Merge main into fix/shape-builder-merge-off-ui-thread

docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (shared PDF reader and writer; app output policy and editable-import adapter retained; verified PngSuite downloads, #1729; synthetic control-input budgets, #1709; desktop printing uses craft-print; Windows 7 fallback retained) · **Target:** Adobe Illustrator 2026 (30.x)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-13 · **Change:** minor (shared PDF reader and writer; app output policy and editable-import adapter retained; verified PngSuite downloads, #1729; synthetic control-input budgets, #1709; desktop printing uses craft-print) · **Target:** Adobe Illustrator 2026 (30.x)
 
 How VectorCraft is built today. The design rationale lives in the local, gitignored `plan/architecture.md`;
 this file describes what is committed. Day-to-day rules (clean-room, never crash, quality gates) are in
@@ -55,9 +55,7 @@ lists every format read or written; importers are fuzzed (`crates/engine/tests/i
 Desktop printer discovery and PDF submission use `craft-print`, pinned to an immutable
 craft-libs revision. The engine still owns sheet composition, copies, separations and colour
 management. Submission runs on the existing background worker; its receipt or refusal
-reaches the status bar, and Quit waits for pending submissions. Windows 7 retains WMI discovery
-and the installed viewer's Print/PrintTo verb;
-its target excludes the shared backend because Windows.Data.Pdf is unavailable there.
+reaches the status bar, and Quit waits for pending submissions.
 
 PDF writing uses the optional `craft-pdf` writer at an immutable craft-libs revision. Shared
 configuration, metadata, font preparation and guarded serialization leave drawing, colour

docs/egui-037-migration-plan.md

@@ -167,11 +167,6 @@ Root workspace (`Cargo.toml`):
   `6d518fc7…`, `winit` to `storytold/winit` rev `a517b384…`, and `hayro-*`/`krilla` to craft-libs rev
   `a0916808…`. The hayro/krilla patches are unrelated to egui and must remain unless a separate comparison proves
   replacement.
-- `vendor/windows-link` is the only vendored package. `vendor/windows-link/VECTORCRAFT-PATCH.md` records the
-  provenance (Microsoft windows-link 0.2.1, crates.io, MIT OR Apache-2.0), the sole change (`CoTaskMemFree` from
-  `ole32.dll` on the Windows 7 target), and the removal condition. It is applied only by
-  `packaging/windows/windows7.ps1` through `--config "patch.crates-io.windows-link.path='vendor/windows-link'"`.
-  **Keep it.** Do not add a root path patch for it, and re-run the Windows 7 packaging check after the egui bump.
 - Nested workspaces: `crates/affinity/fuzz` (libfuzzer only; no egui) and `crates/plugins/example` (wasm plug-in
   example; no egui). `crates/plugins/example/Cargo.lock` is separate and must not acquire egui.
 - `crates/affinity/fuzz` has no lockfile in the checkout. Do not create one merely for this migration.
@@ -181,7 +176,7 @@ Manifests that participate in the egui graph (the table records the plan-time de
 | Manifest | Plan-time UI declaration | Required change |
 |---|---|---|
 | `crates/ui-egui/Cargo.toml` | `egui` workspace + `bytemuck`; `egui_extras`; dev `egui_kittest` `wgpu`,`snapshot` | `egui` must also enable `default_fonts` for library tests/embedders and for downstream kittest tests, which do not inherit kittest's own dev-dependency fonts; `egui_extras`/`egui_kittest` to 0.37; no feature rename assumed |
-| `apps/vectorcraft/Cargo.toml` | `eframe` features `default_fonts`, `wayland`, `x11`; default features `wgpu`, `accessibility`; `windows7 = ["eframe/glow"]`; direct `winit 0.30` | add **`eframe/clipboard`**; keep `links` off (existing native `open_url` service); keep `system_fonts` off; retain winit feature set |
+| `apps/vectorcraft/Cargo.toml` | `eframe` features `default_fonts`, `wayland`, `x11`; default features `wgpu`, `accessibility`; direct `winit 0.30` | add **`eframe/clipboard`**; keep `links` off (existing native `open_url` service); keep `system_fonts` off; retain winit feature set |
 | `apps/vectorcraft-web/Cargo.toml` | wasm `eframe` features `default_fonts`, `wgpu`, `accesskit` | keep; add `clipboard` only if the chosen eframe 0.37 web path needs the feature (the web clipboard code is not gated by it, but test it); web `open_url` is handled by the web runner |
 | `craft-ui` / `craft-window` pins | 0.36-era craft-libs revisions | final L2 craft-libs revision on `3832c47…` with workspace `egui = "0.37"` and the CL-2F capture helper |
 | `Cargo.lock` | one coherent 0.36 graph | one coherent 0.37 graph; no second `egui`, `eframe`, `egui-winit`, `egui-wgpu`, `epaint`/`emath`/`ecolor`, or `winit`; external `kittest`/`accesskit*` are separate audited registry identities |
@@ -196,7 +191,7 @@ never against a candidate, an intermediate fork stage or a provisional craft-lib
 
 | Target | Path | Current role |
 |---|---|---|
-| `vectorcraft` binary | `apps/vectorcraft/src/main.rs` | Native eframe/wgpu app, control server, macOS menu, Linux stylus/XWayland, Windows stylus, printing, Windows 7 glow fallback |
+| `vectorcraft` binary | `apps/vectorcraft/src/main.rs` | Native eframe/wgpu app, control server, macOS menu, Linux stylus/XWayland, Windows stylus, printing |
 | `vectorcraft-web` binary | `apps/vectorcraft-web/src/main.rs`, `web.rs` | wasm eframe web runner, WebGPU/WebGL2, DOM paste/drop, `window.vectorcraft` control API |
 | `vectorcraft-cli` binary | `apps/vectorcraft-cli/src/main.rs`, `perf.rs` | Headless run/convert/bench/perf and MCP stdio |
 | `vectorcraft-ui-egui` library | `crates/ui-egui/src/lib.rs` | All frontend state, panels, dialogs, canvas, control methods, i18n, clipboard, fonts, workers |
@@ -424,8 +419,7 @@ Required design (shared weak completion slot, per the suite capture contract):
 
 Required design:
 
-- Add `eframe/clipboard` to the native eframe features (unconditionally, so `--no-default-features --features
-  windows7` keeps it). Keep the app's `SystemClipboard` as the multi-format owner for Copy/Cut (SVG/PDF/PNG/text)
+- Add `eframe/clipboard` to the native eframe features (unconditionally). Keep the app's `SystemClipboard` as the multi-format owner for Copy/Cut (SVG/PDF/PNG/text)
   and for image/PDF/EPS/SVG paste.
 - Consume `Event::PasteImage` in `shortcuts::handle` rather than letting it reach a `TextEdit` or the Type tool:
   - with a `system_clipboard`, treat it as the textless paste signal and let `adopt_system_clipboard` read the
@@ -639,7 +633,6 @@ Source-grounded from the 0.37 changelog and code, with tests rather than assumpt
 - default style tweaks (roomier buttons, larger corners); app sets most tokens but screenshots will move.
 - text tessellation (#8731) and DX12 FXC shader compile (#8736) are upstream reports, not reproduced here. Measure
   our own fixtures before changing anything; preserve Repeat/MirroredRepeat semantics and color emoji.
-- `eframe` now falls back to a compatibility-profile OpenGL context; Windows 7/glow path must be re-tested.
 - #8748 (hidden-parent deferred children) concerns child/deferred viewports. P7c owns the hidden-parent/child fix
   and its regression. VectorCraft has no child viewport, so it verifies only the root window's
   occluded/minimized logic-only path and that any `Area`/`Window` owned by the root does not assume a parent
@@ -674,8 +667,7 @@ One coherent 0.37 family:
 ```
 eframe 0.37 ─┬─ egui 0.37 ── epaint/emath/ecolor/epaint_default_fonts 0.37
              ├─ egui-winit 0.37 ── winit 0.30.13 (approved storytold fork)
-             ├─ egui-wgpu 0.37 ── wgpu 30.0.x
-             └─ egui_glow 0.37 (windows7)
+             └─ egui-wgpu 0.37 ── wgpu 30.0.x
 egui_extras 0.37
 egui_kittest 0.37 ── kittest 0.5.0 (registry)
 craft-ui (final craft-libs rev) ── egui 0.37
@@ -683,7 +675,7 @@ craft-window (final craft-libs rev) ── egui 0.37
 ```
 
 - **Required-used fork-source IDs** (each must appear once from the D1b revision): `egui`, `eframe`, `egui-winit`,
-  `egui-wgpu`, `egui_glow` (`windows7` target only), `egui_extras`, `epaint`, `emath`, `ecolor`,
+  `egui-wgpu`, `egui_extras`, `epaint`, `emath`, `ecolor`,
   `epaint_default_fonts`, `egui_kittest`.
 - **Optional or forbidden-if-present IDs:** `egui_demo_lib`, `egui_inspection`, `egui_system_font_provider` (only
   with the disabled `system_fonts` feature) and `egui_demo_app` (workspace-only binary). Absence is a pass; if one
@@ -704,8 +696,7 @@ craft-window (final craft-libs rev) ── egui 0.37
   dependencies from `craft-ui`/`craft-window` resolve to the same source. A dependency's `[patch]` section is
   ignored by the consumer.
 - Do not use a branch or a machine-local path in publication. The winit fork's own patch is not inherited.
-- Keep `vendor/windows-link` and its separate Windows 7 packaging check, and keep the existing hayro/krilla root
-  patches and PDF fixes. These are unrelated to the egui graph and must not be removed, folded into the fork pin, or
+- Keep the existing hayro/krilla root patches and PDF fixes. These are unrelated to the egui graph and must not be removed, folded into the fork pin, or
   blanket-deleted with PdfCraft's vendors. Do not add `vendor` copies of egui/winit for VectorCraft.
 - Add `cargo xtask ui-deps` (modelled on `xtask/src/pdf_deps.rs`) that runs `cargo metadata --locked` and checks a
   canonical ledger of every package ID and source: required-used fork IDs, optional IDs with an `absent` or
@@ -1105,8 +1096,6 @@ Add accessibility tests in the existing `role_and_state` style and via kittest:
   pass. The existing unsafe `mac_window::center_buttons` may be replaceable by 0.37's
   `Frame::set_traffic_lights_position`, but do not adopt that without macOS evidence; keep the existing code and
   test it on real hardware later.
-- **Windows 7:** compile/package only under `packaging/windows/windows7.ps1 -Test`; no support claim without a real
-  Windows 7 run. The `vendor/windows-link` patch remains.
 - **Windows ARM64 and FreeBSD:** keep the existing `.github/workflows/windows-arm64.yml` and `freebsd.yml` checks:
   compile/package and the smoke they actually run. Do not treat a cross/QEMU build as GUI, IME, clipboard or GPU
   evidence; record those rows as unavailable unless a real machine is used.
@@ -1342,22 +1331,19 @@ These are not “future work”; they block calling the migration done:
    and isolate it from performance comparisons (§6.2). Recheck if main advanced further.
 9. **macOS evidence.** No macOS host/display is available here. Keyboard layouts, IME (including press-and-hold),
    Metal/GL, native pickers, termination and traffic-light positioning remain an explicit release gate.
-10. **Windows 7.** 0.37 + glow + clipboard + the separate `vendor/windows-link` packaging patch must
-    compile/package and be smoke-tested; no support claim from a modern runner alone. Keep the hayro/krilla PDF
-    patches independent.
-11. **Performance.** Paired control at `4a7cba0…` and candidate with the same engine delta, plus a stock-0.37.0
+10. **Performance.** Paired control at `4a7cba0…` and candidate with the same engine delta, plus a stock-0.37.0
     arm in the first report and every investigated regression, using the shared sample floors and the 5%
     median / 10% p95 / 5% RSS gates. Upstream #8731, #8736 and #8512 are reports, not results; do not claim a
     regression or a fix without ours.
-12. **Dependency identities.** Enumerate every fork-family package at one storytold source; audit external
+11. **Dependency identities.** Enumerate every fork-family package at one storytold source; audit external
     `kittest`/`accesskit*` as compatible registry identities, not egui-git crates. Skrifa/harfrust/glifo duplicates
     are expected; measure binary size and confirm no public type crossing. A new `egui`/winit duplicate is a hard
     failure.
-13. **Role semantics.** Review the `SelectableLabel → Button`, `Checkbox → CheckBox`, `CollapsingHeader →
+12. **Role semantics.** Review the `SelectableLabel → Button`, `Checkbox → CheckBox`, `CollapsingHeader →
     DisclosureTriangle` and `Other → Unknown` mappings against actual screen-reader semantics, not just compile.
-14. **Wayland/X11/GPU backend.** The host has an i915 render device but no inherited display session; a managed
+13. **Wayland/X11/GPU backend.** The host has an i915 render device but no inherited display session; a managed
     Linux job must qualify the actual compositor/backend/DPI. Availability is not a qualified result.
-15. **Web.** A wasm `check` is not a browser workflow; headless Chrome WebGPU/WebGL2, paste/drop, save/download and
+14. **Web.** A wasm `check` is not a browser workflow; headless Chrome WebGPU/WebGL2, paste/drop, save/download and
     screenshots are required.
 
 **Done means:** one coherent 0.37 graph; `cargo xtask ci` and `ui-deps` pass from a clean checkout; lifecycle
@@ -1391,7 +1377,7 @@ Every finding in `plan-reviews/vectorcraft-v2.md` is closed below by source-grou
 
 | # | Finding | Disposition |
 |---|---|---|
-| 1 | No stock-0.37.0 control arm | **Accepted and fixed.** Stock 0.37.0 (`841a328b`) is a measured arm in the first baseline report and every investigated regression, with the same environment and a pinned minimal adapter where fork-only code cannot compile; retained even when app acceptance pairs 0.36 with the candidate. §5.3, §6.2, §7.1 V1, §8.11. |
+| 1 | No stock-0.37.0 control arm | **Accepted and fixed.** Stock 0.37.0 (`841a328b`) is a measured arm in the first baseline report and every investigated regression, with the same environment and a pinned minimal adapter where fork-only code cannot compile; retained even when app acceptance pairs 0.36 with the candidate. §5.3, §6.2, §7.1 V1, §8.10. |
 | 2 | Capture admission and geometry under-specified; 64 MiB too small | **Accepted and fixed.** Adopted the shared 4 requests / 128 MiB per image / 256 MiB aggregate defaults (stricter only if the documented intended surface fits), checked bytes reserved before issue, no eviction; records logical/screen bounds, viewport, DPI/zoom and surface epoch at issuance and rejects/retries any change before save, including change-back, then verifies scale/aspect. §3.5, §4.4, §5.2, §8.5. |
 | 3 | W27 old-epoch invalidation missing | **Accepted and fixed.** Old-epoch `done` is rejected and invalidates that epoch, never edits the new owner; current-epoch mismatch applies incoming once and defers outgoing. §3.9, §4.6, §5.6, §5.7. |
 | 4 | P7c ownership of #8763/#8748 absent | **Accepted and fixed.** P7c owns both fixes and their pointer/keyboard and hidden-parent regressions; D1b includes P7c, V2 depends on it, and an app workaround needs equivalent tests plus a removal condition. §3.11, §7.1, §8.1. |

docs/windows7.md

@@ -1,86 +0,0 @@
-# Windows 7 x64 compatibility build (experimental, unsupported)
-
-Windows 7 is not a supported platform. This build is experimental and community-maintained,
-and the VectorCraft maintainers have not verified it on Windows 7.
-
-This separate build targets **64-bit Windows 7 SP1**. It uses OpenGL instead of wgpu,
-and omits the native AccessKit accessibility adapter. Printer discovery supports the
-PowerShell version included with Windows 7, and printer setup opens Control Panel.
-Printing retains the PDF viewer's Print/PrintTo verb on this build: Windows 7 has no
-Windows.Data.Pdf renderer. The win7 target excludes `craft-print` from its dependency
-tree; normal desktop builds use the shared spooler. The `windows7` feature and dedicated win7 target must be selected together; the
-existing compile-time guards reject mixing this feature with the ordinary Windows target.
-The normal desktop and web builds retain their existing defaults. A vendor graphics driver providing **OpenGL 3.3 or newer**
-is required; the Windows built-in generic display driver is insufficient. GPU selection
-in Preferences and `WGPU_POWER_PREF` do not control this OpenGL build.
-
-## Build or download
-
-In your GitHub fork, open **Actions → Windows 7 x64 compatibility → Run workflow** (it
-also runs weekly and on pull requests changing the compatibility path).
-When it succeeds, download the `vectorcraft-windows7-x64-portable` artifact, extract the
-contained portable ZIP, then run `vectorcraft.exe` on Windows 7. The CLI is included.
-No MSI is provided: the existing installer remains for modern Windows.
-
-To build locally, use a **Windows 10/11 build computer**, with Rust/rustup and Visual Studio
-2022 C++ build tools (x64 compiler and Windows SDK). Open an **x64 Native Tools Command
-Prompt for VS 2022**, change to your clone's repository root (the directory containing
-`Cargo.toml`), and run:
-
-```powershell
-powershell -ExecutionPolicy Bypass -File packaging/windows/windows7.ps1
-```
-
-Add `-Test` to also run the app and CLI tests on the build computer.
-
-Output: `dist/release/vectorcraft-windows7-x64-portable.zip`. The script installs the pinned
-nightly compiler and `rust-src`, rebuilds the standard library for
-`x86_64-win7-windows-msvc`, and links the C runtime statically. It never installs Rust on
-the Windows 7 machine. The optional `CRAFT_FONTS_DIR` setting works as in the normal build.
-Without it, install fonts for the languages you need on the destination machine.
-
-The Windows 7 target matters: modern Rust's ordinary `x86_64-pc-windows-msvc` target
-requires Windows 10, including standard-library and random-number APIs. Selecting OpenGL
-alone or changing an installer version check cannot fix that.
-
-References: [Rust's Windows 7 target](https://doc.rust-lang.org/rustc/platform-support/win7-windows-msvc.html)
-and [Windows baseline change](https://blog.rust-lang.org/2024/02/26/Windows-7/).
-
-The packaging script checks x64 PE headers, the subsystem version, and known incompatible
-imports (including `GetSystemTimePreciseAsFileTime`) before creating the ZIP. This is a
-regression check, not an exhaustive audit of every Windows API.
-
-The small vendored `windows-link` patch routes `CoTaskMemFree` to its documented
-`ole32.dll` export on the Windows 7 target; the newer binding otherwise imports
-`combase.dll`, which is absent on Windows 7. Only this script uses it: it passes
-`--config "patch.crates-io.windows-link.path='vendor/windows-link'"` to Cargo, so every other
-build, including the normal Windows one, keeps the checksum-verified crates.io crate. Cargo
-records the patch in `Cargo.lock`, so the script resolves once, fails if anything other than
-windows-link's source changed, builds with `--locked`, and then restores `Cargo.lock`.
-
-## Runtime validation
-
-The contributor reports that a user ran the portable x64 compatibility build on Windows 7 SP1
-with an NVIDIA graphics card. Their original build failed at startup with
-`GetSystemTimePreciseAsFileTime` missing from `kernel32.dll`; the compatibility
-build resolved that failure. The tested build was based on upstream commit
-`1f7873273b67007b0aefc63313e0d34a39f45453`. The exact GPU/driver version and completion
-of every checklist item below were not recorded, and the maintainers have not reproduced it,
-so the build remains experimental and unsupported.
-
-## Runtime acceptance checklist
-
-A successful build on the Windows 2022 CI runner does **not** prove Windows 7 runtime
-compatibility. Before declaring support, test on a Windows 7 SP1 x64 machine and record
-its GPU, driver version, Windows updates and any missing-DLL/entry-point error:
-
-- Start `vectorcraft.exe`; verify a visible canvas, resizing, minimize/restore and exit.
-- Draw a shape, save a `.vectorcraft` document, close and reopen it.
-- Open `examples/dusk-poster.vectorcraft`; export PNG and PDF and inspect both.
-- Exercise native Open/Save dialogs, clipboard text/images and drag-and-drop.
-- Change a preference, exit and verify it survives restarting.
-- Run `vectorcraft-cli.exe --version` and a headless export from a Command Prompt in the
-  extracted application folder.
-
-This build is experimental until that checklist passes. New dependency versions can add
-newer Windows imports, so retain Cargo.lock and repeat runtime QA after dependency updates.