editable type, and the effects after it reshape
@@ -592,7 +597,8 @@ global or spot swatch follow its colour and name, as one undo step, in the art,
 designs, pattern tiles, graphic styles and the art of brushes); `swatch.delete {names, unlink?}` deletes
 swatches and colour groups in one undo step (art using a deleted global swatch keeps its colour, unlinked).
 `swatch.new {color?, mode?, spot?, global?, group?}` saves a colour (into a colour group with `group`), gradient
-or pattern; `swatch.newGroup {fromArtwork: true, toGlobal?, includeTints?}` makes a colour group of the selected
+or pattern (a gradient swatch holds no link to the swatch its gradient came from, and a pattern swatch holds the
+pattern untransformed); `swatch.newGroup {fromArtwork: true, toGlobal?, includeTints?}` makes a colour group of the selected
 art's colours (by default as global swatches the art links to).
 `swatch.move {names, to?, group?}` reorders swatches or moves them into or out of a colour group (as dragging
 them in the Swatches panel does); give colour group names instead to reorder the groups. Dropping a swatch on art
@@ -1790,7 +1796,35 @@ already walks Image Trace. Short agent entry points:
   root; `[1, 0]` is the first object of the art's second member when that member is a group). `fill` and `stroke` take
   a colour string or the paint params of `paint.setFill` (`color`, `none`, `swatch`, `tint`, `gradient`), `opacity` is
   0..100 and `blend` a blend mode name; `null` gives one back to the symbol. It is refused for a static symbol and for
-  a path that names no object. `symbol.instance.reset {ids?}` drops the selected instances' changes (the Properties
+  a path that names no object. On the canvas (VectorCraft's own rule), a Direct Selection click on an instance of a
+  dynamic symbol selects the path, compound path or type object of its art under the pointer and outlines it
+  (`symbol.instance.selectPart {id, path}`; Alt or Shift selects the instance whole). While it is selected,
+  `paint.setFill` and `paint.setStroke` with a solid color or none, `paint.invert` and `paint.complement` on a solid
+  color, all without `ids`, `id` or `item`, and the Eyedropper's `appearance.copyFrom` with a solid fill and stroke
+  change that object's fill or stroke for this instance only, each as one undo step. A painted stroke on type without a
+  weight gets 1 pt. A gradient or pattern for the object is refused with a status message, and so are `paint.invert` and
+  `paint.complement` on type whose characters differ in color, Eyedropper options that pick up neither color, an
+  Eyedropper source that is not a path, compound path or type (a symbol instance or a group, for which the paint defaults
+  stay as they are too), and a click
+  or `symbol.instance.selectPart` on any other object of the art (a group, image, blend or nested instance among them).
+  The commands that change the selected objects without `ids` are refused the same way and change nothing, among them
+  opacity and blending mode, moving and transforming, `path.moveAnchors`, `file.place` with `replace`, Puppet Warp, Delete
+  and Cut, Group, Hide, Lock, Arrange, Expand,
+  Recolor Artwork, plug-in filters, effects, the gradient commands, `gradient.selectStop`, the Appearance panel's rows and
+  `symbol.instance.setAppearance`. A Cmd-drag that lends the Selection or Group Selection tool selects the instance whole
+  first and moves it. `swatch.unused` and `recolor.colors` count the fills and strokes an instance keeps for objects of its
+  art. Commands that change nothing in the document, such as `attributes.info`, `css.selection`, `css.export`,
+  `effect.list` and `object.expand.info`, read the instance. These commands do not check for a selected object and use the instance:
+  `edit.copy` copies the instance whole; `document.exportSelection`, `document.export` with `selectionOnly` and
+  selection-mode `document.exportForScreens` export it whole; `artboard.fitToSelection` fits the artboard to the whole instance;
+  `object.liquify` without `ids` takes the instance as its target and, since it reshapes paths only, leaves it as it is
+  and lists it in `skipped` when the brush reaches it; `object.isolate` without `id` isolates the instance and clears the
+  selection; `library.add` without `ids` adds a copy of the whole instance as a `graphic`, and its fill and stroke kinds
+  read the instance rather than the selected object; `select.save` saves the instance, and `select.recall` then selects it
+  whole. Direct Selection passes over hidden, locked and template objects of the art, and
+  `symbol.instance.selectPart` refuses a path to one or to an object inside one, and an instance that is hidden or
+  locked or sits in a hidden or locked group or layer. Choosing another selection tool selects the instance whole again.
+  `symbol.instance.reset {ids?}` drops the selected instances' changes (the Properties
   panel's Reset). Redefining the symbol (`symbol.update`) reshapes every instance and keeps each change whose path the
   new art still has; `symbol.breakLink` bakes the changes into the expanded art; `symbol.edit` edits the symbol's own
   art, and each edit there keeps the changes whose path the art still has; making the symbol static drops them, and
@@ -1945,7 +1979,8 @@ already walks Image Trace. Short agent entry points:
   instead of playing the excluded steps or failing at a stop; other files use version 1. A file with another `format` or a `version` other than
   1, 2 or 3, a stop whose message is not text or whose `allowContinue` is not true or false, a file larger than 8 MiB, one with more than 1,000 actions and one with an action of more than 10,000 steps are
   refused, and no set is added. The Actions panel menu's Save Actions… and Load Actions… run these; Load Actions… is
-  disabled where there is no open dialog (the web).
+  disabled where there is no open dialog (the web). `ui.actionSet.load` also reads the action sets other apps save as
+  text (`.aia`); see "Action sets from other apps".
 - Actions: `ui.action.rename {set, action, name}` renames the Actions panel's action at `action` in set `set` (0 is
   the top set) to `name` with spaces trimmed from both ends, keeps its steps, function key and color, and returns
   `{name}`. An index past the last set or action, or an empty name, is an error, and then nothing is renamed.
@@ -3142,6 +3177,62 @@ it. The native format keeps the events and the files.
 {"name":"run_command","arguments":{"command":"svgInteractivity.addFile","params":{"file":"menu.js"}}}
 ```
 
+## SVG filters
+
+Effect › SVG Filters lists the document's SVG filters below Apply SVG Filter… and Import SVG Filter…; choosing one
+applies it to the selection. `svgFilter.list {}` returns them as `filters: [{name, xml}]`. Each is one `<filter>`
+element whose `id` is its name, with 1 to 64 primitives and at most 64 KB of XML (`feTurbulence` octaves up to 10,
+`feConvolveMatrix` kernels up to 9 cells a side, `feMorphology` radii and `kernelUnitLength` up to 100 and
+`stdDeviation` up to 500 user units, elements nested at most 16 deep). It holds only filter primitives,
+what they hold, and `desc` and `title`: no scripts, no event attributes, and images only as PNG, JPEG, GIF or WebP
+`data:` URLs of at most 4096 × 4096 pixels. A document
+holds at most 64. `svgFilter.define {xml, replace?}` adds
+a filter after the others, or with `replace` replaces the filter of that name, which keeps its name; a name another
+filter has is refused, and the same filter again records no undo step. `svgFilter.delete {name}` removes one, and `svgFilter.import
+{path?|svg?}` adds the `<filter>` elements of an SVG file (at most 16 MB, not SVGZ, the first 256 filters) or of SVG text, leaving out the names the
+document already has and the filters `svgFilter.define` would refuse (`{added, skipped}`). Each change is one undo
+step. `svgFilter.apply {name, ids?|id?, item?}` applies one as the live effect `svg.filter`, as `effect.apply` does,
+in one undo step. The effect (`{name, xml, scale, origin}`) names the document's filter: editing the filter changes
+what every object that uses it draws, in the edit's one undo step, and an application after an edit takes the edited
+filter. Deleting a filter that objects use leaves their effects in place, still named, drawing nothing (their `xml`
+empty) until a filter of that name is defined or imported again. Opened from such an effect, Apply SVG Filter shows the
+name above the list, not selectable. `effect.apply {effect: "svg.filter", params: {xml}}` takes a filter
+directly and names it by its `id`; an `xml` that isn't one such filter is an error. `ui.svgFilterDialog {}` opens Apply
+SVG Filter (New, Edit, Delete, Import…), and from the Appearance panel it edits which filter an applied effect runs;
+`ui.importSvgFilter {}` picks an SVG file and imports its filters.
+
+The canvas, raster export, printing and PDF draw the filter with the object as its source graphic, its user space
+starting at `origin` (`[x, y]` in points, `[0, 0]` by default) with its units `scale` points (1 by default), its
+object bounding box the drawn object's, and at the Document Raster Effects resolution when the view is finer. The
+filter runs on coarser pixels when a morphology radius or kernel unit would span more than 32 of them, or a standard
+deviation more than 512. An effect whose XML these rules refuse (from a file or a script) is not drawn or exported. The
+filter is drawn and written rebuilt from its filter elements and their filter attributes alone, without comments,
+text, descriptions or other attributes. An image in a filter is drawn only when its bytes are a PNG, JPEG, GIF or WebP
+within the pixel limit. A filter region in user space given in percentages is measured against the object's box (x
+and y from its top-left corner), and one in em or ex or left out takes the default region of that box (10% beyond
+each side); these are VectorCraft's own rules. Scale Strokes & Effects scales
+`scale`. SVG export writes the filter as a `<filter>` element when it is the object's last effect, its only pixel
+effect and `scale` is 1 (with a region measured against the object's box, its only raster effect), with the object in a
+group that places the filter's user space and such a region written in user units. The filter is written in SVG 1.1
+terms: `feImage`'s reference as `xlink:href`; each `feDropShadow` as the blur, offset, flood, composite and merge that
+[Filter Effects](https://www.w3.org/TR/filter-effects-1/#feDropShadowElement) gives as its equivalent; colors as
+`#rrggbb` with a flood color's alpha in `flood-opacity`; `image-rendering` as `optimizeSpeed` or `optimizeQuality`;
+the inputs `BackgroundImage`, `BackgroundAlpha`, `FillPaint` and `StrokePaint` as `SourceGraphic`, and an input that
+names no earlier result as the previous primitive's result;
+and an `feComposite` operator SVG 1.1 lacks, or `edgeMode` on a primitive other than `feConvolveMatrix`, left out, as
+the canvas draws them. A filter with an `feBlend` mode SVG 1.1 lacks (`overlay` and the others), an `feDropShadow`
+whose `flood-color` is `currentColor` or with `primitiveUnits="objectBoundingBox"`, or more than 64 primitives once
+its shadows are expanded, has no SVG 1.1 form. In that case, otherwise, and with the SVG Tiny 1.2 profile, the object
+becomes an image. SVG import keeps a filter that the live effects (Drop Shadow, the
+glows, Gaussian Blur, Feather) can't express as an `svg.filter` effect holding the filter's XML, with `scale` and
+`origin` from the object's user space, unless that user space is turned, skewed or scaled past 0.001 to 1000 points
+to a unit, or the filter is styled by the document's style sheets: such a filter is left out with a warning. The native format keeps the document's filters and the effects.
+
+```json
+{"name":"run_command","arguments":{"command":"svgFilter.define","params":{"xml":"<filter id=\"Soft\"><feGaussianBlur stdDeviation=\"2\"/></filter>"}}}
+{"name":"run_command","arguments":{"command":"svgFilter.apply","params":{"name":"Soft","ids":[12]}}}
+```
+
 ## Removing anchor points
 
 `path.removeAnchors {}` (Object › Path › Remove Anchor Points) removes the direct-selected anchors (`select.anchors
@@ -3395,6 +3486,56 @@ Absolute target, so it leaves objects that already have that size as they are; r
 {"name":"run_command","arguments":{"command":"object.transformEach","params":{"relative":false,"scaleH":50,"scaleV":50}}}
 ```
 
+## Align to Pixel Grid
+
+`object.setPixelAligned {ids?|id?, on?}` turns the pixel-aligned property of the objects given (default: the selected
+objects) on or off (`on` defaults to true), as the Transform panel's Align to Pixel Grid checkbox does (described on
+the help page,
+<https://helpx.adobe.com/illustrator/desktop/get-started/learn-the-basics/pixel-preview-mode-for-web-graphics.html>).
+It returns `{ids}`, the objects whose property changed. While the property is on:
+
+- The object's horizontal and vertical straight segments sit on whole points, or on half points when a stroke centered
+  on the path has an odd weight, so that the stroke's edges fall on the pixel grid. A stroke that is hidden or has no
+  paint does not count. Its stroke weights are whole points, at least 1.
+- Every move, scale, rotation, reflection, shear, Transform Each, Align or Distribute move (of objects or of
+  direct-selected anchors), Transform panel change, move of direct-selected anchors or of one anchor
+  (`path.moveAnchor`), new anchors from `path.setAnchors`, live shape change (`object.setLiveShape`), move of a
+  compound path's path on its own, and artboard move or resize that carries the art (`artboard.move` with
+  `moveArt`, `artboard.setProps` with art, Rearrange Artboards) snaps those segments again, as do the art copies of `artboard.move` with `copy` and Duplicate
+  Artboards, the copies that `edit.duplicate` and the paste commands move, and `object.slice.move` of an object slice,
+  and so does every `stroke.set`, `stroke.weightUp` and `stroke.weightDown` edit, which also rounds the new weight. An
+  appearance edit that adds, removes, hides, repaints or reweighs a stroke snaps them again too:
+  `appearance.setItem`, `appearance.addStroke`, `appearance.removeItem`, `appearance.clear`,
+  `appearance.reduceToBasic`, `appearance.showAllHidden`, `appearance.transfer` (both objects), `appearance.copyFrom`
+  (the Eyedropper), `paint.setStroke` and `graphicStyle.apply`, in the same undo step as the edit, as is every member
+  of an active Global Edit that such an edit or move reaches. Every other command that changes a pixel-aligned object
+  (for example Object › Path › Average) snaps it again as part of its undo step. Each anchor that such a segment shares moves with its handles, so diagonal segments and curves keep their shape apart from those
+  anchors. A rotated shape with no horizontal or vertical segment is left as it is. Pixel-aligned art of a linked
+  opacity mask snaps when its object moves.
+- Coordinates that differ stay at least 1 pt apart within a subpath, so a narrow shape does not collapse. A
+  coordinate on a whole point snaps to the half point above it and one on a half point to the whole point below it, so
+  hiding and showing an odd stroke returns the path to where it was. A placed gradient and the art of a linked opacity
+  mask move with the snapped anchors, and so do pattern tiles when the move transforms patterns. A pixel-aligned member
+  of an Objects on Path group snaps again after the group places it on its path.
+- A live rectangle, polygon, line or pie is moved and scaled as a whole to the snapped bounds, and stays live. A full
+  ellipse has only curves and is left as it is. A path with Live Corners snaps the outline its corners are cut from and keeps
+  its Live Corners. A compound path snaps each of its paths with the compound path's stroke.
+- Make Compound Path from paths or compound paths that include a pixel-aligned one gives a pixel-aligned compound path
+  and snaps it; its paths do not keep the property, and a path inside a compound path cannot take it alone (an error).
+  Release Compound Path gives each released path the property of the compound path. A path pasted into a compound
+  path, alone or from a pasted compound path, drops its own property and snaps with the compound path.
+
+Turning the property on snaps the objects at once; turning it off keeps their geometry. These rules are VectorCraft's
+own: only paths and compound paths can be aligned, and type, images, groups, guides and other objects are an error
+that leaves the document as it was. The change is one undo step, and when every object already has the value nothing
+changes and no undo step is made. The property is saved in the native file (`pixel_aligned` in `document.node`), and
+files saved without it read back with it off.
+
+```json
+{"name":"run_command","arguments":{"command":"object.setPixelAligned","params":{"on":true}}}
+{"name":"run_command","arguments":{"command":"object.setPixelAligned","params":{"ids":[12],"on":false}}}
+```
+
 ## Live Corners
 
 `object.setLiveShape {id?, ids?, radius?, kind?, corners?, items?}` sets the corners of any path (one undo step): a live
@@ -4153,6 +4294,15 @@ selects them. `edit.paste {artboardsAt: [x, y]}` instead centers the copied artb
 value that is not `[x, y]` fails with `` `artboardsAt` must be [x, y] ``. `artboard.duplicate {index? | indices?, art?}` does the same in one step → `{index, indices, ids}`.
 Window › Artboards › Duplicate Artboards passes the selected artboards (those the Artboard tool has selected, else the
 active one) as `indices`, and a row dragged onto New Artboard passes its artboard as `index`.
+`artboard.new {beside?, side}` adds an empty artboard the size of artboard `beside` (default: the last), 20 pt from
+that side of it, and `artboard.duplicate {index, side}` puts the copies there instead, together as they lay on that side
+of the artboards they copy; `side` is `"left"`, `"right"`, `"top"` or `"bottom"`. Another `side` fails with
+`` `side` must be "left", "right", "top" or "bottom" ``, `beside` without `side` fails with `` `beside` needs `side` ``,
+and `artboard.new` refuses `side` given with `x`, `y`, `width` or `height`; each leaves the document and its undo
+history as they were. With the Artboard tool and one artboard selected, a button with a plus shows just outside the
+middle of each edge where an artboard of the same size fits on that side (within the canvas and overlapping no other
+artboard): a click runs `artboard.new {beside, side}`, an Alt-click `artboard.duplicate {index, side, art: true}`, and
+the new artboard becomes the active one. An Alt-click on a locked artboard's button does nothing.
 `artboard.move {copy: true, moveArt: true}` is the Artboard tool's Alt-drag. `artboard.duplicate` and `artboard.move`
 also move the pattern tiles of the copies when `patterns` is true (default: prefs `transformPatternTiles`);
 `edit.paste` leaves the tiles of a pasted artboard's art where they were.
@@ -4649,8 +4799,12 @@ and every stroke a line. `alterPaths` writes as filled outlines those strokes (w
 wider than the widest lineweight (2.11 mm), and every stroke in R13 and R14, which have no lineweights; it keeps other
 strokes as lines. `outlineText` outlines type, `selectedOnly` writes only the
 selected objects in their layers (every export takes it), and `useArtboards: true` writes one drawing per chosen
-artboard holding the art over it. What DXF can't hold (gradients and patterns as one colour, blending, opacity masks,
-raster effects, clipping) comes back in `warnings`. In R13 and later, an image that can't be decoded is left out with
+artboard holding the art over it. `dxfPreset: "cnc"` (CNC / CAM; default `"custom"`) sets the options for cutting
+software that the call does not give: version `2000` (the oldest version that has both lightweight polylines and lineweights), `unit:
+"mm"` and `scale: 1`, `colors: 256` (all version 2000 holds), `preserve: "editability"` with `alterPaths: false` (every
+stroke a center line), `outlineText: true` (type as paths), and `rasterFormat: "png"`. DXF Options has the same choice as its Preset menu,
+which shows Custom again once a field it sets is changed. What DXF can't hold (gradients and patterns as one colour,
+blending, opacity masks, raster effects, clipping) comes back in `warnings`. In R13 and later, an image that can't be decoded is left out with
 no linked file, and `warnings` carries "an image couldn't be decoded and is missing from the picture" once for all such
 images.
 
@@ -4661,6 +4815,7 @@ opened.
 ```json
 {"name":"run_command","arguments":{"command":"document.exportDxf","params":{"path":"/tmp/plan.dxf","version":"2013","unit":"mm","scale":10,"preserve":"editability"}}}
 {"name":"export","arguments":{"path":"/tmp/plan.dxf","options":{"useArtboards":true,"colors":256}}}
+{"name":"run_command","arguments":{"command":"document.exportDxf","params":{"path":"/tmp/sign.dxf","dxfPreset":"cnc"}}}
 ```
 
 ## DXF import
@@ -4976,8 +5131,12 @@ or in `options` (`file.formatOptions {format}` lists them with their values):
 - `includeLinked: true` keeps linked images' own pixels in the file (they stay linked), not just the previews.
 - `embedProfiles` (default true) carries the ICC profiles the document is tagged with that were loaded from files;
   opening the file installs them where they are missing (a warning names one that can't be used).
-- `pdfCompatible`: native files (default false) also carry a PDF of every artboard (`pdf` in the file); `.ai` files
+- `pdfCompatible`: native files (default true) also carry a PDF of every artboard (`pdf` in the file). This makes saves
+  larger and adds PDF rendering work. Set it to false to leave the PDF out; Save remembers that choice. `.ai` files
   (default true) with false write blank pages around the native document (smaller; other apps show empty pages).
+  Native files without artboards and Data Recovery copies omit the PDF.
+  Reopening a native file keeps its saved PDF preference, falling back to whether it declared a PDF in older files.
+  Existing files saved without a PDF remain compact.
 - `.ai` only: `compress` (default true) is the PDF option `compression.compressText`.
 - The editing copy of a `.ai` or `.ait` file (`editingData`) names its active artboard (`CropAreaActive`): the active
   artboard of the app's view when the app saves or exports the file, otherwise the artboard the document opened on (the
@@ -5101,6 +5260,38 @@ renderer measures for what the art draws, its effects included.
 A layer id in `ids` (12 above) is the same as Collect for Export on that Layers row: every object under the layer
 becomes an asset (or one asset with `multiple: false`).
 
+### 3D assets
+
+Asset Export's menu item Export 3D Object (`assets.add3D {ids?, format?}`) collects each selected object (or `ids`)
+that carries Extrude & Bevel, Revolve, Inflate or Rotate as a 3D asset, named after the object; an object already
+collected as a 3D asset keeps it, and an object without such an effect is refused. A 3D asset's Format is `usda` (the
+default), `usdz`, `gltf` or `obj`; the panel shows a Format row for the 3D assets it would export, and
+`assets.set3DFormat {assets, format}` sets it (an undo step only when the format changes). `assets.list` gives each
+asset's `format3D` (null for a picture asset).
+
+`assets.export3D {assets?, folder?, zip?}` writes each 3D asset (default: all of them) as a mesh file named after it:
+`.usda`, `.usdz`, `.gltf` (glTF 2.0, its buffer embedded) or `.obj` with its `.mtl` (whitespace and `#` in an OBJ's
+name become `_`). Every solid of the object (the
+fill's, each stroke's, a group's members') is its own mesh, with a two-sided material in the color it is painted
+(a gradient's stops averaged, a pattern gray). The mesh holds the solid's faces before they are projected onto the
+page, those turned away from the viewer included, at the object's 3D rotation, y up, about the point the object turns
+about: in points (USD's layer gives `metersPerUnit`), in meters in glTF. Files that would share a name get `-2`, `-3` and so on.
+With `zip`, the files go into one ZIP named after the document with `-3D` added (`Untitled-1-3D.zip`), or
+`3D Assets.zip` when the document's title gives no file name.
+An object whose face has a hole that crosses the face's outline or another hole is refused, by `assets.add3D` and
+`assets.export3D` alike, rather than exported with the hole filled. So is an object whose meshes would hold more than
+2,000,000 triangles together, VectorCraft's own limit.
+`assets.export` leaves 3D assets out and refuses one named in its `assets`. On the 3D export page
+(<https://helpx.adobe.com/illustrator/desktop/special-effects-styles/create-3d-graphics/export-3d-vector-artwork.html>)
+the 3D asset's Format is picked in Asset Export, with USDA first; the file layouts follow the glTF 2.0 specification
+(<https://registry.khronos.org/glTF/specs/2.0/glTF-2.0.html>) and OpenUSD (<https://openusd.org/release/index.html>).
+
+```json
+{"name":"run_command","arguments":{"command":"assets.add3D","params":{"ids":[12],"format":"gltf"}}}
+{"name":"run_command","arguments":{"command":"assets.set3DFormat","params":{"assets":[40],"format":"obj"}}}
+{"name":"run_command","arguments":{"command":"assets.export3D","params":{"folder":"/tmp/meshes"}}}
+```
+
 ## CSS Properties
 
 `css.selection {ids?, units?, position?, dimensions?, unnamed?, rasterize?}` returns the CSS web pages style the
@@ -6191,7 +6382,38 @@ permission names, and a `hash` that is not the module's SHA-256. `prefs.set` ret
 changes nothing when a new `pluginsFolder` is missing, is not a folder or can't be listed. It does not check an empty
 value or the folder the preference already holds, and the web build does not check folders.
 
+Safe Mode starts VectorCraft without plug-ins: `vectorcraft --safe-mode`, `vectorcraft-cli --safe-mode <subcommand>`, or
+the choice the desktop app offers when the last launch stopped while a plug-in was loading (Disable and Continue, Start
+Normally, Start in Safe Mode). It names that plug-in without saying it caused the stop. Until the user picks Disable and
+Continue or Start Normally, the next launch asks again, also after a `--safe-mode` launch, which asks nothing.
+`vectorcraft --safe-mode` opens its files in a window of its own, and on Windows and Linux a file opened from the file
+manager while the app is in Safe Mode starts a window with plug-ins. Files given on the command line, or opened from
+the file manager while the choice is up, open after the user picks. On Windows and Linux, when the choice is Start in Safe
+Mode, the files from the file manager open in a new window with plug-ins. `vectorcraft-cli --safe-mode mcp` serves a headless
+session and refuses `--connect`. In Safe Mode no plug-in loads or
+runs: `plugin.install`, `plugin.run`, `plugin.reload` and exporters return an error, and a live-effect plug-in draws its
+object's geometry unchanged while the object keeps the effect: `effect.list` gives that effect `skipped: true`, and the
+Appearance panel shows "(Safe Mode)" after its name and the plug-in's id in its tooltip. `effect.expandAppearance` returns an
+error and changes nothing when an object it would expand holds such an effect, in it or in a symbol it places. `vectorcraft` rejects an option it does not know (such as
+`--safe-mod`) instead of opening it as a file; `--` before a file name that starts with `-` opens it. The web build keeps
+no installed plug-ins from one page load to the next and has no launch marker, so it never offers the choice. `plugin.safeMode` returns `{active, source, disabled,
+pendingItem}`; a command does not turn Safe Mode on or off. `plugin.setEnabled {id | file, enabled}` turns a plug-in on or
+off for the next launch, as Help › Safe Mode's Enable on Re-launch does; it does not load, unload or uninstall anything
+now, and `plugin.install` of a disabled plug-in turns it on. Turning a plug-in on by `id` or by installing it also turns
+on the file it is stored in, which names it when it stopped a launch while loading; when the new version can't be saved
+over that file, the plug-in stays disabled. `plugin.list` reports `safeMode` and `disabled`, and
+`plugin.reload` skips disabled plug-ins. A change to the disabled list is saved on top of the list the file holds at
+that moment, so a change another window saved to the same preferences meanwhile is kept. When the list file can't be
+read (it is too large) or holds another format or version, it is left as it is; a file that isn't JSON is replaced.
+`plugin.setEnabled` returns `saved: false` when its change isn't in the plug-in folder: the session has none (a server
+confined with `--automation-read-root` or `--automation-write-root`), the list there can't be read or written, or it
+already holds 1,000 plug-ins, as another window may have saved it. The
+change stays in the process and is saved with the next change that saves, and the app shows a status message. When
+Disable and Continue can't save the plug-in it turns off, this launch skips it and the next launch asks again.
+
 ```json
+{"name":"run_command","arguments":{"command":"plugin.safeMode","params":{}}}
+{"name":"run_command","arguments":{"command":"plugin.setEnabled","params":{"id":"org.example.wobble","enabled":true}}}
 {"name":"run_command","arguments":{"command":"plugin.install","params":{"path":"/plugins/desaturate.wasm"}}}
 {"name":"run_command","arguments":{"command":"plugin.run","params":{"id":"org.vectorcraft.example.desaturate","params":{"amount":60}}}}
 {"name":"run_command","arguments":{"command":"effect.apply","params":{"effect":"plugin.org.example.wobble","params":{"size":4}}}}
@@ -6457,6 +6679,18 @@ Object → Envelope Distort wraps the selection in a live envelope: `object.enve
 arcLower, arcUpper, arch, bulge, shellLower, shellUpper, flag, wave, fish, rise, fisheye, inflate, squeeze or twist;
 `bend`, `h` and `v` in % from -100 to 100; `horizontal` or `orientation`), `object.envelope.makeWithMesh` (`rows`,
 `cols`: 1–50) and `object.envelope.makeWithTopObject` (the topmost selected path becomes the envelope).
+A top object's outline is split into four sides at four corners. Each corner is the anchor nearest a corner of the
+outline's bounding box among the anchors within 47.5% of the box's width and height from that box corner that count as
+corners: an anchor with a handle 0.01 pt long or shorter, or one whose tangent unit vectors differ by 0.01 or more in
+x or y and turn out of the outline. In this test a straight segment counts as having its handles a third of the way
+along it, so an anchor between two straight segments longer than 0.03 pt is a corner only when it turns out of the
+outline. On a tie, the anchor met first along the outline in the order it was drawn wins.
+Without such an anchor, the corner is the outline's point nearest the box corner, moved onto the anchor at the end of
+its segment when within 0.5% of the segment's parameter. Each piece of a side between anchors and corners takes a
+share of the content's width or height in proportion to the length of its control polygon, spread along the piece by
+its curve parameter, so content spreads evenly along a segment without handles. An envelope opened from an `.ai` file
+keeps the corners the file saves, and they stay on the same anchors when the envelope is moved, rotated or
+reflected. These are VectorCraft's own rules, and existing top-object envelopes redraw by them.
 `object.envelope.info` reads the selected envelope's settings (`type`, the warp's or mesh's values, `fidelity` and
 the options, `editing`), or with no envelope selected the options new envelopes get. With an envelope selected,
 `object.envelope.resetWithWarp` and `object.envelope.resetWithMesh` (`rows`, `cols`, `maintainShape`: true keeps
@@ -6825,6 +7059,40 @@ the entry names and decodes the codes that VectorCraft's default shortcuts agree
 {"name":"run_command","arguments":{"command":"importMatches.set","params":{"matches":[{"kind":"name","name":"Group","target":"object.group"},{"kind":"key","name":"901","target":"G"}]}}}
 ```
 
+## Action sets from other apps
+
+`actionSet.read {path? | data? | dataBase64?, name?}` reads an action set another app saved as text (an `.aia` file
+that starts with `/version`) without changing anything. Give exactly one of `path`, `data` and `dataBase64`. It returns
+the set's name (`set`, else the file's name, else empty), its `version`, and its `actions`, each with its `name` and
+`steps`. A step lists its `name` (the file's `/internalName`), its `label` (the `/localizedName` it is shown with, or
+null when it has none or it is blank), `on` (false when the file sets `/isOn 0`), `params` (how many recorded values it
+has) and its `line`. `unread` lists the tokens the reader skipped, with their lines. The reader stops at 8 MiB, 16 open
+blocks, 1,000 actions, 10,000 steps in an action and 100,000 steps in the set, and cuts names at 1,024 bytes. It sets
+`truncated` when it reaches one of these limits, when the text ends inside a block or a value or after a field's name,
+when `/actionCount`, `/eventCount` or a step's `/parameterCount` differs from the actions, steps or recorded values read
+(a negative count, one too large for a number and one that is not a number always differ), or when a hexadecimal name,
+label or recorded `/value` is not as many bytes as its count says. Text that does not start with `/version` and a
+number is an error.
+
+`ui.actionSet.load` (the Actions panel menu's Load Actions…) reads such a file too, from `path`, a picked file or
+`data`, and adds its set after the other sets with all its actions. The set's name is the file's `/name`, else the
+file's name, else `Actions`. A step with a label and no recorded values comes in as the VectorCraft command with that
+label, in English or in the interface language, in any case and without a final `…`, when exactly one menu command has
+that label and that command is directly in a top menu, can be recorded in actions, is what its menu bar item runs with
+no values and opens no dialog (Group, Ungroup). A submenu's items, file and document commands, Paste, Undo, Redo and
+add-on commands are never matched. The step runs with no params, and a step that is off in the file is excluded from
+playback. Other steps are left out, including every step with no label and every step recorded with values (recorded
+menu items too). The reply lists the first 1,000 in `skipped` (`{action, step}`, the step by its label, else its name),
+`leftOut` counts them, and the status bar says how many were left out. An action with no name is called `Action N`, by
+its place in the file. Function keys and colors are not read. A file marked `truncated` is refused, and no set is added.
+Text that starts `/version` and is not an action set gives "not an action set file". Tokens in `unread` do not stop a
+load.
+
+```json
+{"name":"run_command","arguments":{"command":"actionSet.read","params":{"path":"/Users/me/Prep.aia"}}}
+{"name":"run_command","arguments":{"command":"ui.actionSet.load","params":{"path":"/Users/me/Prep.aia"}}}
+```
+
 ## Artwork Cleanup add-on
 
 Artwork Cleanup is a built-in add-on: its commands are `addon.cleanup.*`, and in the desktop app it lives in Object ›
diff --git a/docs/plugins.md b/docs/plugins.md
index b5a4296b4..240ad9da8 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -291,8 +291,8 @@ object: its geometry (`type`, `path`, `fillRule`, `bounds`) and its `fills` and
 from before these give geometry only). The paints are read only: an effect may draw as wide as a stroke or use a
 fill's colour to decide its shape, but it changes only the geometry.
 
-An **exporter** gets something else: the document as a native `.vectorcraft` file's JSON, as `document.save` writes it
-but without indentation (the format is documented in [`crates/format/src/lib.rs`](../crates/format/src/lib.rs)). That is every layer, object,
+An **exporter** gets something else: the native `.vectorcraft` document JSON without indentation, optional preview/PDF
+renditions or save-preference metadata (the format is documented in [`crates/format/src/lib.rs`](../crates/format/src/lib.rs)). That is every layer, object,
 appearance and effect record, artboard, swatch and symbol, so an exporter reads whatever the document holds; it checks
 `version`, since a later host may write a newer one. Images of 8 KiB or more are listed in `images` with their MIME
 type and `blob` but without their data, which follows the JSON in a saved file; smaller ones keep their base64 `data`.
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 047fb5304..8cc682c7e 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -187,7 +187,7 @@ dominate; 3D, graphs and automation are specialist). They sum to 105. Feature de
 | Colour, swatches, gradients, patterns, mesh, recolor | 7 | 92% | 30.0's gradient additions are done (dither, perceptual blending, presets); freeform gradients in SVG/PDF, mixed spot/process gradients in SVG, PDF gradients mixing a spot color with RGB or Lab stops, and dithered spot gradient fills and Perceptual spot gradients with RGB or Lab stops other than white or more than 4,096 stops on their curve, which PDF export writes as images in process colors | 4–7 | estimated; Recolor model selection is available through the engine and MCP (#2520), and the dialog's color sliders (HSB, RGB, CMYK, Lab, Tint for a spot color) edit the selected row's new color in its mode, and the Edit tab's Global Adjust sliders (Saturation, Brightness, Temperature, Luminosity, -100% to 100%) change every recolored color at once (lowered from 96%: target moved); unpainted zero-width stroke restoration fixed (#1253), score and hours unchanged; Eyedropper source reads regression-tested (#1251); screen-bounded Recolor Edit chip list (#3416), score and hours unchanged |
 | Strokes, brushes, width profiles | 5 | 88% | Shift-double-click adjoining adjustment is implemented; brush libraries are done (four generated libraries, User Defined, Other Library…, Save Brushes); remaining:  Art brush Overlap, Pattern brush auto corners, pen pressure on macOS, tilt/bearing/rotation | 8–15 | estimated; width-point creation and adjoining adjustment regression-tested; dialog layout reviewed; evidence below; finite-arithmetic follow-up regressions and full CI passed (evidence below) |
 | Appearance, transparency, graphic styles, masks | 5 | 97% | raster effect reach in preview bounds | 1–2 | estimated; Transform typing, sliders, preview, and undo are covered in `crates/ui-egui/src/panels/tests_appearance.rs` |
-| 3D and Materials (and Turntable) | 4 | ~25% | live Revolve with automatic smooth vector shading and default-on continuous circular caps, Extrude & Bevel (twist, taper, caps, five bevel shapes), Inflate and Rotate with Position presets (colored Inflate uses smooth membrane lighting; white-light Inflate retains its existing shading; Extrude & Bevel and Rotate retain planar shading; one to ten colored lights, shared neutral ambient, painter visibility); materials, light presets, shadows, ray tracing, 3D Classic, Turntable views, 3D export | 30–55 | estimated (Extrude & Bevel, Inflate and Rotate added 2026-10-12) |
+| 3D and Materials (and Turntable) | 4 | ~25% | live Revolve with automatic smooth vector shading and default-on continuous circular caps, Extrude & Bevel (twist, taper, caps, five bevel shapes), Inflate and Rotate with Position presets (colored Inflate uses smooth membrane lighting; white-light Inflate retains its existing shading; Extrude & Bevel and Rotate retain planar shading; one to ten colored lights, shared neutral ambient, painter visibility); materials, light presets, shadows, ray tracing, 3D Classic, Turntable views, textures, map art and shading in 3D export | 30–55 | estimated (Extrude & Bevel, Inflate and Rotate added 2026-10-12) |
 | Type core | 9 | 80% | Auto-leading style resets are implemented; Hyphenation… and Justification… options are done (#2310, #2755), and a paragraph's Auto Leading also sets the Character panel's Leading, the Alt+↑/↓ leading nudge and Fill with Placeholder Text; remaining: Optical Margin Alignment, Middle Eastern features beyond bidi layout, optional group font-size preservation; transformed character controls fixed (#1034), see [type-parity.md](type-parity.md) | 14–19 | estimated; eleven-language pattern hyphenation in both composers, with grapheme and shaping-cluster protection (#4947, `hyphen::tests` and `layout::wrapping_tests`); Sanskrit patterns pending an allowlisted source; recent-font groups in font pickers (#3515); full-name font matches regression-tested (#1258); mixed paragraph alignment indication implemented; headless regressions, full integration CI and visual review pass; localized legacy family-name fallback with loaded/catalog regressions (#2208); Fractional Widths per type object regression-tested; color emoji fonts with bitmap glyphs (`sbix`, `CBDT`) draw and export; threading ports: every selected area type and type on a path shows its in and out ports (empty, arrow, red "+"), and the Selection tool threads from either, the in port into a frame before it, and a double-click on a threaded port breaks the thread there (`threads::tests::break_splits_the_thread_and_the_story_flows_into_the_first_part`, `select::tests::a_double_click_on_a_threaded_port_breaks_the_thread`, `canvas::tests::a_double_click_on_a_threaded_out_port_breaks_the_thread`) (#2572; `select::tests::a_click_on_the_in_port_threads_into_a_frame_before_it`, `text::tests::selected_type_shows_its_ports_in_each_state`, `threads::tests::add_before_threads_the_story_from_the_new_frame_into_the_clicked_one`, live screenshot); the Glyphs panel highlights and scrolls to the character selected with the Type tool (#4908, `panels::glyphs` tests); the OpenType panel lists only `ss01`–`ss20` sets present in the selected font and uses its custom names when supplied; Type-range desktop Copy publishes styled art and keeps font family, size and color on canvas Paste after editing (#5636) |
 | Type advanced (CJK, spelling, Touch Type, Retype) | 4 | 50% | CJK vertical composition (ruby, mojikumi), variable font axes, tab leaders, spell check, Touch Type, Retype | 20–28 | estimated; upright fallback for fullwidth `！` / `？` regression-tested; score and hours unchanged |
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 87% | 30.7's Blend panel with ease in/out, on-canvas Direct Selection of parts inside dynamic symbol instances and their `.ai` round trip, more built-in symbol libraries, envelope Anti-Alias/Preserve Shape; Symbol Options › Registration, Export Type (Graphic / Movie Clip) and 9-slice guides (drawn and draggable during symbol editing, #5280) and Symbol Type (dynamic symbols keep per-instance appearance linked, #4938) are done | 4–8 | estimated; Blend panel Type and Ramp control step easing with a separate color Shift (#2539); Blend Options retains spacing and orientation; polynomial curves are original approximations; interactive selected mirror axis implemented; bounding-box handles take priority over the axis line (focused regression and native checks passed; full CI blocked by an unrelated text test); #2544 spine Anchor Point conversion and picking regression-tested; scores and hours unchanged |
@@ -195,7 +195,7 @@ dominate; 3D, graphs and automation are specialist). They sum to 105. Feature de
 | Symbols, blends, envelopes, Repeat, perspective | 5 | 87% | 30.7's Blend panel with ease in/out, on-canvas Direct Selection of parts inside dynamic symbol instances and their `.ai` round trip, symbol libraries, Start Global Edit, envelope Anti-Alias/Preserve Shape; Symbol Options › Registration, Export Type (Graphic / Movie Clip) and 9-slice guides (drawn and draggable during symbol editing, #5280) and Symbol Type (dynamic symbols keep per-instance appearance linked, #4938) are done | 4–8 | estimated; Blend panel Type and Ramp control step easing with a separate color Shift (#2539); Blend Options retains spacing and orientation; polynomial curves are original approximations; interactive selected mirror axis implemented; bounding-box handles take priority over the axis line (focused regression and native checks passed; full CI blocked by an unrelated text test); #2544 spine Anchor Point conversion and picking regression-tested; scores and hours unchanged |
 | Image Trace, graphs, image tools | 3 | 75% | graph Column designs, Image Trace Create Strokes depth (Create Object Mosaic is done; junction-returning piece survival has source-generated regressions in `image-trace-quality.md`; simpler contour walk, identical output; an edge's sub-pixel shift is the same from either side; notches read only their own piece; collapsed loops keep few segments, so Paths is monotone on the code-drawn sweep) | 5–8 | estimated (raised from 72%); quick presets reveal adjustment controls, Properties reopens them; Live trace result bounds and selection highlights exclude the retained bitmap except in source-image views (scores/hours unchanged) |
 | Live vector effects | 5 | 85% | Outline Object, SVG Filters | 4–8 | measured count 49/50 (Pathfinder 13/13 with Trap), depth estimated; Warp Options controls verified by focused checks and original-image review |
-| 3D and Materials (and Turntable) | 4 | ~25% | live Revolve with automatic smooth vector shading and default-on continuous circular caps, Extrude & Bevel (twist, taper, caps, five bevel shapes), Inflate and Rotate with Position presets (colored Inflate uses smooth membrane lighting; white-light Inflate retains its existing shading; Extrude & Bevel and Rotate retain planar shading; one to ten colored lights, shared neutral ambient, original lighting presets, painter visibility); materials, shadows, ray tracing, 3D Classic, Turntable views, 3D export | 30–55 | estimated (Extrude & Bevel, Inflate and Rotate added 2026-10-12) |
+| 3D and Materials (and Turntable) | 4 | ~25% | live Revolve with automatic smooth vector shading and default-on continuous circular caps, Extrude & Bevel (twist, taper, caps, five bevel shapes), Inflate and Rotate with Position presets (colored Inflate uses smooth membrane lighting; white-light Inflate retains its existing shading; Extrude & Bevel and Rotate retain planar shading; one to ten colored lights, shared neutral ambient, original lighting presets, painter visibility); materials, shadows, ray tracing, 3D Classic, Turntable views, textures, map art and shading in 3D export | 30–55 | estimated (Extrude & Bevel, Inflate and Rotate added 2026-10-12) |
 | Type advanced (CJK, spelling, Touch Type, Retype) | 4 | 50% | CJK vertical composition (mojikumi), variable font axes, tab leaders, spell check, Touch Type, Retype | 20–28 | estimated; No Break keeps marked characters on one line; upright fallback for fullwidth `！` / `？` regression-tested; score and hours unchanged |
 | Type advanced (CJK, spelling, Touch Type, Retype) | 4 | 50% | CJK vertical composition (mojikumi), tab leaders, spell check, Touch Type, Retype | 20–28 | estimated; No Break keeps marked characters on one line; upright fallback for fullwidth `！` / `？` regression-tested; score and hours unchanged |
 | Raster effects (Effect Gallery) | 4 | 52% | the Effect Gallery's filter thumbnails and in-dialog preview area ([Filter Gallery overview](https://helpx.adobe.com/photoshop/desktop/effects-filters/get-started-with-filters/filter-gallery.html)) | 1–2 | estimated (raised from 49%: the Effect Gallery shipped, #2883, six categories, per-filter settings, ordered stack, live canvas preview, one undo step, `dialogs::effect_gallery::tests::stack_ok_is_one_undo_step`, `stack_preview_is_one_interaction`); measured count 57/57 (Artistic complete with Colored Pencil, Fresco, Paint Daubs, Palette Knife, Rough Pastels and Underpainting; Sketch complete with Torn Edges and Conté Crayon, `pixel::tests_sketch::conte_crayon_*`); texture redraw distances optimized (#1257), pixels verified; depth estimated |
@@ -204,6 +204,7 @@ dominate; 3D, graphs and automation are specialist). They sum to 105. Feature de
 | Layers, artboards, document setup | 5 | 78% | Selected-artboard deletion is consistent across panel actions (all-selected retains artboard 1); history prunes removed indices while preserving valid multiselection; remaining:  30.0's artboard locking and colours and managing artboards from the canvas, Layers panel row context menus and Collect for Export (click-to-fit objects is done, #1227) | 5–8 | estimated (lowered from 82%: target moved); Artboard deletion keys keep artwork and the first of an all-selected set; Artboard Options' Show Center Mark and Show Cross Hairs draw on the canvas only (exports and print leave them out), regression-tested; Artboard Options' Show Video Safe Areas and Video Ruler Pixel Aspect Ratio (per artboard, native format) are done ([video display options](#evidence-what-ships-today-by-area)), score unchanged |
 | View & navigation | 3 | 70% | multiple windows and the rest of Arrange (Cascade, Float in Window, Float All in Windows) | 9–14 | estimated; Window › Arrange › Tile and Consolidate All Windows done (score/hours unchanged); document-tab artwork hover/copy and lossless transfer tested (2026-10-22; score/hours unchanged); cached canvas reprojection preserves scale during resize, rotation and DPI changes (regression and contributor original-file evidence below; scores/hours unchanged); cached canvas dimensions match the renderer limit before cache-key creation, view construction and worker submission (regression evidence below) |
 | File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), no writing of Illustrator's editing data (#868), FreeHand/CorelDRAW/DWG/HEIC import, 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified | 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`; the distance from the path under Align to Path comes from VectorCraft's font metrics, and the fit under Gravity does not reproduce the file's layout), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. |
+| File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), a saved `.ai`'s editing copy without live effects on objects other than paths, compound paths and groups that qualify (at most a fill and a stroke, a non-zero fill rule when filled, no large canvas) and whose appearance and effects the art-style writer supports, and with live objects as their art (#868), FreeHand/CorelDRAW/DWG/HEIC import, textures, map art and shading in 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified | 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. |
 | File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), a saved `.ai`'s editing copy without live effects on objects other than paths, compound paths and groups that qualify (at most a fill and a stroke, a non-zero fill rule when filled, no large canvas) and whose appearance and effects the art-style writer supports, and with live objects as their art (#868), FreeHand/CorelDRAW/DWG/HEIC import, 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified | 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); SVG CSS classes survive export and repeated import in all four styling modes (#2480); current-main integration retains event attributes and scripts; EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. |
 | View & navigation | 3 | 70% | multiple windows and the rest of Arrange (Cascade, Float in Window, Float All in Windows) | 9–14 | estimated; Window › Arrange › Tile and Consolidate All Windows done (score/hours unchanged); document-tab artwork hover/copy and lossless transfer tested (2026-10-22; score/hours unchanged); cached canvas reprojection preserves scale during resize, rotation and DPI changes (regression and contributor original-file evidence below; scores/hours unchanged) |
 | View & navigation | 3 | 70% | multiple windows and the rest of Arrange (Cascade, Float in Window, Float All in Windows) | 9–14 | estimated; Window › Arrange › Tile and Consolidate All Windows done (score/hours unchanged) |
@@ -542,6 +543,7 @@ since 2026-10-01.
 - **Transform effect options (#885):** Effect › Distort & Transform › Transform… has visible Transform Objects, Transform Patterns and Scale Strokes & Effects checkboxes (`distort.transform` params `objects`, `patterns`, `strokes`; files without them draw as before). With Transform Objects off the geometry stays and makes no copies; Scale Strokes & Effects scales stroke weights, dashes and the fills' and strokes' effect distances by the mean scale, and Transform Patterns moves pattern tiles, each copy `k` by the transformation `k` times. Such objects draw, export and expand through the same per-copy art, so the canvas and Expand Appearance agree (engine `tests_transformfx`, effects `tests_transformfx`, the dialog test). A Transform effect in a fill's or stroke's own effects applies the same options to that fill or stroke: its weight and dashes, the distances of its later effects and its pattern follow the transformation, and with copies each copy is an object of its own; the canvas, export, Expand Appearance and Use Preview Bounds use the same art (effects `tests_transformfx`). Not yet: object effects after a Transform effect keep their distances. Public reference: [Scale objects](https://helpx.adobe.com/illustrator/desktop/manage-objects/reshape-transform-objects/scale-objects.html), [How to apply effects](https://helpx.adobe.com/illustrator/using/effects.html), [Distort and transform effects](https://helpx.adobe.com/illustrator/desktop/manage-objects/reshape-transform-objects/distort-and-transform-effects-in-illustrator.html). Scores and hours unchanged.
 - **Warp Options (#1760):** Effect > Warp and existing Appearance effect links share the fifteen existing styles, original schematic previews, orientation choices and percent Bend/Distortion controls. Focused tests passed for real numeric entry and slider input, Preview/Cancel, immediate Enter/OK, mixed-style edits, target/slot/visibility preservation and Undo/Redo. Each applied style stays unchanged until an explicit Style choice. Original style-menu and live-preview captures were reviewed; their numeric values were supplied programmatically. Public references: [Reshaping with effects](https://helpx.adobe.com/illustrator/using/reshaping-objects-effects.html) and [Using effects](https://helpx.adobe.com/illustrator/using/effects.html). Warp geometry, optional Properties integration and remembered defaults are unchanged; no broader parity claim.
 - **Distort Appearance with Transform effect options:** with Envelope Options › Distort Appearance on, a path whose Transform effect has Scale Strokes & Effects or Transform Patterns on, or copies it with a gradient, is bent as the same per-copy art it draws and expands as outside the envelope: each copy's own stroke weight, dashes, pattern placement and gradient (effects `bake::tests`). Scores and hours unchanged.
+- **Placed gradients follow Transform and Free Distort effects:** a gradient placed with the Gradient tool moves, turns and scales with the object when the object's Transform effect moves its outline, and each copy of the Transform effect takes it as many times as it takes the transform. Under Free Distort it moves and scales from the path's bounds before the effect to its bounds after it. This holds on the canvas, in export, in Expand Appearance, in Pathfinder and compound shapes, and in Object › Expand of the fill, for an object's own effects, a group's (the own fills of the group, of the groups inside it, of a symbol's art, and of the images and symbol instances it moves, included) and a fill's or stroke's own. A gradient on a path inside a group with a Transform effect now moves with the path (#2214 moved only the gradients of type), and so does a gradient on an image's or symbol instance's own fill. When a path keeps its shape because the effect would pass the geometry budget, the group's own gradients stay in place. How gradients follow each effect is VectorCraft's own rule; what each effect does to the object is described in [Distort and transform effects](https://helpx.adobe.com/illustrator/desktop/manage-objects/reshape-transform-objects/distort-and-transform-effects-in-illustrator.html) (effects `bake::tests::a_baked_transform_moves_a_placed_gradient_with_the_path`, `bake::tests::a_strokes_own_transform_and_free_distort_move_its_placed_gradient`, `bake::tests::a_fills_gradient_follows_the_effects_around_its_transform_with_options`, `bake::tests::baked_free_distort_moves_placed_gradients_from_the_bounds_to_the_distorted_bounds`, `group::tests::a_groups_transform_and_free_distort_move_the_gradients_placed_on_its_paths`, `group::tests::a_groups_transform_moves_the_gradient_of_its_own_fill`, `group::tests::a_nested_groups_own_gradient_follows_the_outer_groups_transform_and_free_distort`, `group::tests::a_groups_transform_moves_the_gradients_placed_on_an_images_own_fills`, `group::tests::shape_art_moves_gradients_with_a_transform_effect`, `group::tests::shape_art_moves_the_gradient_of_a_symbol_instances_art_with_its_transform`, `tests::art_past_the_budget_keeps_its_own_gradients_in_place`; render `objectfx::a_paths_gradient_moves_with_its_transform_and_free_distort`; engine `objexpand::a_placed_gradient_moved_by_a_transform_or_free_distort_expands_as_the_canvas_draws_it`). Scores and hours unchanged.
 - **Constrain Angle (#394):** General › Constrain Angle turns the arrow keys' axes (guides stay on the page's), holds Shift drags of the Selection, Direct Selection, Free Transform, Slice Selection, Reshape and Measure tools and the Pen's handles to the turned axes, and new rectangles, rounded rectangles, ellipses, grids, point and area type, Shift-drawn polygons and stars and the shape size dialogs are drawn along it with their bounding box turned; 0° and whole turns are exactly as before, quarter turns exact (<https://helpx.adobe.com/illustrator/desktop/manage-objects/arrange-objects/rotate-objects-by-specific-angles.html>). Tests: `tests_constrain_tools`, `tests_constrain_new` (engine), `geom` `constrain_axes` / `rotate_deg`, the shape, grid and type tool tests.
 
 - **Clipping paths on their outline (G1):** the selection tools (Selection, Direct Selection, Group Selection), Object Highlighting and a right-click take a clipping path on its outline before the art it clips; Select Behind lists the same; the eyedropper, the tools that act on what is drawn and the selection tools' double-clicks, loaded text and guide release take the art. Doc and tool regression tests; score unchanged.
@@ -620,6 +622,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 - **Artboard Escape routing:** Escape leaves Artboard editing for Selection; during a drag it first cancels the gesture. Headless egui key events cover idle Escape, active-drag cancellation and a subsequent Escape in `tests/distortkeys.rs`.
 - **Escape in the distort tools:** Escape during a Puppet Warp pin drag or turn, a Perspective Grid tool handle or plane widget drag, a Perspective Selection move, resize or plane widget drag, or a Liquify stroke cancels it: the art goes back to how the press found it, no undo step is added, and the tool stays chosen. Puppet Warp also selects again the pins selected before the press, and Escape during a Liquify Alt-drag puts the brush size back. Regression tests: `escape_cancels_*` in `crates/tools/src/distort/puppet.rs`, `perspective.rs` and `liquify.rs`, and `escape_cancels_a_puppet_warp_perspective_or_liquify_drag` in `tests/distortkeys.rs`.
 - **Shift with the Artboard tool:** a Shift-click adds an artboard to the selection or takes it out when the button comes up. A Shift-drag inside an artboard draws a new artboard there, and a Shift-drag on the pasteboard is a marquee that toggles the artboards it touches, as the [default keyboard shortcuts](https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html) (a Shift-drag draws an artboard within an existing one) and [Using multiple artboards](https://web.archive.org/web/20210925094818/https://helpx.adobe.com/illustrator/using/using-multiple-artboards.html) (archived copy) describe. Shift no longer keeps an artboard move at 45° steps or a drawn artboard square. Escape during a marquee or while a new artboard is being drawn cancels it and keeps the Artboard tool. Pointer and key tests in `crates/tools/src/xform/artboard.rs` cover the four gestures and Escape.
+- **Artboard edge buttons:** with the Artboard tool and one artboard selected, a button with a plus shows just outside the middle of each edge where an artboard of the same size fits on that side; clicking it adds an empty artboard of that size there (`artboard.new {beside, side}`), and Alt-clicking duplicates the artboard with its art there (`artboard.duplicate {index, side}`), each in one undo step, with the new artboard active. An Alt-click on a locked artboard's button does nothing, as the tool doesn't copy a locked artboard. The 20 pt gap and the room rule (within the canvas, overlapping no other artboard) are VectorCraft's own. Pointer tests in `crates/tools/src/xform/artboard/tests.rs` and an engine test in `tests/panelcmds.rs` cover it. Public references: [Add artboards instantly](https://helpx.adobe.com/illustrator/desktop/create-manage-artboards/add-edit-artboards/add-new-artboards.html) and [Duplicate artboards instantly](https://helpx.adobe.com/illustrator/desktop/create-manage-artboards/add-edit-artboards/duplicate-artboards.html).
 - **Artboard deletion keys:** Delete/Backspace delete selected boards in one Undo step, retaining the original first board in the current order when all are selected, as in the public [Delete artboards guide](https://helpx.adobe.com/illustrator/desktop/create-manage-artboards/add-edit-artboards/delete-artboards.html). The last board and active drags stay protected; neither key clears selected artwork. Headless shortcut regressions in `tests/distortkeys.rs` cover reordered boards, artwork, saved state and Undo/Redo.
 - **Locked artboards:** a click in the Artboards panel's lock column locks or unlocks an artboard in one undo step (`artboard.setProps {index, locked}`), and the native format saves the lock. The Artboard tool doesn't move, copy, resize or delete a locked artboard, Rearrange and Fit to Artwork Bounds leave it as it is, and its name isn't edited on the canvas. The art on it (each object whose bounds overlap it, a group as one object) acts as locked art until it is unlocked: clicks, marquees, `select.set`, `select.all` and the tools pass over it, and commands that act on the selection leave it; art drawn or pasted onto it stays selected and editable until the selection leaves it out. Tests in `crates/doc/src/lib.rs`, `tests/panelcmds.rs`, `xform/artboard.rs`, `panels/artboards.rs` and `canvas.rs` cover them. Public references: [Lock artboards](https://helpx.adobe.com/illustrator/desktop/create-manage-artboards/organize-manage-artboards/lock-artboards.html) and [Managing Artboards in Illustrator](https://creativepro.com/managing-artboards-in-illustrator/).
 - **Linux RPM packaging:** 64-bit runtime capabilities replace Fedora-specific required package names (#1275); glibc 2.35, libm and libgcc_s are declared alongside dynamically loaded xkbcommon and Vulkan/EGL. Generated x86_64/aarch64 metadata and isolated synthetic-provider resolution checked; real-distro install/start-up QA remains pending.
@@ -634,6 +637,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - Variables: Lock Variables (`variable.lock`, in the Variables panel's bottom bar and menu) stops variables from being defined, deleted or renamed until they are unlocked, while objects can still be bound and unbound and data sets still change and apply; the lock is saved with the document.
   - Batch…: Override Save and Override Export name each file with the extension of the format the step writes, however the step spells the format (`.svg` and `SVG` give `.svg`, `png8` gives `.png`), in `action.batch`.
   - Actions panel menu: Save Actions… writes the current action set with all its actions to a file, and Load Actions… adds the set from such a file to the panel ([Manage a set of actions](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/manage-a-set-of-actions.html); `ui.actionSet.save`, `ui.actionSet.load`). The file is VectorCraft's own action set file (`.vcactions`); a loaded set named like one in the panel gets the next free number.
+  - Actions panel menu: Load Actions… also reads action sets saved as `.aia` files ([Actions panel overview](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/actions-panel-overview.html); `actionSet.read`, `ui.actionSet.load`). VectorCraft's own rules: the set comes in with all its actions. A step with a label and no recorded values comes in as the one menu command with the step's label, when that command is directly in a top menu, is what its menu bar item runs with no values and opens no dialog. A step that is off in the file stays excluded from playback. The other steps, recorded menu items included, are left out, and the status bar says how many.
   - Actions panel: the panel menu's Action Options… renames the selected action and keeps its steps ([Actions panel overview](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/actions-panel-overview.html): the menu item opens a dialog that renames the action or gives it a function key and color; `ui.action.options`). It also sets the action's function key and color.
   - Actions panel: Create New Action (bottom bar) and the panel menu's New Action… ask for the new action's name, set, function key and color, and Record adds the action and starts recording into it ([Create new actions](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/record-actions.html): the New Action dialog takes the action's name and the set it goes in; `ui.action.new`, `ui.action.play`). The function key (F1 to F15, with Ctrl or Command and Shift) plays the action. An action's function key plays the action even when a command has the same shortcut, and the command keeps it. VectorCraft's own rules, which the page does not cover: when several actions have the same key the first in panel order plays; a copied action has no key; New Action does not open while an action is recording. The color is kept with the action for Button Mode, which VectorCraft does not have yet.
   - Actions panel (record/playback, persisted), generic parameter dialogs for every "…" command.
@@ -666,7 +670,8 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), large containers slice with `document.node {depth?, childLimit?}` (truncated levels report `childCount`), `document.inspect` and the `inspect_document` tool slice the same way so a depth-0 read is the layer skeleton (~9.7 KB instead of ~2 MB on a 2,000-object document), `document.find` locates nodes by name/kind/text with ancestor paths, and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads).
   - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`). A `run` step, like a `command_batch` step over MCP, can use an earlier step's result (`"$1.id"`, #785); `run --commands FILE` (or `-` for standard input) reads the steps from a JSON array or JSON Lines, past the Windows command-line limit (#3147, `apps/vectorcraft-cli/tests/it/cli.rs` `run_reads_*`, `run_refuses_malformed_commands_naming_the_step`).
   - File › Scripts › Check Script… reads a script written for Illustrator (`.jsx`, `.jsxinc` or a compiled `.jsxbin`) without running any of it and reports what it needs (the document model, files, dialogs, menu commands, features only Illustrator has), what it would do outside the document, the menu commands and document-model members it uses, its directives and included files, and the problems that would stop it loading (`script.check`, which also reads `.js` files); File › Open and drag-and-drop show the report for `.jsx`, `.jsxinc` and `.jsxbin` files.
-  - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). Nothing runs scripts yet. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`.
+  - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). This entry covers parsing; the next entry covers running scripts. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`.
+  - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap. Built-ins are limited to `Object`, `Function` with `call` and `apply`, `eval` and the error types. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only these built-ins: 3,074 of 3,078 runs pass (the 4 others expect the completion values of later editions). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`.
 - **UI:** Illustrator 2026 layout restyled to measured values:
   - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
   - Hint bar, contextual task bar, 19 dock panels with ≡ menus.
@@ -708,6 +713,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - The History panel menu's Clear History (`edit.clearHistory`) removes every step to undo and to redo and leaves the document as it is; it is not an undo step itself, and it is disabled when there is no step to clear.
   - The New Document from State button at the bottom of the History panel (`edit.newDocumentFromState`) makes a new document, which becomes active, from the state the panel has selected ([public source](https://helpx.adobe.com/illustrator/desktop/get-started/learn-the-basics/undo-edits-and-manage-design-history.html)). VectorCraft's own rules: the new document takes the next Untitled-N name, is marked unsaved, has nothing selected and has no steps to undo or redo, and the source document and its steps stay as they are.
   - The Transform panel menu's Transform Object Only, Transform Pattern Only and Transform Both (`transformPanelPatterns`) choose whether the fields, flips and menu flips of the Transform panel and the Properties panel's Transform section move the object and leave its pattern tiles, move the tiles alone, or both (until a choice they follow General › Transform Pattern Tiles, as before); Use Registration Point for Symbol (`useRegistrationPointForSymbol`) measures and transforms one selected symbol instance from its symbol's registration point, where the instance's flips, rotations and shears put it ([Transform panel overview](https://helpx.adobe.com/illustrator/desktop/manage-objects/reshape-transform-objects/transform-panel-overview.html); `panels::transform::tests::the_menu_chooses_whether_the_object_its_pattern_or_both_transform`, `use_registration_point_for_symbol_measures_an_instance_from_its_registration_point`, `use_registration_point_for_symbol_follows_a_transformed_instance`, `tests_prefs::transform_panel_patterns_defaults_to_following_the_general_preference`).
+  - The Transform panel's Align to Pixel Grid checkbox (`object.setPixelAligned`) gives paths and compound paths a pixel-aligned property, saved in the native file: their horizontal and vertical straight segments sit on whole points (half points under an odd centered stroke) with whole stroke weights, and every move, scale, rotation, reflection, Transform Each, Align move, Transform panel change, move of direct-selected anchors or of one anchor, move of a compound path's path on its own, artboard move, resize or copy that carries the art, Duplicate or paste that moves a copy, stroke edit and appearance edit that adds, removes, hides, repaints or reweighs a stroke snaps them again, while diagonal segments and curves keep their shape; a compound path made from an aligned path or compound path is aligned and snaps its paths with its own stroke; the box shows a dash for a mixed selection and is unavailable for type, images and groups ([Pixel-aligned property](https://helpx.adobe.com/illustrator/desktop/get-started/learn-the-basics/pixel-preview-mode-for-web-graphics.html); `tests::pixelalign::turning_it_on_snaps_the_path_in_one_undo_step`, `it_stays_aligned_through_transforms`, `it_stays_aligned_when_its_artboard_moves`, `diagonal_segments_and_curves_keep_their_shape`, `type_and_images_cannot_be_aligned`, `the_property_is_saved_and_read_back`, `stroke_edits_keep_it_aligned`, `a_compound_path_of_aligned_paths_is_aligned`, `a_compound_path_of_an_aligned_compound_path_is_aligned`, `a_stroke_without_paint_snaps_to_whole_points`, `moving_direct_selected_anchors_keeps_it_aligned`, `moving_one_anchor_keeps_it_aligned`, `moving_a_path_of_an_aligned_compound_path_keeps_it_aligned`, `artboard_options_and_artboard_copies_keep_it_aligned`, `appearance_edits_keep_it_aligned`, `placed_gradients_follow_the_snapped_path`, `duplicates_and_pastes_keep_it_aligned`, `paths_added_to_or_moved_in_an_aligned_compound_path_keep_it_aligned`, `the_art_of_a_linked_opacity_mask_keeps_it_aligned`, `a_linked_opacity_mask_follows_a_snap`, `aligning_direct_selected_anchors_keeps_it_aligned`, `global_edit_keeps_its_members_aligned`, `a_path_with_live_corners_snaps_its_inner_edges`, `geometry_edits_keep_it_aligned`, `other_path_edits_keep_it_aligned`, `panels::transform::tests::align_to_pixel_grid_shows_and_sets_the_property`).
   - Object › Transform › Reset Bounding Box squares the box of every object inside the selected ones as well: the children of groups, compound paths, clip groups, blends, envelopes, repeats and intertwines, and the art of linked opacity masks. Ungroup and the release commands then bring back boxes square to the page (VectorCraft's own behavior; `bboxrotate::reset_bounding_box_squares_the_objects_inside_a_group`, `reset_bounding_box_squares_the_turned_members_of_a_square_group`, `reset_bounding_box_then_release_clipping_mask` and the other `reset_bounding_box_then_*` tests, `reset_bounding_box_leaves_the_art_of_an_unlinked_opacity_mask`).
   - Native macOS menu bar, vector tool cursors, a ⌘K command palette, middle-button panning with any tool. Native menus explicitly end tracking on command selection, outside window presses and Escape; menu updates wait until tracking ends, and a dismissing press never starts a canvas gesture (M14.8).
   - The errors of the blend spine commands (Move Spine Point, Reshape Spine Segment, Add Spine Point and Delete Spine Point) show in the status bar in the interface language: each has a row in every catalog that translates all status and error messages and in Bulgarian (`blend_spine_param_errors_are_translated`).
@@ -721,13 +727,12 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - **9-slice scaling** ([public source](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/maintain-proportions-while-scaling-symbols.html)): a scaled instance of a symbol with Enable Guides for 9-Slice Scaling on stays an instance and keeps the parts of its art outside the guides at their size. New guides sit a quarter of the symbol's width and height in from each edge ([reference](https://help.adobe.com/archive/en/illustrator/cs6/illustrator_reference.pdf), Use 9-slice scaling section); saved guides keep their values. The rest is VectorCraft's own rule: the corners keep both sizes, the top and bottom edges stretch in width, the left and right edges in height and the center in both; an instance smaller than its two outer cells on an axis shrinks them in proportion and leaves the center empty; the cells are sized along the symbol's axes before the instance's rotation, shear or reflection. A path with solid paint that crosses a guide is cut there and stays one path, its stroke at its weight with Scale Strokes & Effects on or off; type, images, live objects and gradient or pattern paint that cross a guide are drawn in each cell they reach, clipped to it, except those that draw symbol art (a nested instance, type with an inline graphic, a placed document, a brushed stroke, or a pattern whose tile draws one of these), which are placed by the cell their center is in; an object in one cell is placed by that cell and stays as it is. The canvas, bounds, the Eyedropper, Break Link to Symbol and the PDF, EPS, DXF, EMF/WMF and SVG exports place the art the same way; SVG writes such an instance as its placed art instead of a `<use>`, and DXF and WMF, which do not clip, cut every path that crosses a guide and place other such objects by the cell their center is in. Tests: `symbol_nine_slice::tests` in `crates/doc`, `crates/engine/src/tests/symbol_nine_slice.rs`, `a_scaled_nine_slice_instance_keeps_its_corners` (PDF), `a_scaled_nine_slice_instance_is_written_as_the_canvas_draws_it` (SVG), `a_scaled_nine_slice_instance_is_sampled_as_it_is_drawn` (Eyedropper).
   - **Symbol editing mode** ([Edit symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/edit-symbols.html), [Symbols panel options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html)): a double-click on a symbol instance, the Control bar's Edit Symbol button, a double-click on a symbol in the Symbols panel and the panel menu's Edit Symbol (`symbol.edit`) open the symbol's art on a temporary isolated layer, where the instance shows it (from the panel: centered on the active artboard, or in the view in a document without artboards), with the rest of the document dimmed. Each edit there changes every instance at once; the instances keep their own transforms and stay linked (Break Link to Symbol still expands one), and a dynamic symbol's instances keep their appearance changes to the objects the art still has. Escape, the isolation bar's back button, the Control bar's Exit Symbol Editing Mode and a double-click outside the art leave the mode (`symbol.exitEditing`); leaving without an edit adds no undo step. Saving leaves the editing layer out. Tests: `crates/engine/src/tests/symboledit.rs`, `select::tests::a_double_click_on_a_symbol_instance_edits_its_symbol`, `panels::symbols::tests::edit_symbol_from_the_panel_centers_the_art_on_the_active_artboard_or_the_view`.
   - Symbol editing mode keeps every instance in step: instances of a dynamic symbol inside other symbols' art, pattern tiles, graph designs, stored brushes and opacity masks keep their appearance changes on the objects an edit reorders and drop the changes to objects it deletes. The view does not draw the instance the edit was entered from. Area type in the symbol's art takes the text wrap that moving a wrap object gives it. Editing another symbol at a place that fails keeps the current edit open, and only the editing layer or art on it can be isolated. Tests: `crates/engine/src/tests/symboledit.rs`, `isolation::symbol_editing_does_not_draw_the_instance_it_was_entered_from`, `panels::symbols::tests::double_clicking_a_symbol_in_the_panel_edits_it_in_either_view`, `the_panel_menus_edit_symbol_edits_the_instances_symbol_or_the_panels`, `the_control_bars_edit_symbol_edits_the_selected_instances_symbol`, `chrome::tests::the_control_bar_exits_symbol_editing_mode`.
+  - **Dynamic symbol instances on the canvas** ([Symbols, archived copy](https://web.archive.org/web/20240206075757/https://helpx.adobe.com/illustrator/using/symbols.html)): each instance of a dynamic symbol can have an appearance of its own while it shares the symbol's shape. The rest of this entry is VectorCraft's own rules. A Direct Selection click on an instance of a dynamic symbol selects the path, compound path or type object of the symbol's art under the pointer and outlines it (`symbol.instance.selectPart`); the Swatches and Color panels, the Control bar, the Eyedropper and the other fill and stroke controls then change that object's solid color fill or stroke for this instance only, each as one undo step, and the symbol's art and its other instances stay as they were. Alt or Shift picks the instance whole. A gradient or pattern for the object, an Eyedropper source that is not a path, compound path or type, a click on any other object of the art (a group, image, blend or nested instance) and the commands that change the selected objects (opacity, moving, Delete, Group, Hide, Lock, Arrange, Expand, the gradient commands, the Appearance panel's rows and others) are refused with a status message. Copy, Export Selection, Fit to Selection, Liquify, Isolate, Add to Library and Save Selection use the whole instance (`docs/mcp.md`), and another selection tool selects the instance whole again. Tests: `crates/engine/src/tests/dynamic_symbols.rs`, `direct::tests::a_click_on_a_dynamic_instance_picks_the_object_under_the_pointer`.
   - **9-slice guides on the canvas** ([public source](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/maintain-proportions-while-scaling-symbols.html)): while a symbol with Enable Guides for 9-Slice Scaling on is edited in symbol editing mode, the canvas draws its two horizontal and two vertical guides as dotted lines across its art, with any tool and with ruler guides hidden. With the Selection tool the pointer near a guide shows the Move cursor, and dragging the guide moves it (`symbol.options`'s `nineSliceGuides`) as one undo step; Escape during the drag puts it back. VectorCraft's own rules: a guide within 4 screen pixels takes the press before the art and the bounding box; it stays within the art's box (guides outside the art are not supported yet) and stops short of the opposite guide; the drag does not snap. Tests: `nineslice::tests`, `symbol_nine_slice::tests::the_edited_symbols_guides_cross_its_art_where_the_editing_layer_shows_it`, `a_moved_guide_stays_in_the_art_and_short_of_the_opposite_guide`, `canvas::tests::the_edited_symbols_nine_slice_guides_are_drawn_and_dragged_on_the_canvas`.
   - **Delete Symbol asks first** ([Symbols panel](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html), [symbol libraries](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-or-import-symbol-libraries.html), [Alt-click Delete](https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html)): the Symbols panel's Delete Symbol button and menu item ask "Delete the selected symbol?" with Yes and No for a symbol no instance uses. For a symbol with placed instances they ask with Expand Instances (the instances become ordinary art), Delete Instances and Cancel; either Instances button deletes the symbol in one undo step. Alt-click on the button deletes an unused symbol without asking and still asks about one with instances. A question left open while another document became active deletes nothing. `symbol.delete` itself does not ask. Tests: `panels::symbols::tests::delete_symbol_asks_first_and_alt_click_deletes_an_unused_symbol_at_once`, `the_in_use_question_expands_or_deletes_the_instances`, `a_stale_delete_symbol_question_deletes_nothing`, `the_delete_symbol_questions_show_their_buttons`.
   - **Symbols › Select All Unused** ([Symbols panel](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html), #4918): the Symbols panel menu's Select All Unused shows the symbols nothing places selected (`symbol.unused`): instances in the art (opacity masks included), graph designs, pattern tiles and brush art count, and so do instances in a used symbol's art. Delete Symbol, the button or the menu item, then asks "Delete the selected symbols?" once and deletes those still unused in one undo step (`symbol.delete {names}`); Alt-click on the button deletes them without asking, and a click on a symbol picks just it again. Tests: `tests::brushsym::symbol_unused_lists_the_symbols_nothing_places_and_delete_takes_several`, `panels::symbols::tests::select_all_unused_picks_the_unused_symbols_and_delete_deletes_them`, `dialogs::symbol_delete::tests::several_symbols_get_the_plural_question`.
   - **Expand of symbol instances:** Object › Expand turns selected symbol instances (without effects, not in perspective, in groups or placed documents too) into their art as Break Link to Symbol places it, one level deep, as one undo step; the Expand dialog's Fill and Stroke reach that art (`object.expand`, `crates/engine/src/tests/expand_symbols.rs`; estimated, score unchanged).
   - **Reset Transformation** ([Transform symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/transform-symbols.html), [Symbols panel options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html)): the Symbols panel menu's Reset Transformation and the Control bar's Reset, shown while symbol instances are selected, give the selected instances their symbol's own scale again, without rotation or shear, as one undo step (`symbol.instance.resetTransform`); an instance in perspective is left as it is. VectorCraft's own rules: each instance keeps the center of its bounding box in place, reflection is removed too, and the menu item and the button are enabled only while a selected instance would change. Tests: `tests::brushsym::reset_transformation_restores_the_symbols_scale_and_keeps_the_center`, `reset_transformation_keeps_the_center_of_art_away_from_the_origin`, `reset_transformation_ignores_a_stored_size_that_is_not_positive`, `reset_transformation_leaves_unchanged_instances_and_refuses_bad_ids`, `panels::symbols::tests::reset_transformation_is_enabled_for_a_transformed_instance_and_resets_it`.
-  - **Reset Transformation** ([Transform symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/transform-symbols.html), [Symbols panel options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html)): the Symbols panel menu's Reset Transformation and the Control bar's Reset, shown while symbol instances are selected, give the selected instances their symbol's own scale again, without rotation or shear, as one undo step (`symbol.instance.resetTransform`); an instance in perspective is left as it is. VectorCraft's own rules: each instance keeps the center of its bounding box in place, reflection is removed too, and the menu item and the button are enabled only while a selected instance would change. Tests: `tests::brushsym::reset_transformation_restores_the_symbols_scale_and_keeps_the_center`, `reset_transformation_keeps_the_center_of_art_away_from_the_origin`, `reset_transformation_leaves_unchanged_instances_and_refuses_bad_ids`, `panels::symbols::tests::reset_transformation_is_enabled_for_a_transformed_instance_and_resets_it`.
-  - **Reset Transformation** ([Transform symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/transform-symbols.html), [Symbols panel options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html)): the Symbols panel menu's Reset Transformation and the Control bar's Reset, shown while symbol instances are selected, give the selected instances their symbol's own scale again, without rotation or shear, as one undo step (`symbol.instance.resetTransform`); an instance in perspective is left as it is. VectorCraft's own rules: each instance keeps the center of its bounding box in place, reflection is removed too, and the menu item and the button are enabled only while a selected instance would change. Tests: `tests::brushsym::reset_transformation_restores_the_symbols_scale_and_keeps_the_center`, `reset_transformation_leaves_unchanged_instances_and_refuses_bad_ids`, `panels::symbols::tests::reset_transformation_is_enabled_for_a_transformed_instance_and_resets_it`.
   - **Expand of dimensions:** Object › Expand, Expand Appearance, Create Outlines and Outline Stroke turn a dimension whose art they change into a plain group of that art, which stays as it is through later moves, scales and edits of what it measured; undo gives the live dimension back (`crates/engine/tests/it/dimensions.rs`; VectorCraft's own rule; estimated, score unchanged).
   - **Brush libraries** ([public source](https://helpx.adobe.com/illustrator/desktop/paint-and-fill/apply-and-edit-strokes/create-new-brush-libraries.html), [import](https://helpx.adobe.com/illustrator/desktop/paint-and-fill/apply-and-edit-strokes/import-brushes-from-brush-libraries-or-other-files.html), [Brushes panel](https://helpx.adobe.com/illustrator/desktop/paint-and-fill/apply-and-edit-strokes/brushes-panel-overview.html)): Window › Brush Libraries, the Brushes panel's Brush Libraries Menu and its menu's Open Brush Library open each library in a library panel of its own, as swatch, graphic style and symbol libraries do. The built-in libraries (Art Ribbons, Calligraphic Nibs, Pattern Borders, Scatter Shapes) are original brushes generated in code (`crates/engine/src/cmd/brushlib.rs`); Striped Ribbon's art is filled with the library's own pattern and Sparkles scatters the library's own symbol. A click on a brush adds it to the document's Brushes as one undo step with every resource its art uses (patterns, symbols, swatches, graphic styles, images), makes it the current brush and, with paths selected, applies it to them in the same step; a brush the document already has is not added again and a different brush of the same name comes in numbered ("Wave 2"). Shift/Cmd-clicks select brushes for Add to Brushes; a brush dragged onto a path is added and applied to it, and one dragged onto the Brushes panel is added. Save Brushes… / the Brushes panel's Save Brush Library… write the document's brushes (or the selected ones) as a `.vectorcraft` library into the `Brushes` folder next to the preferences, listed under User Defined, or to a file; Other Library… reads the brushes of any document VectorCraft opens. Thumbnails, in the library panels, the Brushes panel and Brush Options, render brush art with the patterns and symbols it uses. Copying brushed art now carries the patterns and symbols its brush's art uses too. Tests: `crates/engine/src/tests/brushlib.rs`, `crates/ui-egui/src/panels/tests_brush_libraries.rs`, `panels::brushes::tests::library_brush_previews_show_the_patterns_their_art_uses`, `canvas::tests::a_library_brush_dropped_on_a_path_is_added_and_applied_in_one_step`.
   - A canvas context menu: right-click selects the object under the pointer and lists what applies to the selection (Undo/Redo, clipboard, group, isolation, join, Remove Anchor Points when anchors are selected, masks, compound paths, guides, Transform, Arrange, Select, Export Selection), or the view commands on empty canvas.
@@ -787,6 +792,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - Shortcut sets other apps save as text (`.kys`) open in Import Shortcut Set from File › Open, from Edit › Keyboard Shortcuts › Import… in the desktop app, or from a drop on the window. It matches each entry to a tool, command or panel by name and decodes the file's key and modifier codes where VectorCraft's default shortcuts agree on them; the user answers the rest, and Apply fills the Keyboard Shortcuts dialog's working set. The answers are kept with the preferences for the next import (`shortcutSet.read`, `importMatches.*`).
   - Edit › Keyboard Shortcuts › Export Text… saves the set shown in the dialog as a UTF-8 text file, as the reference app's [Export keyboard shortcuts list as a text document](https://helpx.adobe.com/illustrator/desktop/get-started/preferences-and-settings/export-keyboard-shortcuts-list.html) page describes (`shortcuts.exportText {path?}`). The layout is VectorCraft's own: the set's name, then the Tools and Menu Commands rows in the dialog's order, each with its name, a tab and its shortcuts as the dialog shows them, and nothing after the tab for a row with no shortcut. Tests `shortcut_editor::tests::export_text_*` and `tests::picks::keyboard_shortcuts_export_text_writes_the_working_set_as_text`.
   - On Windows and Linux the app bar is the window's title bar (its own minimize, maximize and close buttons, drag to move, edges to resize), with the dragon app icon as the brand mark; dialogs and menus size to their content. As on a native menu bar, once one menu is open, moving the pointer onto another title opens that one.
+  - On Linux and the BSDs, Preferences › User Interface › VectorCraft Title Bar on Every Desktop (off by default) uses the app bar as the title bar from the next start in the sessions where the desktop would draw the window's frame (X11, Wayland compositors with server-side decorations such as KDE Plasma, a window opened through XWayland). System Title Bar and `VECTORCRAFT_TITLEBAR` take precedence over it.
   - Edit › Keyboard Shortcuts lists items of the menu bar and panel menus, as the reference app's [Customize keyboard shortcuts](https://web.archive.org/web/20221205131209id_/https://helpx.adobe.com/illustrator/using/customizing-keyboard-shortcuts.html) page describes for its Menu Commands. A menu command with no default shortcut that needs a value a key press does not give, such as File › Document Setup › Units (`document.setUnits {units}`), is listed only while the user has changed its shortcut. A command stays listed when a menu bar item runs it without a value or when it opens a dialog run without one, as the Variables panel's commands do.
   - A shortcut on the key left of 1 runs whatever character that key types, and Edit › Keyboard Shortcuts, the menus in the window, the command palette and tool tips show it as that character once the key has been pressed: `"` on a Turkish Q layout, `~` on a US layout as before. Shortcuts saved as `~` keep working (#4559).
   - On Windows a maximized window stays inside the work area with the taskbar on any edge (#3242, #3723).
@@ -871,7 +877,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
     View › Hide Edges hides the Live Corners widgets, the bounding box and the type widget, and the selection tools then do not answer a press on them or change the cursor over them.
   - **Blend spine Anchor Point tool (#2544):** on a selected blend, dragging a spine corner makes symmetric Smooth handles; the tool displays and picks existing spine handles when switched to, drags one independently or retracts it on click, and clicking a point with handles retracts both. The spine is edited live without moving its key objects. Windows native canvas checks and screenshots reviewed: symmetric and independent handles, corner/retraction, Shift constraints and perpendicular reshaping, tool switching, key preservation, Undo/Redo, save/reopen, hidden handles and overlapping Path/Blend priority (PR #2643). Behaviour reference: [public path-editing documentation](https://helpx.adobe.com/illustrator/using/adjust-path-segments.html).
   - **Path editing (#494):** the handles shown are the handles that drag: Direct Selection drags those of a path selected as a whole (as the Pen leaves it), the Anchor Point tool and Pen+Alt no longer grab handles that Show handles when multiple anchors are selected hides, a handle shorter than the tolerance leaves its anchor to be picked, and the anchor tools pick within Selection & Anchor Display › Tolerance. A dragged segment keeps a smooth anchor at either end smooth. With Direct Selection, the Pen, the Curvature and the anchor tools, a path selected as a whole shows all its anchors selected, and the Control bar and the Properties panel offer Convert (corner, smooth) for them too; Remove and Cut wait for anchors direct-selected (#504). A handle drag gathers its snap targets once per drag (it took 21 ms per pointer move on a 20,000-path document, now 1 ms; `vectorcraft-cli perf` measures handle and segment drags on a 5,000-anchor path). Join merges the selected anchor points that lie on one another, as after Average, into one anchor (#1582, fixes #1533); Object › Path › Average & Join… (`path.averageJoin`, Cmd+Alt+Shift+J, the "Create corner or smooth join" shortcut of [Default keyboard shortcuts](https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html)) moves two open path ends to their midpoint and joins them there, a corner or smooth point as its dialog's Points choice asks, in one undo step.
-  - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type. A series starts in greyscale; Group Selection's fill and stroke, and the paint, weight and opacity of a mark's top visible fill or stroke row after an Appearance command or the Eyedropper, are kept separately on the graph and reapplied when its data, type or size changes, and through save, open and undo. Graph Type's Override Calculated Values (both `axisMin` and `axisMax`) uses exactly that value-axis range, split into the tick count (5 when automatic). Line graphs take Edge-to-Edge Lines (off by default: the points sit at the centres of their categories; graphs saved before the option keep their edge-to-edge lines), and radar graphs follow Mark Data Points and Connect Data Points. Blank cells (an empty CSV cell or `null`) are values left out, not zeros: columns, bars and stacked segments skip them, lines and scatter lines break around them and the value axis ignores them, while area, pie and radar draw them as 0; a number in straight quotes is a label, and the data window writes it back quoted. Graph types combine: Graph Type on series picked with Group Selection (or `series` indexes) draws them as their own type, with column, stacked column, line and area mixing on the vertical value axis and bar and stacked bar on the horizontal one; stacked columns take one slot of the cluster, lines draw in front of columns and areas behind. The value axis goes on the left, the right or both sides (column, stacked column, line, area and scatter graphs; bar graphs keep theirs along the bottom), and Separate Scales gives the series assigned to the right axis a scale of their own with its own tick values. Each value axis takes tick marks of no, short or full (across the plot) length and a count per division, and a prefix and suffix for its numbers; the category axis takes tick marks too (none by default), at or between its labels. Graph designs: Object › Graph › Design lists the designs with a preview of the selected one, and New Design (the selected art), Rename, Delete Design, Paste Design (a copy back to edit) and Select Unused, and Marker draws the data points and legend swatches of line, scatter and radar series with a design, scaled so its backmost object fills the default marker's square. Graph Data transposes rows and columns and switches a scatter graph's x and y, and a `|` in a category or series label starts a new line. Pie graphs take Legends in Wedges, Position (Even, Ratio sized by area, Stacked on one centre) and Sort (None, All, First). Graph Type takes column and cluster widths up to 1000% (overlapping past 100%) with First Row and First Column in Front (First Row orders each series' categories; across series the series order decides, so series stay one group each for Group Selection), draws filled lines, adds drop shadows behind columns, bars, lines and wedges, and puts the legend in rows across the top. Text formatted with the Character or Appearance controls, on the whole graph or on labels picked with Group Selection, is kept per kind of label (value axis numbers, category labels, legend labels) through the graph being drawn again. Object › Graph › Data opens a worksheet: cells picked with a click and edited above the sheet (Tab moves right, Enter down, the arrows between cells), Import Data from a tab-separated text file, Transpose, Switch x/y, Cell Style (decimals shown, column width), Revert and Apply. `graph.setData` returns and takes the data as CSV with each value written exactly, not rounded to two decimals, so applying the returned CSV changes nothing (#1485).
+  - **Graphs:** Column, Stacked Column, Bar, Stacked Bar, Line, Area, Scatter, Pie and Radar graph tools with Graph Data and Graph Type. A series starts in greyscale; Group Selection's fill and stroke, and the paint, weight and opacity of a mark's top visible fill or stroke row after an Appearance command, the Eyedropper, a graphic style, Default Fill and Stroke or Swap Fill and Stroke, are kept separately on the graph and reapplied when its data, type or size changes, and through save, open and undo. Graph Type's Override Calculated Values (both `axisMin` and `axisMax`) uses exactly that value-axis range, split into the tick count (5 when automatic). Line graphs take Edge-to-Edge Lines (off by default: the points sit at the centres of their categories; graphs saved before the option keep their edge-to-edge lines), and radar graphs follow Mark Data Points and Connect Data Points. Blank cells (an empty CSV cell or `null`) are values left out, not zeros: columns, bars and stacked segments skip them, lines and scatter lines break around them and the value axis ignores them, while area, pie and radar draw them as 0; a number in straight quotes is a label, and the data window writes it back quoted. Graph types combine: Graph Type on series picked with Group Selection (or `series` indexes) draws them as their own type, with column, stacked column, line and area mixing on the vertical value axis and bar and stacked bar on the horizontal one; stacked columns take one slot of the cluster, lines draw in front of columns and areas behind. The value axis goes on the left, the right or both sides (column, stacked column, line, area and scatter graphs; bar graphs keep theirs along the bottom), and Separate Scales gives the series assigned to the right axis a scale of their own with its own tick values. Each value axis takes tick marks of no, short or full (across the plot) length and a count per division, and a prefix and suffix for its numbers; the category axis takes tick marks too (none by default), at or between its labels. Graph designs: Object › Graph › Design lists the designs with a preview of the selected one, and New Design (the selected art), Rename, Delete Design, Paste Design (a copy back to edit) and Select Unused, and Marker draws the data points and legend swatches of line, scatter and radar series with a design, scaled so its backmost object fills the default marker's square. Graph Data transposes rows and columns and switches a scatter graph's x and y, and a `|` in a category or series label starts a new line. Pie graphs take Legends in Wedges, Position (Even, Ratio sized by area, Stacked on one centre) and Sort (None, All, First). Graph Type takes column and cluster widths up to 1000% (overlapping past 100%) with First Row and First Column in Front (First Row orders each series' categories; across series the series order decides, so series stay one group each for Group Selection), draws filled lines, adds drop shadows behind columns, bars, lines and wedges, and puts the legend in rows across the top. Text formatted with the Character or Appearance controls, on the whole graph or on labels picked with Group Selection, is kept per kind of label (value axis numbers, category labels, legend labels) through the graph being drawn again. Object › Graph › Data opens a worksheet: cells picked with a click and edited above the sheet (Tab moves right, Enter down, the arrows between cells), Import Data from a tab-separated text file, Transpose, Switch x/y, Cell Style (decimals shown, column width), Revert and Apply. `graph.setData` returns and takes the data as CSV with each value written exactly, not rounded to two decimals, so applying the returned CSV changes nothing (#1485).
   - **Graph column designs:** Object › Graph › Column (`graph.column`) draws the columns, bars or stacked segments and the legend swatch of the series picked with Group Selection with a graph design: Vertically Scaled stretches it to each column's length, Uniformly Scaled scales it both ways and centers it, Repeating stacks a copy for each Each Design Represents value and chops or scales the last one (For Fractions), and Sliding keeps the part above the design's guide line in proportion and stretches the part below. The dialog lists the designs with a preview; the choice is saved with the graph and follows the design's rename and delete.
     Type in a column design that holds a `%` followed by two digits shows each column's value in place of the `%` and the digits: the first digit is the least number of places before the decimal point (zeros are added in front; 0 gives as many as the value needs), and the second digit sets the places after it, rounded. Unless it is inside a group that clips or has its own opacity or appearance, or inside a blend, compound shape, envelope, repeat or intertwined objects, the type keeps its size and is drawn once per column in a repeating design. The legend swatch leaves it out.
   - **Other:** Eyedropper, Gradient annotator, Artboard (Alt-drag duplicates an artboard, and its art with Move/Copy Artwork with Artboard on; Copy, Cut and Paste take the artboard with its art, Paste right of the last artboard, Paste in Place where it was, into this or another document, #446; Object › Artboards › Rearrange All Artboards lays them out in a grid by row or by column, in one row or one column, left to right or right to left, from the menu, the Artboards panel or Properties' Rearrange All, #681; Scale Artwork with Artboard, in the Control bar and Properties beside Move Artwork with Artboard, resizes the artboard proportionally with the art fully inside it and its guides, strokes and corners per the Scale preferences, #602), Measure, Type, Hand, Zoom, Rotate View.
@@ -981,6 +987,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - Extrude & Bevel and Inflate treat strokes as outlined: each visible stroke builds a solid from its outline in its own paint beside the top fill's ([three-d.md](three-d.md#fills-and-strokes)).
   - Extrude & Bevel, Inflate and Rotate apply to type: it makes a solid of its glyph outlines, painted with its own fills and strokes or, when it has none, its characters' colour (the first run's), and stays type, so editing the text reshapes the solid (#4715).
   - Extrude & Bevel, Inflate and Rotate (Effect › 3D and Materials): live effects in the `three-d` crate with depth, twist, taper, solid or hollow caps, five original bevel shapes (width, height, repeat, spacing, inside, both sides), Inflate's volume, both sides, twist, taper and cap, Rotate's turned fills and strokes, Position presets, the rotation and light gizmos, SVG/PDF vector output and Expand Appearance; one 3D effect per object; covered by geometry, effect, canvas-versus-export, command and dialog tests ([three-d.md](three-d.md)).
+  - Export 3D Object (Asset Export's menu): an object with Extrude & Bevel, Revolve, Inflate or Rotate becomes a 3D asset whose Format is USDA (the default), USDZ, glTF or OBJ, and Export writes each of its solids as a mesh with a material in its paint's color (`assets.add3D`, `assets.set3DFormat`, `assets.export3D`; [export 3D vector artwork](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/create-3d-graphics/export-3d-vector-artwork.html)).
   - Initial live Revolve (#605, #846): a portable geometry and shading crate (`three-d`), editable path and compound profiles, compact options with artboard rotation and light gizmos, SVG/PDF vector output and Expand Appearance that can trim covered faces. Open ends have continuous caps by default, shading is smooth with one to ten colored lights, and intersecting surfaces' visibility is approximate ([revolve.md](revolve.md)).
   - Live effects with previewing dialogs: Distort & Transform, Path, Convert to Shape, 15 Warp styles, Round Corners, Scribble, Effect → Pathfinder (all 10 operations, live on groups; several loose objects are grouped first, in one undo step), Color Adjustments (Brightness/Contrast, Curves, Levels, Hue/Saturation, Shift to Color, Temperature/Tint, on vectors, live type and embedded images), and raster drop shadow, glows and feather. SVG and PDF export keep live effects (geometry baked; SVG raster effects as filters). Zig Zag spaces its ridges evenly along each segment, so lines and curves get a regular wave in Corner and Smooth (#1558). Warp › Arc (the effect and Envelope › Make with Warp) bends in the object's real proportions: a circular arc with concentric edges and no fold-over at 100%, so Arc on art that isn't square draws differently from before (#1581, fixes #1578). `effect.apply` and `effect.setParams` give an error for a misspelt or wrongly typed effect parameter instead of running the effect with its default (#1623, #1592). Roughen with Smooth keeps turn-backs smooth instead of making cusps that draw as spikes (#1646, #1643). Scribble draws one zig-zag per region, with no lines across holes and notches; convex shapes are unchanged (#1651, #1648). On the canvas, in Expand Appearance and in exports, Effect → Pathfinder uses the glyph outlines of type in the group, and results painted like the type keep its opacity and blend mode.
   - Cmd/Ctrl+4 (`pathfinder.repeat`) repeats the last successful Pathfinder panel operation, direct `object.pathfinder.*` command or `command.batch` step (including Actions playback) on the current selection; the panel menu names it. `action.batch`, Trap, compound-shape edits and live effects do not set history. Public references: [Default keyboard shortcuts](https://web.archive.org/web/20260726060015/https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html), [Pathfinder panel overview](https://helpx.adobe.com/illustrator/desktop/manage-objects/reshape-transform-objects/pathfinder-panel-overview.html).
@@ -1014,7 +1021,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 - **Recent font pickers (#3515):** The shared Character, Properties, Glyphs and Find Font family picker lists recently applied families first, once each, in most-recent order and limited by Preferences › Type › Number of Recent Fonts. Search and filters apply to both sections; unavailable families are omitted. Section headings cannot be selected or previewed. Confirmed character-range font edits update the same saved history; previews and failed edits do not. Requirement: [issue #3515](https://github.com/storytold/vectorcraft/issues/3515).
 - **Find Font: Replace With Font From:** a dropdown under Replace With Font chooses the list the replacement font comes from: Document lists the families the document uses, once each; Recent lists the recently applied families that are installed (fonts applied with Find Font's Change and Change All included), newest first, as many as Preferences › Type › Number of Recent Fonts allows; System, the default, lists the installed families available in the font menu. The dialog opens on System with Source Sans 3 chosen, or the font menu's first family when Source Sans 3 is not installed. Choosing a list keeps the chosen font when the list has it and it is installed; otherwise Document and Recent choose the list's first installed font, and System chooses Source Sans 3 or the font menu's first family. Change and Change All are unavailable when the list has no installed font (Recent before any font was applied) and when the chosen family is not installed or is not in the shown list. Behavior reference: [Find and replace fonts](https://helpx.adobe.com/illustrator/desktop/design-with-text/fonts-and-scripts/find-and-replace-fonts.html) (public documentation). Tests: `crates/ui-egui/src/find_font.rs`.
 - **Mouse wheel over the font family field (#5253):** In the Character and Properties panels and the Control bar, turning the mouse wheel over the closed font family field applies the next family to the selected type (the previous one when turned up), keeping the style when the family has it, else its closest. Each notch is one undo step; leaving the field or Escape keeps the family, and Undo takes it back. The steps use the font menu's order at the first turn and keep it until the pointer leaves the field or the text selection changes, so recent-font updates do not reshuffle later turns. That order follows the menu's saved font filters but ignores its search text, puts recent families first, and stops at the first and last family. A turn with a modifier key is left to the panel and the canvas. Behavior reference: the [Illustrator CS6 reference](https://help.adobe.com/archive/en/illustrator/cs6/illustrator_reference.pdf#page=10) describes editing hovered dropdown controls with the mouse wheel; [Find and apply fonts](https://helpx.adobe.com/illustrator/desktop/design-with-text/fonts-and-scripts/find-and-apply-fonts.html) names the family field's places. Applying it to the font field, the order, the ends and the undo steps are VectorCraft's own rules. Tests: `crates/ui-egui/src/tests/font_menu.rs`, `crates/ui-egui/src/font_menu/tests.rs`, `crates/ui-egui/tests/font_wheel.rs`.
-- **Type:** Character size, leading, baseline shift and horizontal-scale controls account for object/group transforms (#1034): exact document-point sizes, mixed-value display and keyboard increments, range edits, resettable horizontal stretch, undo/redo and native save/reopen (`tests_typescale`, Character panel tests). Point size is the transformed em-height axis, independent of glyph ink bounds; affine rotation, reflection and shear are retained. Group scaling still scales text; preserving font sizes is a separate enhancement. Behaviour reference: [Transform text](https://helpx.adobe.com/illustrator/desktop/design-with-text/edit-format-text/transform-text.html) (public documentation). Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), paragraph attributes per paragraph (alignment, indents, spacing, hyphenation, hanging punctuation, tab stops, paragraph style, direction, mojikumi and leading model; the Paragraph, Tabs and Paragraph Styles panels act on the paragraphs the Type tool's selection or caret touches, Return continues the paragraph's style, threads and SVG keep them), Area Type Options (rows/columns/inset/first baseline, Text Flow by rows or by columns (#4978), vertical Align Top/Center/Bottom/Justify per row/column, reflowing non-rectangular frames and text wrap), threaded text across any closed shapes, Fit Headline, the Every-line Composer for justified and ragged text (paragraph-wide breaks for an even rag, Single-line per object from the Paragraph panel menu or `text.setFormat {composer}`). Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`), and an anchor of the path of type on a path outside perspective, the type reflowing along it (`text.reshapePath`, #3980). Point type still scales. Auto Size: the frame height follows the text after every edit, in the same undo step (rectangular frames of horizontal type in one row; columns get the least height that holds them; a height set by hand or threading turns it off), and the "Auto Size New Area Type" preference gives it to new area type. Shrink Text to Fit (beyond Illustrator): overflowing area type scales its sizes, leading and baseline shifts down by the largest factor (in 0.1 pt steps of the first run, down to a minimum percentage) that fits, at layout time so every export sees it. `text.areaOptions` and `document.inspect` report overflow and the shrink factor. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. The Character panel's Variable Font sliders set each axis (see Fonts). Beyond Illustrator: inline graphics (`text.insertInline`, Type ▸ Insert Inline Symbol) set a document symbol in a run of type as one character that flows, wraps and justifies like a glyph (InDesign-style inline objects, e.g. mana symbols in card rules text): sized to a multiple of the font size, centred on the cap height, opening up tall lines, following Redefine Symbol; a character of its run's size for Character Alignment and Top-to-Top leading, placed by the bidi reordering in right-to-left text (a neutral U+FFFC); drawn on the canvas, kept as live text plus a `<use>` in SVG and as vector art in PDF; Backspace removes it whole. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Arabic typefaces: builds made with a craft-fonts checkout that holds its Arabic families (Noto Sans Arabic, the Arabic fallback, plus Cairo, Tajawal, Almarai, IBM Plex Sans Arabic, Noto Kufi Arabic, Amiri, Alexandria, Fustat, Reem Kufi, Aref Ruqaa and Gulzar once craft-fonts adds them, storytold/craft-fonts#11; releases get them when their craft-fonts pin moves) list them in the font menus on desktop; the web build fetches them from beside the wasm (Noto Sans Arabic before start, so Arabic never shows as boxes, the rest in the background). Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458). Type › Bold and Italic (beyond Illustrator, as page layout apps have them; Cmd+Shift+B / Cmd+Shift+I while the Type tool edits text) switch the selected type to its family's own Bold or Italic face and back, keeping its width (a Narrow face stays Narrow); a family without that face says so (#724). The commands that make or restyle type (and the MCP `add_text` tool) say in their result when area type does not fit its frame, and `add_text` takes Auto Size and Shrink Text to Fit (#1500, fixes #1471). Cmd+Shift+C (Align center) works on Windows and Linux too (#1940). A double-click on area type's bottom middle handle turns on Auto Size (#1940). Print and Print Preview warn about the area type and type on a path that prints without the text that doesn't fit, and give their ids. A tab stop in the Tabs panel drags from where the press landed, a stop just added included (#1487, fixes #1458). Area type in a non-rectangular shape moves a word too wide for the top lines down to the first line that holds it instead of breaking it (#1617, fixes #1615). Stylistic sets (ss01–ss20), stylistic and titling alternates, proportional and lining figures, and superscript and subscript glyphs can be turned on as OpenType features of a character style (`text.setStyle {features}`), and the OpenType panel keeps them (#1611, fixes #1607). Escape while typing ends the edit, keeps the type selected and switches to the Selection tool (#1802, #1686, #1656). Select › Same matches type on its characters' fill and stroke (#1746, #1737). `text.create`, `text.createInPath` and the MCP `add_text` tool take `justify`, so point type can be centred on or end at its point (#1752, #1748).
+- **Type:** Character size, leading, baseline shift and horizontal-scale controls account for object/group transforms (#1034): exact document-point sizes, mixed-value display and keyboard increments, range edits, resettable horizontal stretch, undo/redo and native save/reopen (`tests_typescale`, Character panel tests). Point size is the transformed em-height axis, independent of glyph ink bounds; affine rotation, reflection and shear are retained. Group scaling still scales text; preserving font sizes is a separate enhancement. Behaviour reference: [Transform text](https://helpx.adobe.com/illustrator/desktop/design-with-text/edit-format-text/transform-text.html) (public documentation). Text Wrap, Type on a Path effects (Rainbow/Skew/3D Ribbon/Stair Step/Gravity) and Options (Flip, Align to Path, Spacing; OK keeps the type where it is), type on a path's start, centre and end brackets (Selection and Direct Selection drag them to set where the type runs, slide it along its path and, across the path, flip it: #429), Character and Paragraph Styles (override-preserving redefine), paragraph attributes per paragraph (alignment, indents, spacing, hyphenation, hanging punctuation, tab stops, paragraph style, direction, mojikumi and leading model; the Paragraph, Tabs and Paragraph Styles panels act on the paragraphs the Type tool's selection or caret touches, Return continues the paragraph's style, threads and SVG keep them), Area Type Options (rows/columns/inset/first baseline, Text Flow by rows or by columns (#4978), vertical Align Top/Center/Bottom/Justify per row/column, reflowing non-rectangular frames and text wrap), threaded text across any closed shapes, Fit Headline, the Every-line Composer for justified and ragged text (paragraph-wide breaks for an even rag, Single-line per object from the Paragraph panel menu or `text.setFormat {composer}`). Area type resizes like Illustrator's type areas: a bounding-box handle drag (Selection tool) or Area Type Options Width/Height size the frame and the text reflows at its size (threads too); Direct Selection drags a frame corner or edge (`text.reshapeArea`), and an anchor of the path of type on a path outside perspective, the type reflowing along it (`text.reshapePath`, #3980). Point type still scales. Auto Size: the frame height follows the text after every edit, in the same undo step (rectangular frames of horizontal type in one row; columns get the least height that holds them; a height set by hand or threading turns it off), and the "Auto Size New Area Type" preference gives it to new area type. Shrink Text to Fit (beyond Illustrator): overflowing area type scales its sizes, leading and baseline shifts down by the largest factor (in 0.1 pt steps of the first run, down to a minimum percentage) that fits, at layout time so every export sees it. `text.areaOptions` and `document.inspect` report overflow and the shrink factor. The Selection tool shows the type widget beside selected type's bounding box (hollow on point type, filled on area type); double-clicking it converts between them (Type › Convert To Area Type / Convert To Point Type), keeping the text and its styles in place. Variable fonts list every named instance as a style of their family (Figtree Light to Black and their italics, Bahnschrift, Segoe UI Variable), and the instance chosen is shaped, drawn, outlined and measured at its axis settings; PDF and SVG embed it as that instance. The Character panel's Variable Font sliders set each axis (see Fonts). Beyond Illustrator: inline graphics (`text.insertInline`, Type ▸ Insert Inline Symbol) set a document symbol in a run of type as one character that flows, wraps and justifies like a glyph (InDesign-style inline objects, e.g. mana symbols in card rules text): sized to a multiple of the font size, centred on the cap height, opening up tall lines, following Redefine Symbol; a character of its run's size for Character Alignment and Top-to-Top leading, placed by the bidi reordering in right-to-left text (a neutral U+FFFC); drawn on the canvas, kept as live text plus a `<use>` in SVG and as vector art in PDF; Backspace removes it whole. Hebrew and Arabic are laid out right to left with the Unicode bidirectional algorithm (embedded Latin and numbers keep their direction, lines put in visual order after wrapping) in point, area and path type, with caret, selection and arrow keys in visual order; each paragraph's direction comes from its first strong character unless Paragraph Direction sets it (Paragraph panel with Show Indic Options, `text.setFormat {direction}`), and new type aligns to the start of its direction. SVG export outlines right-to-left text. Arabic typefaces: builds made with a craft-fonts checkout that holds its Arabic families (Noto Sans Arabic, the Arabic fallback, plus Cairo, Tajawal, Almarai, IBM Plex Sans Arabic, Noto Kufi Arabic, Amiri, Alexandria, Fustat, Reem Kufi, Aref Ruqaa and Gulzar once craft-fonts adds them, storytold/craft-fonts#11; releases get them when their craft-fonts pin moves) list them in the font menus on desktop; the web build fetches them from beside the wasm (Noto Sans Arabic before start, so Arabic never shows as boxes, the rest in the background). Font Size and Leading are combo boxes in the Character and Properties panels (Font Size in the Control bar too, beside the Character link, font family and style): type, step with ↑/↓ or the spinner, scrub the label, or pick a preset (6–72 pt, shown in the type unit; Leading also Auto), each pick one undo step; Kerning and Tracking list -100…200; a size, leading, kerning or tracking the selected text doesn't share shows blank (#458). Type › Bold and Italic (beyond Illustrator, as page layout apps have them; Cmd+Shift+B / Cmd+Shift+I while the Type tool edits text) switch the selected type to its family's own Bold or Italic face and back, keeping its width (a Narrow face stays Narrow); a family without that face says so (#724). The commands that make or restyle type (and the MCP `add_text` tool) say in their result when area type does not fit its frame, and `add_text` takes Auto Size and Shrink Text to Fit (#1500, fixes #1471). Cmd+Shift+C (Align center) works on Windows and Linux too (#1940). A double-click on area type's bottom middle handle turns on Auto Size (#1940). Print and Print Preview warn about the area type and type on a path that prints without the text that doesn't fit, and give their ids. A tab stop in the Tabs panel drags from where the press landed, a stop just added included (#1487, fixes #1458). Area type in a non-rectangular shape moves a word too wide for the top lines down to the first line that holds it instead of breaking it (#1617, fixes #1615). Stylistic sets (ss01–ss20), stylistic and titling alternates, proportional and lining figures, and superscript and subscript glyphs can be turned on as OpenType features of a character style (`text.setStyle {features}`), and the OpenType panel keeps them (#1611, fixes #1607). Escape while typing ends the edit, keeps the type selected and switches back to the tool that was active before type editing began (kept while clicks move editing to other text), or to the Selection tool when there was none (#1802, #1686, #1656). Select › Same matches type on its characters' fill and stroke (#1746, #1737). `text.create`, `text.createInPath` and the MCP `add_text` tool take `justify`, so point type can be centred on or end at its point (#1752, #1748).
   The Character panel menu's Show Font Height Options shows a Set Font Height Reference dropdown under Font Size (`text.setFormat` or `text.setRangeStyle` `{fontHeightReference}`). With Em Box, the default, the font size is the size of the em square; with Cap Height, x-Height or ICF Box, the characters are set at the em size at which the font's OS/2 cap height, its x height or the height of its ideographic character face equals the font size. With a font that has no such value, or one outside 0.1 to 2 em, the size measures the em box. SVG, PDF and legacy `.ai` export and the CSS Properties rules write the em size the characters are drawn at, and DXF export writes 0.7 times that em size as each TEXT entity's height (group 40, the height of its capitals). Behavior reference: [Vary font height](https://web.archive.org/web/20251118174722/https://helpx.adobe.com/illustrator/desktop/design-with-text/edit-format-text/vary-font-height.html).
   The Every-line Composer composes a paragraph whose characters differ in line metrics (type size, font, leading or vertical scale, or an inline graphic taller than the text) in rectangular area type, rows and columns included. In area type of another shape, or with text wrap, such a paragraph is broken with the Single-line Composer.
   The Character panel's Small Caps, Superscript and Subscript buttons and the panel menu's items of the same names turn small caps and the superscript or subscript position on and off for the selected type, or for the text the Type tool has selected (`text.setFormat` or `text.setRangeStyle` `{smallCaps, position}`), in Document Setup's proportions. Turning Superscript on turns Subscript off, and turning Subscript on turns Superscript off. A button or item shows as on when the first selected character (at a caret, the character before it) has its attribute.
@@ -1056,6 +1063,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   While no type is being edited, a press with Shift held makes new type with the horizontal or vertical counterpart of the Type, Area Type or Type on a Path tool chosen, and a press with Alt (Option) held makes it with Type on a Path in place of Area Type or the reverse, in the chosen tool's writing direction; with both keys held, both switch ([Default keyboard shortcuts](https://web.archive.org/web/20260726060015/https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html)). The pointer shows the tool the press acts as, and the tool chosen stays selected.
   The Type tool starts a list from the characters [Create bulleted or numbered lists](https://web.archive.org/web/20260417034638/https://helpx.adobe.com/illustrator/desktop/design-with-text/edit-format-text/create-bulleted-or-numbered-lists.html) names (`text.startList`): a space typed on its own after `1.`, `1)`, `A.` or `A)` at the start of a paragraph in no list makes the paragraph a numbered list in 1, 2, 3 or A, B, C, and a space typed after `*`, `+`, `#` or `>` makes it a bulleted list with the filled dot, the hollow circle, the filled square or the dash (a VectorCraft choice: the page does not say which bullet each character gives). The typed characters are removed, and one Undo puts them back as text with no list. The same characters later in a paragraph, and pasted list characters, start nothing.
   PDF export writes bullets and numbers as text, in the glyphs and at the places the canvas draws them, in area type, type on a path, right-to-left paragraphs and threaded frames, and a PDF viewer selects, copies and finds them; a marker glyph that stands for no character is drawn as a path.
+  SVG export writes type on a path with the Skew, 3D Ribbon, Stair Step or Gravity effect as outlines, with a warning, so the file draws the type as the canvas does.
   The Character panel menu's Character Direction (with the Indic options; `text.setFormat {charDirection}`, `text.setRangeStyle {charDirection}`) sets the selected characters left to right or right to left inside their paragraph, as a Unicode bidi embedding: a date set Left to Right keeps its order in right-to-left text, and a word set Right to Left keeps the punctuation after it on its left. Default (the default) leaves the characters to the bidi algorithm; character styles and the native file keep the setting.
   In vertical type, the Tabs panel names its alignment buttons Top-Justified Tab, Center-Justified Tab, Bottom-Justified Tab and Decimal-Justified Tab, in their tool tips and for screen readers, and labels the position field Y. In horizontal type the buttons keep the names Left-Justified Tab and Right-Justified Tab, and the field keeps the label X.
   The Tabs panel's ruler is numbered in the General unit with the canvas rulers' label steps and a tick every tenth of a step. With the panel menu's Snap to Unit on, or Shift held, a tab stop placed by a click on the ruler or dragged on it lands on the nearest tick (`text.tabs.set`).
@@ -1292,6 +1300,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
     A `.ai` or EPS opened from its editing data keeps each artboard's center mark, cross hairs, video safe areas and video ruler pixel aspect ratio, and the file's Document Raster Effects Settings; the author comes from the header's `%%For` (the editing data's, else an EPS's own) when the file's File Info gives none, the header's custom colors that no swatch has come in as spot swatches, a named color the file defines takes the place of a default swatch of that name when the file has no palette, and an older file's `%%TemplateBox` places its artboard. A value of another type or out of range keeps its default (`crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`, `crates/engine/src/cmd/fileio/tests_aiimport.rs`).
     A `.ai` opened from its editing data opens its Objects on Path groups live, with their path, their objects in order along it, Pivot and Rotate, and their art where the file draws it; a group whose spacing has been dragged, or with options an Objects on Path group doesn't hold, opens as a plain group (`crates/eps/src/import/ai/tests.rs`).
     `.ai` symbol definitions and placed instances open as live symbols, in the Symbols panel's order; an instance of a symbol that isn't read, or whose appearance differs from its symbol's, comes in as the page draws it (`crates/eps/src/import/ai/tests.rs`).
+    In a `.ai` opened from its editing data, an object in a pattern's art or a brush's art with an art style VectorCraft reads opens as itself with its effects live, as an object on a layer does, and an object in a pattern's art keeps the id of a graphic style in the file's list (`crates/eps/src/import/ai/tests.rs`).
     Blends and envelopes in the definitions of a `.ai`'s symbols, patterns and brushes' art count against the same per-file limits on blend layout and envelope checks as the layers' art, so a file with many definitions does not get those limits again for each one (`crates/eps/src/import/ai/read/directives.rs`).
     A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art. A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. An Art brush in Tints keeps that colorization. Pattern brushes and brushes that can't be read are left out with a note. Paths with a Calligraphic brush, and paths with an Art brush at 100% in Tints that stretches art of solid-filled paths unflipped, open as the path with the brush on its stroke, and other brushed paths still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`).
     In a `.ai` opened from its editing data, a path or type object with Offset Path, Outline Object or Outline Stroke on the whole object opens as itself with those effects live, in their order and shown or hidden; on a fill or stroke of type they stay on that fill or stroke. Offset Path keeps its Offset, Joins and Miter Limit, and Outline Stroke takes its width from the stroke. An Offset Path with a setting missing, out of range or not read keeps the drawn art, as does a path with a Path effect on one fill or stroke (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`).
@@ -1307,10 +1316,12 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
     A `.ai` or EPS opened from its editing data with one object on a shown layer that the reader can't read (an unknown operator inside a group, a pattern fill whose pattern it doesn't have, a symbol instance, a placed file without a usable preview) keeps its layers and groups: in that object's place, its layer gets a group of the page's objects inside the object's box, named after it, with a warning that lists what came in as the page's art and an export or Save As to its own path asking first (`acknowledgeLoss`). The file still opens from its page or PDF part when no box can be found, when live art or another unread object shares the page art inside it, when the object spans two artboards, or when the page art doesn't carry the object's transparency (#4806; `crates/eps/src/import/tests_native.rs`, `crates/engine/src/cmd/fileio/tests_aiimport.rs`).
     In a `.ai` opened from its editing data, an envelope made with a warp, a mesh or a top object opens as a live envelope of its contents, with its warp style, bend and distortions, its mesh points and handles or its top object's outline, its Envelope Options, its Fidelity and whether its contents are being edited. When Distort Appearance is on and the size the file saves for the contents matches their bounds with strokes, the contents map from that stroked box, until an edit in Edit Contents changes how far the strokes reach; VectorCraft's new envelopes map from the geometric box, as do contents with no width or no height, such as a single straight line. An envelope that can't be read, or that VectorCraft draws differently from the file's drawn art, keeps that drawn art, with a note. An envelope of type keeps its drawn art, with its type hidden (`crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`).
     In a `.ai` opened from its editing data, Convert to Shape on a whole path or type object opens as a live Rectangle, Rounded Rectangle or Ellipse effect with its Absolute or Relative size, its corner radius, its place among the object's effects and whether it is hidden. A relative size in the file is added to each side. A relative Ellipse, or a setting VectorCraft doesn't read, keeps the drawn art (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`).
+    In a `.ai` opened from its editing data, Bas Relief in an art style takes its Detail, Smoothness and Light direction from the style's settings block, and an object other than type with it opens as itself with the live effect. A settings block that VectorCraft can't read (malformed, another effect's, a value out of range or a key it doesn't know) keeps the object's drawn look (part of #637; [raster effects reference](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/raster-effects-reference.html), [Photoshop File Formats Specification](https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/), [scripting the filter gallery](https://community.adobe.com/questions-712/scripting-support-for-the-filter-gallery-1064646); `crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`).
     PDF export and `.ai` saves write a page with a side longer than 14,400 pt with a `UserUnit` (PDF 1.6), its longer side divided by 14,400 and rounded up to the next thousandth, so that no side is longer than 14,400 units (ISO 32000-1, Annex C.2); in PDF 1.3 to 1.5 files and PDF/X files such a page is written in points.
     PDF export warns when a PDF/X file has no bleed on a side where the document's bleed has one, and writes the file as asked.
     Placed (linked) files in a `.ai`'s editing data come in as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (a file found next to the document, at its path, or in the folder the editing data names relative to the document's, such as `src/`, is read as the document opens, and its link takes that file's size, modification time and hash). A file with them no longer falls back to its PDF part, so its guides, sublayers and hidden objects open (#1264; `crates/eps/src/import/ai/tests.rs`, `crates/engine/src/tests/links.rs`). In a file opened that way, a gradient with stops in the middle runs its whole ramp across its shape and a gradient object no longer passes its fill to the next path (#1390); text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line, the frame made taller with a warning in the open result (#1392).
     Placed (linked) files in a `.ai`'s editing data come in as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (a file found next to the document or at its path is read as the document opens). A file with them no longer falls back to its PDF part, so its guides, sublayers and hidden objects open (#1264; `crates/eps/src/import/ai/tests.rs`, `crates/engine/src/tests/links.rs`). In a file opened that way, a gradient with stops in the middle runs its whole ramp across its shape and a gradient object no longer passes its fill to the next path (#1390); text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line, the frame made taller with a warning in the open result (#1392).
+    A placed PDF or `.ai` file in a `.ai`'s editing data comes in as a placed document instead of a linked image: it shows the page and Crop to box its dictionary names, and the preview the file keeps until its file is found, then the page as vectors. A placed file in opacity-mask art keeps showing its preview (`crates/eps/src/import/ai/tests.rs`, `crates/engine/src/tests/placed_document.rs`).
     In a `.ai` or EPS opened from its editing data, and in a legacy `.ai`, each anchor is smooth or a corner as the case of the segment operator ending on it says (`l`, `c`, `v`, `y` smooth; `L`, `C`, `V`, `Y` corner), and a closed path's first anchor takes the case of the segment back to it; points and handles stay where they are. Paths, compound paths, clipping paths, guide paths, area type frames and type-on-a-path paths all keep it (`crates/eps/src/import/ai/tests.rs`, `crates/eps/src/legacy_ai/tests.rs`).
     In `.ai` and EPS editing-data import, a clipping group, layer or opacity mask's art with several clipping paths (`W`) clips to their intersection: each clipping path after the first clips a clipping group nested inside the one before it, and each keeps its own stroke and transparency. A compound path of clipping paths (`*u` … `*U`) is still one clipping path, and clipping paths that would nest the art past the document's 32 levels stop the editing data from being read (`crates/eps/src/import/ai/tests.rs`).
     `.ai` and EPS editing-data import keeps template layers, and opens canvas and artboard ruler guides as ruler guides on their layers; guide objects stay editable guide paths (#779; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`).
@@ -1335,7 +1346,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - EPS and PostScript import keeps a CMYK image's ink amounts, as PDF import does: the samples of `image` and `colorimage` in a CMYK color space, and of a CMYK JPEG read through `DCTDecode`, come in as a CMYK TIFF, read through the image's Decode array, and the pixels a `MaskColor` or `ImageType 3` mask hides become a grayscale opacity mask (`crates/eps/src/import/tests_images.rs`). Such images came in as RGB PNGs.
   - EPS and PostScript import reads image data through `CCITTFaxDecode`: Group 4 (ITU-T T.6) and Group 3 one-dimensional and mixed (ITU-T T.4) data, with the filter's `K`, `Columns`, `Rows`, `EndOfBlock`, `EndOfLine`, `EncodedByteAlign` and `BlackIs1` parameters, decodes to 1-bit rows for `image` and `imagemask`. Damaged data keeps the rows decoded before it (damage in the first row is a PostScript `ioerror`), and parameters out of range or past the 256 MiB limit on decoded data are refused (`crates/eps/src/import/tests_images.rs`). Reading such a file stopped at an error naming the filter, and the file opened from a fallback, such as its preview or the art drawn before the image, or did not open.
   - EPS and PostScript `.ai` import undoes the TIFF predictor (`/Predictor 2`) of `FlateDecode` and `LZWDecode` data at 1, 2, 4 and 16 bits a component as well as 8: each component adds the same component of the pixel to its left within its bit width, 16-bit components add as big-endian numbers, and each row starts again (ISO 32000-1 §7.4.4.4; `crates/eps/src/import/tests_images.rs`, `crates/engine/src/cmd/fileio/tests_epsimport.rs`). At those depths the image drew the stored differences instead of its samples.
-  - DXF control-point SPLINE import honors its closed flag (#1299 follow-up after #1320 fixed export), including rational curves; open curves whose endpoints meet stay open. Own-fixture regressions cover controls/knots, fit-point fallback and all export versions (`crates/cad/src/import/tests.rs`, `crates/cad/src/tests.rs`); native save/read checked. Circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE, and a non-circular ellipse keeps the existing fallback (`crates/cad/src/tests.rs`); an open path of one straight segment exports as a LINE (R12 to R14 strokes with a weight stay polylines, which carry the width) and reads back as the same segment (`crates/cad/src/tests.rs`, `crates/cad/src/import/tests.rs`); CNC preset and VCarve QA remain pending.
+  - DXF control-point SPLINE import honors its closed flag (#1299 follow-up after #1320 fixed export), including rational curves; open curves whose endpoints meet stay open. Own-fixture regressions cover controls/knots, fit-point fallback and all export versions (`crates/cad/src/import/tests.rs`, `crates/cad/src/tests.rs`); native save/read checked. Circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE, and a non-circular ellipse keeps the existing fallback (`crates/cad/src/tests.rs`); an open path of one straight segment exports as a LINE (R12 to R14 strokes with a weight stay polylines, which carry the width) and reads back as the same segment (`crates/cad/src/tests.rs`, `crates/cad/src/import/tests.rs`); DXF Options' Preset menu and `document.exportDxf`'s `dxfPreset: "cnc"` set the CNC / CAM options (version 2000, 1 mm = 1 unit, 256 colors, Maximize Editability with Alter Paths off, Outline Text, PNG placed images), and the menu shows Custom once a field changes (`the_cnc_preset_writes_version_2000_in_millimeters_with_type_as_paths_and_strokes_as_lines`, `the_cnc_preset_sets_the_options_that_are_not_given`, `the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom`); VCarve QA remains pending.
   - DXF export writes a path of straight segments and circular arcs (a slot, a D shape, a rounded rectangle, a pie) as one polyline whose vertices carry a bulge (group 42) for each arc: an LWPOLYLINE in R14 and later, a POLYLINE with VERTEX entities in R12 and R13, closed when the path is closed, and it reads back as the same outline (#1299, `crates/cad/src/tests.rs`). Such a path was written as one SPLINE (a flattened polyline in R12); a path with any other curve still is. A shallow curve becomes an ARC or a bulge only when it lies on the circle within 5e-4 of its own extent as well as of the radius, and the drawing extents (`$EXTMIN`, `$EXTMAX`) reach the furthest points of every ARC and bulge.
   - Affinity documents in (AF.1–AF.4): `.af` (Affinity 3) and `.afdesign`/`.afphoto`/`.afpub` (Affinity 1 and 2, container versions 8–12) open and place as editable art: layers and sublayers, groups (pass-through or isolated), artboards (with their names and backgrounds) and Publisher pages side by side, curves with live corners, parametric shapes (rectangles with corner radii, ellipses, polygons, stars, pies, triangles, trapezoids), compound shapes, solid/linear/elliptical gradient fills and strokes (weight, dashes, alignment, scale-with-object), clipping by nesting, vector and pixel masks, artistic and frame text with fonts, sizes, tracking, leading and alignment, placed images (their original JPEG/PNG) and pixel layers (8/16-bit RGB, CMYK), opacity, visibility, locking and blend modes, at the document's resolution in points. Effects, adjustments, brushes and pressure profiles, transparency gradients, master pages, symbol instances (imported as their cached picture), special shapes (cloud, heart, cog…, imported as ellipses) and Affinity-only blend modes are named in the import warning. A file whose native data can't be read opens as its embedded preview with the reason, and that preview can't be placed. Save never writes back over the Affinity file and there is no Affinity export. AF.5 (from DesignCraft's import, storytold/designcraft#291) adds master pages (on a locked layer behind the pages that show them), tables (area type per cell and a line per edge), each paragraph's alignment, indents, spacing and leading, horizontal text scale, outlined text, frame text sized by its text scale, drop shadows and outer glows as live effects (inner shadows as inner glows), outline effects as strokes, colour and gradient overlays baked into the paint, embedded Affinity documents as editable content (their artboards don't become artboards), pixel layers over 64 MP at a reduced resolution and HEIC photos from their stored pixels; automatic leading (size plus the font's line gap) fitted on thumbnails; underlines and strikethrough; strokes whose style is None (every shape stores one) left out, which also brings 6 public files closer to their thumbnails; line breaks inside a paragraph; table cell text centred as Affinity centres it, also where it is taller than its cell; CMYK pixel layers converted through the document's embedded CMYK profile (relative colorimetric with black-point compensation, as each layer's colour settings name), or kept as CMYK images when there is none; outline effects on stroked shapes around their stroke; artistic text whose paragraphs align differently aligned within its longest line, a frame's first baseline at cap height, and frames whose last lines' descenders hang out made tall enough to show them (all measured on a local document's own PDF export: baselines match to 0.1 pt); a local 56-artboard document's mean thumbnail difference went from 16.2 to 11.4, and its pages' mean difference from the owner's PDF export from 12.9 to 9.3. AF.4 adds Affinity 3 artboard recognition and actual-outline clipping, source-backed JPEG/PNG raster tiles, Unicode text-run recovery, stored fallback/exact installed fonts, OpenType feature flags and compound-geometry limits. 51 public CC0/MIT/Apache-2.0 files (33 current `.af`), pinned and sha256-verified (`cargo xtask corpus --affinity`), test native retention and every-board native/SVG/PDF/PSD output for current files; selected files compare their saved thumbnails. No Affinity reopen or independent paired PSD oracle was available; [source audit and complex-font gaps](affinity-validation.md); [scope, provenance and limits](../crates/affinity/README.md).
   - Placed documents: File › Place of a `.vectorcraft` file links to it by default (`file.place`'s `link`): one locked object showing an artboard of the document (or its art's bounds), read the way placing it without Link reads it, its symbols, patterns and images kept apart from the document's; without Link (or from bytes, not a file) it is an editable copy as before. It stays vectors in every output (SVG, PDF, EPS, EMF, DXF), and so do placed documents inside it, read from their own files up to 8 levels deep (documents that place each other stop there). On screen they draw from bitmaps cached per file and zoom step, shared by every copy and made in the background (a placeholder until ready), so a sheet of them redraws in about a millisecond; exports and prints draw them exactly. Like linked images, a save keeps only a preview of each (JPEG when opaque) unless Include Linked Files; output, and zooming past the preview, read the file again, falling back to the preview with a warning when it is gone or changed. Saves for older versions write them as plain art. Links check, update, relink, Update Links on open, Link Info (the artboard's size), Placement Options, Break Link (also Embed, Object › Expand: the editable copy placing without Link gives, its resources joining the document), Edit Original (the document in a new tab) and the Links panel cover them; saving a document updates the open documents that place it. The native format (v4) keeps data of 8 KB or more after the JSON instead of base64 in it.
@@ -1395,8 +1406,10 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   With `--deep`, each memory row of `vectorcraft-cli perf` also gives the peak so far: the peak working set on Windows and the peak resident memory (`VmHWM`) on Linux. A new last row gives the memory after the SVG export and the save → open → save at the end of the run.
   The renderer composes the two ink planes of a CMYK document that shows transparency into screen colors on up to as many threads as it rasterizes with, instead of on one. At 2880 × 1800 on 8 threads, a page of 300 shapes at 20% to 90% opacity takes 30 ms a frame instead of 55 ms, and 50,000 paths with one at 99% opacity take 258 ms instead of 361 ms (`vectorcraft-cli bench`), with the same pixels.
   With Overprint Preview or Separations Preview on, the renderer keeps the art it prepared for the preview from one frame to the next. It prepares again the objects that changed, and all of the art when Discard White Overprint changes or, with Separations Preview, when the plates shown, the proof setup, the swatches, the Spot Colors option or the color settings change or a profile is loaded. It draws the other objects from the art, geometry and stroke outlines it kept for them.
+  Pathfinder › Merge and the `pathfinder.merge` group effect find the faces of every fill in a few contour passes over the arrangement, as Trim and Crop do, instead of one pass for each distinct fill. The output paths and their order are the same. With 8,000 squares that do not touch, each with its own fill, Merge takes 72 to 107 ms instead of 17 to 32 s (release build).
   The Pathfinder panel, Offset Path, Clean Up, Divide Objects Below, Make and Release Blend, Envelope Distort's Make and Release, Repeat (Radial, Grid, Mirror and Release), Vector Halftone, New and Redefine Symbol, Delete Symbol, erasing with the Symbol Sprayer, Rasterize, Convert to Artboards, Flatten Transparency, Clear Guides, Shape Builder, Live Paint, Release Image Trace, Make and Release Opacity Mask, Delete with direct-selected anchor points, Remove Anchor Points, Cut Path, and the Shaper, Knife, Eraser, Path Eraser, Line Cut, Rectangle Cut, Mirror & Cut and Blob Brush tools add and remove objects in one pass over each layer or group they change, and Outline Stroke and Expand write each new object in the place of the object it replaces (#1429).
   Offset Path looks up the segments near each candidate hole or island in a tree of the source path's segment bounds when it decides whether to drop that contour, instead of testing the bounds of every segment. The output paths are the same. On compound and open paths of 25,000 to 40,000 anchors with 6,400 to 11,976 candidate contours, that check takes 11 to 13 ms instead of 140 to 649 ms (medians of five interleaved runs). The limit on overlapping segment pairs is the same, so a path that stops with "Offset Path: the path is too complex to offset" still stops there.
+  Finding the distinct regions of an arrangement lists the shapes that cover each region instead of keeping a flag for every shape, so that step's time follows how many shapes cover each region rather than how many shapes there are. Divide, Hard Mix, Soft Mix, Shape Builder, Flatten Transparency, trapping, Intertwine and the Pathfinder effects are among the commands that use that step. The regions, their order and the output are the same. Divide on 3,000 overlapping rectangles takes 0.84 to 1.13 billion CPU cycles on its thread instead of 1.25 to 1.46 billion (dev build, six runs of each, alternating, while other builds were running).
   With more than 10,000 type on a path objects selected, the Selection and Direct Selection tools neither draw nor hit-test the objects' brackets.
   The renderer outlines the stroke of a path object with more than 1,024 path elements, without dashes or a width profile, only in and around the view, with a margin of the view's size on each side, and outlines it again when the view moves past that margin. The pixels are the same. At 1600 × 1200, the frame after one anchor of an open path of 200,000 anchors moves takes 28 to 30 ms instead of 103 ms, and with a closed path of 50,000 anchors 10 ms instead of 30 ms (`cargo run --release -p vectorcraft-engine --example anchor_bench`).
   The renderer outlines a dashed stroke of such a path the same way, without a width profile, and draws its dashes and dots in the same places as when the whole path is dashed, so the pixels are the same. A pattern too fine to draw is drawn solid, as before, and its stroke is outlined near the view too. At 1600 × 1200, the frame after one anchor moves takes 14 ms instead of 102 ms with a filled closed path of 50,000 anchors and a stroke of 6 pt dashes and 4 pt gaps (`cargo run --release -p vectorcraft-engine --example anchor_bench`, which now includes that document).
@@ -1440,6 +1453,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 - **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`). Scatter graph data near the largest number is refused with a message instead of hanging the app (#1780). One very long Liquify stroke segment can no longer create an unbounded number of dabs (#1779). A drag whose last preview failed is no longer recorded as a committed command in the journal that actions and scripts read (#1775). Tests: text import fuzzing no longer searches installed fonts (#1785). Tests: render tests that add fonts no longer race the frame cache tests (#1795).
 - **Raster-effect resolution in PDF:** when the 64 million pixel cap on an effect image renders an object's raster effects below the document's raster effects resolution, PDF export warns once per object with the requested and the lowest achieved ppi (`crates/engine/src/tests/pdfraster.rs`).
 - **Rasterize effect:** Effect › Rasterize… (`rasterize`) draws an object as an image of square pixels at its own resolution or the document's raster effects resolution, with Object › Rasterize's color model, background, anti-aliasing, clipping mask and room around the object, while its paths stay editable. Expand Appearance and PDF and SVG export of an object whose only raster effect is Rasterize give the image Object › Rasterize gives (`crates/engine/src/tests/rastersettings.rs`, `crates/render/src/tests/rasterize.rs`). Behavior reference: [How to save artwork in Illustrator](https://helpx.adobe.com/illustrator/using/saving-artwork.html), [Work with effects](https://helpx.adobe.com/illustrator/using/effects.html).
+- **SVG filters:** Effect › SVG Filters lists the document's own SVG filters below Apply SVG Filter… and Import SVG Filter…, and choosing one applies it to the selection as a live effect in one undo step (`svgFilter.apply`). Apply SVG Filter applies the selected filter, New and Edit open its code, and Delete and Import… remove filters or add those of an SVG file (`svgFilter.define`, `svgFilter.delete`, `svgFilter.import`). VectorCraft ships no default filters. The canvas, raster export and PDF draw the filter at the Document Raster Effects resolution; SVG export writes it as a `<filter>` element when it is the object's last effect and otherwise draws the object as an image; SVG import keeps filters the other live effects can't express as this effect instead of leaving them out; the native format keeps the filters (`crates/engine/src/tests/svgfilter.rs`, `crates/effects/src/svg_filter/tests.rs`). Behavior reference: [Apply SVG filter effects](https://helpx.adobe.com/illustrator/desktop/special-effects-styles/apply-filter-effects/apply-svg-filter-effects.html), [CS5 help, Apply SVG effects](https://help.adobe.com/archive/en_US/illustrator/cs5/illustrator_cs5_help.pdf#page=402), [SVG 1.1 Filter Effects](https://www.w3.org/TR/SVG11/filters.html).
 
 - **Pattern tiles:** the renderer keeps a tile of each pattern for each scale it rasterizes the pattern at, until the tiles fill the tile cache's budget, and then drops the least recently used tiles first. Objects that show one pattern at different scales, such as a pattern scaled to 25% with Transform Pattern Tiles next to the same pattern at 100%, draw from tiles kept between frames.
 
@@ -1460,6 +1474,8 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 
 - **Envelopes of type map from the glyphs:** an envelope maps point type, area type, type in groups and layers and type used as a clipping path from the bounds of the glyph outlines, underlines and strikethroughs instead of the type's laid-out box (ascent to descent, or the area's frame), with inline graphics counted by their boxes; rotated type and type in perspective map from their outlines as drawn. Make with Mesh, Make with Top Object and Reset with Mesh without Maintain Shape use those bounds. Type that draws nothing keeps its laid-out box, and so does type inside any other object, such as a blend, a repeat or a symbol instance. This is VectorCraft's own rule; envelopes of type made in VectorCraft and in saved files redraw by it. Tests: `crates/engine/src/tests/envelope.rs`, and `tests/envelope_ink.rs` in `vectorcraft-eps`, `vectorcraft-render` and `vectorcraft-effects`. Scores and hours unchanged.
 
+- **Top-object envelopes share each side by control polygon:** each piece of a top object's four sides takes a share of the content's width or height in proportion to the length of its control polygon, spread along the piece by its curve parameter (evenly along a segment without handles), where the sides used to share it out by length. Each corner is the nearest anchor within 47.5% of the bounding box from its box corner that has a handle 0.01 pt long or shorter, or whose tangent unit vectors differ by 0.01 or more in x or y and turn out of the outline, or else the outline's nearest point to that box corner. Envelopes opened from `.ai` files keep the corners the file saves, through moves, rotations and reflections. These are VectorCraft's own rules; existing top-object envelopes redraw by them, and gradient meshes made from a path keep sides measured by length. Tests: `a_top_object_*`, `a_reflected_top_object_keeps_the_corners_a_file_gives`, `a_split_curve_moves_the_top_object_share_to_its_new_anchor`, `a_rounded_rectangle_top_object_stays_close_to_the_identity` and `a_rectangle_top_object_is_the_identity` in `live::tests` (`vectorcraft-doc`), `envelope_top_object_shares_a_side_by_control_polygon_length` in `vectorcraft-engine`, `a_top_object_envelope_opens_live_with_its_outline` in `vectorcraft-eps`. Scores and hours unchanged.
+
 - **Texture redraws (#1257):** Craquelure, Mosaic Tiles and Stained Glass compare squared distances when finding their nearest cells; rounding/tie boundaries use the original distance ordering. Brute-force candidate tests and three 1800×1500 viewport comparisons preserve the old pixels. A CMYK rectangle move at 190.07%/DPI 1.5 is reproducible with `cargo test -p vectorcraft-render texture_drag_perf -- --ignored --nocapture`; idle-machine Windows interaction is still unverified.
 
 - **Smart Blur modes:** Effect › Blur › Smart Blur… has a Mode menu with Normal, Edge Only and Overlay Edge (`blurMode`: `normal`, `edgeOnly` or `overlayEdge`; an effect saved without it draws as Normal). Edge Only draws the edges in white on black, and Overlay Edge draws them in white over the Normal blur. A pixel is on an edge when one of the pixels the search reads within Radius of it differs from it by more than Threshold in a channel and its channels, alpha included, add up to at least that pixel's. The search reads neighbors as the Normal blur does, kept within Radius, and always the four nearest pixels, so a color step gives a line about as wide as Radius, and at least one pixel wide, on the side with the larger sum (lines on both sides when the sums are equal). The white and the black keep each pixel's coverage. Behavior reference: [Summary of effects](https://helpx.adobe.com/illustrator/using/summary-effects.html).
@@ -1502,6 +1518,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 - **Filter plug-ins set effects and stroke styles (G17):** a filter is given each object's effect records and its strokes' `join`, `cap` and `miterLimit`, and may return them; the records are admitted as `effect.apply` admits them (a known effect or installed live-effect plug-in, parameters it takes, one 3D effect that fits, no texture read from a file), and one refused refuses the output. Regressions: `crates/engine/src/tests/plugins.rs`, `crates/plugins/src/objects/tests.rs`. Scores and hours unchanged.
 - **Plug-in data kept with the document (G17):** a filter writes JSON of at most 1 MiB with `documentData` (one undo step with its objects; `null` removes it) and reads it back in `_context.documentData`, which no other filter is given. It is the document's foreign data (`unknown.pluginData`, by plug-in id), as the perspective grid is, so the native file keeps it with no section of its own; an exporter is given the whole document, so it can read every plug-in's. Regressions: `crates/engine/src/tests/plugins.rs`, `crates/engine/tests/plugin_export.rs` (the exporter), `crates/doc/src/plugin_data.rs`, `crates/plugins/src/objects/tests.rs`. Scores and hours unchanged.
 - **Heavy filter plug-ins (G17):** a filter's manifest may ask for `"budget": "heavy"`: 1 G instructions (20 times a light run's) and 300 s a run, for routing, packing or simulation. Install Plug-in… and File › Open ask the user first, `plugin.install` needs `allowHeavy: true` (`plugin.inspect` tells beforehand), the Additional Plug-ins Folder skips such filters, and the plug-in store keeps the answer. Its dialog has no Preview; the app runs it on a thread of its own with a progress window (Cancel, Continue in Background) and applies the result as `plugin.run` with the same parameters, one undo step, unless the document or the plug-in changed meanwhile. Regressions: `crates/plugins/tests/abi.rs`, `crates/plugins/src/manifest.rs`, `crates/engine/src/tests/plugins.rs`, `crates/ui-egui/src/tests/plugin_runs.rs`. Scores and hours unchanged.
+- **Safe Mode for plug-ins (G17):** `vectorcraft --safe-mode` and `vectorcraft-cli --safe-mode <subcommand>` start without plug-ins. When a launch stopped while a plug-in was loading or drawing its first live effect, the next launch names that plug-in, without saying it caused the stop, and offers Disable and Continue, Start Normally or Start in Safe Mode. Help › Safe Mode lists the disabled plug-ins with Enable on Re-launch, which takes effect at the next launch, and the app bar and the window title show Safe Mode. The help page (https://web.archive.org/web/20210601162814/https://helpx.adobe.com/pdf/illustrator_reference.pdf, pages 65 to 69) describes the same choice between diagnosing and starting normally, a Safe Mode with the problem item off and the rest of the app working, and turning the item back on at the next launch. In Safe Mode no plug-in loads or runs, and a live-effect plug-in draws its object's geometry unchanged while the object keeps the effect, which the Appearance panel marks "(Safe Mode)" with the plug-in's id in its tooltip and `effect.list` marks `skipped`; Expand Appearance refuses such an object. The web build keeps no plug-ins between page loads and has no marker. Each desktop launch with preferences keeps a marker in the `Launch` folder next to them; `vectorcraft-cli` and a desktop launch without preferences keep none, so a stop there leads to no choice at the next launch. Disabled plug-ins are listed in `Plug-ins/disabled.json`. `plugin.safeMode` reports Safe Mode and the disabled plug-ins, and `plugin.setEnabled` changes the list. Regressions: `crates/plugins/src/safe_mode.rs`, `crates/plugins/tests/safe_mode.rs`, `crates/engine/tests/plugin_safe_mode.rs`, `crates/ui-egui/tests/safe_mode.rs`. Scores and hours unchanged.
 - **Plug-in instruction budget at a bulk memory instruction:** a run that pauses where one slice of its instruction budget ends keeps the instructions the slice still held. A `memory.fill` or `memory.copy` that the slice can't pay for in full runs on the next slice, so a run whose budget covers its work finishes; a run ends with `Limit("instruction budget")` only when the instructions it has left can't pay for the next instruction. Regressions: `crates/plugins/tests/abi.rs`. Scores and hours unchanged.
 - **Plug-in permissions (G17):** a manifest may list `permissions` (`doc.read`, `doc.write`, `state`, `effect.render`, `export.write`; the first three follow storytold/photocraft#662) and an `api` level; without the list a plug-in gets what its kind implies and installs as before. Install Plug-in… and File › Open show the name, id, version, file SHA-256 and each permission in plain words, with control and bidirectional characters escaped, and install nothing on Cancel; `plugin.install` needs `grant`, and folders install only granted plug-ins. The grant is kept with the module's hash, a module asking for more asks again, and a filter run refuses output its permissions don't allow. Regressions: `crates/plugins/src/permissions.rs`, `crates/plugins/src/manifest.rs`, `crates/engine/src/tests/plugins.rs`, `crates/engine/tests/plugin_fuzz.rs`, `crates/ui-egui/src/tests/plugins.rs`. Scores and hours unchanged.
 - **Plug-in grants cover one module (G17):** a grant counts only for the module with the id and SHA-256 it records. A module with other bytes under the same id needs a new approval, even with the same permissions: `plugin.inspect` reports `needsApproval`, `plugin.install` refuses it without `grant`, Install Plug-in… and File › Open ask again, and the plug-in store and plug-in folders skip it. A grant with a malformed hash covers nothing. Regressions: `crates/plugins/src/permissions.rs`, `crates/engine/src/tests/plugins.rs`, `crates/ui-egui/src/tests/plugins.rs`. Scores and hours unchanged.
@@ -1755,7 +1772,7 @@ A VectorCraft addition, not a feature of the reference app, so no area score mov
 
 ## Dynamic symbols (2026-11-01)
 
-Symbols area (#4938), from the public symbol documentation ([create and place symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-and-place-symbols.html), [edit symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/edit-symbols.html)). Symbol Options has Symbol Type (Dynamic Symbol / Static Symbol; the dialog's default is Dynamic, `symbol.new`'s `type` defaults to static so scripts behave as before). An instance of a dynamic symbol keeps its own fill, stroke, opacity and blend for any object of the symbol's art, named by a child-index path (`symbol.instance.setAppearance`), and stays an instance: the canvas, SVG, PDF, EPS, legacy `.ai`, EMF/WMF and DXF writers, effects and Expand draw the art with those changes. Redefining the symbol reshapes every instance and keeps each change whose object the new art still has; Break Link bakes the changes into the art; Edit Symbol expands the symbol's own art; Reset (`symbol.instance.reset`: the Properties panel's Quick Actions and the Symbols panel menu) and making the symbol static drop them, and Replace Symbol drops them when it gives the instance a different symbol. The type is stored on the symbol and the changes on the instance in the native format, both left out when unset, so documents without them save byte for byte as before. Remaining: Direct Selection of an object inside a dynamic instance on the canvas (with the Fill/Stroke controls then setting its change), and reading and writing the type and changes in `.ai` files. Evidence: `crates/engine/src/tests/dynamic_symbols.rs`, `crates/doc/src/symbol_overrides.rs` tests. Score unchanged at 87% (estimated); hours 5–9 → 4–8.
+Symbols area (#4938), from the public symbol documentation ([create and place symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-and-place-symbols.html), [edit symbols](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/edit-symbols.html)). Symbol Options has Symbol Type (Dynamic Symbol / Static Symbol; the dialog's default is Dynamic, `symbol.new`'s `type` defaults to static so scripts behave as before). An instance of a dynamic symbol keeps its own fill, stroke, opacity and blend for any object of the symbol's art, named by a child-index path (`symbol.instance.setAppearance`), and stays an instance: the canvas, SVG, PDF, EPS, legacy `.ai`, EMF/WMF and DXF writers, effects and Expand draw the art with those changes. Redefining the symbol reshapes every instance and keeps each change whose object the new art still has; Break Link bakes the changes into the art; Edit Symbol expands the symbol's own art; Reset (`symbol.instance.reset`: the Properties panel's Quick Actions and the Symbols panel menu) and making the symbol static drop them, and Replace Symbol drops them when it gives the instance a different symbol. The type is stored on the symbol and the changes on the instance in the native format, both left out when unset, so documents without them save byte for byte as before. Remaining: on-canvas editing beyond a solid fill and stroke on a path, compound path or type object inside a dynamic instance; reading and writing the type and changes in `.ai` files. Evidence: `crates/engine/src/tests/dynamic_symbols.rs`, `crates/doc/src/symbol_overrides.rs` tests. Score unchanged at 87% (estimated); hours 5–9 → 4–8.
 
 ## Document Tools add-on: Export All Open Documents (2026-11-01)
 
diff --git a/docs/type-parity.md b/docs/type-parity.md
index 69ea7c373..f4658814d 100644
--- a/docs/type-parity.md
+++ b/docs/type-parity.md
@@ -21,6 +21,8 @@ against Illustrator's public documentation; **estimated** unless noted.
 | Mouse wheel over the closed font-family field | done | #5253: Character, Properties and Control step selected text through the family list using saved font filters (excluding search text), one undo step per notch; the style is matched and the list stops at either end. Escape and leaving the field keep the change. Order, bounds and Undo grouping are VectorCraft's choices; scores unchanged. |
 | Soft return (forced line break, Shift+Enter) | done | Shift+Enter inserts a soft return (U+2028), breaking the line without starting a new paragraph; paragraph spacing (space before/after) and first-line indents apply only at paragraph ends; continuation lines in lists do not repeat the marker; soft return lines in justified text do not spread (#2754) |
 | Native font-family labels | partial | With Show Font Names in English off, localized legacy names are used when typographic names contain no native label (#2208); loaded-font and catalog-only regressions. Choosing among multiple native languages is unchanged. |
+| Point, area and type-on-a-path type; vertical variants | done / partial | vertical point, area and path type have initial support; fullwidth `！` / `？` keep the nominal glyph upright when no vertical alternate exists (Unicode Tu); in a non-rectangular area a word too wide for the top lines moves down to the first line that holds it (#1615); Escape while typing ends the edit, keeps the type selected and switches back to the tool that was active before type editing began (kept while clicks move editing to other text), or to the Selection tool when there was none (#1802), and Cmd+Enter (Ctrl+Enter on Windows and Linux) does the same unless a command is bound to it; `text.create` and `text.createInPath` take `justify` (#1752); MCP `add_text` forwards `vertical` to both commands; the Type and Vertical Type tools make area type when a closed path's outline is clicked and type on a path when an open one is, with pointers that say which, as the public help describes ([Create text](https://web.archive.org/web/20220127090642/https://helpx.adobe.com/illustrator/using/creating-text.html), [Create type on a path](https://web.archive.org/web/20220127090635/https://helpx.adobe.com/illustrator/using/creating-type-path.html)) |
+| Point, area and type-on-a-path type; vertical variants | done / partial | vertical point, area and path type have initial support; fullwidth `！` / `？` keep the nominal glyph upright when no vertical alternate exists (Unicode Tu); in a non-rectangular area a word too wide for the top lines moves down to the first line that holds it (#1615); Escape while typing ends the edit, keeps the type selected and switches back to the tool that double-clicked into the type, or to the Selection tool (#1802), and Cmd+Enter (Ctrl+Enter on Windows and Linux) does the same unless a command is bound to it; `text.create` and `text.createInPath` take `justify` (#1752); MCP `add_text` forwards `vertical` to both commands; the Type and Vertical Type tools make area type when a closed path's outline is clicked and type on a path when an open one is, with pointers that say which, as the public help describes ([Create text](https://web.archive.org/web/20220127090642/https://helpx.adobe.com/illustrator/using/creating-text.html), [Create type on a path](https://web.archive.org/web/20220127090635/https://helpx.adobe.com/illustrator/using/creating-type-path.html)) |
 | Point, area and type-on-a-path type; vertical variants | done / partial | vertical point, area and path type have initial support; fullwidth `！` / `？` keep the nominal glyph upright when no vertical alternate exists (Unicode Tu); in a non-rectangular area a word too wide for the top lines moves down to the first line that holds it (#1615); Escape while typing ends the edit, keeps the type selected and switches to the Selection tool (#1802); `text.create` and `text.createInPath` take `justify` (#1752); MCP `add_text` forwards `vertical` to both commands; Type › Type Orientation sets every frame of a thread, and a thread's frames share one writing direction |
 | Point, area and type-on-a-path type; vertical variants | done / partial | vertical point, area and path type have initial support; fullwidth `！` / `？` keep the nominal glyph upright when no vertical alternate exists (Unicode Tu); in a non-rectangular area a word too wide for the top lines moves down to the first line that holds it (#1615); Escape while typing ends the edit, keeps the type selected and switches to the Selection tool (#1802), and Cmd+Enter (Ctrl+Enter on Windows and Linux) does the same unless a command is bound to it; `text.create` and `text.createInPath` take `justify` (#1752); MCP `add_text` forwards `vertical` to both commands; the Type and Vertical Type tools make area type when a closed path's outline is clicked and type on a path when an open one is, with pointers that say which, as the public help describes ([Create text](https://web.archive.org/web/20220127090642/https://helpx.adobe.com/illustrator/using/creating-text.html), [Create type on a path](https://web.archive.org/web/20220127090635/https://helpx.adobe.com/illustrator/using/creating-type-path.html)) |
 | Area Type Options (rows, columns, inset, first baseline, Text Flow by rows or by columns, Auto Size, Shrink Text to Fit) | done | Text Flow fills the cells down each column first (By Columns, the default, as files from before it open) or across each row first (By Rows), in the dialog and `text.areaOptions {flow}` (#4978); the commands that make or restyle type say when it does not fit its frame; MCP `add_text` takes Auto Size and Shrink Text to Fit (#1471) |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index b7b2250c5..15bf3cdb4 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -288,7 +288,7 @@ tools, never checked side by side) isn't captured row by row.
 | Artboard tool: the canvas right-click menu has Lock Artboards (Lock Selected, Lock All Except Selected, Lock All) and Unlock Artboards (Unlock Selected, Unlock All) | done | #2531; `artboard.setProps` with `locked` for each artboard named; the lock itself is #2592 |
 | Document Setup → Edit Artboards applies valid settings, closes the dialog and activates the Artboard tool | done | Pointer-click tests cover successful handoff, invalid settings, OK, Cancel and Undo in `dialogs/document_setup.rs`. |
 | Escape leaves Artboard editing for Selection; during a drag it first cancels the gesture | done | Headless egui key events cover idle Escape, active-drag cancellation and a subsequent Escape in `tests/distortkeys.rs`. |
-| Escape while typing ends the edit, keeps the type selected and switches to the Selection tool | done | #1802 (#1686, #1656) |
+| Escape while typing ends the edit, keeps the type selected and switches back to the tool that was active before type editing began (kept while clicks move editing to other text), or to the Selection tool when there was none | done | #1802 (#1686, #1656) |
 | Selection tool: selected area type and type on a path show an in port and an out port (empty, an arrow where threaded, the red "+" of overflow); a click on either loads the text cursor; a click on a closed path, on empty canvas or a drag threads the text there, after the clicked frame from its out port, before it from its in port; Escape or another tool drops it; a double-click on a threaded port breaks the thread there | partial | #2572 (`text.thread.add`, `before` for the in port); the out port sits on the frame's right side above the bottom-right corner handle and the in port on its left side below the top-left one, so the handles can still be grabbed; a double-click on a threaded port breaks the thread (`text.thread.break`, [archived help](https://web.archive.org/web/20220127090642/https://helpx.adobe.com/illustrator/using/creating-text.html)); the loaded cursor borrows the I-beam |
 | Shift-click selects several artboards (Artboard tool, Artboards panel); they move, Alt-copy and delete together | done | `artboard.move`/`artboard.delete` `indices` (#1139); in the panel, Shift- and Ctrl/Cmd-click work with any tool by switching to the Artboard tool (#5698); panel menu, trash and Properties share selected-set deletion; all-selected retains artboard 1 and a single board cannot be deleted, with pointer-event and Undo/Redo coverage |
 | Artboards panel: drag a row above or below another to reorder the artboards (as Move Up / Move Down do) | done | #4687; a line shows where the row lands, `artboard.reorder` in one undo step, the moved artboard becomes active; public forum answers describe the drag |
@@ -366,7 +366,8 @@ next unit in the order a right-click on a ruler lists them, from Feet back to Po
 | Live trace result bounds and selection highlights exclude the retained bitmap; source-image views retain it | done | All TraceView modes and rotated result bounds regression-covered; ordinary hidden group behavior retained |
 | Image Trace panel: the Preview checkbox before Trace chooses whether a setting change traces the selected Image Trace object again at once | done | Per the public documentation, Preview shows the result of the current settings and Trace traces with them (<https://web.archive.org/web/20250831090623/https://helpx.adobe.com/illustrator/using/image-trace.html>). Preview is on by default and kept with the UI preferences; Reset to Default leaves it. Off, changes wait in the panel until Trace applies them as one undo step, or until Preview is turned on again. Changes stay with the object they were made for while another object is selected, and come back when it is selected again. `imageTrace.preview {on?}`, `ui.set {imageTracePreview}`; `panels/image_trace.rs` headless tests (`with_preview_off_a_slider_change_waits_for_trace`, `turning_preview_on_traces_the_changes_that_waited`, `preview_turned_on_with_nothing_selected_traces_when_the_object_is_selected_again`, `settings_that_wait_stay_with_their_object`, `settings_that_wait_come_back_when_their_object_is_selected_again`, `settings_that_wait_are_dropped_when_their_object_changed_since`, `preview_is_kept_with_the_preferences_and_reset_to_default_leaves_it`) |
 | Toolbar without group labels by default, one or two columns; All Tools drawer by flyout group with shortcuts, its menu (Reset, Basic, Advanced) and Show section | done | #1751; a preference brings the labels back; `toolbar.show` sets the Fill/Stroke, Coloring, Draw Mode and Screen Mode controls |
-| Actions panel: ≡ › Save Actions… saves the current set with all its actions to a file and ≡ › Load Actions… adds a saved set ([Manage a set of actions](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/manage-a-set-of-actions.html)) | partial | `ui.actionSet.save`, `ui.actionSet.load`; `panels/actions.rs` tests. The file is VectorCraft's own `.vcactions` JSON; the reference app's `.aia` files and Reset, Clear and Replace Actions remain |
+| Actions panel: ≡ › Save Actions… saves the current set with all its actions to a file and ≡ › Load Actions… adds a saved set ([Manage a set of actions](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/manage-a-set-of-actions.html)) | partial | `ui.actionSet.save`, `ui.actionSet.load`; `panels/actions.rs` tests. The file is VectorCraft's own `.vcactions` JSON; Reset, Clear and Replace Actions remain |
+| Actions panel: ≡ › Load Actions… also reads action sets saved as `.aia` files ([Actions panel overview](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/actions-panel-overview.html)) | partial | `actionSet.read`, `ui.actionSet.load`; `tests/actionset.rs`, `panels/actions.rs` tests, `import_fuzz`. Only steps with a label and no recorded values come in, as menu commands that run with no values and open no dialog, matched by label; the other steps, recorded menu items included, are left out and counted |
 | Actions panel: ≡ › Action Options… renames the selected action and sets its function key and color ([Actions panel overview](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/actions-panel-overview.html)) | partial | `ui.action.options`; `panels/actions.rs` tests (part of #1629). The color shows nowhere until Button Mode exists |
 | Actions panel: ≡ › Playback Options… plays actions Accelerated, Step by Step or with a pause between steps ([Specify playback speed](https://helpx.adobe.com/illustrator/desktop/automate-visualize-data/automate-actions/specify-playback-speed.html)) | done | `ui.action.playbackOptions`; `panels/actions.rs` tests. The pause is a whole number of seconds from 1 to 60 (VectorCraft's own range); Batch… plays at full speed |
 | Actions panel: a clicked action stays selected for Play Current Selection and Delete Selection | partial | #1853 (part of #1629); editing actions and action shortcuts remain |
@@ -385,7 +386,7 @@ next unit in the order a right-click on a ruler lists them, from Feet back to Po
 | Symbol libraries: Window › Symbol Libraries (Basic Shapes, User Defined, Other Library…, Save Symbols…) and the Symbols panel's Symbol Libraries Menu button and its menu's Open Symbol Library / Save Symbol Library…; a click on a library symbol adds it to the document's Symbols (one undo step, it becomes the current symbol), Shift/Cmd-clicks select for Add to Symbols, and a symbol dragged onto the canvas is added and placed where it is dropped | done | [public source](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-or-import-symbol-libraries.html), [Symbols panel options](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/symbols-panel-options.html), [placing from a library](https://helpx.adobe.com/illustrator/desktop/manage-objects/traces-mockups-symbols/create-and-place-symbols.html); `window.symbolLibrary`, `window.symbolLibrary.other`, `ui.saveSymbolLibrary` (dialog `saveSymbolLibrary`), `window.userSymbolLibrary1`…`10`; `panels::tests_symbol_libraries`; only one built-in library (original, generated in code) |
 | Brush libraries: Window › Brush Libraries (Art Ribbons, Calligraphic Nibs, Pattern Borders, Scatter Shapes, User Defined, Other Library…, Save Brushes…) and the Brushes panel's Brush Libraries Menu button and its menu's Open Brush Library / Save Brush Library…; a click on a library brush adds it to the document's Brushes (one undo step, it becomes the current brush, and selected paths take it in the same step), Shift/Cmd-clicks select for Add to Brushes, a brush dragged onto a path is added and applied to it and one dragged onto the Brushes panel is added; thumbnails render with the library's patterns and symbols | done | [public source](https://helpx.adobe.com/illustrator/desktop/paint-and-fill/apply-and-edit-strokes/create-new-brush-libraries.html), [import brushes](https://helpx.adobe.com/illustrator/desktop/paint-and-fill/apply-and-edit-strokes/import-brushes-from-brush-libraries-or-other-files.html), [Brushes panel overview](https://helpx.adobe.com/illustrator/desktop/paint-and-fill/apply-and-edit-strokes/brushes-panel-overview.html); `window.brushLibrary`, `window.brushLibrary.other`, `ui.saveBrushLibrary` (dialog `saveBrushLibrary`), `window.userBrushLibrary1`…`10`; `panels::tests_brush_libraries`; four built-in libraries (original, generated in code) |
 | Symbols panel: New Symbol opens Symbol Options (Name) before making the symbol; Alt-click skips it | partial | #1560 (#1566); Registration 9-point grid in Symbol Options (`symbol.new` / `symbol.place`); Export Type (Graphic / Movie Clip) and Enable Guides for 9-Slice Scaling (scaled instances keep their corners; in symbol editing mode the guides are drawn over the art and the Selection tool drags them); Symbol Type (Dynamic Symbol / Static Symbol, new symbols dynamic; #4938) |
-| Dynamic symbols: an instance changes the fill, stroke, opacity and blend of objects in its symbol's art and stays linked; Reset in the Properties panel's Quick Actions and the Symbols panel menu (Reset Symbol Instance) | partial | #4938; `symbol.instance.setAppearance` (by child-index path) and `symbol.instance.reset`; redefining keeps the changes, Break Link bakes them; on-canvas Direct Selection of a part inside an instance (with the Fill/Stroke controls then setting its change) remains |
+| Dynamic symbols: an instance changes the fill, stroke, opacity and blend of objects in its symbol's art and stays linked; Reset in the Properties panel's Quick Actions and the Symbols panel menu (Reset Symbol Instance) | partial | #4938; `symbol.instance.setAppearance` (by child-index path) and `symbol.instance.reset`; redefining keeps the changes, Break Link bakes them; Direct Selection of a path, compound path or type object inside an instance, with the Fill/Stroke controls setting its solid fill or stroke, is on canvas; on-canvas editing beyond a solid fill and stroke, and `.ai` read and write, remain |
 | Pathfinder Trim, Merge and Crop remove strokes; Merge joins same-fill objects whatever their strokes | done | #1570 (#1572) |
 | Pathfinder panel on one group selected alone; a greyed-out button says what it needs | partial | #1450; the group's members are combined; one plain path selected alone stays disabled (the public documentation doesn't say what the operations do to a single path) |
 | Pathfinder Divide: an open cutting line splits a filled path | done | #1307; straight, crossed, bent and curved cutters, holes and frontmost appearance regression-tested; native automation: independent piece movement, one Undo/Redo, saved-document round trip and window capture; existing bounded-map fallback remains |
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 334910732..bfd6172ac 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -43,7 +43,8 @@ commands:
                   pack PNGs into a Windows .ico (used by packaging/icons.sh)
   stats [--exact] count tests and lines per crate (--exact: ask the test harness via `-- --list`)
   test262         fetch the pinned ECMAScript conformance suite into corpus/test262 (sha256
-                  verified) and parse its ES5 subset with vectorcraft-js, printing the counts
+                  verified), parse its ES5 subset with vectorcraft-js and run the ES5 language
+                  tests its interpreter supports, printing the counts
   web-fonts       copy the craft-fonts faces in crates/text/web-fonts.txt into the web site (the Trunk
                   post_build hook; a no-op without CRAFT_FONTS_DIR)
 ";
@@ -338,7 +339,8 @@ Tests that use a corpus skip cleanly when it is absent.
   corpus/affinity/   public Affinity documents (CC0/MIT/Apache-2.0) at pinned commits, sha256
                      verified: oracles for the Affinity reader. Fetch: cargo xtask corpus --affinity
   corpus/test262/    the ECMAScript conformance suite (BSD-3-Clause) at a pinned commit, sha256
-                     verified: the JavaScript parser's ES5 subset. Fetch and run: cargo xtask test262
+                     verified: the JavaScript parser's and interpreter's ES5 subsets. Fetch and run:
+                     cargo xtask test262
 ",
         corpus.display()
     );
diff --git a/xtask/src/test262.rs b/xtask/src/test262.rs
index ab390538b..30f6f2472 100644
--- a/xtask/src/test262.rs
+++ b/xtask/src/test262.rs
@@ -1,7 +1,8 @@
 //! `cargo xtask test262`: the official ECMAScript conformance suite (https://github.com/tc39/test262,
 //! BSD-3-Clause) at a pinned commit, fetched as GitHub's archive of that commit, checked against
 //! its SHA-256 and size, and unpacked into `corpus/test262/` (gitignored, never committed). It then
-//! runs `vectorcraft-js`'s `test262` test, which parses the ES5 parse subset and prints its counts.
+//! runs `vectorcraft-js`'s `test262` tests, which parse the ES5 parse subset, run the ES5
+//! `test/language` tests that need only the interpreter's built-ins, and print each one's counts.
 //!
 //! Moving the pin: change [`COMMIT`], run the command once with the new commit to see the
 //! archive's SHA-256 in the error, check the archive, and update [`SHA256`].