diff --git a/apps/vectorcraft-web/src/main.rs b/apps/vectorcraft-web/src/main.rs
index f7dd201af2..3808c281f9 100644
--- a/apps/vectorcraft-web/src/main.rs
+++ b/apps/vectorcraft-web/src/main.rs
@@ -7,7 +7,7 @@
 //! Differences from the desktop app:
 //! - no TCP control server (browsers can't listen on sockets);
 //! - File → Open uses the browser file picker; bytes arrive asynchronously through
-//!   `Services::inbox`;
+//!   `Services::picked_inbox`;
 //! - Save / Export trigger a browser download;
 //! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox;
 //! - pen and finger input is read from Pointer Events by `pencil` (Apple Pencil pressure and
diff --git a/apps/vectorcraft-web/src/web.rs b/apps/vectorcraft-web/src/web.rs
index b4ca434d90..2de7f3b481 100644
--- a/apps/vectorcraft-web/src/web.rs
+++ b/apps/vectorcraft-web/src/web.rs
@@ -17,7 +17,7 @@ use vectorcraft_ui_egui::i18n;
 use vectorcraft_ui_egui::place::{DropTarget, PlaceArrival, PlaceInbox};
 use vectorcraft_ui_egui::print::{PrintJob, PrintService, Printer};
 use vectorcraft_ui_egui::stylus::StylusFeed;
-use vectorcraft_ui_egui::{Services, VectorcraftApp};
+use vectorcraft_ui_egui::{PickedInbox, Services, VectorcraftApp};
 use wasm_bindgen::JsCast as _;
 
 use crate::locks::WebLocks;
@@ -25,6 +25,18 @@ use crate::pencil::SharedPointers;
 
 pub(crate) type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
+/// The files waiting to open, by where they came from (`Services::inbox`, `picked_inbox` and
+/// `page_inbox`).
+#[derive(Clone, Default)]
+struct OpenInboxes {
+    /// Dropped on the page.
+    dropped: Inbox,
+    /// The open picker's answers.
+    picked: PickedInbox,
+    /// Handed over by the page's script (`window.vectorcraft.openFile`).
+    page: Inbox,
+}
+
 /// Where the pointer was over the canvas during the last file drag (CSS px from its top-left) and
 /// whether Shift was held: where dropped files land.
 type DragPos = Rc<Cell<Option<(f32, f32, bool)>>>;
@@ -48,7 +60,7 @@ const MAX_RESTARTS: u32 = 3;
 #[derive(Clone)]
 struct Host {
     runner: eframe::WebRunner,
-    inbox: Inbox,
+    inbox: OpenInboxes,
     place_inbox: PlaceInbox,
     script_inbox: ScriptInbox,
     drag: DragPos,
@@ -77,7 +89,7 @@ pub fn start() {
         crate::fonts::load_startup_fonts().await;
         let host = Host {
             runner: eframe::WebRunner::new(),
-            inbox: Arc::default(),
+            inbox: OpenInboxes::default(),
             place_inbox: Arc::default(),
             script_inbox: Arc::default(),
             drag: DragPos::default(),
@@ -132,13 +144,13 @@ async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Movi
                         // The old services asked the old context for frames.
                         app.services = services;
                         app.status("The graphics were lost and have been restarted");
-                        crate::api::connect(None, host.inbox.clone(), ctx.clone());
+                        crate::api::connect(None, host.inbox.page.clone(), ctx.clone());
                         app
                     }
                     None => {
                         // `window.vectorcraft`: the page's control channel (crate::api).
                         let (control_tx, control_rx) = std::sync::mpsc::channel();
-                        crate::api::connect(Some(control_tx), host.inbox.clone(), ctx.clone());
+                        crate::api::connect(Some(control_tx), host.inbox.page.clone(), ctx.clone());
                         if let Err(e) = crate::api::install() {
                             log::error!("vectorcraft-web: couldn't install window.vectorcraft: {}", js_err(e));
                         }
@@ -409,7 +421,7 @@ impl eframe::App for WebShell {
                 for f in dropped {
                     let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
                     let target = app.drop_target(&name, pos, shift);
-                    let (inbox, place_inbox, repaint) = (self.host.inbox.clone(), self.host.place_inbox.clone(), ctx.clone());
+                    let (inbox, place_inbox, repaint) = (self.host.inbox.dropped.clone(), self.host.place_inbox.clone(), ctx.clone());
                     wasm_bindgen_futures::spawn_local(async move {
                         match f.bytes_async().await {
                             Ok(bytes) => {
@@ -432,14 +444,14 @@ impl eframe::App for WebShell {
 }
 
 fn services(
-    inbox: Inbox,
+    inbox: OpenInboxes,
     place_inbox: PlaceInbox,
     script_inbox: ScriptInbox,
     ctx: egui::Context,
     locks: Option<WebLocks>,
     stylus: StylusFeed,
 ) -> Services {
-    let open_inbox = inbox.clone();
+    let open_inbox = inbox.picked.clone();
     let picked = place_inbox.clone();
     let place_ctx = ctx.clone();
     let screen_color = eye_dropper(ctx.clone());
@@ -488,11 +500,12 @@ fn services(
                 let dialog = fileio::open_filters().fold(rfd::AsyncFileDialog::new(), |d, (name, exts)| {
                     d.add_filter(vectorcraft_ui_egui::i18n::tr_ctx(vectorcraft_ui_egui::i18n::current(), "file-filter", name), exts)
                 });
-                let Some(file) = dialog.pick_file().await else {
-                    return;
+                // A canceled pick answers `None`.
+                let answer = match dialog.pick_file().await {
+                    Some(file) => Some((file.file_name(), file.read().await)),
+                    None => None,
                 };
-                let bytes = file.read().await;
-                inbox.lock().unwrap_or_else(|e| e.into_inner()).push((file.file_name(), bytes));
+                inbox.lock().unwrap_or_else(|e| e.into_inner()).push(answer);
                 ctx.request_repaint();
             });
         })),
@@ -500,7 +513,9 @@ fn services(
         screen_color,
         // A download that couldn't be started fails the save or export it is for (#1693).
         download: Some(Box::new(|name: &str, bytes: &[u8]| download(name, bytes).inspect_err(|e| log::error!("download of {name} failed: {e}")))),
-        inbox: Some(inbox),
+        inbox: Some(inbox.dropped),
+        picked_inbox: Some(inbox.picked),
+        page_inbox: Some(inbox.page),
         recovery_store: Some(Arc::new(BrowserStore { locks })),
         // File → Print: the browser's print dialog.
         print: Some(Box::new(BrowserPrint)),
diff --git a/crates/cad/src/lib.rs b/crates/cad/src/lib.rs
index d96df39b6a..0ef28a4aaa 100644
--- a/crates/cad/src/lib.rs
+++ b/crates/cad/src/lib.rs
@@ -281,6 +281,10 @@ pub struct DxfOptions {
     pub scale_lineweights: bool,
     pub colors: ColorDepth,
     pub raster: RasterFormat,
+    /// Placed images are written as IMAGE entities with their files (else left out, undecoded).
+    pub include_images: bool,
+    /// Filled areas get a solid HATCH after their outlines (else the outlines alone).
+    pub include_hatches: bool,
     pub preserve: Preserve,
     /// Alter Paths for Appearance: a stroke a CAD line can't draw (one [`Preserve::Appearance`]
     /// outlines, one wider than the widest lineweight, or any stroke in R13 and R14, which have
@@ -303,6 +307,8 @@ impl Default for DxfOptions {
             scale_lineweights: false,
             colors: ColorDepth::default(),
             raster: RasterFormat::default(),
+            include_images: true,
+            include_hatches: true,
             preserve: Preserve::default(),
             alter_paths: false,
             outline_text: false,
@@ -322,7 +328,8 @@ pub enum DxfPreset {
     /// For CNC and CAM cutting software: version 2000 (the oldest version that has both lightweight
     /// polylines and lineweights), 1 mm = 1 unit, 256 indexed colors (all version 2000 holds), Maximize
     /// Editability with Alter Paths off (every stroke a center line), Outline Text (type as paths),
-    /// and placed images as PNG.
+    /// and placed images and fill hatches left out (fills are their outlines), with PNG as the
+    /// format images take when they are put back in.
     Cnc,
 }
 
@@ -360,6 +367,8 @@ impl DxfPreset {
                 scale_lineweights: false,
                 colors: ColorDepth::Aci256,
                 raster: RasterFormat::Png,
+                include_images: false,
+                include_hatches: false,
                 preserve: Preserve::Editability,
                 alter_paths: false,
                 outline_text: true,
@@ -377,6 +386,8 @@ impl DxfPreset {
             && o.scale_lineweights == c.scale_lineweights
             && o.colors == c.colors
             && o.raster == c.raster
+            && o.include_images == c.include_images
+            && o.include_hatches == c.include_hatches
             && o.preserve == c.preserve
             && o.alter_paths == c.alter_paths
             && o.outline_text == c.outline_text;
diff --git a/crates/cad/src/scene.rs b/crates/cad/src/scene.rs
index 3faf94423f..7c5d8b6755 100644
--- a/crates/cad/src/scene.rs
+++ b/crates/cad/src/scene.rs
@@ -1,5 +1,6 @@
 //! The document walk: each visible object becomes DXF entities on its layer's DXF layer, in paint
-//! order. Fills are their outlines then solid hatches (the outlines alone in R12), strokes
+//! order. Fills are their outlines then solid hatches (the outlines alone in R12 or with
+//! hatches left out), placed images are linked image files unless left out, strokes
 //! polylines (with bulges for circular arcs) and cubic splines with a lineweight and dashes, or
 //! filled outlines where the look needs them.
 
@@ -28,6 +29,8 @@ const NO_TRUE_COLOR: &str = "true colour needs DXF 2004 or later: colours are wr
 const NO_TRANSPARENCY: &str = "transparency needs DXF 2004 or later: transparent objects are written opaque";
 const NO_FILLS: &str = "DXF R12 has no fills: filled areas are written as their outlines";
 const NO_IMAGES: &str = "DXF R12 has no images: placed images are left out";
+const IMAGES_OFF: &str = "placed images are left out (Include Placed Images is off)";
+const HATCHES_OFF: &str = "fill hatches are left out: filled areas are written as their outlines (Include Fill Hatches is off)";
 const WIDE_LINES: &str =
     "lines wider than 2.11 mm (the widest lineweight) are written at 2.11 mm: Alter Paths for Appearance writes their true width";
 const STROKE_EXTRAS: &str = "stroke alignment, width profiles, arrowheads and brushes are left out (Maximize Editability writes strokes as lines)";
@@ -339,6 +342,32 @@ fn subpaths(bp: &BezPath) -> Vec<Sub> {
     out
 }
 
+/// `bp` with each open subpath that can enclose an area closed, as a fill closes it: two or more
+/// segments, or one curve. A single straight segment stays open.
+fn closed_fill(bp: &BezPath) -> BezPath {
+    let mut out = BezPath::new();
+    let (mut segs, mut curved) = (0usize, false);
+    let close = |out: &mut BezPath, segs: usize, curved: bool| {
+        if segs >= 2 || (segs == 1 && curved) {
+            out.close_path();
+        }
+    };
+    for el in bp.elements() {
+        match *el {
+            PathEl::MoveTo(_) => {
+                close(&mut out, segs, curved);
+                (segs, curved) = (0, false);
+            }
+            PathEl::ClosePath => (segs, curved) = (0, false),
+            PathEl::LineTo(_) => segs += 1,
+            PathEl::QuadTo(..) | PathEl::CurveTo(..) => (segs, curved) = (segs + 1, true),
+        }
+        out.push(*el);
+    }
+    close(&mut out, segs, curved);
+    out
+}
+
 /// The most pixels of an image written (it is held decoded, as RGBA and encoded at once).
 const MAX_IMAGE_PIXELS: u64 = 64 << 20;
 
@@ -878,13 +907,13 @@ impl<'a> Scene<'a> {
         Some(vectorcraft_brush::stroke_pieces(doc, b, bp, st))
     }
 
-    /// A filled area as its outlines followed by a solid hatch (R12: the outlines alone). Laser
-    /// and cutter software reads the outlines and skips hatches. `clean`: the path has no
+    /// A filled area as its outlines followed by a solid hatch (R12, or with hatches left out: the
+    /// outlines alone). Laser and cutter software reads the outlines and skips hatches. `clean`: the path has no
     /// overlaps, so the hatch's even-odd rule reads it as it is.
     fn area(&mut self, bp: &BezPath, rule: FillRule, style: &EntityStyle, clean: bool) {
         if !self.o.version.handles() {
             self.warn(NO_FILLS);
-            self.lines(bp, style, 0.0);
+            self.lines(&closed_fill(bp), style, 0.0);
             return;
         }
         let several = bp.elements().iter().filter(|e| matches!(e, PathEl::MoveTo(_))).count() > 1;
@@ -893,11 +922,17 @@ impl<'a> Scene<'a> {
             .flatten()
             .map(|p| p.to_bezpath());
         let outline = normalized.as_ref().unwrap_or(bp);
+        // A fill with no loop of three points or more encloses no area: no outline and no hatch.
         let loops: Vec<Vec<Point>> = polygons(outline).into_iter().filter(|p| p.len() >= 3).collect();
         if loops.is_empty() {
             return;
         }
-        self.lines(outline, style, 0.0);
+        // The outlines close as the fill does, so an open path's fill keeps its closing edge.
+        self.lines(&closed_fill(outline), style, 0.0);
+        if !self.o.include_hatches {
+            self.warn(HATCHES_OFF);
+            return;
+        }
         let h = self.handle();
         let layer = self.layer.clone();
         self.e.entity("HATCH", h, fixed::MODEL_RECORD, &layer, style, "AcDbHatch");
@@ -1285,6 +1320,10 @@ impl<'a> Scene<'a> {
             self.warn(NO_IMAGES);
             return;
         }
+        if !self.o.include_images {
+            self.warn(IMAGES_OFF);
+            return;
+        }
         let Some(i) = self.image_def(im) else { return };
         let Some((dw, dh)) = self.images.get(i).map(|d| (f64::from(d.size.0), f64::from(d.size.1))) else { return };
         let (w, h) = (f64::from(im.width.max(1)), f64::from(im.height.max(1)));
diff --git a/crates/cad/src/tests.rs b/crates/cad/src/tests.rs
index 90e4cbc2c6..9d2a519e1d 100644
--- a/crates/cad/src/tests.rs
+++ b/crates/cad/src/tests.rs
@@ -843,10 +843,151 @@ fn the_cnc_preset_writes_version_2000_in_millimeters_with_type_as_paths_and_stro
     assert!(out.images.is_empty());
     assert_eq!(DxfPreset::of(&o), DxfPreset::Cnc);
     assert_eq!(DxfPreset::of(&DxfOptions { colors: ColorDepth::True, ..o.clone() }), DxfPreset::Custom);
+    assert_eq!(DxfPreset::of(&DxfOptions { include_images: true, ..o.clone() }), DxfPreset::Custom);
+    assert_eq!(DxfPreset::of(&DxfOptions { include_hatches: true, ..o.clone() }), DxfPreset::Custom);
     assert_eq!(DxfPreset::of(&DxfOptions::default()), DxfPreset::Custom);
     assert_eq!(DxfPreset::from_id(" CNC "), Some(DxfPreset::Cnc));
 }
 
+/// A 4 × 2 px PNG placed at (10, 20) under key `raster-1`, and before it in paint order
+/// `fill`'s rectangle.
+fn image_and_fill_doc(fill: Paint) -> Document {
+    let mut png = vec![];
+    image::RgbaImage::from_pixel(4, 2, image::Rgba([0, 0, 255, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut d = doc_with(|d| {
+        let im = ImageObject {
+            key: "raster-1".into(),
+            width: 4,
+            height: 2,
+            xf: Affine::translate((10.0, 20.0)) * Affine::scale(5.0),
+            link: None,
+            placement: Default::default(),
+            pixels: None,
+        };
+        vec![
+            path(d, shapes::rectangle(Rect::new(50.0, 10.0, 150.0, 60.0)), fill, Paint::None, 0.0),
+            Node::new(d.alloc_id(), NodeKind::Image(Box::new(im))),
+        ]
+    });
+    d.images.insert("raster-1".into(), ImageBlob { mime: "image/png".into(), bytes: Arc::new(png), proxy: None });
+    d
+}
+
+const IMAGES_OFF: &str = "placed images are left out (Include Placed Images is off)";
+const HATCHES_OFF: &str = "fill hatches are left out: filled areas are written as their outlines (Include Fill Hatches is off)";
+
+#[test]
+fn fills_without_hatches_keep_their_outlines() {
+    let d = shapes_doc();
+    let out = export(&d, &DxfOptions { include_hatches: false, ..opts(&d) }).unwrap();
+    assert_eq!(kinds(&out), ["LWPOLYLINE", "LWPOLYLINE", "CIRCLE"], "the fill's outline, the stroke, the circle");
+    assert_eq!(out.warnings, [HATCHES_OFF]);
+    let e = entities(&out);
+    assert_eq!((get(&e[0], 70), get(&e[0], 370)), (Some("1"), None), "the closed outline, without a lineweight");
+    // Hatches stay by default, with no note.
+    let on = export(&d, &opts(&d)).unwrap();
+    assert!(kinds(&on).iter().any(|k| k == "HATCH") && !on.warnings.iter().any(|w| w == HATCHES_OFF));
+    // The outlines are the ones written beside hatches, also for overlapping subpaths, which are
+    // merged first; a fill with no area (a flat rectangle, a diagonal line) writes nothing either way.
+    let compound = doc_with(|d| {
+        let mut bp = shapes::rectangle(Rect::new(10.0, 10.0, 60.0, 60.0)).to_bezpath();
+        bp.extend(shapes::rectangle(Rect::new(40.0, 40.0, 90.0, 90.0)).to_bezpath().elements().iter().copied());
+        let p = PathData::from_bezpath(&bp);
+        vec![
+            path(d, p, Paint::solid(Color::BLACK), Paint::None, 0.0),
+            path(d, shapes::rectangle(Rect::new(10.0, 70.0, 90.0, 70.0)), Paint::solid(Color::BLACK), Paint::None, 0.0),
+            path(d, shapes::line(Point::new(100.0, 10.0), Point::new(150.0, 60.0)), Paint::solid(Color::BLACK), Paint::None, 0.0),
+        ]
+    });
+    let without_hatches = |o: &DxfOutput| {
+        let mut e = entities(o);
+        e.retain(|x| kind(x) != "HATCH");
+        e.into_iter().map(|x| x.into_iter().filter(|p| p.0 != 5).collect::<Pairs>()).collect::<Vec<_>>()
+    };
+    let (c_on, c_off) =
+        (export(&compound, &opts(&compound)).unwrap(), export(&compound, &DxfOptions { include_hatches: false, ..opts(&compound) }).unwrap());
+    assert_eq!(kinds(&c_on), ["LWPOLYLINE", "HATCH"], "one merged outline");
+    assert_eq!(without_hatches(&c_off), without_hatches(&c_on));
+    assert_eq!(without_hatches(&out), without_hatches(&on));
+    // Strokes outlined for their look are areas too: their outlines stay.
+    let altered =
+        export(&d, &DxfOptions { include_hatches: false, alter_paths: true, preserve: Preserve::Editability, version: DxfVersion::R14, ..opts(&d) })
+            .unwrap();
+    assert!(!kinds(&altered).iter().any(|k| k == "HATCH") && !kinds(&altered).is_empty(), "{:?}", kinds(&altered));
+    // Nothing filled: no note.
+    let lines = doc_with(|d| vec![path(d, shapes::ellipse(Rect::new(120.0, 20.0, 180.0, 80.0)), Paint::None, Paint::solid(Color::BLACK), 1.0)]);
+    assert!(export(&lines, &DxfOptions { include_hatches: false, ..opts(&lines) }).unwrap().warnings.is_empty());
+    // R12 has no hatches anyway: the same outlines, and its own note alone.
+    let r12 = |include_hatches| export(&d, &DxfOptions { version: DxfVersion::R12, include_hatches, ..opts(&d) }).unwrap();
+    let (off, on) = (r12(false), r12(true));
+    assert_eq!(off.bytes, on.bytes);
+    assert_eq!(off.warnings, on.warnings);
+    assert!(!off.warnings.iter().any(|w| w == HATCHES_OFF));
+}
+
+#[test]
+fn an_open_path_s_fill_outline_keeps_its_closing_edge() {
+    let mut bp = vectorcraft_geom::BezPath::new();
+    bp.move_to((10.0, 10.0));
+    bp.line_to((90.0, 10.0));
+    bp.line_to((50.0, 80.0));
+    let open = PathData::from_bezpath(&bp);
+    let d = doc_with(|d| vec![path(d, open.clone(), Paint::solid(Color::BLACK), Paint::solid(Color::BLACK), 1.0)]);
+    let closed = |e: &Pairs| get(e, 70).and_then(|v| v.trim().parse::<i64>().ok()).is_some_and(|v| v & 1 == 1);
+    for include_hatches in [false, true] {
+        let out = export(&d, &DxfOptions { include_hatches, ..opts(&d) }).unwrap();
+        let e: Vec<Pairs> = entities(&out).into_iter().filter(|x| kind(x) == "LWPOLYLINE").collect();
+        assert_eq!(e.len(), 2, "the fill's outline and the stroke: {:?}", kinds(&out));
+        assert!(closed(&e[0]), "the fill's outline closes as the fill does (hatches {include_hatches})");
+        assert!(!closed(&e[1]), "the stroke stays open (hatches {include_hatches})");
+    }
+    // R12 writes the outline alone, closed too.
+    let fill_only = doc_with(|d| vec![path(d, open.clone(), Paint::solid(Color::BLACK), Paint::None, 0.0)]);
+    let r12 = export(&fill_only, &DxfOptions { version: DxfVersion::R12, ..opts(&fill_only) }).unwrap();
+    let e = entities(&r12);
+    assert_eq!(kind(&e[0]), "POLYLINE", "{:?}", kinds(&r12));
+    assert!(closed(&e[0]), "R12's outline closes as the fill does");
+}
+
+#[test]
+fn images_can_be_left_out_with_their_files() {
+    let d = image_and_fill_doc(Paint::None);
+    let out = export(&d, &DxfOptions { include_images: false, ..opts(&d) }).unwrap();
+    assert!(entities(&out).is_empty() && out.images.is_empty(), "{:?}", kinds(&out));
+    let p = pairs(&out.bytes);
+    assert!(!section(&p, "OBJECTS").iter().any(|o| matches!(kind(o), "IMAGEDEF" | "IMAGEDEF_REACTOR" | "RASTERVARIABLES")));
+    assert!(!section(&p, "CLASSES").iter().any(|o| get(o, 1) == Some("IMAGE")));
+    assert_eq!(out.warnings, [IMAGES_OFF]);
+    // An image that can't be decoded is not read when images are left out.
+    let mut broken = d.clone();
+    broken.images.insert("raster-1".into(), ImageBlob { mime: "image/png".into(), bytes: Arc::new(b"not a png".to_vec()), proxy: None });
+    assert_eq!(export(&broken, &DxfOptions { include_images: false, ..opts(&broken) }).unwrap().warnings, [IMAGES_OFF]);
+    assert!(export(&broken, &opts(&broken)).unwrap().warnings.iter().any(|w| w.contains("couldn't be decoded")));
+    // R12 has no images anyway: its own note alone.
+    let r12 = export(&d, &DxfOptions { version: DxfVersion::R12, include_images: false, ..opts(&d) }).unwrap();
+    assert!(r12.warnings.iter().any(|w| w.contains("no images")) && !r12.warnings.iter().any(|w| w == IMAGES_OFF));
+}
+
+#[test]
+fn images_and_hatches_are_left_out_independently_and_the_cnc_preset_leaves_out_both() {
+    let d = image_and_fill_doc(Paint::solid(Color::rgb(1.0, 0.0, 0.0)));
+    let run = |o: DxfOptions| export(&d, &DxfOptions { region: d.artboards[0].rect, ..o }).unwrap();
+    let both = run(DxfOptions::default());
+    assert_eq!(kinds(&both), ["LWPOLYLINE", "HATCH", "IMAGE"]);
+    assert_eq!(both.images.len(), 1);
+    let no_images = run(DxfOptions { include_images: false, ..DxfOptions::default() });
+    assert_eq!((kinds(&no_images), no_images.images.len()), (vec!["LWPOLYLINE".to_string(), "HATCH".into()], 0));
+    let no_hatches = run(DxfOptions { include_hatches: false, ..DxfOptions::default() });
+    assert_eq!((kinds(&no_hatches), no_hatches.images.len()), (vec!["LWPOLYLINE".to_string(), "IMAGE".into()], 1));
+    // CNC / CAM: the cutting path alone, with no image file and both notes.
+    let cnc = run(DxfPreset::Cnc.options());
+    assert_eq!(kinds(&cnc), ["LWPOLYLINE"]);
+    assert!(cnc.images.is_empty());
+    assert!(cnc.warnings.iter().any(|w| w == IMAGES_OFF) && cnc.warnings.iter().any(|w| w == HATCHES_OFF), "{:?}", cnc.warnings);
+    let custom = DxfPreset::Custom.options();
+    assert!(custom.include_images && custom.include_hatches, "Custom keeps both");
+}
+
 #[test]
 fn layers_become_dxf_layers() {
     let mut d = shapes_doc();
diff --git a/crates/doc/src/blend.rs b/crates/doc/src/blend.rs
index d6b7eda2c5..05968ced7e 100644
--- a/crates/doc/src/blend.rs
+++ b/crates/doc/src/blend.rs
@@ -1052,11 +1052,27 @@ fn pinned(spec: &BlendSpec, keys: usize, n: usize) -> Option<Vec<usize>> {
 ///   its handles) moved onto the key's centre, so moving a key moves its end of the spine;
 /// - a spine from Replace Spine: its first subpath, `None` for the anchors (the keys spread
 ///   evenly along it by arc length).
+///
+/// `None` for a blend made without a spine ([`BlendSpec::no_spine`]).
 pub fn blend_spine(keys: &[Arc<Node>], spec: &BlendSpec) -> Option<(PathData, Option<Vec<usize>>)> {
+    if spec.no_spine {
+        return None;
+    }
+    layout_spine(keys, spec)
+}
+
+/// The spine `spec` stores, unless the blend was made without one.
+fn stored_spine(spec: &BlendSpec) -> Option<&PathData> {
+    spec.spine.as_ref().filter(|_| !spec.no_spine)
+}
+
+/// [`blend_spine`] for placing the steps: a blend made without a spine still places them on the
+/// straight lines between its key centers.
+fn layout_spine(keys: &[Arc<Node>], spec: &BlendSpec) -> Option<(PathData, Option<Vec<usize>>)> {
     if keys.len() < 2 {
         return None;
     }
-    let Some(stored) = &spec.spine else {
+    let Some(stored) = stored_spine(spec) else {
         let centers: Vec<Point> = keys.iter().map(|k| center_of(k)).collect();
         return Some((PathData::single(SubPath::polyline(&centers, false)), Some((0..keys.len()).collect())));
     };
@@ -1127,10 +1143,10 @@ impl Rail {
     /// `None` when nothing moves: no stored spine and the steps keep the page's orientation.
     fn new(keys: &[Arc<Node>], spec: &BlendSpec) -> Option<Self> {
         let rotate = spec.orientation == BlendOrientation::AlignToPath;
-        if spec.spine.is_none() && !rotate {
+        if stored_spine(spec).is_none() && !rotate {
             return None;
         }
-        let (path, anchors) = blend_spine(keys, spec)?;
+        let (path, anchors) = layout_spine(keys, spec)?;
         let spine = Spine::new(&path)?;
         let total = spine.length();
         let k = keys.len();
@@ -1192,10 +1208,10 @@ impl Rail {
 /// spine it is moved to, and so does its own centre, which it turns about. `None` when nothing
 /// moves.
 pub(crate) fn rail_reach(keys: &[Arc<Node>], spec: &BlendSpec, symbols: Option<&crate::SymbolBoxes>) -> Option<Rect> {
-    if spec.spine.is_none() && spec.orientation != BlendOrientation::AlignToPath {
+    if stored_spine(spec).is_none() && spec.orientation != BlendOrientation::AlignToPath {
         return None;
     }
-    let spine = blend_spine(keys, spec)?.0.bounds()?;
+    let spine = layout_spine(keys, spec)?.0.bounds()?;
     let radius = keys
         .iter()
         .filter_map(|k| {
@@ -1404,7 +1420,9 @@ pub fn blend_expand(keys: &[Arc<Node>], spec: &BlendSpec) -> Vec<Node> {
         for j in 1..=n {
             // Even position of the step, then where the easing puts its shape and its colours.
             let u = j as f64 / (n + 1) as f64;
-            let (t, tc) = (if rail.is_some() { spec.ease.apply(u) } else { u }, spec.color_position(u));
+            // Easing needs a spine: a blend made without one keeps its steps evenly spaced.
+            let eased = rail.is_some() && !spec.no_spine;
+            let (t, tc) = (if eased { spec.ease.apply(u) } else { u }, spec.color_position(u));
             let mut s = lerp.at_eased(t, tc);
             if let Some(r) = &rail {
                 r.place(&mut s, i, t);
diff --git a/crates/doc/src/live.rs b/crates/doc/src/live.rs
index 304c4e70f6..7233f88a50 100644
--- a/crates/doc/src/live.rs
+++ b/crates/doc/src/live.rs
@@ -49,7 +49,7 @@ mod expand;
 mod mesh;
 mod warp;
 
-pub use blend_spec::{BlendDefaults, BlendEase, BlendEaseType, BlendOrientation, BlendSpacing, BlendSpec};
+pub use blend_spec::{BlendDefaults, BlendEase, BlendEaseType, BlendOrientation, BlendSpacing, BlendSpec, BlendSpineMode};
 #[cfg(test)]
 use blend_spec::{blend_color_shift, blend_ramp};
 pub use envelope::{
diff --git a/crates/doc/src/live/blend_spec.rs b/crates/doc/src/live/blend_spec.rs
index 75df5eee1f..56405e0d18 100644
--- a/crates/doc/src/live/blend_spec.rs
+++ b/crates/doc/src/live/blend_spec.rs
@@ -107,6 +107,11 @@ pub struct BlendSpec {
     /// on anchor points); `None`: chosen so closed shapes don't twist.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub starts: Vec<Option<u32>>,
+    /// The blend was made without a spine (Create Spine › Never): it has no spine to show, edit,
+    /// reverse or release, and no easing. Its steps still sit on the straight lines between the
+    /// key centers. Replace Spine gives it one.
+    #[serde(default, rename = "noSpine", skip_serializing_if = "is_false", deserialize_with = "lenient_bool")]
+    pub no_spine: bool,
 }
 
 impl BlendSpec {
@@ -116,6 +121,41 @@ impl BlendSpec {
     }
 }
 
+/// The Blend panel's Create Spine setting: whether a new blend gets a spine.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum BlendSpineMode {
+    /// The usual rule: every new blend gets a spine, the straight lines between its key centers.
+    #[default]
+    Auto,
+    /// Every new blend gets a spine, whatever its key objects are.
+    Always,
+    /// New blends get no spine.
+    Never,
+}
+
+impl BlendSpineMode {
+    /// Every mode, in the order the Blend panel lists them.
+    pub const ALL: [Self; 3] = [Self::Auto, Self::Always, Self::Never];
+
+    pub fn id(self) -> &'static str {
+        match self {
+            Self::Auto => "auto",
+            Self::Always => "always",
+            Self::Never => "never",
+        }
+    }
+
+    pub fn from_id(id: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|m| m.id() == id)
+    }
+
+    /// Whether a new blend made with this mode gets a spine.
+    pub fn creates_spine(self) -> bool {
+        self != Self::Never
+    }
+}
+
 /// Blend Options set with no blend selected: what new blends start with.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Serialize, Deserialize)]
 pub struct BlendDefaults {
@@ -123,6 +163,29 @@ pub struct BlendDefaults {
     pub spacing: BlendSpacing,
     #[serde(default)]
     pub orientation: BlendOrientation,
+    /// Create Spine (`object.blend.createSpine`).
+    #[serde(default, rename = "createSpine", skip_serializing_if = "is_auto", deserialize_with = "spine_mode")]
+    pub create_spine: BlendSpineMode,
+}
+
+fn is_false(v: &bool) -> bool {
+    !*v
+}
+
+fn is_auto(v: &BlendSpineMode) -> bool {
+    *v == BlendSpineMode::Auto
+}
+
+/// Reading a native file never fails over a `noSpine` that is not a boolean: the blend keeps its
+/// spine.
+fn lenient_bool<'de, D: serde::Deserializer<'de>>(d: D) -> Result<bool, D::Error> {
+    Ok(serde_json::Value::deserialize(d)?.as_bool().unwrap_or(false))
+}
+
+/// Reading the preferences never fails over an unknown Create Spine value: it becomes Auto.
+fn spine_mode<'de, D: serde::Deserializer<'de>>(d: D) -> Result<BlendSpineMode, D::Error> {
+    let v = serde_json::Value::deserialize(d)?;
+    Ok(v.as_str().and_then(BlendSpineMode::from_id).unwrap_or_default())
 }
 
 /// Reading a native file never fails over one bad blend number: out-of-range values clamp,
diff --git a/crates/engine/src/cmd/fileio/dxf.rs b/crates/engine/src/cmd/fileio/dxf.rs
index b63447e228..16cf3b2631 100644
--- a/crates/engine/src/cmd/fileio/dxf.rs
+++ b/crates/engine/src/cmd/fileio/dxf.rs
@@ -21,7 +21,7 @@ pub fn specs() -> Vec<CommandSpec> {
         "Export DXF",
         [],
         None,
-        "{path?, dxfPreset?: custom (default)|cnc (CNC / CAM: version 2000, the oldest version that has both lightweight polylines and lineweights; unit mm, scale 1; colors 256, all 2000 holds; preserve editability and alterPaths false, so strokes stay center lines; outlineText true, so type is paths; rasterFormat png; the options given override it), version?: R12|R13|R14|2000|2004|2007|2010|2013|2018 (default), unit?: mm (default; any unit name: pt, in, cm…), scale?: 1 (drawing units per unit), scaleLineweights?: false, colors?: 8|16|256|true (default; true colour needs 2004+, else 256), rasterFormat?: png (default)|jpeg (placed images, written next to the file), preserve?: appearance (default: type as outlines; strokes a CAD line can't draw as filled outlines; brush art)|editability (type as text; every stroke a line with its lineweight and dashes), alterPaths?: false (strokes a CAD line can't draw as their filled outlines, with editability too; also strokes wider than 2.11 mm, and every stroke in R13 and R14), outlineText?: false, selectedOnly?: false (the selected objects, in their layers), artboard?: 0 (the origin is its bottom-left corner), useArtboards?: true (one drawing per chosen artboard, artboards?/range?, holding the art over it: {stem}-{artboard}.dxf) | false (the origin at the art's bounds)} → {path, bytes, warnings, files?, linked?: [image files]}; no path → {dataBase64, …, linked?: [{name, dataBase64}]}. Layers become DXF layers (hidden: off; locked; non-printing: not plotted); paths become polylines and splines, fills their outlines (which laser and cutter software reads) and solid hatches. Same as document.export {format: dxf}. A key DXF doesn't take is refused",
+        "{path?, dxfPreset?: custom (default)|cnc (CNC / CAM: version 2000, the oldest version that has both lightweight polylines and lineweights; unit mm, scale 1; colors 256, all 2000 holds; preserve editability and alterPaths false, so strokes stay center lines; outlineText true, so type is paths; includeImages and includeHatches false, so fills are their outlines and no image files are written; rasterFormat png; the options given override it), version?: R12|R13|R14|2000|2004|2007|2010|2013|2018 (default), unit?: mm (default; any unit name: pt, in, cm…), scale?: 1 (drawing units per unit), scaleLineweights?: false, colors?: 8|16|256|true (default; true colour needs 2004+, else 256), rasterFormat?: png (default)|jpeg (placed images, written next to the file), includeImages?: true (false: placed images and their files are left out), includeHatches?: true (false: fills are their outlines, without solid hatches), preserve?: appearance (default: type as outlines; strokes a CAD line can't draw as filled outlines; brush art)|editability (type as text; every stroke a line with its lineweight and dashes), alterPaths?: false (strokes a CAD line can't draw as their filled outlines, with editability too; also strokes wider than 2.11 mm, and every stroke in R13 and R14), outlineText?: false, selectedOnly?: false (the selected objects, in their layers), artboard?: 0 (the origin is its bottom-left corner), useArtboards?: true (one drawing per chosen artboard, artboards?/range?, holding the art over it: {stem}-{artboard}.dxf) | false (the origin at the art's bounds)} → {path, bytes, warnings, files?, linked?: [image files]}; no path → {dataBase64, …, linked?: [{name, dataBase64}]}. Layers become DXF layers (hidden: off; locked; non-printing: not plotted); paths become polylines and splines, fills their outlines (which laser and cutter software reads) and solid hatches. Same as document.export {format: dxf}. A key DXF doesn't take is refused",
         has_doc,
         export_dxf
     )]
@@ -37,7 +37,7 @@ pub(crate) const OPTIONS: &[FormatOption] = &[
         name: "dxfPreset",
         ty: "string",
         default: "\"custom\"",
-        description: "custom, or cnc (CNC / CAM: version 2000, mm, 256 colors, editability, type as outlines, PNG images); the options given override it",
+        description: "custom, or cnc (CNC / CAM: version 2000, mm, 256 colors, editability, type as outlines, no images, no fill hatches); the options given override it",
     },
     FormatOption { name: "version", ty: "string", default: "\"2018\"", description: "R12, R13, R14, 2000, 2004, 2007, 2010, 2013 or 2018" },
     FormatOption {
@@ -60,6 +60,18 @@ pub(crate) const OPTIONS: &[FormatOption] = &[
         default: "\"png\"",
         description: "png or jpeg: the files placed images are written to, next to the drawing",
     },
+    FormatOption {
+        name: "includeImages",
+        ty: "boolean",
+        default: "true",
+        description: "placed images are written, linked to their files; false leaves them and their files out",
+    },
+    FormatOption {
+        name: "includeHatches",
+        ty: "boolean",
+        default: "true",
+        description: "filled areas get a solid hatch after their outlines; false writes the outlines alone",
+    },
     FormatOption {
         name: "preserve",
         ty: "string",
@@ -133,6 +145,8 @@ struct Params {
     scale_lineweights: Option<bool>,
     colors: Option<Value>,
     raster_format: Option<String>,
+    include_images: Option<bool>,
+    include_hatches: Option<bool>,
     preserve: Option<String>,
     alter_paths: Option<bool>,
     outline_text: Option<bool>,
@@ -176,6 +190,8 @@ fn parse(p: &Value) -> Result<(DxfOptions, ArtboardPick)> {
         scale_lineweights: q.scale_lineweights.unwrap_or(d.scale_lineweights),
         colors: choice("colors", q.colors.as_ref().map(text), ColorDepth::from_id, d.colors, "8, 16, 256 or true")?,
         raster: choice("rasterFormat", q.raster_format, RasterFormat::from_id, d.raster, "png or jpeg")?,
+        include_images: q.include_images.unwrap_or(d.include_images),
+        include_hatches: q.include_hatches.unwrap_or(d.include_hatches),
         preserve: choice("preserve", q.preserve, Preserve::from_id, d.preserve, "appearance or editability")?,
         alter_paths: q.alter_paths.unwrap_or(d.alter_paths),
         outline_text: q.outline_text.unwrap_or(d.outline_text),
diff --git a/crates/engine/src/cmd/fileio/tests_dxf.rs b/crates/engine/src/cmd/fileio/tests_dxf.rs
index 8497676836..54839edda4 100644
--- a/crates/engine/src/cmd/fileio/tests_dxf.rs
+++ b/crates/engine/src/cmd/fileio/tests_dxf.rs
@@ -84,6 +84,11 @@ fn the_cnc_preset_sets_the_options_that_are_not_given() {
             true
         )
     );
+    assert_eq!((o.include_images, o.include_hatches), (false, false), "CNC / CAM leaves out images and fill hatches");
+    let given = dxf::options(&json!({"dxfPreset": "cnc", "includeImages": true, "includeHatches": true})).unwrap();
+    assert_eq!((given.include_images, given.include_hatches), (true, true), "the options given override it");
+    let custom = dxf::options(&json!({})).unwrap();
+    assert_eq!((custom.include_images, custom.include_hatches), (true, true), "Custom keeps both");
     assert_eq!(dxf::options(&json!({})).unwrap().version, vectorcraft_cad::DxfVersion::R2018, "custom by default");
     let e = s.execute("document.exportDxf", &json!({"dxfPreset": "laser"})).unwrap_err().to_string();
     assert!(e.contains("custom or cnc"), "{e}");
@@ -151,6 +156,44 @@ fn placed_images_come_back_as_linked_files() {
     let _ = std::fs::remove_dir_all(dir);
 }
 
+/// `includeImages` and `includeHatches` leave out placed images (with their files) and fill
+/// hatches, each on its own, through both commands, with and without a path; CNC / CAM leaves
+/// out both, and the options given override it.
+#[test]
+fn placed_images_and_fill_hatches_can_be_left_out() {
+    let mut s = super::tests_svg::image_session();
+    s.execute("paint.setFill", &json!({"color": "#ff0000"})).unwrap();
+    s.execute("paint.setStroke", &json!({"none": true})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 1, "height": 1})).unwrap();
+    let counts = |r: &Value| {
+        let e = entities(&text(r));
+        let n = |k: &str| e.iter().filter(|x| *x == k).count();
+        (n("LWPOLYLINE"), n("HATCH"), n("IMAGE"), r.get("linked").and_then(Value::as_array).map_or(0, Vec::len))
+    };
+    let warned = |r: &Value, w: &str| r["warnings"].as_array().unwrap().iter().any(|x| x.as_str().is_some_and(|x| x.starts_with(w)));
+    let all = s.execute("document.export", &json!({"format": "dxf"})).unwrap();
+    assert_eq!(counts(&all), (1, 1, 1, 1));
+    let r = s.execute("document.export", &json!({"format": "dxf", "includeImages": false})).unwrap();
+    assert_eq!(counts(&r), (1, 1, 0, 0));
+    assert!(warned(&r, "placed images are left out") && !warned(&r, "fill hatches"), "{r}");
+    let r = s.execute("document.exportDxf", &json!({"includeHatches": false})).unwrap();
+    assert_eq!(counts(&r), (1, 0, 1, 1));
+    assert!(warned(&r, "fill hatches are left out") && !warned(&r, "placed images"), "{r}");
+    let r = s.execute("document.exportDxf", &json!({"dxfPreset": "cnc"})).unwrap();
+    assert_eq!(counts(&r), (1, 0, 0, 0));
+    let r = s.execute("document.export", &json!({"format": "dxf", "dxfPreset": "cnc", "includeImages": true})).unwrap();
+    assert_eq!(counts(&r), (1, 0, 1, 1));
+    // With a path, no image file is written next to the drawing.
+    let dir = std::env::temp_dir().join(format!("vc-dxf-out-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("cut.dxf").to_string_lossy().to_string();
+    let r = s.execute("document.exportDxf", &json!({"path": path, "dxfPreset": "cnc"})).unwrap();
+    assert!(r.get("linked").is_none(), "{r}");
+    let files: Vec<String> = std::fs::read_dir(&dir).unwrap().filter_map(|e| e.ok()).map(|e| e.file_name().to_string_lossy().to_string()).collect();
+    assert_eq!(files, ["cut.dxf"]);
+    let _ = std::fs::remove_dir_all(dir);
+}
+
 /// Two placed images whose pixel data can't be decoded are left out of the drawing and get no
 /// linked file, and `warnings` holds the note raster exports give, once, without naming either
 /// image's key.
@@ -181,6 +224,8 @@ fn bad_dxf_options_are_refused() {
         json!({"rasterFormat": "gif"}),
         json!({"preserve": "both"}),
         json!({"alterPaths": "yes"}),
+        json!({"includeImages": "no"}),
+        json!({"includeHatches": 0}),
     ] {
         let e = s.execute("document.exportDxf", &p).unwrap_err().to_string();
         assert!(e.contains("DXF"), "{p}: {e}");
@@ -203,6 +248,8 @@ fn formats_list_dxf_and_what_can_not_be_written() {
         "scaleLineweights",
         "colors",
         "rasterFormat",
+        "includeImages",
+        "includeHatches",
         "preserve",
         "alterPaths",
         "outlineText",
diff --git a/crates/engine/src/cmd/live/blend.rs b/crates/engine/src/cmd/live/blend.rs
index 7d7c21227a..609936ecf7 100644
--- a/crates/engine/src/cmd/live/blend.rs
+++ b/crates/engine/src/cmd/live/blend.rs
@@ -1,5 +1,7 @@
 use std::collections::BTreeSet;
 
+use vectorcraft_doc::live::BlendSpineMode;
+
 use super::common::{
     DEFAULT_DISTANCE, DEFAULT_STEPS, ease_param, fix_ids, ids_json, is_blend, orientation_param, percent_param, roots_param, selected_of,
     spacing_param, starts_param, wrap,
@@ -61,6 +63,19 @@ fn extend_spine(spec: &mut BlendSpec, old: &[Arc<Node>], old_spec: &BlendSpec, k
     spec.spine = Some(path);
 }
 
+/// Does `p` set easing (`easingType` or `ramp`)? Easing needs a spine.
+fn gives_easing(p: &Value) -> bool {
+    ["easingType", "ramp"].iter().any(|key| p.get(*key).is_some_and(|v| !v.is_null()))
+}
+
+/// The Create Spine mode `p` gives as `key`, or `current` when it is omitted or null.
+fn spine_mode_param(p: &Value, cmd: &str, key: &str, current: BlendSpineMode) -> Result<BlendSpineMode> {
+    match p.get(key).filter(|v| !v.is_null()) {
+        None => Ok(current),
+        Some(v) => v.as_str().and_then(BlendSpineMode::from_id).ok_or_else(|| bad(cmd, format!("`{key}` must be one of auto, always, never"))),
+    }
+}
+
 pub(super) fn blend_make(s: &mut Session, p: &Value) -> Result<Value> {
     const C: &str = "object.blend.make";
     let roots = roots_param(s, p)?;
@@ -69,16 +84,22 @@ pub(super) fn blend_make(s: &mut Session, p: &Value) -> Result<Value> {
     }
     let starts = starts_param(p, &roots)?;
     let base = first_blend(&s.doc()?.doc, &roots);
+    let defaults = s.prefs.blend_options.unwrap_or_default();
+    // Create Spine applies to a new blend; one taking more keys keeps whether it has a spine.
+    let create_spine = spine_mode_param(p, C, "createSpine", defaults.create_spine)?;
     let cur = match base.as_ref().map(|n| &n.kind) {
-        Some(NodeKind::Blend { spec, .. }) => BlendDefaults { spacing: spec.spacing, orientation: spec.orientation },
-        _ => s.prefs.blend_options.unwrap_or_default(),
+        Some(NodeKind::Blend { spec, .. }) => BlendDefaults { spacing: spec.spacing, orientation: spec.orientation, ..defaults },
+        _ => defaults,
     };
     let spacing = spacing_param(p, C, cur.spacing)?;
     let orientation = orientation_param(p, cur.orientation);
-    let (ease0, color0) = match base.as_ref().map(|n| &n.kind) {
-        Some(NodeKind::Blend { spec, .. }) => (spec.ease, spec.color_shift),
-        _ => Default::default(),
+    let (ease0, color0, no_spine) = match base.as_ref().map(|n| &n.kind) {
+        Some(NodeKind::Blend { spec, .. }) => (spec.ease, spec.color_shift, spec.no_spine),
+        _ => (Default::default(), 0.0, !create_spine.creates_spine()),
     };
+    if no_spine && gives_easing(p) {
+        return Err(bad(C, "the blend has no spine"));
+    }
     let ease = ease_param(p, C, ease0)?;
     let color_shift = percent_param(p, C, "colorShift", color0, -100.0)?;
     let id = s.edit("Make Blend", |d, sel| {
@@ -91,7 +112,7 @@ pub(super) fn blend_make(s: &mut Session, p: &Value) -> Result<Value> {
                 n.knockout = vectorcraft_doc::Knockout::On;
                 n
             });
-            let mut spec = BlendSpec { spacing, orientation, ease, color_shift, starts, ..Default::default() };
+            let mut spec = BlendSpec { spacing, orientation, ease, color_shift, starts, no_spine, ..Default::default() };
             if let NodeKind::Blend { children: old, spec: old_spec } = &n.kind {
                 extend_spine(&mut spec, old, old_spec, &children);
             }
@@ -346,9 +367,12 @@ pub(super) fn blend_options(s: &mut Session, p: &Value) -> Result<Value> {
         // Nothing to set them on: the options new blends start with (easing is per blend).
         let d = s.prefs.blend_options.unwrap_or_default();
         let spacing = spacing_param(p, C, d.spacing)?;
-        s.prefs.blend_options = Some(BlendDefaults { spacing, orientation: orientation_param(p, d.orientation) });
+        s.prefs.blend_options = Some(BlendDefaults { spacing, orientation: orientation_param(p, d.orientation), ..d });
         return Ok(json!({ "defaults": true }));
     };
+    if gives_easing(p) && any_without_spine(s) {
+        return Err(bad(C, "the blend has no spine"));
+    }
     let spacing = spacing_param(p, C, cur.spacing)?;
     let orientation = orientation_param(p, cur.orientation);
     let ease = ease_param(p, C, cur.ease)?;
@@ -384,6 +408,7 @@ pub(super) fn blend_info(s: &mut Session, _: &Value) -> Result<Value> {
             v["colorShift"] = json!(spec.color_shift);
             v["starts"] = json!((0..keys.len()).map(|i| spec.start(i)).collect::<Vec<_>>());
             v["keys"] = json!(keys.iter().map(|k| k.0).collect::<Vec<_>>());
+            v["hasSpine"] = json!(!spec.no_spine);
             if let Some(NodeKind::Blend { children, .. }) = s.doc()?.doc.node(id).map(|n| &n.kind)
                 && let Some((path, anchors)) = live::blend_spine(children, &spec)
                 && let Some(sp) = path.subpaths.first()
@@ -403,6 +428,19 @@ pub(super) fn blend_info(s: &mut Session, _: &Value) -> Result<Value> {
     })
 }
 
+/// The Blend panel's Create Spine: with `mode`, sets whether new blends get a spine; without, reads
+/// it. A tool setting kept with the preferences, not an undo step; blends already made keep theirs.
+pub(super) fn blend_create_spine(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "object.blend.createSpine";
+    let mut d = s.prefs.blend_options.unwrap_or_default();
+    let mode = spine_mode_param(p, C, "mode", d.create_spine)?;
+    if mode != d.create_spine {
+        d.create_spine = mode;
+        s.prefs.blend_options = Some(d);
+    }
+    Ok(json!({ "mode": mode.id() }))
+}
+
 pub(super) fn blend_expand(s: &mut Session, _: &Value) -> Result<Value> {
     let blends = selected_of(s, is_blend);
     let ids = s.edit("Expand Blend", |d, sel| {
@@ -507,6 +545,8 @@ pub(super) fn blend_replace_spine(s: &mut Session, _: &Value) -> Result<Value> {
         let spine = d.node(path).and_then(|n| n.path_data().cloned()).ok_or(EngineError::NoNode(path))?;
         d.remove(path)?;
         if let Some(NodeKind::Blend { children, spec }) = d.node_mut(b).map(|n| &mut n.kind) {
+            // A blend made without a spine gets this one.
+            spec.no_spine = false;
             spec.spine = Some(spine);
             spec.key_anchors.clear();
             keys_to_spine(children, spec);
@@ -517,7 +557,16 @@ pub(super) fn blend_replace_spine(s: &mut Session, _: &Value) -> Result<Value> {
     ok()
 }
 
+/// Is any selected blend one made without a spine?
+fn any_without_spine(s: &Session) -> bool {
+    let Ok(st) = s.doc() else { return false };
+    selected_of(s, is_blend).iter().any(|b| matches!(st.doc.node(*b).map(|n| &n.kind), Some(NodeKind::Blend { spec, .. }) if spec.no_spine))
+}
+
 pub(super) fn blend_reverse_spine(s: &mut Session, _: &Value) -> Result<Value> {
+    if any_without_spine(s) {
+        return Err(bad("object.blend.reverseSpine", "the blend has no spine"));
+    }
     edit_blends(s, "Reverse Spine", |children, spec| {
         if spec.spine.is_some() && pin(children, spec) {
             // The keys keep their anchors, which now count from the other end.
diff --git a/crates/engine/src/cmd/live/commands.rs b/crates/engine/src/cmd/live/commands.rs
index b69b4e869d..5480f7ae58 100644
--- a/crates/engine/src/cmd/live/commands.rs
+++ b/crates/engine/src/cmd/live/commands.rs
@@ -1,6 +1,6 @@
 use super::blend::{
-    blend_expand, blend_info, blend_make, blend_options, blend_release, blend_replace_spine, blend_reverse_spine, blend_reverse_stack,
-    spine_add_anchor, spine_convert_anchor, spine_move_anchor, spine_remove_anchor, spine_reshape_segment,
+    blend_create_spine, blend_expand, blend_info, blend_make, blend_options, blend_release, blend_replace_spine, blend_reverse_spine,
+    blend_reverse_stack, spine_add_anchor, spine_convert_anchor, spine_move_anchor, spine_remove_anchor, spine_reshape_segment,
 };
 use super::common::{has_blend, has_envelope, has_mesh};
 use super::envelope::{
@@ -18,7 +18,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Make",
             ["Object", "Blend"],
             Some("Cmd+Alt+B"),
-            "{ids?, steps?: n | distance?: pt | smooth?: bool, orientation?: page|path (default: the Blend Options set with nothing selected, else smooth colour and page), starts?: [anchor index | null, …] (per object of `ids`, else of the selection in paint order: the anchor of its first subpath the blend starts from; an open path's last anchor runs it the other way), spacing?: smooth|steps|distance (with value), value?: n, easingType?: easeIn|easeOut|easeInOut|easeOutIn, ramp?: pct (0..100), colorShift?: pct (-100..100; 0: even)} blend the selected objects (paint order) into a live blend; a blend among them takes the others in as more key objects (keeping its options, name and transparency) instead of nesting → {id}",
+            "{ids?, steps?: n | distance?: pt | smooth?: bool, orientation?: page|path (default: the Blend Options set with nothing selected, else smooth colour and page), starts?: [anchor index | null, …] (per object of `ids`, else of the selection in paint order: the anchor of its first subpath the blend starts from; an open path's last anchor runs it the other way), spacing?: smooth|steps|distance (with value), value?: n, easingType?: easeIn|easeOut|easeInOut|easeOutIn, ramp?: pct (0..100), colorShift?: pct (-100..100; 0: even), createSpine?: auto|always|never (default: the mode object.blend.createSpine sets; never: a blend without a spine, which takes no easing)} blend the selected objects (paint order) into a live blend; a blend among them takes the others in as more key objects (keeping its options, name, transparency and whether it has a spine) instead of nesting → {id}",
             has_doc,
             blend_make
         ),
@@ -27,7 +27,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Release",
             ["Object", "Blend"],
             Some("Cmd+Alt+Shift+B"),
-            "{} release the selected blends: the key objects come back and the spine stays as a path with no fill or stroke, below them; a blend with a name, opacity, blend mode, isolation, opacity mask or appearance of its own comes back as a group keeping them (and its knockout) → {ids (the keys), spines: [ids], groups: [ids]}",
+            "{} release the selected blends: the key objects come back and the spine (if the blend has one) stays as a path with no fill or stroke, below them; a blend with a name, opacity, blend mode, isolation, opacity mask or appearance of its own comes back as a group keeping them (and its knockout) → {ids (the keys), spines: [ids], groups: [ids]}",
             has_blend,
             blend_release
         ),
@@ -40,6 +40,15 @@ pub fn specs() -> Vec<CommandSpec> {
             always,
             blend_options
         ),
+        cmd!(
+            "object.blend.createSpine",
+            "Create Spine",
+            [],
+            None,
+            "{mode?: auto|always|never} the Blend panel's Create Spine: whether new blends get a spine (auto and always: the straight lines between the key centers, as before; never: no spine to show, edit, reverse or release, and no easing, until Replace Spine gives one); with no `mode`, reads it; blends already made keep theirs (a tool setting kept with the preferences, not an undo step) → {mode}",
+            always,
+            blend_create_spine
+        ),
         cmd!(
             "object.blend.expand",
             "Expand",
@@ -54,7 +63,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Replace Spine",
             ["Object", "Blend"],
             None,
-            "{} use the selected path as the spine of the selected blend (the path is consumed)",
+            "{} use the selected path as the spine of the selected blend (the path is consumed); a blend made without a spine gets this one",
             has_blend,
             blend_replace_spine
         ),
@@ -63,7 +72,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reverse Spine",
             ["Object", "Blend"],
             None,
-            "{} reverse the order of the key objects along the spine",
+            "{} reverse the order of the key objects along the spine; an error when a selected blend has no spine",
             has_blend,
             blend_reverse_spine
         ),
@@ -72,7 +81,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Blend Info",
             [],
             None,
-            "{} the options of the first selected blend, else those new blends start with → {target: blend|defaults, id?, spacing: smooth|steps|distance, steps, distance, orientation: page|path, easingType?: easeIn|easeOut|easeInOut|easeOutIn, ramp?: pct, colorShift?: pct, keys?: [ids], starts?: [anchor|null], spine?: {anchors: [{x, y, in: [x, y], out: [x, y]}], closed, keyAnchors: [anchor each key sits on] | null (keys spread evenly: a spine from Replace Spine), explicit: false for the straight lines between the key centres}}",
+            "{} the options of the first selected blend, else those new blends start with → {target: blend|defaults, id?, spacing: smooth|steps|distance, steps, distance, orientation: page|path, easingType?: easeIn|easeOut|easeInOut|easeOutIn, ramp?: pct, colorShift?: pct, keys?: [ids], starts?: [anchor|null], hasSpine?: false for a blend made without a spine (no `spine` then), spine?: {anchors: [{x, y, in: [x, y], out: [x, y]}], closed, keyAnchors: [anchor each key sits on] | null (keys spread evenly: a spine from Replace Spine), explicit: false for the straight lines between the key centres}}",
             always,
             blend_info
         ),
diff --git a/crates/engine/src/cmd/object/commands.rs b/crates/engine/src/cmd/object/commands.rs
index eb019a88e9..5c66ec8442 100644
--- a/crates/engine/src/cmd/object/commands.rs
+++ b/crates/engine/src/cmd/object/commands.rs
@@ -52,7 +52,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Reflect…",
             ["Object", "Transform"],
             None,
-            "{ids?: [id…] (selected first; default: the selection), axis: \"vertical\"|\"horizontal\"|deg, origin?, copy?, objects?: bool (Transform Objects, default true; false: the art stays and, with patterns, only its pattern tiles transform), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles), typeAreas?: bool (area type: the frame is reshaped and the text reflows at its size)}. With anchors selected with Direct Selection (and no copy), only those anchors and their handles transform, about the centre of their own box.",
+            "{ids?: [id…] (selected first; default: the selection), axis: \"vertical\"|\"horizontal\"|deg (the mirror line, counter-clockwise from horizontal; 0: horizontal; omitted: vertical), origin?, copy?, objects?: bool (Transform Objects, default true; false: the art stays and, with patterns, only its pattern tiles transform), patterns?: bool (Transform Patterns: pattern fills and strokes transform with the art; default: prefs transformPatternTiles), typeAreas?: bool (area type: the frame is reshaped and the text reflows at its size)}. With anchors selected with Direct Selection (and no copy), only those anchors and their handles transform, about the centre of their own box.",
             has_selection,
             reflect
         ),
diff --git a/crates/engine/src/cmd/plugin.rs b/crates/engine/src/cmd/plugin.rs
index 50f9ee48e8..2d16bbc683 100644
--- a/crates/engine/src/cmd/plugin.rs
+++ b/crates/engine/src/cmd/plugin.rs
@@ -760,14 +760,16 @@ fn install(s: &mut Session, p: &Value) -> Result<Value> {
         // When the write failed, the old stored module stays in the folder and needs its grant at
         // the next launch. A grant that can't be removed still approves the old bytes, so the store
         // gets the module it held back. When that module can't be read or written back, or there
-        // was none, no module goes with the grant, and the grant stops counting for this session. A
-        // grants file that is too large or doesn't hold a list approves nothing, and the new module
-        // stays; one that can't be opened or read may approve the old bytes once it reads again.
+        // was none, no module goes with the grant, and the grant stops counting for every session in
+        // the process attached to the folder. A grants file that is too large or doesn't hold a list
+        // approves nothing, and the new module stays; one that can't be opened or read may approve
+        // the old bytes once it reads again.
+        let writes = s.grant_writes();
         if stored && !s.store_grant(&m.id, None) && s.holds_plugin_grant(&m.id) {
             let back = previous.as_ref().is_ok_and(|held| s.put_back_plugin(plugin.id(), held.as_deref()));
             stored = !back && holds_new(s);
             if !back || matches!(previous, Ok(None)) {
-                s.ignore_stored_grant(&m.id);
+                s.ignore_stored_grant(&m.id, writes);
             }
         }
     }
diff --git a/crates/engine/src/cmd/plugin_call/reviewed.rs b/crates/engine/src/cmd/plugin_call/reviewed.rs
index 51470e742d..5c03317fa9 100644
--- a/crates/engine/src/cmd/plugin_call/reviewed.rs
+++ b/crates/engine/src/cmd/plugin_call/reviewed.rs
@@ -676,6 +676,7 @@ pub(super) const DENIED: &[&str] = &[
     "addon.pen.nextSegment",
     "effect.refreshDeferred",
     "graphicStyle.setOptions",
+    "object.blend.createSpine",
     "object.blend.options",
     "object.liquify",
     "object.pathfinder.options",
diff --git a/crates/engine/src/cmd/prefscmds.rs b/crates/engine/src/cmd/prefscmds.rs
index b053796c91..af09b032da 100644
--- a/crates/engine/src/cmd/prefscmds.rs
+++ b/crates/engine/src/cmd/prefscmds.rs
@@ -769,7 +769,7 @@ impl Session {
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
-        cmd!(query "prefs.get", "Get Preferences", [], None, "{key?} → the value of one preference (or preference group: eyedropper), or {prefs: {…all…}}", always, get),
+        cmd!(query "prefs.get", "Get Preferences", [], None, "{key?} → the value of one preference (or preference group: eyedropper), or {prefs: {…all…}}; under automation read roots a folder preference outside them is null, and an export preset's folder outside them is left out", always, get),
         cmd!(
             query "prefs.set",
             "Set Preference",
@@ -780,7 +780,7 @@ pub fn specs() -> Vec<CommandSpec> {
             set
         ),
         cmd!(query "prefs.reset", "Reset Preferences", [], None, "{category?} reset one category (or everything) to defaults", always, reset),
-        cmd!(query "prefs.list", "List Preferences", [], None, "{} → [{key, category, section, label, kind, value, …}] every preference", always, list),
+        cmd!(query "prefs.list", "List Preferences", [], None, "{} → [{key, category, section, label, kind, value, …}] every preference; under automation read roots a folder preference's value outside them is null", always, list),
         cmd!(
             query "prefs.export",
             "Export Preferences",
@@ -886,8 +886,42 @@ fn import(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "imported": values.len() }))
 }
 
+/// The preferences that name a folder: the [`FOLDER_PREFS`] and the scratch disks.
+const PATH_PREFS: [&str; 6] = ["fontsFolder", "pluginsFolder", "scratchPrimary", "scratchSecondary", "recoveryFolder", "templatesFolder"];
+
+/// The scratch disk choices that are not folders.
+const SCRATCH_CHOICES: [&str; 2] = ["Startup", "None"];
+
+/// The preferences as `prefs.get`, `prefs.list`, `prefs.set` and `prefs.reset` show them to the
+/// request being served. Under automation read roots, a folder preference ([`PATH_PREFS`]) outside
+/// them is `null`, as `ui.inspect` leaves it out, and an export preset's `folder` outside them is
+/// left out. An empty value (the default folder) and a scratch
+/// disk choice ([`SCRATCH_CHOICES`]) are shown. Without roots the preferences are shown as they are.
+fn shown_prefs(prefs: &Prefs) -> Value {
+    let mut all = prefs.to_json();
+    if crate::file_access::current().is_none() {
+        return all;
+    }
+    // The app trims a folder before it uses it.
+    let hidden = |path: &str| !path.trim().is_empty() && crate::file_access::check_read(path.trim()).is_err();
+    for key in PATH_PREFS {
+        let Some(path) = all[key].as_str() else { continue };
+        if hidden(path) && !(key.starts_with("scratch") && SCRATCH_CHOICES.contains(&path.trim())) {
+            all[key] = Value::Null;
+        }
+    }
+    if let Some(presets) = all.get_mut("screenExportPresets").and_then(Value::as_array_mut) {
+        for settings in presets.iter_mut().filter_map(|p| p.get_mut("settings").and_then(Value::as_object_mut)) {
+            if settings.get("folder").and_then(Value::as_str).is_some_and(hidden) {
+                settings.remove("folder");
+            }
+        }
+    }
+    all
+}
+
 fn get(s: &mut Session, p: &Value) -> Result<Value> {
-    let all = s.prefs.to_json();
+    let all = shown_prefs(&s.prefs);
     match str_param(p, "key") {
         Some(k) if spec(k).is_some() || PREF_GROUPS.contains(&k) => Ok(all[k].clone()),
         Some(k) => Err(bad("prefs.get", format!("unknown preference `{k}`"))),
@@ -915,7 +949,7 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
     if document_units && values.contains_key("unitsGeneral") && s.active().is_some() {
         s.set_document_units(s.default_units())?;
     }
-    let all = s.prefs.to_json();
+    let all = shown_prefs(&s.prefs);
     Ok(Value::Object(values.keys().map(|k| (k.clone(), all[k.as_str()].clone())).collect()))
 }
 
@@ -929,11 +963,11 @@ fn reset(s: &mut Session, p: &Value) -> Result<Value> {
     let mut next = s.prefs.clone();
     next.reset(cat);
     s.apply_prefs(next);
-    Ok(json!({ "prefs": s.prefs.to_json() }))
+    Ok(json!({ "prefs": shown_prefs(&s.prefs) }))
 }
 
 fn list(s: &mut Session, _: &Value) -> Result<Value> {
-    let all = s.prefs.to_json();
+    let all = shown_prefs(&s.prefs);
     Ok(Value::Array(
         PREF_SPECS
             .iter()
diff --git a/crates/engine/src/cmd/typecmd/block_tests.rs b/crates/engine/src/cmd/typecmd/block_tests.rs
index 2dda356146..ec458a0c9b 100644
--- a/crates/engine/src/cmd/typecmd/block_tests.rs
+++ b/crates/engine/src/cmd/typecmd/block_tests.rs
@@ -140,6 +140,35 @@ fn block_turns_off_keeping_its_sizes_and_records_nothing_when_nothing_changes()
     assert_eq!(undo_len(&s), n + 2, "already off: no undo step");
 }
 
+#[test]
+fn convert_to_point_type_turns_block_off_keeping_its_sizes() {
+    let mut s = session();
+    let id = area(&mut s, 300.0, 400.0, "BIG\na much longer second line");
+    s.execute("type.dynamicText", &json!({"on": true})).unwrap();
+    let sizes = |t: &TextObject| t.runs.iter().map(|r| (r.text.clone(), r.style.size, r.style.leading)).collect::<Vec<_>>();
+    let fitted = sizes(&text(&s, id));
+    let n = undo_len(&s);
+    s.execute("type.convertToPointType", &json!({})).unwrap();
+    assert_eq!(undo_len(&s), n + 1, "one undo step");
+    let t = text(&s, id);
+    assert!(matches!(t.kind, TextKind::Point));
+    assert!(!t.dynamic_text, "point type has Dynamic Text off");
+    assert_eq!(sizes(&t), fitted, "point type keeps the sizes Block set");
+    assert!(serde_json::to_value(&t).unwrap().get("dynamicText").is_none(), "saved without dynamicText");
+    // Back to area type, the frame is not refitted: Block stays off.
+    s.execute("type.convertToAreaType", &json!({})).unwrap();
+    let t = text(&s, id);
+    assert!(matches!(t.kind, TextKind::Area { .. }));
+    assert!(!t.dynamic_text, "Block does not come on again");
+    assert_eq!(sizes(&t), fitted);
+    // Undo gives the Block frame back.
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+    let t = text(&s, id);
+    assert!(t.dynamic_text && matches!(t.kind, TextKind::Area { .. }));
+    assert_eq!(sizes(&t), fitted);
+}
+
 #[test]
 fn bad_params_and_other_type_are_refused() {
     let mut s = session();
diff --git a/crates/engine/src/cmd/typemenu.rs b/crates/engine/src/cmd/typemenu.rs
index faaaf2145d..bb0e426c9b 100644
--- a/crates/engine/src/cmd/typemenu.rs
+++ b/crates/engine/src/cmd/typemenu.rs
@@ -47,7 +47,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Convert To Point Type",
             ["Type"],
             None,
-            "{ids?|id?} area type → point type; soft line wraps become line breaks, and a frame of threaded text leaves its thread with the text it holds → {ids}",
+            "{ids?|id?} area type → point type; soft line wraps become line breaks, a frame of threaded text leaves its thread with the text it holds, and Dynamic Text (Block) is turned off, keeping the sizes it set → {ids}",
             has_selection,
             to_point
         ),
@@ -410,6 +410,9 @@ fn to_point(s: &mut Session, p: &Value) -> Result<Value> {
                 Justify::Auto if lay.lines.first().is_some_and(|l| l.rtl) => x1,
                 _ => x0,
             };
+            // Point type has no Dynamic Text: Block is turned off, keeping the sizes it set, so
+            // converting back to area type does not turn it on again.
+            t.dynamic_text = false;
             t.kind = TextKind::Point;
             t.xf *= Affine::translate((ox, baseline));
             refresh_bounds(t);
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index f1f188f00c..745a6fb62c 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -171,10 +171,6 @@ pub struct Session {
     /// The Scripts folder, whose scripts File › Scripts lists; `None`: no folder
     /// ([`Session::attach_scripts_dir`]).
     scripts_dir: Option<std::path::PathBuf>,
-    /// The plug-in ids whose grant in the plug-in store should be gone but could not be removed:
-    /// [`Session::plugin_approver`] and a load of the store do not count those grants, and a successful
-    /// [`Session::store_grant`] for the id takes it out.
-    ignored_plugin_grants: std::sync::Mutex<std::collections::BTreeSet<String>>,
     /// A filter's output that a run made in the background handed in for `plugin.run` to apply
     /// ([`cmd::plugin::FilterRun::hand_in`]); the next `plugin.run` takes it.
     plugin_output: Option<cmd::plugin::HandedIn>,
diff --git a/crates/engine/src/session/documents.rs b/crates/engine/src/session/documents.rs
index 83a0367751..2d850fd44d 100644
--- a/crates/engine/src/session/documents.rs
+++ b/crates/engine/src/session/documents.rs
@@ -87,7 +87,6 @@ impl Session {
             color_settings_file: None,
             plugin_dir: None,
             scripts_dir: None,
-            ignored_plugin_grants: Default::default(),
             plugin_output: None,
             plugin_install_approval: None,
             plugin_grants_from_requests: false,
diff --git a/crates/engine/src/store.rs b/crates/engine/src/store.rs
index fd25437516..4943353ee0 100644
--- a/crates/engine/src/store.rs
+++ b/crates/engine/src/store.rs
@@ -89,6 +89,24 @@ static PLUGIN_DATA_LOCK: Mutex<()> = Mutex::new(());
 /// The state of each plug-in folder's storage, shared by every storage made for the folder until
 /// the plug-in is removed, which closes it and drops it.
 static PLUGIN_DATA_OPEN: Mutex<BTreeMap<PathBuf, Arc<PluginData>>> = Mutex::new(BTreeMap::new());
+/// The grants of plug-in stores that the sessions of the process don't count, and when each was
+/// last written ([`IgnoredGrants`]). Another process reads `grants.json` as it is.
+static IGNORED_PLUGIN_GRANTS: Mutex<IgnoredGrants> = Mutex::new(IgnoredGrants { ignored: BTreeSet::new(), written: BTreeMap::new(), writes: 0 });
+/// How many of the latest grant writes [`IgnoredGrants`] keeps.
+const MAX_GRANT_WRITES_KEPT: usize = 256;
+
+/// Grants of plug-in stores, by the store's folder ([`plugin_store_key`]) and the plug-in id.
+struct IgnoredGrants {
+    /// The grants that should be gone but could not be removed: no session in the process counts
+    /// them ([`Session::ignore_stored_grant`]) until one writes the store's grants for the id
+    /// ([`Session::store_grant`]).
+    ignored: BTreeSet<(PathBuf, String)>,
+    /// The latest grant writes of the process, at most [`MAX_GRANT_WRITES_KEPT`], each with the
+    /// count of writes it made ([`IgnoredGrants::writes`]).
+    written: BTreeMap<(PathBuf, String), u64>,
+    /// How many grant writes the sessions of the process have made ([`Session::grant_writes`]).
+    writes: u64,
+}
 
 /// The file name (without extension) a stored item called `name` gets: its name made safe for any
 /// file system, then a hash of the name, so that names that differ only in characters a file name
@@ -100,6 +118,37 @@ pub(crate) fn file_stem(name: &str) -> String {
     format!("{}-{hash:016x}", safe.trim())
 }
 
+/// The folder `dir` spelled one way for every path to it, so that sessions attached to it by
+/// different paths share [`IGNORED_PLUGIN_GRANTS`]: the canonical path when the folder exists, else
+/// the canonical path of its nearest folder that exists followed by the rest of the path, with `.`
+/// and `..` taken out by name. The path as given when it has no absolute form (the current folder
+/// can't be read).
+pub(crate) fn plugin_store_key(dir: &Path) -> PathBuf {
+    if let Ok(path) = std::fs::canonicalize(dir) {
+        return path;
+    }
+    let Ok(absolute) = std::path::absolute(dir) else { return dir.to_path_buf() };
+    let mut parts: Vec<std::path::Component> = Vec::new();
+    for part in absolute.components() {
+        match part {
+            std::path::Component::CurDir => {}
+            std::path::Component::ParentDir => {
+                if matches!(parts.last(), Some(std::path::Component::Normal(_))) {
+                    parts.pop();
+                }
+            }
+            _ => parts.push(part),
+        }
+    }
+    for kept in (1..=parts.len()).rev() {
+        let base: PathBuf = parts[..kept].iter().collect();
+        if let Ok(found) = std::fs::canonicalize(&base) {
+            return parts[kept..].iter().fold(found, |path, part| path.join(part));
+        }
+    }
+    parts.iter().collect()
+}
+
 /// The regular files of `dir` with the extension `ext` (any case), by file name, at most
 /// [`MAX_STORE_FILES`]; none when the folder can't be read.
 fn list_files(dir: &Path, ext: &str) -> Vec<PathBuf> {
@@ -355,9 +404,6 @@ impl Session {
         let disabled =
             read_capped(&dir.join(DISABLED_FILE), safe_mode::MAX_DISABLED_FILE_BYTES).map(|b| safe_mode::parse_disabled_file(&b)).unwrap_or_default();
         safe_mode::set_disabled(disabled);
-        if self.plugin_dir.as_ref() != Some(&dir) {
-            self.ignored_plugin_grants.lock().unwrap_or_else(|e| e.into_inner()).clear();
-        }
         self.plugin_dir = Some(dir);
         self.load_stored_plugins();
     }
@@ -368,7 +414,8 @@ impl Session {
     /// there don't grant that very module ([`grant_covers`]), is skipped with a log record, and
     /// stays in the folder with its grant. A grant for an id whose stored module lists no
     /// permissions is forgotten; one that can't be removed from the grants file doesn't count for
-    /// the rest of the session ([`Session::plugin_approver`]).
+    /// any session in the process attached to the folder until the file can be written for the id
+    /// ([`Session::ignore_stored_grant`]).
     pub fn load_stored_plugins(&mut self) {
         let Some(dir) = self.plugin_dir.clone() else { return };
         if safe_mode::active() {
@@ -432,8 +479,11 @@ impl Session {
                 Ok(file) => file.names(id),
                 Err(e) => e.unread,
             };
-            if named && !self.store_grant(id, None) && self.holds_plugin_grant(id) {
-                self.ignore_stored_grant(id);
+            if named {
+                let writes = self.grant_writes();
+                if !self.store_grant(id, None) && self.holds_plugin_grant(id) {
+                    self.ignore_stored_grant(id, writes);
+                }
             }
         }
     }
@@ -515,12 +565,16 @@ impl Session {
         }
     }
 
-    /// The grants kept in the plug-in store `dir` ([`stored_grants`]) without those this session
-    /// doesn't count ([`Session::ignore_stored_grant`]).
+    /// The grants kept in the plug-in store `dir` ([`stored_grants`]) without those the process
+    /// doesn't count for that folder ([`Session::ignore_stored_grant`]). The folder's key is worked
+    /// out on each call, so a path whose link now leads elsewhere is matched with where it leads.
     fn counted_grants(&self, dir: &Path) -> BTreeMap<String, vectorcraft_plugins::permissions::Grant> {
-        let ignored = self.ignored_plugin_grants.lock().unwrap_or_else(|e| e.into_inner());
+        let key = plugin_store_key(dir);
         let mut grants = stored_grants(dir);
-        grants.retain(|id, _| !ignored.contains(id));
+        let shared = IGNORED_PLUGIN_GRANTS.lock().unwrap_or_else(|e| e.into_inner());
+        for (_, id) in shared.ignored.range((key.clone(), String::new())..).take_while(|(folder, _)| *folder == key) {
+            grants.remove(id);
+        }
         grants
     }
 
@@ -573,20 +627,53 @@ impl Session {
     /// be read or doesn't hold a list is left as it is, with a log record, and nothing is recorded;
     /// so is one whose new content would be larger than `MAX_GRANTS_FILE`. → whether the store now
     /// holds what was asked (`false` without a folder). When it does, the grant kept for `id` counts
-    /// again ([`Session::ignore_stored_grant`]).
+    /// again, for every session in the process attached to the store ([`Session::ignore_stored_grant`]).
     pub(crate) fn store_grant(&self, id: &str, grant: Option<vectorcraft_plugins::permissions::Grant>) -> bool {
         let done = self.write_grant(id, grant);
-        if done {
-            self.ignored_plugin_grants.lock().unwrap_or_else(|e| e.into_inner()).remove(id);
+        if done && let Some(key) = self.plugin_dir.as_deref().map(plugin_store_key) {
+            let mut shared = IGNORED_PLUGIN_GRANTS.lock().unwrap_or_else(|e| e.into_inner());
+            let entry = (key, id.to_string());
+            shared.ignored.remove(&entry);
+            shared.writes = shared.writes.saturating_add(1);
+            let writes = shared.writes;
+            shared.written.insert(entry, writes);
+            if shared.written.len() > MAX_GRANT_WRITES_KEPT
+                && let Some(oldest) = shared.written.iter().min_by_key(|(_, at)| **at).map(|(entry, _)| entry.clone())
+            {
+                shared.written.remove(&oldest);
+            }
         }
         done
     }
 
-    /// Stop counting the store's grant for the plug-in `id` until [`Session::store_grant`] next
-    /// succeeds for it or another store is attached: for a grant that should be gone and could not
-    /// be removed, which would otherwise approve the bytes it covers.
-    pub(crate) fn ignore_stored_grant(&self, id: &str) {
-        self.ignored_plugin_grants.lock().unwrap_or_else(|e| e.into_inner()).insert(id.to_string());
+    /// How many grant writes the sessions of the process have made ([`Session::store_grant`]).
+    /// Taken before a write that may fail, for [`Session::ignore_stored_grant`].
+    pub(crate) fn grant_writes(&self) -> u64 {
+        IGNORED_PLUGIN_GRANTS.lock().unwrap_or_else(|e| e.into_inner()).writes
+    }
+
+    /// How many grant writes the process keeps ([`IgnoredGrants::written`]).
+    #[cfg(test)]
+    pub(crate) fn grant_writes_kept() -> usize {
+        IGNORED_PLUGIN_GRANTS.lock().unwrap_or_else(|e| e.into_inner()).written.len()
+    }
+
+    /// Stop counting the attached store's grant for the plug-in `id`, in every session in the
+    /// process attached to the same folder, until [`Session::store_grant`] next succeeds for it in
+    /// one of them: for a grant that should be gone and could not be removed, which would otherwise
+    /// approve the bytes it covers. `writes` is [`Session::grant_writes`] from before the failed
+    /// write: when a session has written the store's grants for `id` since, the file holds what that
+    /// write asked for, and the grant keeps counting. A write no longer among the latest
+    /// [`MAX_GRANT_WRITES_KEPT`] is not seen, and the grant stops counting. Another process on the
+    /// folder reads `grants.json` as it is.
+    pub(crate) fn ignore_stored_grant(&self, id: &str, writes: u64) {
+        if let Some(key) = self.plugin_dir.as_deref().map(plugin_store_key) {
+            let mut shared = IGNORED_PLUGIN_GRANTS.lock().unwrap_or_else(|e| e.into_inner());
+            let entry = (key, id.to_string());
+            if shared.written.get(&entry).is_none_or(|at| *at <= writes) {
+                shared.ignored.insert(entry);
+            }
+        }
     }
 
     fn write_grant(&self, id: &str, grant: Option<vectorcraft_plugins::permissions::Grant>) -> bool {
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 91c95cb630..abf65d834a 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -133,6 +133,7 @@ mod placed_document;
 mod plugins;
 mod prefs;
 mod prefs_file;
+mod prefs_roots;
 mod previewbounds;
 mod print;
 mod printadvanced;
diff --git a/crates/engine/src/tests/blendopts.rs b/crates/engine/src/tests/blendopts.rs
index 059357ddb3..4b391c5714 100644
--- a/crates/engine/src/tests/blendopts.rs
+++ b/crates/engine/src/tests/blendopts.rs
@@ -418,3 +418,179 @@ fn native_blend_easing_values_clamp_and_non_finite_become_default() {
         assert_eq!((spec.ease.ramp, spec.color_shift), (ramp, shift), "{bad}");
     }
 }
+
+fn create_spine(s: &mut Session, p: Value) -> Value {
+    s.execute("object.blend.createSpine", &p).unwrap()["mode"].clone()
+}
+
+/// Two squares 100 pt apart blended with `p`; the blend.
+fn make(s: &mut Session, y: f64, p: Value) -> NodeId {
+    let (a, b) = (rect(s, 0.0, y, 10.0), rect(s, 100.0, y, 10.0));
+    let mut p = p;
+    p["ids"] = json!([a.0, b.0]);
+    p["steps"] = json!(3);
+    id_of(&s.execute("object.blend.make", &p).unwrap())
+}
+
+#[test]
+fn create_spine_sets_whether_new_blends_get_a_spine() {
+    let mut s = session();
+    assert_eq!(create_spine(&mut s, json!({})), "auto", "Auto until one is chosen");
+    let spined = make(&mut s, 0.0, json!({}));
+    assert!(!spec(&s, spined).1.no_spine);
+    let depth = s.doc().unwrap().history.undo.len();
+    assert_eq!(create_spine(&mut s, json!({"mode": "never"})), "never");
+    assert_eq!(s.doc().unwrap().history.undo.len(), depth, "a tool setting, not an undo step");
+    assert_eq!(create_spine(&mut s, json!({})), "never");
+    // The Blend Options set with nothing selected keep it, and it keeps them.
+    s.execute("select.none", &json!({})).unwrap();
+    s.execute("object.blend.options", &json!({"steps": 7})).unwrap();
+    assert_eq!(create_spine(&mut s, json!({})), "never");
+    assert_eq!(s.prefs.blend_options.unwrap().spacing, BlendSpacing::Steps(7));
+    // A new blend has no spine; the blend made before keeps its own.
+    let bare = make(&mut s, 50.0, json!({}));
+    assert!(spec(&s, bare).1.no_spine);
+    assert!(!spec(&s, spined).1.no_spine, "blends already made keep their spine");
+    sel(&mut s, &[bare]);
+    let info = s.execute("object.blend.info", &json!({})).unwrap();
+    assert_eq!(info["hasSpine"], json!(false));
+    assert!(info.get("spine").is_none(), "{info}");
+    sel(&mut s, &[spined]);
+    assert_eq!(s.execute("object.blend.info", &json!({})).unwrap()["hasSpine"], json!(true));
+    // `createSpine` on Make chooses for that blend only.
+    let forced = make(&mut s, 100.0, json!({"createSpine": "always"}));
+    assert!(!spec(&s, forced).1.no_spine);
+    assert_eq!(create_spine(&mut s, json!({})), "never");
+    assert_eq!(create_spine(&mut s, json!({"mode": "always"})), "always");
+    let always = make(&mut s, 150.0, json!({}));
+    assert!(!spec(&s, always).1.no_spine);
+    assert!(spec(&s, bare).1.no_spine, "blends already made keep having no spine");
+    let none = make(&mut s, 200.0, json!({"createSpine": "never"}));
+    assert!(spec(&s, none).1.no_spine);
+    // The setting survives a round trip through the preferences file; Auto is not written.
+    let back: Prefs = serde_json::from_value(s.prefs.to_json()).unwrap();
+    assert_eq!(back.blend_options.unwrap().create_spine, vectorcraft_doc::live::BlendSpineMode::Always);
+    assert_eq!(s.prefs.to_json()["blendOptions"]["createSpine"], json!("always"));
+    create_spine(&mut s, json!({"mode": "auto"}));
+    assert!(s.prefs.to_json()["blendOptions"].get("createSpine").is_none());
+    let mut odd = s.prefs.to_json();
+    odd["blendOptions"]["createSpine"] = json!("sometimes");
+    let unknown: Prefs = serde_json::from_value(odd).unwrap();
+    assert_eq!(unknown.blend_options.unwrap().create_spine, vectorcraft_doc::live::BlendSpineMode::Auto, "an unknown value reads as Auto");
+}
+
+#[test]
+fn create_spine_refuses_bad_values_and_changes_nothing() {
+    let mut s = session();
+    create_spine(&mut s, json!({"mode": "never"}));
+    let prefs = s.prefs.blend_options;
+    for bad in [json!({"mode": "sometimes"}), json!({"mode": 1}), json!({"mode": true}), json!({"mode": ["never"]}), json!({"mode": "Never"})] {
+        let e = s.execute("object.blend.createSpine", &bad).unwrap_err().to_string();
+        assert!(e.contains("`mode` must be one of auto, always, never"), "{bad}: {e}");
+        assert_eq!(s.prefs.blend_options, prefs, "{bad}");
+    }
+    let (a, b) = (rect(&mut s, 0.0, 0.0, 10.0), rect(&mut s, 100.0, 0.0, 10.0));
+    let depth = s.doc().unwrap().history.undo.len();
+    for bad in [json!({"createSpine": "x"}), json!({"createSpine": 0}), json!({"createSpine": "never", "easingType": "easeIn"}), json!({"ramp": 30})]
+    {
+        let mut p = bad.clone();
+        p["ids"] = json!([a.0, b.0]);
+        assert!(s.execute("object.blend.make", &p).is_err(), "{bad}");
+        assert_eq!(s.doc().unwrap().history.undo.len(), depth, "{bad}: nothing made");
+    }
+    assert!(s.execute("object.blend.createSpine", &json!({"spine": "never"})).is_err(), "an unknown key");
+}
+
+#[test]
+fn a_blend_without_a_spine_has_none_to_edit_reverse_ease_or_release() {
+    let mut s = session();
+    let g = make(&mut s, 0.0, json!({"createSpine": "never"}));
+    sel(&mut s, &[g]);
+    let before = node(&s, g);
+    let depth = s.doc().unwrap().history.undo.len();
+    // Reverse Spine, easing and the spine point commands refuse it and change nothing.
+    let refused = [
+        ("object.blend.reverseSpine", json!({})),
+        ("object.blend.options", json!({"easingType": "easeOut"})),
+        ("object.blend.options", json!({"ramp": 40})),
+        ("object.blend.spine.addAnchor", json!({"x": 50, "y": 5})),
+        ("object.blend.spine.moveAnchor", json!({"anchor": 0, "x": 0, "y": 50})),
+    ];
+    for (cmd, p) in refused {
+        let e = s.execute(cmd, &p).unwrap_err().to_string();
+        assert!(e.contains("the blend has no spine"), "{cmd}: {e}");
+        assert_eq!((node(&s, g), s.doc().unwrap().history.undo.len()), (before.clone(), depth), "{cmd}");
+    }
+    // Spacing, Orientation and Shift still apply; Align to Path makes no spine.
+    s.execute("object.blend.options", &json!({"steps": 2, "orientation": "path", "colorShift": 20})).unwrap();
+    let sp = spec(&s, g).1;
+    assert_eq!((sp.spacing, sp.orientation, sp.color_shift, sp.no_spine), (BlendSpacing::Steps(2), BlendOrientation::AlignToPath, 20.0, true));
+    assert!(s.execute("object.blend.info", &json!({})).unwrap().get("spine").is_none());
+    // Taking in another key keeps it without a spine, whatever Create Spine says.
+    let c = rect(&mut s, 200.0, 0.0, 10.0);
+    sel(&mut s, &[g, c]);
+    create_spine(&mut s, json!({"mode": "always"}));
+    let g = id_of(&s.execute("object.blend.make", &json!({})).unwrap());
+    assert_eq!(spec(&s, g).0.len(), 3);
+    assert!(spec(&s, g).1.no_spine && spec(&s, g).1.spine.is_none());
+    // Release gives back the keys and no spine path.
+    sel(&mut s, &[g]);
+    let r = s.execute("object.blend.release", &json!({})).unwrap();
+    assert_eq!((r["ids"].as_array().map(Vec::len), &r["spines"]), (Some(3), &json!([])));
+    s.execute("edit.undo", &json!({})).unwrap();
+    // Replace Spine gives it one: then it reverses and eases like any other.
+    let line = id_of(&s.execute("path.create", &json!({"d": "M0 100 L200 150"})).unwrap());
+    sel(&mut s, &[g, line]);
+    s.execute("object.blend.replaceSpine", &json!({})).unwrap();
+    let sp = spec(&s, g).1;
+    assert!(!sp.no_spine && sp.spine.is_some());
+    let info = s.execute("object.blend.info", &json!({})).unwrap();
+    assert_eq!((&info["hasSpine"], &info["spine"]["explicit"]), (&json!(true), &json!(true)));
+    s.execute("object.blend.reverseSpine", &json!({})).unwrap();
+    s.execute("object.blend.options", &json!({"easingType": "easeOut", "ramp": 40})).unwrap();
+    assert_eq!(spec(&s, g).1.ease.ramp, 0.4);
+}
+
+#[test]
+fn a_blend_without_a_spine_draws_its_steps_where_one_with_a_spine_does() {
+    let mut s = session();
+    for orientation in ["page", "path"] {
+        let spined = make(&mut s, 0.0, json!({"orientation": orientation}));
+        let bare = make(&mut s, 0.0, json!({"orientation": orientation, "createSpine": "never"}));
+        let boxes = |g: NodeId| -> Vec<_> { vectorcraft_doc::live::expand_live(&node(&s, g)).iter().map(|n| n.geometric_bounds()).collect() };
+        assert_eq!(boxes(bare), boxes(spined), "{orientation}");
+        assert!(boxes(bare).len() >= 3, "the three steps at least");
+    }
+    // Easing stored on a blend without a spine (a hand-edited file) leaves its steps evenly spaced.
+    let bare = make(&mut s, 300.0, json!({"orientation": "path", "createSpine": "never"}));
+    let even = vectorcraft_doc::live::expand_live(&node(&s, bare));
+    let mut eased = node(&s, bare);
+    if let NodeKind::Blend { spec, .. } = &mut eased.kind {
+        spec.ease = vectorcraft_doc::live::BlendEase { kind: vectorcraft_doc::live::BlendEaseType::In, ramp: 1.0 };
+    }
+    let boxes = |v: &[Node]| -> Vec<_> { v.iter().map(|n| n.geometric_bounds()).collect() };
+    assert_eq!(boxes(&vectorcraft_doc::live::expand_live(&eased)), boxes(&even));
+}
+
+#[test]
+fn whether_a_blend_has_a_spine_is_saved_and_old_blends_have_one() {
+    let mut s = session();
+    let bare = make(&mut s, 0.0, json!({"createSpine": "never"}));
+    let spined = make(&mut s, 50.0, json!({}));
+    let d = &s.doc().unwrap().doc;
+    let back = vectorcraft_format::load(&vectorcraft_format::save(d, false)).unwrap();
+    assert_eq!(&back.layers, &d.layers);
+    let saved = |g: NodeId| match &back.node(g).unwrap().kind {
+        NodeKind::Blend { spec, .. } => spec.no_spine,
+        _ => panic!("not a blend"),
+    };
+    assert!(saved(bare) && !saved(spined));
+    assert_eq!(serde_json::to_value(spec(&s, bare).1).unwrap()["noSpine"], json!(true));
+    assert!(serde_json::to_value(spec(&s, spined).1).unwrap().get("noSpine").is_none(), "a spine is not written");
+    let old: BlendSpec = serde_json::from_value(json!({"spacing": {"steps": 4}})).unwrap();
+    assert!(!old.no_spine, "a blend saved before Create Spine has a spine");
+    for odd in [json!("yes"), json!(1), json!(null)] {
+        let v: BlendSpec = serde_json::from_value(json!({"noSpine": odd.clone()})).unwrap_or_else(|e| panic!("{odd}: {e}"));
+        assert!(!v.no_spine, "{odd}");
+    }
+}
diff --git a/crates/engine/src/tests/plugins.rs b/crates/engine/src/tests/plugins.rs
index 36dbc5ba8e..4d225e4bdc 100644
--- a/crates/engine/src/tests/plugins.rs
+++ b/crates/engine/src/tests/plugins.rs
@@ -1820,11 +1820,11 @@ fn a_grant_that_cannot_be_removed_and_has_no_stored_module_stops_counting() {
     run(&mut s, "plugin.remove", json!({"id": id}));
 }
 
-/// A grant that a load of the plug-in store should forget and can't stays out of the approvals for
-/// the session: both when `grants.json` can't be rewritten and when it can't be read at the load.
-/// A grant recorded later counts again, and another store starts with nothing ignored.
+/// A grant that a load of the plug-in store should forget and can't stays out of the approvals in
+/// the process: both when `grants.json` can't be rewritten and when it can't be read at the load.
+/// A grant recorded later counts again, and another store's grant for the id counts.
 #[test]
-fn a_grant_the_load_cannot_remove_stops_counting_for_the_session() {
+fn a_grant_the_load_cannot_remove_stops_counting_in_the_process() {
     use vectorcraft_plugins::permissions::sha256_hex;
     let folder = crate::tests_links::Folder::new("plugin-store-load-forget");
     let elsewhere = crate::tests_links::Folder::new("plugin-store-load-forget-other");
@@ -1856,8 +1856,12 @@ fn a_grant_the_load_cannot_remove_stops_counting_for_the_session() {
     next.attach_plugin_store(elsewhere.0.clone());
     assert_eq!(run(&mut next, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "that store's grant counts");
 
+    // A load that can rewrite the file forgets the grant, and the store has nothing ignored again.
+    std::fs::write(&grants, &recorded).unwrap();
+    next.attach_plugin_store(folder.0.clone());
+    assert!(!grants.exists(), "the load removes the grant");
+
     // A directory at the file's path gives a read error on every platform.
-    std::fs::remove_file(&grants).unwrap();
     std::fs::create_dir(&grants).unwrap();
     vectorcraft_plugins::registry::remove(id);
     let mut third = session();
@@ -1883,6 +1887,180 @@ fn a_grant_the_load_cannot_remove_stops_counting_for_the_session() {
     run(&mut third, "plugin.remove", json!({"id": id}));
 }
 
+/// A grant one session stops counting stops counting for every session in the process attached to
+/// the same folder, by any path to it: one attached before, one attached after with no stored module
+/// to try the removal for, and one that comes back from another folder. A successful write of the
+/// grant in any of them makes it count in all of them again.
+#[test]
+fn an_ignored_stored_grant_is_shared_by_sessions_on_the_same_folder() {
+    use vectorcraft_plugins::permissions::sha256_hex;
+    let folder = crate::tests_links::Folder::new("plugin-store-shared-ignore");
+    let elsewhere = crate::tests_links::Folder::new("plugin-store-shared-ignore-other");
+    let id = "test.engine.permissions.sharedignore";
+    let empty = json!({"objects": []});
+    let approved = asking(id, r#"["doc.read"]"#, &empty);
+    let approved_data = vectorcraft_format::base64_encode(&approved);
+    let plain = asking(id, "null", &empty);
+    let needs_approval = json!({"dataBase64": approved_data});
+    let grants = folder.0.join("grants.json");
+    let entry = json!({"id": id, "hash": sha256_hex(&approved), "permissions": ["doc.read"]});
+    let recorded = serde_json::to_vec(&json!([entry])).unwrap();
+    std::fs::write(&grants, &recorded).unwrap();
+    let mut first = session();
+    first.attach_plugin_store(folder.0.clone());
+    let inside = folder.0.join("inside");
+    std::fs::create_dir(&inside).unwrap();
+    let mut other = session();
+    other.attach_plugin_store(inside.join(".."));
+    assert_eq!(run(&mut other, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "the recorded grant counts");
+
+    // `1e9` is written back as `1000000000.0`, which makes the rewritten file larger than the 1 MiB that is read.
+    let full = format!(r#"[{entry},{{"n":[{}]}}]"#, vec!["1e9"; 200_000].join(",")).into_bytes();
+    std::fs::write(&grants, &full).unwrap();
+    run(&mut first, "plugin.install", json!({"dataBase64": vectorcraft_format::base64_encode(&plain)}));
+    let file = first.stored_plugin_file(id).unwrap();
+    assert!(!std::path::Path::new(&file).exists(), "the store keeps no module");
+    assert_eq!(std::fs::read(&grants).unwrap(), full);
+
+    assert_eq!(run(&mut other, "plugin.inspect", needs_approval.clone())["needsApproval"], true, "the other session doesn't count it");
+    let refused = other.execute("plugin.install", &json!({"dataBase64": approved_data, "replace": true})).unwrap_err().to_string();
+    assert!(refused.contains("doc.read"), "{refused}");
+    std::fs::write(&file, &approved).unwrap();
+    vectorcraft_plugins::registry::remove(id);
+    other.load_stored_plugins();
+    assert!(vectorcraft_plugins::registry::get(id).is_none(), "the formerly approved module isn't loaded");
+    std::fs::remove_file(&file).unwrap();
+
+    let mut later = session();
+    later.attach_plugin_store(folder.0.clone());
+    assert_eq!(run(&mut later, "plugin.inspect", needs_approval.clone())["needsApproval"], true, "a session attached later doesn't count it");
+
+    std::fs::write(elsewhere.0.join("grants.json"), &recorded).unwrap();
+    other.attach_plugin_store(elsewhere.0.clone());
+    assert_eq!(run(&mut other, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "that store's grant counts");
+    other.attach_plugin_store(folder.0.clone());
+    assert_eq!(run(&mut other, "plugin.inspect", needs_approval.clone())["needsApproval"], true, "back on the folder, it doesn't");
+
+    std::fs::write(&grants, &recorded).unwrap();
+    assert!(later.store_grant(id, Some(serde_json::from_value(entry).unwrap())), "the file can be written");
+    for s in [&mut first, &mut other, &mut later] {
+        assert_eq!(run(s, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "it counts again");
+    }
+    std::fs::remove_file(&grants).unwrap();
+}
+
+/// A plug-in folder that doesn't exist yet gets the key it gets once it is made, and every path to a
+/// folder gets the same key.
+#[test]
+fn a_plugin_folder_has_one_key_for_every_path_to_it() {
+    use crate::store::plugin_store_key;
+    let folder = crate::tests_links::Folder::new("plugin-store-key");
+    let dir = folder.0.join("Plug-ins");
+    let before = plugin_store_key(&dir);
+    assert_eq!(plugin_store_key(&dir.join("sub").join("..")), before);
+    assert_eq!(plugin_store_key(&folder.0.join(".").join("Plug-ins")), before);
+    std::fs::create_dir(&dir).unwrap();
+    assert_eq!(plugin_store_key(&dir), before, "the key stays when the folder is made");
+    assert_eq!(plugin_store_key(&dir.join(".")), before);
+    #[cfg(windows)]
+    {
+        let plain = std::path::absolute(&dir).unwrap();
+        let verbatim = std::path::PathBuf::from(format!(r"\\?\{}", plain.display()));
+        assert_eq!(plugin_store_key(&verbatim), before, "a verbatim path names the same folder");
+    }
+}
+
+/// Sessions attached to a plug-in folder before it exists, by paths that only name the same folder
+/// once it is made, share the grants the process doesn't count for it. A grant that one session
+/// writes while another fails to remove it keeps counting.
+#[test]
+fn sessions_attached_before_the_folder_exists_share_its_ignored_grants() {
+    use vectorcraft_plugins::permissions::sha256_hex;
+    let folder = crate::tests_links::Folder::new("plugin-store-late-folder");
+    let id = "test.engine.permissions.latefolder";
+    let approved = asking(id, r#"["doc.read"]"#, &json!({"objects": []}));
+    let needs_approval = json!({"dataBase64": vectorcraft_format::base64_encode(&approved)});
+    let entry = json!({"id": id, "hash": sha256_hex(&approved), "permissions": ["doc.read"]});
+    std::fs::create_dir_all(folder.0.join("a").join("b")).unwrap();
+    let dir = folder.0.join("a").join("Plug-ins");
+    // On disk `link/..` is `a`, so `link/../Plug-ins` is the folder; by name it is a `Plug-ins` beside `a`.
+    // On Windows the folder is named in other letter case.
+    #[cfg(unix)]
+    let alias = {
+        std::os::unix::fs::symlink(folder.0.join("a").join("b"), folder.0.join("link")).unwrap();
+        folder.0.join("link").join("..").join("Plug-ins")
+    };
+    #[cfg(windows)]
+    let alias = folder.0.join("A").join("PLUG-INS");
+    #[cfg(not(any(unix, windows)))]
+    let alias = dir.clone();
+    let mut first = session();
+    first.attach_plugin_store(dir.clone());
+    let mut other = session();
+    other.attach_plugin_store(alias);
+    std::fs::create_dir(&dir).unwrap();
+    std::fs::write(dir.join("grants.json"), serde_json::to_vec(&json!([entry])).unwrap()).unwrap();
+    assert_eq!(run(&mut other, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "the recorded grant counts");
+
+    first.ignore_stored_grant(id, first.grant_writes());
+    assert_eq!(run(&mut other, "plugin.inspect", needs_approval.clone())["needsApproval"], true, "the other session doesn't count it");
+    assert!(other.store_grant(id, Some(serde_json::from_value(entry.clone()).unwrap())), "the file can be written");
+    assert_eq!(run(&mut first, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "it counts again");
+
+    // A write that fails in one session while another writes the grant for the id leaves the grant
+    // counting.
+    let before = first.grant_writes();
+    assert!(other.store_grant(id, Some(serde_json::from_value(entry).unwrap())), "the other session writes the grant");
+    first.ignore_stored_grant(id, before);
+    assert_eq!(run(&mut first, "plugin.inspect", needs_approval)["needsApproval"], false, "the written grant counts");
+    std::fs::remove_file(dir.join("grants.json")).unwrap();
+}
+
+/// Grant writes that change nothing, each for another id, don't grow what the process keeps past its
+/// limit.
+#[test]
+fn the_process_keeps_a_bounded_number_of_grant_writes() {
+    let folder = crate::tests_links::Folder::new("plugin-store-writes-kept");
+    let mut s = session();
+    s.attach_plugin_store(folder.0.clone());
+    for n in 0..300 {
+        assert!(s.store_grant(&format!("test.engine.permissions.unknown{n}"), None), "nothing to remove is a success");
+    }
+    assert!(Session::grant_writes_kept() <= 256, "{}", Session::grant_writes_kept());
+}
+
+/// A session attached by a link to a plug-in folder matches the grants the process doesn't count
+/// with the folder the link leads to now, not the one it led to when the session was attached.
+#[cfg(unix)]
+#[test]
+fn a_linked_plugin_folder_uses_the_ignored_grants_of_where_the_link_leads() {
+    use vectorcraft_plugins::permissions::sha256_hex;
+    let folder = crate::tests_links::Folder::new("plugin-store-relinked");
+    let id = "test.engine.permissions.relinked";
+    let approved = asking(id, r#"["doc.read"]"#, &json!({"objects": []}));
+    let needs_approval = json!({"dataBase64": vectorcraft_format::base64_encode(&approved)});
+    let entry = json!({"id": id, "hash": sha256_hex(&approved), "permissions": ["doc.read"]});
+    let recorded = serde_json::to_vec(&json!([entry])).unwrap();
+    let (old, new, link) = (folder.0.join("old"), folder.0.join("new"), folder.0.join("Plug-ins"));
+    for dir in [&old, &new] {
+        std::fs::create_dir(dir).unwrap();
+        std::fs::write(dir.join("grants.json"), &recorded).unwrap();
+    }
+    std::os::unix::fs::symlink(&old, &link).unwrap();
+    let mut linked = session();
+    linked.attach_plugin_store(link.clone());
+    assert_eq!(run(&mut linked, "plugin.inspect", needs_approval.clone())["needsApproval"], false, "the recorded grant counts");
+
+    std::fs::remove_file(&link).unwrap();
+    std::os::unix::fs::symlink(&new, &link).unwrap();
+    let mut direct = session();
+    direct.attach_plugin_store(new.clone());
+    direct.ignore_stored_grant(id, direct.grant_writes());
+    assert_eq!(run(&mut linked, "plugin.inspect", needs_approval.clone())["needsApproval"], true, "the link leads to the ignored grant");
+    assert!(linked.store_grant(id, Some(serde_json::from_value(entry).unwrap())), "the file can be written");
+    assert_eq!(run(&mut direct, "plugin.inspect", needs_approval)["needsApproval"], false, "it counts again");
+}
+
 /// A grants file that can't be opened or read may name the old module once it reads again, so
 /// neither a module listing no permissions nor `plugin.remove` gets past it. A directory at the
 /// file's path gives a read error on every platform.
diff --git a/crates/engine/src/tests/prefs_roots.rs b/crates/engine/src/tests/prefs_roots.rs
new file mode 100644
index 0000000000..b9818949f1
--- /dev/null
+++ b/crates/engine/src/tests/prefs_roots.rs
@@ -0,0 +1,107 @@
+//! The preferences commands under automation roots: a confined request sees a folder preference and
+//! an export preset's folder only inside its read roots.
+
+use std::path::{Path, PathBuf};
+
+use serde_json::{Value, json};
+
+use crate::cmd::fileio::ScreenExportPreset;
+use crate::file_access::{AutomationRoots, confine};
+use crate::*;
+
+fn run(s: &mut Session, id: &str, p: Value) -> Value {
+    s.execute(id, &p).unwrap_or_else(|e| panic!("{id} {p}: {e}"))
+}
+
+fn text(p: &Path) -> String {
+    p.to_string_lossy().to_string()
+}
+
+/// A fresh scratch folder for one test, with the folders `in` and `out`.
+fn folder(name: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(format!("vc-prefs-roots-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    for sub in ["in", "out"] {
+        std::fs::create_dir_all(dir.join(sub)).unwrap();
+    }
+    dir
+}
+
+/// The folder preferences that name the folder outside the read root.
+const OUTSIDE: [&str; 3] = ["pluginsFolder", "scratchPrimary", "templatesFolder"];
+
+/// A session whose folder preferences name `inside` (fonts, and the Data Recovery folder with
+/// spaces around it) and `outside` (the [`OUTSIDE`] ones, the Templates folder with spaces around
+/// it), with a scratch disk choice and an export preset kept with each folder.
+fn session(inside: &str, outside: &str) -> Session {
+    let mut s = Session::new();
+    s.prefs.fonts_folder = inside.to_string();
+    s.prefs.recovery_folder = format!(" {inside} ");
+    s.prefs.plugins_folder = outside.to_string();
+    s.prefs.scratch_primary = outside.to_string();
+    s.prefs.scratch_secondary = "None".to_string();
+    s.prefs.templates_folder = format!(" {outside} ");
+    for (name, folder) in [("Inside", inside), ("Outside", outside)] {
+        let settings = json!({"formats": [{"format": "svg"}], "folder": folder});
+        s.prefs.screen_export_presets.push(ScreenExportPreset { name: name.into(), settings: settings.as_object().cloned().unwrap_or_default() });
+    }
+    s
+}
+
+/// Does a string anywhere in `v` hold `path`?
+fn holds(v: &Value, path: &str) -> bool {
+    v.to_string().contains(&path.replace('\\', "\\\\"))
+}
+
+#[test]
+fn prefs_commands_leave_out_folders_outside_the_read_root() {
+    let base = folder("get");
+    let (inside, outside) = (text(&base.join("in").join("fonts")), text(&base.join("out")));
+    let roots = AutomationRoots::new(&[&base.join("in")], &[]).unwrap();
+    let mut s = session(&inside, &outside);
+
+    let all = confine(roots.as_ref(), || run(&mut s, "prefs.get", json!({})));
+    let prefs = &all["prefs"];
+    assert_eq!(prefs["fontsFolder"], json!(inside), "a folder inside the root is shown");
+    assert_eq!(prefs["recoveryFolder"], json!(format!(" {inside} ")), "checked without the spaces, shown as kept");
+    assert_eq!(prefs["scratchSecondary"], json!("None"), "a scratch disk choice is shown");
+    for key in OUTSIDE {
+        assert_eq!(prefs[key], Value::Null, "{key}: {all}");
+    }
+    let presets = prefs["screenExportPresets"].as_array().unwrap();
+    assert_eq!(presets[0]["settings"]["folder"], json!(inside));
+    assert_eq!(presets[1]["name"], json!("Outside"), "the preset stays");
+    assert!(presets[1]["settings"].get("folder").is_none(), "{all}");
+    assert!(!holds(&all, &outside), "{all}");
+
+    for key in OUTSIDE {
+        let one = confine(roots.as_ref(), || run(&mut s, "prefs.get", json!({"key": key})));
+        assert_eq!(one, Value::Null, "{key}");
+    }
+    assert_eq!(confine(roots.as_ref(), || run(&mut s, "prefs.get", json!({"key": "fontsFolder"}))), json!(inside));
+
+    let list = confine(roots.as_ref(), || run(&mut s, "prefs.list", json!({})));
+    assert!(!holds(&list, &outside), "{list}");
+    let row = |key: &str| list.as_array().unwrap().iter().find(|r| r["key"] == key).cloned().unwrap();
+    assert_eq!(row("fontsFolder")["value"], json!(inside));
+    assert_eq!(row("pluginsFolder")["value"], Value::Null);
+    assert_eq!(row("pluginsFolder")["kind"], json!("text"), "the row stays");
+
+    // A request that sets another preference, or resets a category without folders.
+    let set = confine(roots.as_ref(), || run(&mut s, "prefs.set", json!({"values": {"keyboardIncrement": 2, "pluginsFolder": outside}})));
+    assert_eq!(set, json!({"keyboardIncrement": 2.0, "pluginsFolder": null}), "a folder kept as it was is left out too");
+    let reset = confine(roots.as_ref(), || run(&mut s, "prefs.reset", json!({"category": "General"})));
+    assert!(!holds(&reset, &outside), "{reset}");
+    assert_eq!(reset["prefs"]["fontsFolder"], json!(inside));
+
+    // Unconfined and with only a write root.
+    let all = run(&mut s, "prefs.get", json!({}));
+    assert_eq!(all["prefs"]["pluginsFolder"], json!(outside), "unconfined, the folder is shown");
+    assert_eq!(all["prefs"]["screenExportPresets"][1]["settings"]["folder"], json!(outside));
+    let write_only = AutomationRoots::new(&[], &[&base.join("in")]).unwrap();
+    let all = confine(write_only.as_ref(), || run(&mut s, "prefs.get", json!({})));
+    assert_eq!(all["prefs"]["fontsFolder"], Value::Null, "without a read root no folder is shown");
+    assert_eq!(all["prefs"]["recoveryFolder"], Value::Null);
+    assert_eq!(s.prefs.plugins_folder, outside, "the preferences are unchanged");
+    let _ = std::fs::remove_dir_all(&base);
+}
diff --git a/crates/engine/src/tests/turn_direction.rs b/crates/engine/src/tests/turn_direction.rs
index f12f0d1962..a8961f3c46 100644
--- a/crates/engine/src/tests/turn_direction.rs
+++ b/crates/engine/src/tests/turn_direction.rs
@@ -114,3 +114,12 @@ fn keys_named(doc: &str) -> Vec<String> {
     }
     found.into_iter().map(|(k, _)| k).collect()
 }
+
+/// Turn notes the key walk above doesn't reach: a numeric reflection axis and the Scatter brush's
+/// `rotation [a, b]` range, whose head isn't a plain key.
+#[test]
+fn turns_outside_plain_keys_say_which_way() {
+    let doc = |id: &str| command_specs().iter().find(|c| c.id == id).map(|c| c.params).unwrap_or_default();
+    assert!(doc("object.reflect").contains("|deg (the mirror line, counter-clockwise from horizontal"), "object.reflect's numeric axis");
+    assert!(doc("brush.options").contains("rotation [a, b] −180..180° (counter-clockwise)"), "the Scatter brush's rotation");
+}
diff --git a/crates/engine/tests/command_sweep.rs b/crates/engine/tests/command_sweep.rs
index 947cf559d0..b3779d8108 100644
--- a/crates/engine/tests/command_sweep.rs
+++ b/crates/engine/tests/command_sweep.rs
@@ -674,6 +674,8 @@ fn structured_junk() {
         ("object.blend.options", json!({"spacing": "distance", "value": -1e308, "orientation": 5})),
         ("object.blend.options", json!({"ramp": 1e308, "colorShift": -1e308, "easingType": [1]})),
         ("object.blend.make", json!({"ids": [1, 2], "ramp": f64::NAN, "colorShift": [1]})),
+        ("object.blend.make", json!({"ids": [1, 2], "createSpine": ["never"], "easingType": "easeIn"})),
+        ("object.blend.createSpine", json!({"mode": 1e308})),
         ("object.blend.spine.moveAnchor", json!({"id": 2, "anchor": u64::MAX, "x": 1e308, "y": -1e308, "handle": "sideways"})),
         ("object.blend.spine.addAnchor", json!({"id": u64::MAX, "x": 0, "y": 0})),
         ("object.blend.spine.reshapeSegment", json!({"id": 2, "segment": u64::MAX, "t": f64::NAN, "dx": 1e308, "dy": -1e308})),
diff --git a/crates/js/src/ast.rs b/crates/js/src/ast.rs
index 5a4363108a..8d9ffc06c0 100644
--- a/crates/js/src/ast.rs
+++ b/crates/js/src/ast.rs
@@ -187,7 +187,8 @@ pub enum Expr {
         qualifier: Option<XmlQualifier>,
         name: XmlNamePart,
     },
-    /// An E4X name standing alone (`@a` in a filter): looked up on the nearest XML value in scope.
+    /// An E4X name standing alone (`@a` in a filter): looked up on the nearest XML value in scope
+    /// that holds it, and also an assignment, update or `delete` target.
     XmlScopeName(ExprId),
     /// `object..name`.
     XmlDescendants {
diff --git a/crates/js/src/bytecode.rs b/crates/js/src/bytecode.rs
index 3092530d46..6992fd5606 100644
--- a/crates/js/src/bytecode.rs
+++ b/crates/js/src/bytecode.rs
@@ -160,8 +160,11 @@ pub(crate) enum Op {
         parts: u32,
         list: bool,
     },
-    /// `name` → the value of the name on the nearest XML value in scope.
+    /// `name` → the value of the name on the nearest XML value in scope that holds it.
     XmlScopeGet,
+    /// `name` → `object name`: the nearest XML value in scope that holds the name, for an
+    /// assignment, update or `delete`.
+    XmlScopeRef,
     /// `object` → the filter's state.
     XmlFilterStart,
     /// `state` → `state item`, or jumps with `state` when the items are used up.
@@ -170,8 +173,9 @@ pub(crate) enum Op {
     XmlFilterTest,
     /// `state` → the XMLList of the items kept.
     XmlFilterEnd,
-    /// `iterator name` → `iterator value`: the value under the name a `for each` got.
-    ForEachValue,
+    /// `iterator name x₁…xₙ` → `iterator name x₁…xₙ value`: the value under the name a `for each`
+    /// got, read after the `n` values its target pushed.
+    ForEachValue(u32),
     /// `value` → nothing: sets the default XML namespace of the running code.
     SetDefaultNamespace,
 }
@@ -308,7 +312,8 @@ fn effect(op: Op, finally_tables: &[Vec<u32>]) -> Result<Effect, String> {
         Op::XmlDescendants | Op::XmlFilterTest => e(2, 1),
         Op::XmlEscape(_) | Op::XmlScopeGet | Op::XmlFilterStart | Op::XmlFilterEnd => e(1, 1),
         Op::XmlLiteral { parts, .. } => e(parts, 1),
-        Op::ForEachValue => e(2, 2),
+        Op::XmlScopeRef => e(1, 2),
+        Op::ForEachValue(n) => e(n + 2, n + 3),
         Op::SetDefaultNamespace => e(1, 0),
     })
 }
diff --git a/crates/js/src/compiler.rs b/crates/js/src/compiler.rs
index 071e99a60e..3023e3b127 100644
--- a/crates/js/src/compiler.rs
+++ b/crates/js/src/compiler.rs
@@ -497,16 +497,21 @@ impl<'a> FnCompiler<'a> {
         let brk = self.new_label();
         self.bind(head);
         self.jump(Op::ForInNext, brk);
-        if each {
-            self.emit(Op::ForEachValue);
-        }
         match target {
             ForInTarget::Var(d) => {
                 let n = self.var_name(&d.name.name);
+                if each {
+                    self.emit(Op::ForEachValue(0));
+                }
                 self.emit(Op::SetVar(n));
             }
+            ForInTarget::Expr(e) if each => self.store_value_to(*e)?,
             ForInTarget::Expr(e) => self.store_key_to(*e)?,
         }
+        if each {
+            // The value; the name under it goes next.
+            self.emit(Op::Pop);
+        }
         self.emit(Op::Pop);
         self.loop_body(body, labels, brk, head)?;
         self.jump(Op::Jump, head);
@@ -538,6 +543,11 @@ impl<'a> FnCompiler<'a> {
                 self.emit(Op::Rot3);
                 self.emit(Op::SetIndex);
             }
+            Some(Expr::XmlScopeName(name)) => {
+                self.xml_scope_ref(target, *name)?;
+                self.emit(Op::Rot3);
+                self.emit(Op::SetIndex);
+            }
             _ => {
                 self.expr(target)?;
                 self.emit(Op::Pop);
@@ -547,6 +557,46 @@ impl<'a> FnCompiler<'a> {
         Ok(())
     }
 
+    /// Assigns the value under the name on top of the stack to a `for each` target expression,
+    /// leaving the name and then the value on top. The target is evaluated before the value is
+    /// read (ECMA-357 section 12.3).
+    fn store_value_to(&mut self, target: ExprId) -> CResult<()> {
+        let target = self.ast.unparenthesized(target);
+        self.at(self.ast.expr_span(target).start);
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::ForEachValue(0));
+                self.emit(Op::SetVar(n));
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                self.emit(Op::ForEachValue(1));
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::SetMember(n));
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::ToKey);
+                self.emit(Op::ForEachValue(2));
+                self.emit(Op::SetIndex);
+            }
+            Some(Expr::XmlScopeName(name)) => {
+                self.xml_scope_ref(target, *name)?;
+                self.emit(Op::ForEachValue(2));
+                self.emit(Op::SetIndex);
+            }
+            _ => {
+                self.expr(target)?;
+                self.emit(Op::Pop);
+                self.emit(Op::ForEachValue(0));
+                self.throw_invalid_target();
+            }
+        }
+        Ok(())
+    }
+
     fn throw_invalid_target(&mut self) {
         let s = self.string(&"invalid assignment target".encode_utf16().collect::<Vec<u16>>());
         let depth = self.depth;
@@ -854,6 +904,15 @@ impl<'a> FnCompiler<'a> {
         Ok(())
     }
 
+    /// Pushes the nearest XML value in scope that holds the E4X name `name` of the expression
+    /// `id`, then the name, as an assignment, update or `delete` uses them.
+    fn xml_scope_ref(&mut self, id: ExprId, name: ExprId) -> CResult<()> {
+        self.expr(name)?;
+        self.at(self.ast.expr_span(id).start);
+        self.emit(Op::XmlScopeRef);
+        Ok(())
+    }
+
     fn xml_literal(&mut self, parts: &[XmlPart], list: bool) -> CResult<()> {
         for part in parts {
             match part {
@@ -1096,6 +1155,10 @@ impl<'a> FnCompiler<'a> {
                 self.expr(*index)?;
                 self.emit(Op::DeleteIndex);
             }
+            Some(Expr::XmlScopeName(name)) => {
+                self.xml_scope_ref(arg, *name)?;
+                self.emit(Op::DeleteIndex);
+            }
             _ => {
                 self.expr(arg)?;
                 self.emit(Op::Pop);
@@ -1202,6 +1265,13 @@ impl<'a> FnCompiler<'a> {
                     self.emit(Op::GetIndex);
                 }
             }
+            Some(Expr::XmlScopeName(name)) => {
+                self.xml_scope_ref(target, *name)?;
+                if op.is_some() {
+                    self.emit(Op::Dup2);
+                    self.emit(Op::GetIndex);
+                }
+            }
             _ => {
                 self.expr(target)?;
                 if op.is_none() {
@@ -1222,7 +1292,7 @@ impl<'a> FnCompiler<'a> {
                 let n = self.name_key(key_of(&property.name));
                 self.emit(Op::SetMember(n));
             }
-            Some(Expr::Index { .. }) => self.emit(Op::SetIndex),
+            Some(Expr::Index { .. } | Expr::XmlScopeName(_)) => self.emit(Op::SetIndex),
             _ => self.throw_invalid_target(),
         }
         Ok(())
@@ -1246,6 +1316,10 @@ impl<'a> FnCompiler<'a> {
                 self.expr(*index)?;
                 self.emit(Op::IncIndex { prefix, dec });
             }
+            Some(Expr::XmlScopeName(name)) => {
+                self.xml_scope_ref(target, *name)?;
+                self.emit(Op::IncIndex { prefix, dec });
+            }
             _ => {
                 self.expr(target)?;
                 self.emit(Op::ToNumber);
diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs
index aeafeec59d..f5e2ce2ae6 100644
--- a/crates/js/src/interp.rs
+++ b/crates/js/src/interp.rs
@@ -943,11 +943,12 @@ impl Interp {
             Op::XmlEscape(kind) => self.op_xml_escape(kind),
             Op::XmlLiteral { parts, list } => self.op_xml_literal(parts, list),
             Op::XmlScopeGet => self.op_xml_scope_get(),
+            Op::XmlScopeRef => self.op_xml_scope_ref(),
             Op::XmlFilterStart => self.op_xml_filter_start(),
             Op::XmlFilterNext(t) => self.op_xml_filter_next(t),
             Op::XmlFilterTest => self.op_xml_filter_test(),
             Op::XmlFilterEnd => self.op_xml_filter_end(),
-            Op::ForEachValue => self.op_for_each_value(),
+            Op::ForEachValue(n) => self.op_for_each_value(n as usize),
             Op::SetDefaultNamespace => self.op_set_default_namespace(),
             Op::Return | Op::ReturnCompletion => internal("return reached the dispatcher"),
         }
diff --git a/crates/js/src/parser.rs b/crates/js/src/parser.rs
index 3c2ab3ed30..fa201c58ff 100644
--- a/crates/js/src/parser.rs
+++ b/crates/js/src/parser.rs
@@ -873,8 +873,9 @@ impl<'s> Parser<'s> {
     }
 
     /// An assignment's, `++`'s, `--`'s or `for-in`'s target: an identifier (in strict code
-    /// neither `eval` nor `arguments`), a property, or outside strict mode code a call (assigning
-    /// to its result fails at run time, as ECMA-262 2015 Annex B and web browsers have it).
+    /// neither `eval` nor `arguments`), a property, an E4X name standing alone (`@a`, `ns::a`;
+    /// ECMA-357 section 11.1), or outside strict mode code a call (assigning to its result fails
+    /// at run time, as ECMA-262 2015 Annex B and web browsers have it).
     fn check_target(&self, expr: ExprId, message: &str) -> Result<()> {
         let inner = self.ast.unparenthesized(expr);
         match self.ast.expr(inner) {
@@ -884,7 +885,7 @@ impl<'s> Parser<'s> {
                 }
                 Ok(())
             }
-            Some(Expr::Member { .. } | Expr::Index { .. }) => Ok(()),
+            Some(Expr::Member { .. } | Expr::Index { .. } | Expr::XmlScopeName(_)) => Ok(()),
             Some(Expr::Call { .. }) if !self.ctx.strict => Ok(()),
             _ => Err(self.error_at_offset(self.ast.expr_span(expr).start, message)),
         }
diff --git a/crates/js/src/xml.rs b/crates/js/src/xml.rs
index 019a9638b0..8d83162a50 100644
--- a/crates/js/src/xml.rs
+++ b/crates/js/src/xml.rs
@@ -2863,27 +2863,24 @@ impl Interp {
         self.replace(n, value)
     }
 
-    pub(crate) fn op_xml_scope_get(&mut self) -> JsResult<()> {
-        let name = self.peek(0)?;
-        let n = self.xml_name_only(&name)?;
+    /// The nearest XML or XMLList value in scope whose [[HasProperty]] accepts `n`, or a
+    /// ReferenceError when none does (ECMA-357 section 11.1).
+    fn xml_scope_holder(&mut self, n: &NameRef) -> JsResult<ObjId> {
         let mut cur = Some(self.frame()?.env);
-        let mut first = None;
+        let mut any_xml = false;
         while let Some(e) = cur {
             match self.heap.env(e) {
                 Some(Env::Decl { outer, .. }) => cur = *outer,
                 Some(&Env::Obj { object, outer, .. }) => {
                     let v = Value::Object(object);
                     if self.is_xml(&v) {
-                        if first.is_none() {
-                            first = Some(object);
-                        }
+                        any_xml = true;
                         let found = match self.classify(&v) {
-                            Xv::Node(x) => self.node_has_name(x, &n)?,
-                            _ => self.list_has_name(object, &n)?,
+                            Xv::Node(x) => self.node_has_name(x, n)?,
+                            _ => self.list_has_name(object, n)?,
                         };
                         if found {
-                            first = Some(object);
-                            break;
+                            return Ok(object);
                         }
                     }
                     cur = outer;
@@ -2891,13 +2888,26 @@ impl Interp {
                 None => return Err(Abrupt::Internal("environment out of range".into())),
             }
         }
-        let Some(object) = first else {
-            return Err(self.throw(ErrorType::Reference, "an XML name is used outside any XML value"));
-        };
+        let message = if any_xml { "no XML value in scope has the XML name" } else { "an XML name is used outside any XML value" };
+        Err(self.throw(ErrorType::Reference, message))
+    }
+
+    pub(crate) fn op_xml_scope_get(&mut self) -> JsResult<()> {
+        let name = self.peek(0)?;
+        let n = self.xml_name_only(&name)?;
+        let object = self.xml_scope_holder(&n)?;
         let v = self.xml_select(object, &n)?;
         self.replace(1, Value::Object(v))
     }
 
+    pub(crate) fn op_xml_scope_ref(&mut self) -> JsResult<()> {
+        let name = self.peek(0)?;
+        let n = self.xml_name_only(&name)?;
+        let object = self.xml_scope_holder(&n)?;
+        self.replace(1, Value::Object(object))?;
+        self.push(name)
+    }
+
     pub(crate) fn op_xml_filter_start(&mut self) -> JsResult<()> {
         let base = self.peek(0)?;
         let input = match self.classify(&base) {
@@ -2951,9 +2961,9 @@ impl Interp {
         self.replace(1, Value::Object(out))
     }
 
-    pub(crate) fn op_for_each_value(&mut self) -> JsResult<()> {
-        let name = self.peek(0)?;
-        let Value::Object(iter) = self.peek(1)? else { return Err(Abrupt::Internal("for-in iterator is not an object".into())) };
+    pub(crate) fn op_for_each_value(&mut self, above: usize) -> JsResult<()> {
+        let name = self.peek(above)?;
+        let Value::Object(iter) = self.peek(above + 1)? else { return Err(Abrupt::Internal("for-in iterator is not an object".into())) };
         let object = match self.heap.object(iter).map(|o| &o.class) {
             Some(Class::ForIn(state)) => state.object,
             _ => return Err(Abrupt::Internal("not a for-in iterator".into())),
@@ -2965,7 +2975,7 @@ impl Interp {
             }
             None => Value::Undefined,
         };
-        self.replace(1, v)
+        self.push(v)
     }
 
     /// The URI of a Namespace value or of its string form.
diff --git a/crates/js/src/xml_tests.rs b/crates/js/src/xml_tests.rs
index 9fb9452816..99a0100fe3 100644
--- a/crates/js/src/xml_tests.rs
+++ b/crates/js/src/xml_tests.rs
@@ -688,6 +688,103 @@ fn a_scope_name_skips_a_list_without_that_name() {
     truth("var outer = <o id='1'/>; var inner = <><i id='2'/></>; with (outer) with (inner) { @id == '2' }");
 }
 
+#[test]
+fn bare_attribute_assignment_uses_nearest_holder() {
+    truth("var x = <a b='1'/>; with (x) { @b = '2'; } x.@b == '2'");
+    truth("var outer = <o id='1'/>; var inner = <i/>; with (outer) with (inner) { @id = '9'; } outer.@id == '9' && inner.@id.length() === 0");
+    truth("var outer = <o id='1'/>; var inner = <i id='2'/>; with (outer) with (inner) { @id = '9'; } outer.@id == '1' && inner.@id == '9'");
+    truth("var outer = <o id='1'/>; var inner = <><i/></>; with (outer) with (inner) { @id = '9'; } outer.@id == '9' && inner.@id.length() === 0");
+    truth("var x = <a b='1'/>; with (x) with ({ b: 7 }) { @b = '3'; } x.@b == '3'");
+    truth("with (<a b='1'/>) { (@b = 5) === 5 }");
+    truth("var x = <a b='1' c='2'/>; with (x) { @b = @c = 'v'; } x.@b == 'v' && x.@c == 'v'");
+    truth("var n = 0; var x = <a b='1'/>; with (x) { @[(n++, 'b')] = 'z'; } n === 1 && x.@b == 'z' && x.attributes().length() === 1");
+    truth("var x = <a><c>1</c></a>; with (x) { *::c = '2'; } x.c == '2' && x.*.length() === 1");
+    truth("var x = <a b='1'/>; x.@b = '4'; x.@b == '4'");
+}
+
+#[test]
+fn bare_qualified_assignment_keeps_namespace() {
+    truth(
+        "var ns = new Namespace('u'); var x = <a xmlns:p='u'><p:c>1</p:c><c>0</c></a>; with (x) { ns::c = '2'; } \
+         x.ns::c == '2' && x.ns::c.name().uri === 'u' && x.c == '0' && x.*.length() === 2",
+    );
+    truth(
+        "var ns = new Namespace('u'); var x = <a xmlns:p='u' p:t='1' t='0'/>; with (x) { @ns::t = '5'; } \
+         x.@ns::t == '5' && x.@ns::t.name().uri === 'u' && x.@t == '0'",
+    );
+}
+
+#[test]
+fn bare_assignment_in_filter_mutates_each_matching_item() {
+    truth("var l = <><i id='1'/><i id='2'/></>; var r = l.(@id = 'z', true); r.length() === 2 && l[0].@id == 'z' && l[1].@id == 'z'");
+    truth("var l = <><i n='1'/><i n='2'/></>; var r = l.(@n = 0); r.length() === 0 && l[0].@n == '0' && l[1].@n == '0'");
+    truth("var l = <><i n='1'/><i n='2'/></>; var r = l.(@n = 'k'); r.length() === 2");
+    truth("var o = <o k='1'/>; var l = <><i/><i/></>; with (o) { l.(@k += 'x', true); } o.@k == '1xx' && l[0].@k.length() === 0");
+}
+
+#[test]
+fn bare_assignment_without_holder_throws_reference_error_before_rhs() {
+    assert_eq!(thrown_name("@a = 1"), "ReferenceError");
+    assert_eq!(thrown_name("with ({ a: 1 }) { @a = 1 }"), "ReferenceError");
+    assert_eq!(thrown_name("with (<x/>) { @a = 1 }"), "ReferenceError");
+    assert_eq!(thrown_name("with (<x/>) { @a += 1 }"), "ReferenceError");
+    assert_eq!(thrown_name("with (<x/>) { @a++ }"), "ReferenceError");
+    assert_eq!(thrown_name("var ns = new Namespace('u'); with (<x><c/></x>) { ns::c = 1 }"), "ReferenceError");
+    truth("var n = 0; var e = ''; try { with (<x/>) { @a = (n++, 1); } } catch (err) { e = err.name; } e === 'ReferenceError' && n === 0");
+    truth(
+        "var b = 'g'; var x = <x/>; var e = ''; try { with (x) { @b = 'w'; } } catch (err) { e = err.name; } \
+         e === 'ReferenceError' && b === 'g' && x.@b.length() === 0 && x.*.length() === 0",
+    );
+}
+
+#[test]
+fn bare_name_read_without_holder_throws_reference_error() {
+    assert_eq!(thrown_name("with (<x/>) { @a }"), "ReferenceError");
+    assert_eq!(thrown_name("var l = <><i id='1'/><i/></>; l.(@id == '1')"), "ReferenceError");
+    truth("var o = <o id='0'/>; var l = <><i id='1'/><i/></>; var r; with (o) { r = l.(@id == '1'); } r.length() === 1");
+}
+
+#[test]
+fn bare_scope_compound_and_updates_resolve_once() {
+    truth("var n = 0; var x = <a t='1'/>; with (x) { @[(n++, 't')] += 1; } n === 1 && x.@t == '11'");
+    truth("var n = 0; var x = <a t='1'/>; with (x) { @[(n++, 't')]++; } n === 1 && x.@t == '2'");
+    truth("var x = <a t='1'/>; var r; with (x) { r = ++@t; } r === 2 && x.@t == '2'");
+    truth("var x = <a t='1'/>; var r; with (x) { r = @t++; } r === 1 && x.@t == '2'");
+    truth("var x = <a t='5'/>; var r; with (x) { r = --@t; } r === 4 && x.@t == '4'");
+    truth("var x = <a t='5'/>; var r; with (x) { r = @t--; } r === 5 && x.@t == '4'");
+}
+
+#[test]
+fn bare_scope_delete_removes_attribute() {
+    truth("var x = <a t='1' u='2'/>; var r; with (x) { r = delete @t; } r === true && x.@t.length() === 0 && x.@u == '2'");
+    truth("var x = <a><c/><d/></a>; with (x) { delete *::c; } x.c.length() === 0 && x.d.length() === 1");
+    assert_eq!(thrown_name("with (<a/>) { delete @t }"), "ReferenceError");
+}
+
+#[test]
+fn bare_scope_for_targets_assign_each_iteration() {
+    truth("var x = <a k=''/>; var s = ''; with (x) { for (@k in { p: 1, q: 2 }) s += @k; } s === 'pq' && x.@k == 'q'");
+    truth("var x = <a k=''/>; var s = ''; with (x) { for each (@k in [3, 4]) s += @k; } s === '34' && x.@k == '4'");
+    assert_eq!(thrown_name("with (<a/>) { for (@k in { p: 1 }); }"), "ReferenceError");
+}
+
+#[test]
+fn for_each_evaluates_its_target_before_reading_the_value() {
+    truth("var o = { p: 1 }; var t = {}; for each ((o.p = 2, t).v in o); t.v === 2");
+    truth("var o = { p: 1 }; var t = {}; for each (t[(o.p = 3, 'w')] in o); t.w === 3");
+    truth("var x = <a k=''/>; var o = { p: 1 }; with (x) { for each (@[(o.p = 2, 'k')] in o); } x.@k == '2'");
+    truth("var o = { p: 1, q: 2 }; var s = ''; for each (var v in o) s += v; var t; for each (t in o) s += t; s === '1212' && t === 2");
+}
+
+#[test]
+fn bare_scope_targets_need_e4x_option() {
+    for src in ["@a = 1", "ns::a = 1", "@a += 1", "++@a", "@a--", "for (@a in o);", "for each (@a in o);", "\"use strict\"; @a = 1"] {
+        assert!(parse(src, &Options::default()).is_err(), "{src}");
+        assert!(parse(src, &e4x()).is_ok(), "{src}");
+    }
+    truth("'use strict'; var l = <><i b='1'/></>; l.(@b = '2', true); l[0].@b == '2'");
+}
+
 #[test]
 fn a_bracket_key_converts_to_a_string_before_it_names_a_child() {
     truth("var x = <a><true>1</true></a>; x[true] == '1' && (true in x) && !(false in x)");
diff --git a/crates/mcp/src/headless.rs b/crates/mcp/src/headless.rs
index 00e914ddba..69c7b5ba0e 100644
--- a/crates/mcp/src/headless.rs
+++ b/crates/mcp/src/headless.rs
@@ -56,6 +56,24 @@ fn s<'a>(p: &'a Value, k: &str) -> Option<&'a str> {
     p.get(k).and_then(Value::as_str)
 }
 
+/// An optional param read with `read`: none when it is omitted or null, else an error naming the
+/// key when `read` gets nothing from its value.
+fn opt<T>(p: &Value, k: &str, read: impl Fn(&Value) -> Option<T>, what: &str) -> Result<Option<T>, String> {
+    match p.get(k) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => read(v).map(Some).ok_or_else(|| format!("`{k}` must be {what}")),
+    }
+}
+
+fn opt_bool(p: &Value, k: &str) -> Result<Option<bool>, String> {
+    opt(p, k, Value::as_bool, "true or false")
+}
+
+/// A pointer packet's `mods`: none when omitted or null, else an object of booleans.
+fn packet_mods(p: &Value) -> Result<Option<Mods>, String> {
+    opt(p, "mods", |m| m.as_object().and_then(|_| serde_json::from_value(m.clone()).ok()), "an object of true or false values")
+}
+
 pub(crate) fn pointer_kind(k: &str) -> Option<PointerKind> {
     Some(match k {
         "down" => PointerKind::Down,
@@ -210,28 +228,30 @@ impl Headless {
 
     fn pointer(&mut self, p: &Value) -> Result<Value, String> {
         let events = p.get("events").and_then(Value::as_array).ok_or("missing `events`")?;
-        let base: Mods = p.get("mods").and_then(|m| serde_json::from_value(m.clone()).ok()).unwrap_or_default();
+        let base = packet_mods(p)?.unwrap_or_default();
         let default = PointerEvent::json_backquote(p, false)?;
         let held = events.iter().map(|e| PointerEvent::json_backquote(e, default)).collect::<Result<Vec<_>, _>>()?;
+        // Every event is read before any is sent, so a malformed packet sends none of them.
+        let read = events
+            .iter()
+            .zip(held)
+            .map(|(e, backquote)| {
+                let mods = packet_mods(e)?.unwrap_or(base);
+                let kind = s(e, "kind").unwrap_or("");
+                let kind = pointer_kind(kind).ok_or_else(|| format!("unknown pointer kind `{kind}` (down|drag|up|move|doubleclick)"))?;
+                PointerEvent::json_check(e)?;
+                if s(e, "space") == Some("screen") {
+                    return Err("screen-space pointer events need the desktop app; use document coordinates".to_string());
+                }
+                let x = e.get("x").and_then(Value::as_f64).ok_or("pointer event needs numeric `x`")?;
+                let y = e.get("y").and_then(Value::as_f64).ok_or("pointer event needs numeric `y`")?;
+                Ok((e, kind, Point::new(x, y), mods, backquote))
+            })
+            .collect::<Result<Vec<_>, String>>()?;
         self.ensure_document();
         let mut requests = vec![];
-        for (e, backquote) in events.iter().zip(held) {
-            let kind = s(e, "kind").unwrap_or("");
-            let kind = pointer_kind(kind).ok_or_else(|| format!("unknown pointer kind `{kind}` (down|drag|up|move|doubleclick)"))?;
-            if s(e, "space") == Some("screen") {
-                return Err("screen-space pointer events need the desktop app; use document coordinates".into());
-            }
-            let x = e.get("x").and_then(Value::as_f64).ok_or("pointer event needs numeric `x`")?;
-            let y = e.get("y").and_then(Value::as_f64).ok_or("pointer event needs numeric `y`")?;
-            let mods = e.get("mods").and_then(|m| serde_json::from_value(m.clone()).ok()).unwrap_or(base);
-            let ev = PointerEvent {
-                kind,
-                pos: Point::new(x, y),
-                mods,
-                backquote,
-                pressure: PointerEvent::json_pressure(e),
-                pen: PointerEvent::json_pen(e),
-            };
+        for (e, kind, pos, mods, backquote) in read {
+            let ev = PointerEvent { kind, pos, mods, backquote, pressure: PointerEvent::json_pressure(e), pen: PointerEvent::json_pen(e) };
             let reqs = self.session.pointer(&ev, self.view).map_err(|e| e.to_string())?;
             self.apply_ui_requests(reqs, &mut requests)?;
             // With no frames to show the highlight or apply an edit in later, each event waits for
@@ -253,8 +273,8 @@ impl Headless {
 
     fn key(&mut self, p: &Value) -> Result<Value, String> {
         let key = s(p, "key").ok_or("missing `key`")?;
-        let b = |n: &str| p.get(n).and_then(Value::as_bool).unwrap_or(false);
-        let mods = Mods { shift: b("shift"), alt: b("alt"), cmd: b("cmd"), ctrl: b("ctrl"), ..Mods::default() };
+        let b = |n: &str| opt_bool(p, n).map(|on| on.unwrap_or(false));
+        let mods = Mods { shift: b("shift")?, alt: b("alt")?, cmd: b("cmd")?, ctrl: b("ctrl")?, ..Mods::default() };
         // A letter reaches the tool only when the tool claims it without Cmd, Ctrl or Alt (E while
         // a selection marquee is dragged); otherwise it is a shortcut.
         let mut tk = tool_key(key);
@@ -296,16 +316,18 @@ impl Headless {
     }
 
     fn render(&mut self, p: &Value) -> Result<Value, String> {
+        let idx = opt(p, "artboard", |v| v.as_u64().and_then(|i| usize::try_from(i).ok()), "a whole number of 0 or more")?.unwrap_or(0);
+        let scale = opt(p, "scale", Value::as_f64, "a number")?.unwrap_or(1.0).clamp(0.01, 16.0);
+        let trace_views = opt_bool(p, "traceViews")? == Some(true);
+        let data = opt_bool(p, "data")? == Some(true);
         let st = self.session.active().ok_or("no document")?;
         let doc = st.doc.clone();
-        let idx = p.get("artboard").and_then(Value::as_u64).unwrap_or(0) as usize;
         let r = doc.artboards.get(idx).map(|a| a.rect).ok_or("no such artboard")?;
-        let scale = p.get("scale").and_then(Value::as_f64).unwrap_or(1.0).clamp(0.01, 16.0);
         vectorcraft_render::raster_size(r, scale)?;
         // Rendered with the options of a PNG export on white, so its pixels are the exported file's.
         // `traceViews: true` draws Image Trace objects as their View shows them, as the canvas does.
         let mut opts = RasterExportOptions { background: Some([255; 3]), ..Default::default() }.render_options(RasterFormat::Png);
-        opts.trace_views = p.get("traceViews").and_then(Value::as_bool) == Some(true);
+        opts.trace_views = trace_views;
         let img = self.renderer.render_region_with(&doc, r, scale, &opts);
         // A cancelled render stops drawing: the picture is not whole and is not written.
         vectorcraft_engine::cancel::check().map_err(|e| e.to_string())?;
@@ -317,7 +339,7 @@ impl Headless {
                 vectorcraft_format::write_atomic(std::path::Path::new(path), &png).map_err(|e| format!("write {path}: {e}"))?;
                 out["path"] = json!(path);
                 // `data: true` asks for the image as well as the file.
-                if p.get("data").and_then(Value::as_bool) == Some(true) {
+                if data {
                     out["pngBase64"] = json!(vectorcraft_format::base64_encode(&png));
                 }
             }
diff --git a/crates/mcp/src/tests.rs b/crates/mcp/src/tests.rs
index a10de68499..ffb6fcb93e 100644
--- a/crates/mcp/src/tests.rs
+++ b/crates/mcp/src/tests.rs
@@ -1452,6 +1452,44 @@ fn headless_backend_methods() {
     assert!(h.call("ui.resize", json!({})).is_err());
 }
 
+/// The headless key, pointer and screenshot calls refuse a value of the wrong type and change
+/// nothing; omitting it or giving null keeps its default.
+#[test]
+fn headless_methods_refuse_params_of_the_wrong_type() {
+    let mut h = Headless::new();
+    h.call("engine.execute", json!({"command": "file.new", "params": {"width": 300, "height": 200}})).unwrap();
+    h.call("ui.tool.select", json!({"tool": "rectangle"})).unwrap();
+    let before = h.call("document.json", json!({})).unwrap();
+    let drag = |mods: Value| json!({"events": [{"kind": "down", "x": 10, "y": 10}, {"kind": "drag", "x": 60, "y": 60, "mods": mods}, {"kind": "up", "x": 60, "y": 60}]});
+    let after_rect = |last: Value| json!({"events": [{"kind": "down", "x": 10, "y": 10}, {"kind": "drag", "x": 60, "y": 60}, {"kind": "up", "x": 60, "y": 60}, last]});
+    for (method, params, key) in [
+        ("ui.render", json!({"artboard": "0"}), "artboard"),
+        ("ui.render", json!({"scale": "2"}), "scale"),
+        ("ui.render", json!({"traceViews": 1}), "traceViews"),
+        ("ui.screenshot", json!({"data": "yes", "path": "x.png"}), "data"),
+        ("ui.key", json!({"key": "Delete", "shift": "true"}), "shift"),
+        ("ui.pointer", drag(json!({"shift": "yes"})), "mods"),
+        ("ui.pointer", json!({"mods": 1, "events": []}), "mods"),
+        ("ui.pointer", drag(json!([true])), "mods"),
+        // A whole rectangle comes before the malformed event, and none of it is drawn.
+        ("ui.pointer", after_rect(json!({"kind": "move", "x": "bad", "y": 0})), "x"),
+        ("ui.pointer", after_rect(json!({"kind": "wiggle", "x": 0, "y": 0})), "wiggle"),
+        ("ui.pointer", after_rect(json!({"kind": "move", "x": 1, "y": 1, "pressure": "bad"})), "pressure"),
+        ("ui.pointer", after_rect(json!({"kind": "move", "x": 1, "y": 1, "holdMs": true})), "holdMs"),
+        ("ui.pointer", after_rect(json!({"kind": "move", "x": 1, "y": 1, "tiltX": "5"})), "tiltX"),
+        ("ui.pointer", after_rect(json!({"kind": "move", "x": 1, "y": 1, "rotation": [0]})), "rotation"),
+        ("ui.pointer", after_rect(json!({"kind": "move", "x": 1, "y": 1, "space": "screeen"})), "space"),
+    ] {
+        let e = h.call(method, params.clone()).unwrap_err();
+        assert!(e.contains(&format!("`{key}`")), "{method} {params}: {e}");
+    }
+    assert_eq!(h.call("document.json", json!({})).unwrap(), before, "a refused call changes nothing");
+    let r = h.call("ui.render", json!({"artboard": null, "scale": null, "traceViews": null})).unwrap();
+    assert_eq!((r["width"].as_u64(), r["height"].as_u64()), (Some(300), Some(200)));
+    h.call("ui.pointer", drag(Value::Null)).unwrap();
+    assert_ne!(h.call("document.json", json!({})).unwrap(), before, "null mods keep the packet's");
+}
+
 // ---------- workflow tools ----------
 
 fn id_of(result: &Value) -> u64 {
diff --git a/crates/mcp/src/tools/definitions.rs b/crates/mcp/src/tools/definitions.rs
index 783f3c0030..d4d69c945f 100644
--- a/crates/mcp/src/tools/definitions.rs
+++ b/crates/mcp/src/tools/definitions.rs
@@ -259,7 +259,7 @@ pub fn tool_definitions() -> Vec<Value> {
                     "radius1": num("Star outer radius"),
                     "radius2": num("Star inner radius"),
                     "points": {"type": "integer", "minimum": 3, "description": "Star points (default 5)"},
-                    "rotation": num("Rotation in degrees clockwise (polygon/star; 0: a corner or point straight up)"),
+                    "rotation": num("Rotation in degrees clockwise about the centre (rectangle/ellipse: 0 upright; polygon/star: 0 a corner or point straight up)"),
                     "x1": num("Line start x"),
                     "y1": num("Line start y"),
                     "x2": num("Line end x"),
diff --git a/crates/mcp/src/ui_catalog.rs b/crates/mcp/src/ui_catalog.rs
index ee7a5f0ced..c493c36a19 100644
--- a/crates/mcp/src/ui_catalog.rs
+++ b/crates/mcp/src/ui_catalog.rs
@@ -1529,7 +1529,7 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
         "ui.installPlugin",
         "Install Plug-in…",
         "",
-        "{path?: a .wasm file | dataBase64?: the module, name?: the file name shown as its source (with dataBase64), replace?: bool (true: the user agreed it takes the place of the plug-in with its id, as plugin.install), hash?: the module's SHA-256 (as plugin.install)} install a WebAssembly plug-in (plugin.install); without a path pick one (the web opens the browser's file picker; File › Open of a .wasm installs it too). A plug-in that lists permissions the user hasn't granted it asks the user first, showing its name, id, version, file SHA-256 and what each permission lets it do, so does a filter that asks for a heavy budget, and so does one without replace that would take the place of another module with its id and get its settings and cache (needsReplace in plugin.inspect), showing its id and file SHA-256: OK installs it if the file still has the SHA-256 shown, Cancel installs nothing. Only a person can press OK when it asks about permissions or a heavy budget: ui.dialog.confirm, answer_dialog and synthetic input are refused → plugin.install's result | {pending: \"pluginInstall\"} while it asks about permissions or a heavy budget | {pending: \"confirm\"} while it asks only about replacing",
+        "{path?: a .wasm file | dataBase64?: the module, name?: the file name shown as its source (with dataBase64), replace?: bool (true: the user agreed it takes the place of the plug-in with its id, as plugin.install), hash?: the module's SHA-256 (as plugin.install)} install a WebAssembly plug-in (plugin.install); without a path pick one (the web opens the browser's file picker; File › Open of a .wasm installs it too). A plug-in that lists permissions the user hasn't granted it asks the user first, showing its name, id, version, file SHA-256 and what each permission lets it do, so does a filter that asks for a heavy budget, and so does one without replace that would take the place of another module with its id and get its settings and cache (needsReplace in plugin.inspect), showing its id and file SHA-256: OK installs it if the file still has the SHA-256 shown, Cancel installs nothing. Only a person can press OK: ui.dialog.confirm, answer_dialog and synthetic input are refused. When automation asked (a control or MCP request, synthetic input, or a file dialog one of them opened, even when the person picked the file), replace: true doesn't skip the question about replacing, and nothing in the dialog installs it, the person's OK included: the person chooses Object › Plug-ins › Install Plug-in… to install it → plugin.install's result | {pending: \"pluginInstall\"} while it asks | {pending: \"pluginInstall\", approval: \"personMustStartInstall\"} while it asks what automation asked | null on the web without path or dataBase64, once the browser's file picker opens (the picked file is handled as above)",
     ),
     (
         "plugin.cancelRuns",
diff --git a/crates/pdf/src/pdfx.rs b/crates/pdf/src/pdfx.rs
index 116d1cf0c7..e367221d59 100644
--- a/crates/pdf/src/pdfx.rs
+++ b/crates/pdf/src/pdfx.rs
@@ -211,23 +211,46 @@ pub(crate) fn verify(pdf: &[u8], standard: Standard) -> Result<(), PdfError> {
     Ok(())
 }
 
-/// `pdf` without its streams' data (dictionaries and the rest of the syntax), so that what is
-/// looked for there isn't found in image or font bytes.
+/// `pdf` without its streams' data, the text of its literal strings and its comments (dictionaries
+/// and the rest of the syntax), so that what is looked for there isn't found in image or font
+/// bytes, or in a string such as the file identifier, whose base64 hash can hold `/BM`.
 fn without_streams(pdf: &[u8]) -> Vec<u8> {
     let mut out = Vec::with_capacity(pdf.len().min(1 << 20));
     let mut at = 0;
-    while let Some(s) = find(pdf, b"stream", at) {
-        let data = s + b"stream".len();
-        // `endstream` itself, or a stream keyword that isn't one (inside a name or string).
-        if (s >= 3 && pdf.get(s - 3..s) == Some(b"end")) || !pdf.get(data).is_some_and(|b| matches!(b, b'\r' | b'\n')) {
-            out.extend_from_slice(pdf.get(at..data).unwrap_or_default());
-            at = data;
-            continue;
+    while let Some(&b) = pdf.get(at) {
+        match b {
+            // A literal string: parentheses nest, and a backslash escapes the next byte.
+            b'(' => {
+                out.extend_from_slice(b"()");
+                let mut depth = 0usize;
+                at += 1;
+                while let Some(&c) = pdf.get(at) {
+                    at += 1;
+                    match c {
+                        b'\\' => at += 1,
+                        b'(' => depth += 1,
+                        b')' if depth == 0 => break,
+                        b')' => depth -= 1,
+                        _ => {}
+                    }
+                }
+            }
+            // A comment, to the end of its line.
+            b'%' => at += pdf.get(at..).unwrap_or_default().iter().take_while(|c| !matches!(c, b'\r' | b'\n')).count(),
+            // A stream keyword (not `endstream`, and followed by its end of line): its data is left out.
+            b's' if pdf.get(at..at + 6) == Some(b"stream")
+                && !(at >= 3 && pdf.get(at - 3..at) == Some(b"end"))
+                && pdf.get(at + 6).is_some_and(|c| matches!(c, b'\r' | b'\n')) =>
+            {
+                out.extend_from_slice(b"stream");
+                at = find(pdf, b"endstream", at + 6).unwrap_or(pdf.len());
+            }
+            _ => {
+                out.push(b);
+                at += 1;
+            }
         }
-        out.extend_from_slice(pdf.get(at..data).unwrap_or_default());
-        at = find(pdf, b"endstream", data).unwrap_or(pdf.len());
     }
-    out.extend_from_slice(pdf.get(at..).unwrap_or_default());
     out
 }
 
diff --git a/crates/pdf/src/tests/pdfx.rs b/crates/pdf/src/tests/pdfx.rs
index dbc221e0dd..ec22eb0186 100644
--- a/crates/pdf/src/tests/pdfx.rs
+++ b/crates/pdf/src/tests/pdfx.rs
@@ -224,3 +224,23 @@ fn verify_finds_what_each_standard_forbids() {
     assert!(matches!(verify(&file(font), Standard::PdfX4), Err(PdfError::Unsupported(m)) if m.contains("fonts")));
     assert!(verify(&file("<</Type/FontDescriptor/FontFile2 4 0 R>>"), Standard::PdfX4).is_ok());
 }
+
+/// Names inside a string or a comment are text, not syntax: a file identifier, whose base64 hash
+/// can hold `/BM` or `/Lab`, does not make a file break its standard.
+#[test]
+fn verify_skips_names_in_strings_and_comments() {
+    use crate::pdfx::verify;
+    let file = |body: &str| format!("%PDF-1.3\n%/BM/Multiply\n1 0 obj\n{body}\nendobj\n").into_bytes();
+    for ok in [
+        "<</Size 2/ID[(q/BM+Zt1kR0x/Lab=) (q/BM+Zt1kR0x/Lab=)]>>",
+        "<</Title(a\\)/SMask 5 0 R)/Subject(a(b)/ca 0.5)>>",
+        "<</Title(stream\n/BM/Multiply\nendstream)>>",
+    ] {
+        for standard in [Standard::PdfX1a, Standard::PdfX3] {
+            assert!(verify(&file(ok), standard).is_ok(), "{standard:?}: {ok}");
+        }
+    }
+    // A name after a string is still read.
+    let after = "<</Title(a(b)c)/BM/Multiply>>";
+    assert!(matches!(verify(&file(after), Standard::PdfX3), Err(PdfError::Unsupported(m)) if m.contains("blend modes")));
+}
diff --git a/crates/plugins/src/manifest.rs b/crates/plugins/src/manifest.rs
index a16bd8a4f9..b6e17e3ad0 100644
--- a/crates/plugins/src/manifest.rs
+++ b/crates/plugins/src/manifest.rs
@@ -736,10 +736,41 @@ fn input_names<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Result<Ve
 /// Reads the `commands` list one entry at a time from the manifest itself, so each command's
 /// `params` keep their declaration order and a repeated parameter is refused. A malformed entry
 /// is an error that names it (its id when the id comes before the fault, otherwise its place in
-/// the list), and a list is refused at its first entry past [`MAX_COMMANDS`].
+/// the list), and a list is refused at its first entry past [`MAX_COMMANDS`]. A `commands` value,
+/// an entry, an `id` or a `label` of the wrong type gets a fixed message of this function's own.
 fn ordered_commands<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Result<Vec<Command>, D::Error> {
     use serde::de::{Error as _, IgnoredAny, MapAccess, SeqAccess, Visitor};
 
+    /// A visitor's methods for a boolean, a number and a string: each is the error its type's
+    /// `wrong()` gives.
+    macro_rules! refuse_scalars {
+        () => {
+            fn visit_bool<E: serde::de::Error>(self, _: bool) -> std::result::Result<Self::Value, E> {
+                Err(E::custom(self.wrong()))
+            }
+            fn visit_i64<E: serde::de::Error>(self, _: i64) -> std::result::Result<Self::Value, E> {
+                Err(E::custom(self.wrong()))
+            }
+            fn visit_u64<E: serde::de::Error>(self, _: u64) -> std::result::Result<Self::Value, E> {
+                Err(E::custom(self.wrong()))
+            }
+            fn visit_f64<E: serde::de::Error>(self, _: f64) -> std::result::Result<Self::Value, E> {
+                Err(E::custom(self.wrong()))
+            }
+            fn visit_str<E: serde::de::Error>(self, _: &str) -> std::result::Result<Self::Value, E> {
+                Err(E::custom(self.wrong()))
+            }
+        };
+    }
+
+    /// A string field of an entry: anything else is the error "`{key}` must be a string".
+    fn string_field<'de, A: MapAccess<'de>>(map: &mut A, key: &str) -> std::result::Result<std::result::Result<String, String>, A::Error> {
+        Ok(match map.next_value::<Value>()? {
+            Value::String(s) => Ok(s),
+            _ => Err(format!("`{key}` must be a string")),
+        })
+    }
+
     /// A command's `params`, read in declaration order.
     struct Params(Vec<(String, Param)>);
     impl<'de> Deserialize<'de> for Params {
@@ -750,6 +781,11 @@ fn ordered_commands<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Resu
 
     /// The entry at place `.0` in the list.
     struct Entry(usize);
+    impl Entry {
+        fn wrong(&self) -> String {
+            format!("command {} must be an object with an `id` and a `label`", command_name(self.0, ""))
+        }
+    }
     impl<'de> serde::de::DeserializeSeed<'de> for Entry {
         type Value = Command;
         fn deserialize<D: serde::Deserializer<'de>>(self, d: D) -> std::result::Result<Command, D::Error> {
@@ -759,21 +795,29 @@ fn ordered_commands<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Resu
     impl<'de> Visitor<'de> for Entry {
         type Value = Command;
         fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
-            write!(f, "command [{}] as {{id, label, params?}}", self.0)
+            f.write_str(&self.wrong())
+        }
+        refuse_scalars!();
+        fn visit_unit<E: serde::de::Error>(self) -> std::result::Result<Command, E> {
+            Err(E::custom(self.wrong()))
+        }
+        fn visit_seq<A: SeqAccess<'de>>(self, _: A) -> std::result::Result<Command, A::Error> {
+            Err(A::Error::custom(self.wrong()))
         }
         fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> std::result::Result<Command, A::Error> {
             let (mut id, mut label, mut params) = (None::<String>, None::<String>, None::<Params>);
             let named = |id: &Option<String>, e: &dyn std::fmt::Display| {
                 A::Error::custom(format!("command {}: {e}", command_name(self.0, id.as_deref().unwrap_or_default())))
             };
-            while let Some(key) = map.next_key::<String>().map_err(|e| named(&id, &e))? {
+            // A key and an ignored value can only fail as JSON syntax, which keeps serde's own error.
+            while let Some(key) = map.next_key::<String>()? {
                 let repeated = match key.as_str() {
                     "id" if id.is_none() => {
-                        id = Some(map.next_value().map_err(|e| named(&id, &e))?);
+                        id = Some(string_field(&mut map, "id")?.map_err(|e| named(&id, &e))?);
                         false
                     }
                     "label" if label.is_none() => {
-                        label = Some(map.next_value().map_err(|e| named(&id, &e))?);
+                        label = Some(string_field(&mut map, "label")?.map_err(|e| named(&id, &e))?);
                         false
                     }
                     "params" if params.is_none() => {
@@ -782,7 +826,7 @@ fn ordered_commands<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Resu
                     }
                     "id" | "label" | "params" => true,
                     _ => {
-                        map.next_value::<IgnoredAny>().map_err(|e| named(&id, &e))?;
+                        map.next_value::<IgnoredAny>()?;
                         false
                     }
                 };
@@ -801,16 +845,22 @@ fn ordered_commands<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Resu
     }
 
     struct List;
+    impl List {
+        fn wrong(&self) -> &'static str {
+            "`commands` must be a list of commands, each with an `id` and a `label`"
+        }
+    }
     impl<'de> Visitor<'de> for List {
         type Value = Vec<Command>;
         fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
-            f.write_str("`commands` as a list of {id, label, params?}")
+            f.write_str(self.wrong())
         }
+        refuse_scalars!();
         fn visit_unit<E: serde::de::Error>(self) -> std::result::Result<Self::Value, E> {
             Ok(Vec::new())
         }
         fn visit_map<A: MapAccess<'de>>(self, _: A) -> std::result::Result<Self::Value, A::Error> {
-            Err(A::Error::custom("`commands` must be a list of {id, label, params?}"))
+            Err(A::Error::custom(self.wrong()))
         }
         fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> std::result::Result<Self::Value, A::Error> {
             let mut out = Vec::new();
@@ -1215,14 +1265,27 @@ mod tests {
                 r#"{"id":"a","name":"x","kind":"filter","commands":[{"id":"x","label":"A","params":{"r":{"type":"bool"},"r":{"type":"int"}}}]}"#,
                 "command `x`: parameter `r` is declared twice",
             ),
-            (r#"{"id":"a","name":"x","kind":"filter","commands":[1]}"#, "command [0]"),
-            (r#"{"id":"a","name":"x","kind":"filter","commands":{"id":"x"}}"#, "must be a list"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":[1]}"#, "command [0] must be an object with an `id` and a `label`"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":[{"id":"x","label":"A"},null]}"#, "command [1] must be an object"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":[["x"]]}"#, "command [0] must be an object"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":[{"id":1,"label":"A"}]}"#, "command [0]: `id` must be a string"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":[{"id":"x","label":true}]}"#, "command `x`: `label` must be a string"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":[{"id":"x","id":"y","label":"A"}]}"#, "command `x`: duplicate field `id`"),
+            (
+                r#"{"id":"a","name":"x","kind":"filter","commands":{"id":"x"}}"#,
+                "`commands` must be a list of commands, each with an `id` and a `label`",
+            ),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":"x"}"#, "`commands` must be a list of commands"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":7}"#, "`commands` must be a list of commands"),
+            (r#"{"id":"a","name":"x","kind":"filter","commands":true}"#, "`commands` must be a list of commands"),
             (r#"{"id":"a","name":"x","kind":"exporter","extensions":["plt"],"commands":[{"id":"x","label":"A"}]}"#, "only a filter or a live effect"),
             (r#"{"id":"a","name":"x","kind":"filter","budget":"heavy","commands":[{"id":"x","label":"A"}]}"#, "heavy filter"),
             (too_many.as_str(), "at most 32 `commands`"),
         ] {
             let e = Manifest::parse(bad.as_bytes()).unwrap_err().to_string();
             assert!(e.contains(says), "{bad}: {e}");
+            // The message is the manifest reader's own, with serde's place in the manifest once.
+            assert!(!e.contains("invalid type") && !e.contains("expected") && e.matches(" at line ").count() <= 1, "{bad}: {e}");
         }
         let long_id = format!(r#"{{"id":"a","name":"x","kind":"filter","commands":[{{"id":"{}","label":"A"}}]}}"#, "c".repeat(MAX_COMMAND_ID + 1));
         assert!(Manifest::parse(long_id.as_bytes()).is_err());
diff --git a/crates/tools/src/input.rs b/crates/tools/src/input.rs
index ece5231bd2..9b53d2404c 100644
--- a/crates/tools/src/input.rs
+++ b/crates/tools/src/input.rs
@@ -109,6 +109,19 @@ impl PointerEvent {
     pub fn json_backquote(v: &Value, default: bool) -> Result<bool, String> {
         v.get("backquote").map_or(Ok(default), |b| b.as_bool().ok_or_else(|| "`backquote` must be a boolean".to_owned()))
     }
+    /// Checks the optional keys of a JSON pointer event (control channel, MCP): `pressure`,
+    /// `holdMs`, `tiltX`, `tiltY` and `rotation` must be numbers, and `space` must be `doc` or
+    /// `screen`. A key that is absent or null keeps its default.
+    pub fn json_check(e: &Value) -> Result<(), String> {
+        let given = |k: &str| e.get(k).filter(|v| !v.is_null());
+        if let Some(k) = ["pressure", "holdMs", "tiltX", "tiltY", "rotation"].into_iter().find(|k| given(k).is_some_and(|v| v.as_f64().is_none())) {
+            return Err(format!("`{k}` must be a number"));
+        }
+        if given("space").is_some_and(|v| !matches!(v.as_str(), Some("doc" | "screen"))) {
+            return Err("`space` must be doc or screen".to_owned());
+        }
+        Ok(())
+    }
 }
 
 #[cfg(test)]
@@ -135,6 +148,27 @@ mod tests {
             assert!(PointerEvent::json_backquote(&json!({"backquote": bad}), false).is_err(), "{bad}");
         }
     }
+
+    #[test]
+    fn json_check_refuses_pen_values_and_spaces_of_the_wrong_type() {
+        use serde_json::json;
+        for ok in [
+            json!({}),
+            json!({"pressure": 0.5, "holdMs": 10, "tiltX": -5, "tiltY": 5, "rotation": 400, "space": "screen"}),
+            json!({"pressure": null, "space": null}),
+            json!({"space": "doc"}),
+        ] {
+            assert_eq!(PointerEvent::json_check(&ok), Ok(()), "{ok}");
+        }
+        for k in ["pressure", "holdMs", "tiltX", "tiltY", "rotation"] {
+            for bad in [json!("1"), json!(true), json!([1])] {
+                assert_eq!(PointerEvent::json_check(&json!({k: bad})), Err(format!("`{k}` must be a number")), "{k}: {bad}");
+            }
+        }
+        for bad in [json!("screeen"), json!(true), json!(1)] {
+            assert_eq!(PointerEvent::json_check(&json!({"space": bad})), Err("`space` must be doc or screen".to_owned()), "{bad}");
+        }
+    }
 }
 
 /// Keys tools care about.
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index 8674942538..3bb451bfd6 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -1,4 +1,5 @@
 use super::{VectorcraftApp, io, place};
+use crate::services::Inbox;
 
 impl VectorcraftApp {
     /// A file dialog is open off the UI thread (a sheet on macOS, [`picks`]): what asked for it runs
@@ -13,13 +14,25 @@ impl VectorcraftApp {
         self.services.dialogs_are_sheets && self.file_dialog_open()
     }
 
-    pub(super) fn drain_inbox(&mut self) {
-        let arrived: Vec<(String, Vec<u8>)> =
-            self.services.inbox.as_ref().map(|q| std::mem::take(&mut *q.lock().unwrap_or_else(|e| e.into_inner()))).unwrap_or_default();
-        for (name, bytes) in arrived {
-            if let Err(e) = io::open_bytes(self, &name, &bytes, None) {
-                io::report_open_error(self, &name, &e);
-            }
+    pub(crate) fn drain_inbox(&mut self) {
+        fn take(q: Option<&Inbox>) -> Vec<(String, Vec<u8>)> {
+            q.map(|q| std::mem::take(&mut *q.lock().unwrap_or_else(|e| e.into_inner()))).unwrap_or_default()
+        }
+        let answers = self.services.picked_inbox.as_ref().map(|q| std::mem::take(&mut *q.lock().unwrap_or_else(|e| e.into_inner())));
+        // The web's file picker answers for automation when automation opened it; the page's script
+        // is automation.
+        let mut arrived: Vec<_> = take(self.services.inbox.as_ref()).into_iter().map(|f| (f, false)).collect();
+        for answer in answers.unwrap_or_default() {
+            let automated = self.picks.answer_web_open();
+            arrived.extend(answer.map(|f| (f, automated)));
+        }
+        arrived.extend(take(self.services.page_inbox.as_ref()).into_iter().map(|f| (f, true)));
+        for ((name, bytes), automated) in arrived {
+            crate::picks::as_automated(self, automated, |app| {
+                if let Err(e) = io::open_bytes(app, &name, &bytes, None) {
+                    io::report_open_error(app, &name, &e);
+                }
+            });
         }
         place::drain(self);
     }
diff --git a/crates/ui-egui/src/app/links.rs b/crates/ui-egui/src/app/links.rs
index 8f4ce246f5..b27bb494aa 100644
--- a/crates/ui-egui/src/app/links.rs
+++ b/crates/ui-egui/src/app/links.rs
@@ -36,6 +36,13 @@ impl VectorcraftApp {
         self.ui.answering_control || self.synthetic_frame
     }
 
+    /// Did automation ask for what is being handled now: [`Self::automation_is_acting`], or the
+    /// answer of a file dialog that automation opened ([`crate::picks::as_automated`]), even when a
+    /// person picked the file in it?
+    pub(crate) fn automation_asked(&self) -> bool {
+        self.automation_is_acting() || self.picks.automated()
+    }
+
     /// Run a Help link command and open the URL it returns.
     pub fn open_link(&mut self, id: &str) {
         if let Ok(v) = self.run(id, serde_json::json!({}))
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 5199230202..11edb6de6e 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -474,9 +474,24 @@ fn key_from(name: &str) -> Option<egui::Key> {
 
 /// The modifier keys a request holds down (`cmd`, `ctrl`, `alt`, `shift`; `cmd` is Command on
 /// macOS, Ctrl elsewhere).
-fn modifiers(p: &Value) -> egui::Modifiers {
-    let b = |n: &str| p.get(n).and_then(Value::as_bool).unwrap_or(false);
-    egui::Modifiers { alt: b("alt"), ctrl: b("ctrl"), shift: b("shift"), mac_cmd: b("cmd") && cfg!(target_os = "macos"), command: b("cmd") }
+fn modifiers(p: &Value) -> Result<egui::Modifiers, String> {
+    let b = |n: &str| crate::menus::opt_bool(p, n).map(|on| on.unwrap_or(false));
+    let cmd = b("cmd")?;
+    Ok(egui::Modifiers { alt: b("alt")?, ctrl: b("ctrl")?, shift: b("shift")?, mac_cmd: cmd && cfg!(target_os = "macos"), command: cmd })
+}
+
+/// An optional number param of a control request as `f32`, `default` when it is omitted or null.
+fn coord(p: &Value, key: &str, default: f32) -> Result<f32, String> {
+    crate::menus::opt_number(p, key).map(|n| n.map_or(default, |n| n as f32))
+}
+
+/// A pointer packet's `mods`: none when omitted or null, else an object of booleans.
+fn packet_mods(value: Option<&Value>) -> Result<Option<Mods>, String> {
+    match value {
+        None | Some(Value::Null) => Ok(None),
+        Some(m) if !m.is_object() => Err("`mods` must be an object of true or false values".to_string()),
+        Some(m) => serde_json::from_value(m.clone()).map(Some).map_err(|e| format!("`mods` must be an object of true or false values: {e}")),
+    }
 }
 
 pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlRequest) -> Outcome {
@@ -512,10 +527,13 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
         "ui.pointer" => pointer_events(app, ctx, req),
         "ui.key" => {
             let Some(k) = s("key").and_then(key_from) else { return err("unknown or missing `key`") };
+            let m = match modifiers(p) {
+                Ok(m) => m,
+                Err(e) => return err(e),
+            };
             if let Err(e) = reserve_synthetic(app, 2 + usize::from(s("text").is_some())) {
                 return err(e);
             }
-            let m = modifiers(p);
             app.synthetic.push(egui::Event::Key { key: k, physical_key: None, pressed: true, repeat: false, modifiers: m });
             // Typed text comes with the press, so it shares the key's frame and modifiers.
             if let Some(t) = s("text") {
@@ -526,31 +544,39 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
             ok(Value::Null)
         }
         "ui.move" => {
+            let pos = match coord(p, "x", 0.0).and_then(|x| Ok(egui::pos2(x, coord(p, "y", 0.0)?))) {
+                Ok(pos) => pos,
+                Err(e) => return err(e),
+            };
             if let Err(e) = reserve_synthetic(app, 1) {
                 return err(e);
             }
-            let pos = egui::pos2(p.get("x").and_then(Value::as_f64).unwrap_or(0.0) as f32, p.get("y").and_then(Value::as_f64).unwrap_or(0.0) as f32);
             app.synthetic.push(egui::Event::PointerMoved(pos));
             ctx.request_repaint();
             ok(Value::Null)
         }
         "ui.click" | "ui.drag" => synthetic_click(app, ctx, req),
         "ui.wheel" => {
+            // Mouse wheel notches over screen point (x, y): `dy` up (+) or down, `dx` sideways
+            // (`unit: "point"` for trackpad-like points), with modifiers as `ui.click` takes them.
+            let given =
+                (|| Ok::<_, String>(([coord(p, "dx", 0.0)?, coord(p, "dy", 0.0)?, coord(p, "x", 0.0)?, coord(p, "y", 0.0)?], modifiers(p)?)))();
+            let ([dx, dy, x, y], modifiers) = match given {
+                Ok(given) => given,
+                Err(e) => return err(e),
+            };
             if let Err(e) = reserve_synthetic(app, 2) {
                 return err(e);
             }
-            // Mouse wheel notches over screen point (x, y): `dy` up (+) or down, `dx` sideways
-            // (`unit: "point"` for trackpad-like points), with modifiers as `ui.click` takes them.
-            let f = |k: &str| p.get(k).and_then(Value::as_f64).unwrap_or(0.0) as f32;
             let unit = if s("unit") == Some("point") { egui::MouseWheelUnit::Point } else { egui::MouseWheelUnit::Line };
             // Notches, not a flood: a turn stays within what a real wheel sends.
-            let delta = egui::vec2(f("dx"), f("dy")).clamp(egui::Vec2::splat(-100.0), egui::Vec2::splat(100.0));
-            app.synthetic.push(egui::Event::PointerMoved(egui::pos2(f("x"), f("y"))));
+            let delta = egui::vec2(dx, dy).clamp(egui::Vec2::splat(-100.0), egui::Vec2::splat(100.0));
+            app.synthetic.push(egui::Event::PointerMoved(egui::pos2(x, y)));
             app.synthetic.push(egui::Event::MouseWheel {
                 unit,
                 delta,
                 phase: egui::TouchPhase::Move,
-                modifiers: modifiers(p),
+                modifiers,
                 source: egui::MouseWheelSource::Unknown,
             });
             ctx.request_repaint();
@@ -615,8 +641,10 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
             ok(Value::Null)
         }
         "ui.resize" => {
-            let w = p.get("width").and_then(Value::as_f64).unwrap_or(1440.0) as f32;
-            let h = p.get("height").and_then(Value::as_f64).unwrap_or(900.0) as f32;
+            let (w, h) = match coord(p, "width", 1440.0).and_then(|w| Ok((w, coord(p, "height", 900.0)?))) {
+                Ok(size) => size,
+                Err(e) => return err(e),
+            };
             ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(egui::vec2(w, h)));
             ok(Value::Null)
         }
@@ -629,32 +657,48 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlReques
             if let Some(Err(e)) = s("path").map(vectorcraft_engine::file_access::check_write) {
                 return err(e);
             }
-            if p.get("focus").and_then(Value::as_bool).unwrap_or(true) {
+            let flags = crate::menus::opt_bool(p, "focus").and_then(|focus| Ok((focus, crate::menus::opt_bool(p, "data")?)));
+            let (focus, data) = match flags {
+                Ok(flags) => flags,
+                Err(e) => return err(e),
+            };
+            if focus.unwrap_or(true) {
                 ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
             }
             ctx.request_repaint();
-            Outcome::Screenshot { path: s("path").map(str::to_string), data: p.get("data").and_then(Value::as_bool) == Some(true) }
+            Outcome::Screenshot { path: s("path").map(str::to_string), data: data == Some(true) }
         }
         "ui.render" => {
+            let given = (|| {
+                Ok::<_, String>((
+                    crate::menus::opt_index(p, "artboard")?,
+                    crate::menus::opt_number(p, "scale")?,
+                    crate::menus::opt_bool(p, "traceViews")?,
+                    crate::menus::opt_bool(p, "data")?,
+                ))
+            })();
+            let (index, scale, trace_views, data) = match given {
+                Ok(given) => given,
+                Err(e) => return err(e),
+            };
             let Some(st) = app.session.active() else { return err("no document") };
             let doc = st.doc.clone();
             // The artboard asked for (0-based, as headless), else the first.
-            let index = p.get("artboard").and_then(Value::as_u64).map_or(Some(0), |i| usize::try_from(i).ok());
-            let Some(r) = index.and_then(|i| doc.artboards.get(i)).map(|a| a.rect) else { return err("no such artboard") };
-            let scale = p.get("scale").and_then(Value::as_f64).unwrap_or(1.0);
+            let Some(r) = doc.artboards.get(index.unwrap_or(0)).map(|a| a.rect) else { return err("no such artboard") };
+            let scale = scale.unwrap_or(1.0);
             if let Err(e) = vectorcraft_render::raster_size(r, scale) {
                 return err(e);
             }
             // Rendered with the options of a PNG export on white, so its pixels are the exported file's.
             // `traceViews: true` draws Image Trace objects as their View shows them, as the canvas does.
             let mut opts = RasterExportOptions { background: Some([255; 3]), ..Default::default() }.render_options(RasterFormat::Png);
-            opts.trace_views = p.get("traceViews").and_then(Value::as_bool) == Some(true);
+            opts.trace_views = trace_views == Some(true);
             let img = app.canvas.renderer.render_region_with(&doc, r, scale, &opts);
             let png = match img.to_png() {
                 Ok(png) => png,
                 Err(e) => return err(e),
             };
-            let data = p.get("data").and_then(Value::as_bool) == Some(true);
+            let data = data == Some(true);
             match s("path") {
                 Some(path) => match app.services.write.as_mut() {
                     Some(w) => wrap(
@@ -857,7 +901,7 @@ fn rotate_view_pointer(
 
 /// A Rotate View packet accepts only the documented boolean modifier fields.
 fn validate_rotate_view_mods(value: Option<&Value>) -> Result<(), String> {
-    let Some(value) = value else { return Ok(()) };
+    let Some(value) = value.filter(|value| !value.is_null()) else { return Ok(()) };
     let Some(fields) = value.as_object() else { return Err("Rotate View `mods` must be an object of booleans".into()) };
     if fields.iter().any(|(key, value)| !matches!(key.as_str(), "shift" | "alt" | "cmd" | "ctrl" | "space") || !value.is_boolean()) {
         return Err("Rotate View `mods` accepts only boolean shift, alt, cmd, ctrl and space".into());
@@ -906,9 +950,36 @@ fn pointer_events_inner(app: &mut VectorcraftApp, ctx: &egui::Context, req: &Con
     if rotating && let Err(error) = validate_rotate_view_events(p, events) {
         return err(error);
     }
-    let base_mods: Mods = p.get("mods").and_then(|m| serde_json::from_value(m.clone()).ok()).unwrap_or_default();
+    // Every event is read before any is sent, so a malformed packet sends none of them.
+    let read = packet_mods(p.get("mods")).and_then(|base| {
+        let base = base.unwrap_or_default();
+        events
+            .iter()
+            .map(|e| {
+                let kind = match e.get("kind").and_then(Value::as_str).unwrap_or("") {
+                    "down" => PointerKind::Down,
+                    "drag" => PointerKind::Drag,
+                    "up" => PointerKind::Up,
+                    "move" => PointerKind::Move,
+                    "doubleclick" | "dblclick" => PointerKind::DoubleClick,
+                    other => return Err(format!("unknown pointer kind `{other}`")),
+                };
+                PointerEvent::json_check(e)?;
+                let at = |k: &str| crate::menus::opt_number(e, k).map(|n| n.unwrap_or(0.0));
+                Ok((kind, at("x")?, at("y")?, packet_mods(e.get("mods"))?.unwrap_or(base)))
+            })
+            .collect::<Result<Vec<_>, String>>()
+    });
+    let read = match read {
+        Ok(read) => read,
+        Err(e) => return err(e),
+    };
     let view = app.view_info();
     let xf = app.canvas_rect.zip(app.view().copied()).map(|(rect, v)| Xf::new(rect, &v));
+    let screen = |e: &Value| e.get("space").and_then(Value::as_str) == Some("screen");
+    if !rotating && xf.is_none() && events.iter().any(screen) {
+        return err("no canvas yet");
+    }
     let from = app.session.input_count();
     let held =
         PointerEvent::json_backquote(p, false).and_then(|d| events.iter().map(|e| PointerEvent::json_backquote(e, d)).collect::<Result<Vec<_>, _>>());
@@ -916,19 +987,8 @@ fn pointer_events_inner(app: &mut VectorcraftApp, ctx: &egui::Context, req: &Con
         Ok(held) => held,
         Err(e) => return err(e),
     };
-    for (e, backquote) in events.iter().zip(held) {
-        let kind = match e.get("kind").and_then(Value::as_str).unwrap_or("") {
-            "down" => PointerKind::Down,
-            "drag" => PointerKind::Drag,
-            "up" => PointerKind::Up,
-            "move" => PointerKind::Move,
-            "doubleclick" | "dblclick" => PointerKind::DoubleClick,
-            other => return err(format!("unknown pointer kind `{other}`")),
-        };
-        let x = e.get("x").and_then(Value::as_f64).unwrap_or(0.0);
-        let y = e.get("y").and_then(Value::as_f64).unwrap_or(0.0);
-        let screen = e.get("space").and_then(Value::as_str) == Some("screen");
-        let mods = e.get("mods").and_then(|m| serde_json::from_value(m.clone()).ok()).unwrap_or(base_mods);
+    for ((e, backquote), (kind, x, y, mods)) in events.iter().zip(held).zip(read) {
+        let screen = screen(e);
         if rotating {
             if let Err(e) = rotate_view_pointer(app, kind, vectorcraft_geom::Point::new(x, y), screen, mods.shift) {
                 return err(e);
@@ -987,18 +1047,24 @@ fn synthetic_click(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlR
     let Some(events) = count.checked_mul(2).and_then(|n| n.checked_add(steps)).and_then(|n| n.checked_add(1)) else {
         return err("synthetic input event count is out of range");
     };
+    // Screen-space (egui points) pointer input through egui itself: reaches every widget.
+    let drag = req.method == "ui.drag";
+    let given = (|| {
+        let a = egui::pos2(coord(p, "x", 0.0)?, coord(p, "y", 0.0)?);
+        let end = if drag { egui::pos2(coord(p, "toX", 0.0)?, coord(p, "toY", 0.0)?) } else { a };
+        Ok::<_, String>((a, end, modifiers(p)?))
+    })();
+    let (a, end, modifiers) = match given {
+        Ok(given) => given,
+        Err(e) => return err(e),
+    };
     if let Err(e) = reserve_synthetic(app, events) {
         return err(e);
     }
-    // Screen-space (egui points) pointer input through egui itself: reaches every widget.
-    let f = |k: &str| p.get(k).and_then(Value::as_f64).unwrap_or(0.0) as f32;
     let button = match s("button") {
         Some("right") | Some("secondary") => egui::PointerButton::Secondary,
         _ => egui::PointerButton::Primary,
     };
-    let modifiers = modifiers(p);
-    let a = egui::pos2(f("x"), f("y"));
-    let end = if req.method == "ui.drag" { egui::pos2(f("toX"), f("toY")) } else { a };
     app.synthetic.push(egui::Event::PointerMoved(a));
     app.synthetic.push(egui::Event::PointerButton { pos: a, button, pressed: true, modifiers });
     if req.method == "ui.drag" {
@@ -1020,6 +1086,11 @@ fn synthetic_click(app: &mut VectorcraftApp, ctx: &egui::Context, req: &ControlR
 fn set_ui(app: &mut VectorcraftApp, req: &ControlRequest) -> Outcome {
     let p = &req.params;
     let s = |k: &str| p.get(k).and_then(Value::as_str);
+    // A flag of the wrong type is refused before anything is set.
+    let flags = ["rulers", "outline", "grid", "smartGuides", "boundingBox", "controlBar", "imageTracePreview"];
+    if let Some(e) = flags.iter().find_map(|k| crate::menus::opt_bool(p, k).err()) {
+        return err(e);
+    }
     // Outline is a setting of the active document's view: without one, nothing is set.
     if p.get("outline").is_some_and(Value::is_boolean) && app.session.active().is_none() {
         return err("no document");
diff --git a/crates/ui-egui/src/control/tests.rs b/crates/ui-egui/src/control/tests.rs
index 0a9c042a1e..1763fd679a 100644
--- a/crates/ui-egui/src/control/tests.rs
+++ b/crates/ui-egui/src/control/tests.rs
@@ -314,6 +314,93 @@ fn render_takes_the_artboard_asked_for() {
         assert_eq!(got, size.map(Some), "{params}: {r}");
     }
     assert!(request("ui.render", json!({"artboard": 2}))["error"].is_string());
+    for (params, key) in [
+        (json!({"artboard": "1"}), "artboard"),
+        (json!({"artboard": -1}), "artboard"),
+        (json!({"scale": "0.5"}), "scale"),
+        (json!({"traceViews": 1}), "traceViews"),
+        (json!({"data": "yes"}), "data"),
+    ] {
+        let r = request("ui.render", params.clone());
+        assert!(r["error"].as_str().is_some_and(|e| e.contains(&format!("`{key}`"))), "{params}: {r}");
+    }
+    let r = request("ui.render", json!({"artboard": null, "scale": null}));
+    assert_eq!([&r["result"]["width"], &r["result"]["height"]].map(Value::as_u64), [Some(64), Some(64)], "null keeps the default: {r}");
+}
+
+/// The control channel's input methods refuse a number or switch of the wrong type before they
+/// queue any event; omitting it keeps its default.
+#[test]
+fn control_input_refuses_params_of_the_wrong_type() {
+    let move_to = |mods: Value| json!({"events": [{"kind": "move", "x": 5, "y": 5}, {"kind": "move", "x": 6, "y": 6, "mods": mods}]});
+    for (method, params, key) in [
+        ("ui.move", json!({"x": "10"}), "x"),
+        ("ui.move", json!({"y": true}), "y"),
+        ("ui.wheel", json!({"dy": "1"}), "dy"),
+        ("ui.wheel", json!({"dy": 1, "shift": "yes"}), "shift"),
+        ("ui.click", json!({"x": [1]}), "x"),
+        ("ui.click", json!({"cmd": 1}), "cmd"),
+        ("ui.drag", json!({"toX": "5"}), "toX"),
+        ("ui.key", json!({"key": "Enter", "alt": "true"}), "alt"),
+        ("ui.resize", json!({"width": "800"}), "width"),
+        ("ui.screenshot", json!({"focus": "no"}), "focus"),
+        ("ui.screenshot", json!({"data": 1}), "data"),
+        ("ui.set", json!({"rulers": "true"}), "rulers"),
+        ("ui.set", json!({"grid": true, "controlBar": 0}), "controlBar"),
+        ("ui.pointer", json!({"events": [{"kind": "move", "x": "5", "y": 0}]}), "x"),
+        ("ui.pointer", move_to(json!({"shift": "yes"})), "mods"),
+        ("ui.pointer", move_to(json!([true])), "mods"),
+        ("ui.pointer", json!({"mods": "shift", "events": [{"kind": "move", "x": 1, "y": 1}]}), "mods"),
+    ] {
+        let mut app = VectorcraftApp::new(Session::new(), Services::default());
+        app.synthetic.push(egui::Event::Text("pending".into()));
+        let before = (format!("{:?}", app.synthetic), app.ui.view.rulers, app.ui.view.grid, app.ui.control_bar);
+        let r = input_request(&mut app, method, params.clone());
+        assert_eq!(r["ok"], false, "{method} {params}: {r}");
+        assert!(r["error"].as_str().is_some_and(|e| e.contains(&format!("`{key}`"))), "{method} {params}: {r}");
+        let after = (format!("{:?}", app.synthetic), app.ui.view.rulers, app.ui.view.grid, app.ui.control_bar);
+        assert_eq!(after, before, "{method} {params}: nothing is queued or set");
+    }
+    let mut app = VectorcraftApp::new(Session::new(), Services::default());
+    assert_eq!(input_request(&mut app, "ui.move", json!({"x": null, "y": 4}))["ok"], true);
+    assert!(matches!(app.synthetic.first(), Some(egui::Event::PointerMoved(p)) if *p == egui::pos2(0.0, 4.0)));
+}
+
+/// The app's own commands refuse a param of the wrong type and change nothing; omitting it or
+/// giving null keeps its default.
+#[test]
+fn ui_commands_refuse_params_of_the_wrong_type() {
+    let mut app = VectorcraftApp::new(Session::new(), Services::default());
+    app.run("file.new", json!({"width": 200, "height": 200})).unwrap();
+    let id = app.run("shape.rectangle", json!({"x": 10, "y": 10, "width": 40, "height": 40})).unwrap()["id"].as_u64().unwrap();
+    app.run("select.set", json!({"ids": [id]})).unwrap();
+    app.run("view.setZoom", json!({"zoom": 300, "center": [5, 5]})).unwrap();
+    let view = |app: &VectorcraftApp| app.view().map(|v| (v.zoom, v.center.x, v.center.y));
+    let before = (view(&app), app.ui.screen_mode, app.session.documents().len(), app.ui.dialog.is_some(), app.ui.open_panel.clone());
+    for (id, params, key) in [
+        ("view.setZoom", json!({"zoom": "200"}), "zoom"),
+        ("view.setZoom", json!({"zoom": 200, "center": [1]}), "center"),
+        ("view.setZoom", json!({"zoom": 200, "center": "0,0"}), "center"),
+        ("view.screenMode", json!({"mode": "2"}), "mode"),
+        ("view.screenMode", json!({"mode": 1.5}), "mode"),
+        ("window.panel", json!({"panel": "layers", "toggle": "true"}), "toggle"),
+        ("window.panel", json!({"panel": "layers", "toggle": true, "toggleGroup": 1}), "toggleGroup"),
+        ("file.revert", json!({"confirmed": "yes"}), "confirmed"),
+        ("file.close", json!({"index": "0"}), "index"),
+        ("ui.newSwatch", json!({"spot": "true"}), "spot"),
+        ("ui.newSwatch", json!({"global": 1}), "global"),
+        ("ui.symbolOptions", json!({"edit": 1}), "edit"),
+        ("ui.batchDialog", json!({"set": "1"}), "set"),
+        ("ui.batchDialog", json!({"action": -1}), "action"),
+        ("file.exportSelection", json!({"multiple": "true"}), "multiple"),
+    ] {
+        let e = app.run(id, params.clone()).unwrap_err();
+        assert!(e.contains(&format!("`{key}`")), "{id} {params}: {e}");
+        let after = (view(&app), app.ui.screen_mode, app.session.documents().len(), app.ui.dialog.is_some(), app.ui.open_panel.clone());
+        assert_eq!(after, before, "{id} {params}: nothing changes");
+    }
+    app.run("view.setZoom", json!({"zoom": null, "center": null})).unwrap();
+    assert_eq!(app.view().map(|v| v.zoom), Some(crate::state::zoom_from_display_percent(100.0, app.session.prefs.display_print_size)));
 }
 
 #[test]
@@ -370,6 +457,35 @@ fn synthetic_pointer_rejects_a_backquote_that_is_not_a_boolean() {
     }
 }
 
+/// `ui.pointer` refuses an unknown event kind, a pen value or `space` of the wrong type, or a
+/// screen-space event with no canvas, before any of the packet's events runs.
+#[test]
+fn synthetic_pointer_rejects_an_unknown_kind_before_any_event_runs() {
+    let mut app = VectorcraftApp::new(Session::new(), Services::default());
+    app.run("file.new", json!({"width": 400, "height": 400})).unwrap();
+    let id = app.run("shape.rectangle", json!({"x": 100, "y": 100, "width": 50, "height": 50})).unwrap()["id"].as_u64().unwrap();
+    app.run("select.set", json!({"ids": [id]})).unwrap();
+    assert_eq!(input_request(&mut app, "ui.tool.select", json!({"tool": "selection"}))["ok"], true);
+    let before = app.session.doc().unwrap().doc.node(vectorcraft_doc::NodeId(id)).unwrap().clone();
+    let moves = [json!({"kind": "down", "x": 125, "y": 125}), json!({"kind": "drag", "x": 145, "y": 125}), json!({"kind": "up", "x": 145, "y": 125})];
+    for (last, error) in [
+        (json!({"kind": "wiggle", "x": 145, "y": 125}), "unknown pointer kind `wiggle`"),
+        (json!({"kind": "move", "x": 145, "y": 125, "space": "screen"}), "no canvas yet"),
+        (json!({"kind": "move", "x": 145, "y": 125, "pressure": "bad"}), "`pressure` must be a number"),
+        (json!({"kind": "move", "x": 145, "y": 125, "holdMs": "800"}), "`holdMs` must be a number"),
+        (json!({"kind": "move", "x": 145, "y": 125, "tiltY": true}), "`tiltY` must be a number"),
+        (json!({"kind": "move", "x": 145, "y": 125, "rotation": "90"}), "`rotation` must be a number"),
+        (json!({"kind": "move", "x": 145, "y": 125, "space": "screeen"}), "`space` must be doc or screen"),
+        (json!({"kind": "move", "x": 145, "y": 125, "space": true}), "`space` must be doc or screen"),
+    ] {
+        let events = moves.iter().cloned().chain([last]).collect::<Vec<_>>();
+        let r = input_request(&mut app, "ui.pointer", json!({"events": events}));
+        assert_eq!(r["ok"], false, "{error}: {r}");
+        assert!(r["error"].as_str().is_some_and(|e| e.contains(error)), "{r}");
+        assert_eq!(app.session.doc().unwrap().doc.node(vectorcraft_doc::NodeId(id)).unwrap(), &before, "{error}: the drag does not run");
+    }
+}
+
 /// `ui.pointer` replies with the key object: a click on one of two selected objects makes it
 /// the key, and a click on the key again lets it go.
 #[test]
diff --git a/crates/ui-egui/src/dialogs/dxf_options.rs b/crates/ui-egui/src/dialogs/dxf_options.rs
index cc52623931..498d854fe9 100644
--- a/crates/ui-egui/src/dialogs/dxf_options.rs
+++ b/crates/ui-egui/src/dialogs/dxf_options.rs
@@ -1,8 +1,8 @@
 //! DXF Options (Export As → DXF): a preset (Custom, or CNC / CAM, which sets the options below for
 //! cutting software and shows Custom again once one is changed), version, scale (1 unit of the
-//! art = N drawing units) and lineweights, number of colours, the format of placed images,
-//! Preserve Appearance or Maximize Editability, and Export Selected Art Only, Alter Paths for
-//! Appearance and Outline Text.
+//! art = N drawing units) and lineweights, number of colours, the format of placed images and
+//! Include Placed Images, Preserve Appearance or Maximize Editability, and Export Selected Art
+//! Only, Alter Paths for Appearance, Outline Text and Include Fill Hatches.
 //!
 //! Fields: `document.export` params (`format: dxf`, `path?`, the artboard choice) and the DXF
 //! options of `document.exportDxf`. OK remembers the options for next time and writes the file
@@ -58,6 +58,8 @@ fn preset_fields(preset: DxfPreset) -> Map<String, Value> {
         ("scaleLineweights", json!(o.scale_lineweights)),
         ("colors", json!(o.colors.id())),
         ("rasterFormat", json!(o.raster.id())),
+        ("includeImages", json!(o.include_images)),
+        ("includeHatches", json!(o.include_hatches)),
         ("preserve", json!(o.preserve.id())),
         ("alterPaths", json!(o.alter_paths)),
         ("outlineText", json!(o.outline_text)),
@@ -140,6 +142,10 @@ fn body(app: &mut VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog) -> bool {
     }
     let rasters: Vec<(&str, &str)> = RasterFormat::ALL.iter().map(|r| (r.id(), r.label())).collect();
     choice(ui, d, "rasterFormat", tl!("Raster File Format:"), &rasters);
+    ui.horizontal(|ui| {
+        ui.add_space(LABEL + 8.0);
+        check(ui, d, "includeImages", tl!("Include Placed Images"));
+    });
     ui.add_space(10.0);
     widgets::subheader(ui, tl!("Export Option"));
     let preserve = Preserve::from_id(&d.str("preserve")).unwrap_or_default();
@@ -162,6 +168,7 @@ fn body(app: &mut VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog) -> bool {
     if widgets::check(ui, tl!("Outline Text"), appearance || d.bool("outlineText"), !appearance) {
         d.fields.insert("outlineText".into(), json!(!d.bool("outlineText")));
     }
+    check(ui, d, "includeHatches", tl!("Include Fill Hatches"));
     ui.add_space(8.0);
     super::form::caption(
         ui,
diff --git a/crates/ui-egui/src/dialogs/export_for_screens.rs b/crates/ui-egui/src/dialogs/export_for_screens.rs
index 88f9d35c80..54c98052bf 100644
--- a/crates/ui-egui/src/dialogs/export_for_screens.rs
+++ b/crates/ui-egui/src/dialogs/export_for_screens.rs
@@ -784,8 +784,7 @@ fn save_preset_row(app: &mut VectorcraftApp, ui: &mut egui::Ui, d: &mut Dialog)
 /// ones → the names added
 /// (none on the web, where the picked file arrives later and imports through `io::open_bytes`).
 pub(crate) fn import_presets(app: &mut VectorcraftApp) -> Result<Vec<String>, String> {
-    if let Some(f) = app.services.open_async.as_mut() {
-        f();
+    if crate::picks::open_async(app) {
         return Ok(vec![]);
     }
     let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Export presets", fileio::SCREEN_EXPORT_PRESET_EXTS)], ..Default::default() };
diff --git a/crates/ui-egui/src/dialogs/flattener_presets.rs b/crates/ui-egui/src/dialogs/flattener_presets.rs
index e95d0e683a..a8bcdde6e4 100644
--- a/crates/ui-egui/src/dialogs/flattener_presets.rs
+++ b/crates/ui-egui/src/dialogs/flattener_presets.rs
@@ -197,8 +197,7 @@ fn run(app: &mut VectorcraftApp, d: &mut Dialog, act: Action, current: &str) ->
         }
         Action::Import => {
             // On the web the picked file arrives later and imports through `io::open_bytes`.
-            if let Some(f) = app.services.open_async.as_mut() {
-                f();
+            if crate::picks::open_async(app) {
                 return Ok(());
             }
             let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Flattener presets", PRESET_EXTS)], ..Default::default() };
diff --git a/crates/ui-egui/src/dialogs/pdf_presets.rs b/crates/ui-egui/src/dialogs/pdf_presets.rs
index 10f7e0e451..f29b25e9e1 100644
--- a/crates/ui-egui/src/dialogs/pdf_presets.rs
+++ b/crates/ui-egui/src/dialogs/pdf_presets.rs
@@ -173,8 +173,7 @@ fn run(app: &mut VectorcraftApp, d: &mut Dialog, act: Action, current: &str) ->
         }
         Action::Import => {
             // On the web the picked file arrives later and imports through `io::open_bytes`.
-            if let Some(f) = app.services.open_async.as_mut() {
-                f();
+            if crate::picks::open_async(app) {
                 return Ok(());
             }
             let pick = crate::FilePick {
diff --git a/crates/ui-egui/src/dialogs/perspective_presets.rs b/crates/ui-egui/src/dialogs/perspective_presets.rs
index 7432bd3b2d..4772fa133b 100644
--- a/crates/ui-egui/src/dialogs/perspective_presets.rs
+++ b/crates/ui-egui/src/dialogs/perspective_presets.rs
@@ -191,8 +191,7 @@ pub(super) fn run(app: &mut VectorcraftApp, d: &mut Dialog, act: Action, current
         }
         Action::Import => {
             // On the web the picked file arrives later and imports through `io::open_bytes`.
-            if let Some(f) = app.services.open_async.as_mut() {
-                f();
+            if crate::picks::open_async(app) {
                 return Ok(());
             }
             let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Perspective grid presets", PRESET_EXTS)], ..Default::default() };
diff --git a/crates/ui-egui/src/dialogs/plugin.rs b/crates/ui-egui/src/dialogs/plugin.rs
index 63158b7329..706188f6da 100644
--- a/crates/ui-egui/src/dialogs/plugin.rs
+++ b/crates/ui-egui/src/dialogs/plugin.rs
@@ -341,6 +341,21 @@ fn import_confirm(app: &mut VectorcraftApp, d: &Dialog) -> Result<Value, String>
 /// The dialog kind of the approval of a plug-in install.
 pub const INSTALL_KIND: &str = "pluginInstall";
 
+/// Who asked for a plug-in install, fixed when the request is made.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum InstallOrigin {
+    /// The person at the keyboard: Install Plug-in…, File › Open or a drop.
+    Person,
+    /// A control or MCP request, a frame of synthetic input, or a file dialog that one of them
+    /// opened ([`VectorcraftApp::automation_asked`]): nothing in the dialog installs it, and the
+    /// person starts Install Plug-in… to install it.
+    Automation,
+}
+
+/// What [`ask_install`] answers, as `approval`, for a question automation asked: the person has to
+/// start Install Plug-in… to install the module.
+pub(crate) const PERSON_MUST_START_INSTALL: &str = "personMustStartInstall";
+
 /// A plug-in install waiting for a person's answer.
 pub(crate) struct PendingInstall {
     /// The question and the lines under it, in the UI language.
@@ -350,6 +365,8 @@ pub(crate) struct PendingInstall {
     pub params: Value,
     /// What OK approves: the module the question is about.
     pub approval: InstallApproval,
+    /// Who asked; a question automation asked has no OK that installs.
+    pub origin: InstallOrigin,
     /// How long the question has been on screen; [`ask_install`] starts it over.
     pub shown: Shown,
 }
@@ -439,27 +456,44 @@ pub(super) const INSTALL_SPEC: DialogSpec = DialogSpec {
 };
 
 /// Asks a person whether to install what `pending` describes, its question not yet shown, even when
-/// it reads as the one it replaces. → `{pending}`.
+/// it reads as the one it replaces. → `{pending}`, and `approval: "personMustStartInstall"` when
+/// automation asked.
 pub(crate) fn ask_install(app: &mut VectorcraftApp, mut pending: PendingInstall) -> Value {
     pending.shown = Shown::default();
+    let automated = pending.origin == InstallOrigin::Automation;
     app.pending_plugin_install = Some(pending);
     app.ui.dialog = Some(Dialog::new(INSTALL_KIND, json!({})));
+    if automated {
+        return json!({ "pending": INSTALL_KIND, "approval": PERSON_MUST_START_INSTALL });
+    }
     json!({ "pending": INSTALL_KIND })
 }
 
+/// What the approval says when automation asked for the install; the error of its OK
+/// ([`install_confirm`]) is the same text.
+fn automation_asked_note() -> &'static str {
+    tl!("Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.")
+}
+
 /// The question, the lines under it, and OK, which is disabled until the question has been shown
-/// for [`APPROVAL_DELAY`] ([`Shown`]), and Cancel, which never waits.
+/// for [`APPROVAL_DELAY`] ([`Shown`]), and Cancel, which never waits. When automation asked, a note
+/// says so and OK stays disabled.
 fn install_body(app: &mut VectorcraftApp, ui: &mut egui::Ui, _: &mut Dialog) -> DialogAction {
     let Some(pending) = app.pending_plugin_install.as_mut() else { return DialogAction::Cancel };
-    let enabled = pending.shown.drawn(ui);
+    let person = pending.origin == InstallOrigin::Person;
+    let enabled = pending.shown.drawn(ui) && person;
     ui.label(egui::RichText::new(&pending.message).strong());
     ui.add_space(8.0);
     ui.label(egui::RichText::new(&pending.detail).color(crate::theme::Tokens::get(ui.ctx()).text_dim));
+    if !person {
+        ui.add_space(8.0);
+        ui.label(egui::RichText::new(automation_asked_note()).strong());
+    }
     ui.add_space(16.0);
     let mut action = DialogAction::None;
     let row = egui::vec2(ui.min_rect().width(), ui.spacing().interact_size.y);
     ui.allocate_ui_with_layout(row, egui::Layout::right_to_left(egui::Align::Center), |ui| {
-        if widgets::primary_button_enabled(ui, "OK", enabled).clicked() && pending.shown.ready() {
+        if widgets::primary_button_enabled(ui, "OK", enabled).clicked() && person && pending.shown.ready() {
             action = DialogAction::Confirm;
         }
         pending.shown.released(ui);
@@ -472,9 +506,12 @@ fn install_body(app: &mut VectorcraftApp, ui: &mut egui::Ui, _: &mut Dialog) ->
 }
 
 /// OK: installs the module the dialog showed, if a person pressed it; automation is refused and the
-/// dialog stays open. Before the question has been shown for [`APPROVAL_DELAY`] it installs nothing
-/// and the dialog stays open. → `{pending}`.
+/// dialog stays open, and so is any OK of a question automation asked. Before the question has been
+/// shown for [`APPROVAL_DELAY`] it installs nothing and the dialog stays open. → `{pending}`.
 fn install_confirm(app: &mut VectorcraftApp, _: &Dialog) -> Result<Value, String> {
+    if app.pending_plugin_install.as_ref().is_some_and(|p| p.origin == InstallOrigin::Automation) {
+        return Err("Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.".into());
+    }
     if app.automation_is_acting() {
         return Err("Only the person at the keyboard can approve installing a plug-in".into());
     }
diff --git a/crates/ui-egui/src/dialogs/print_presets.rs b/crates/ui-egui/src/dialogs/print_presets.rs
index a8a9f42449..3ad798d998 100644
--- a/crates/ui-egui/src/dialogs/print_presets.rs
+++ b/crates/ui-egui/src/dialogs/print_presets.rs
@@ -153,8 +153,7 @@ pub(super) fn run(app: &mut VectorcraftApp, d: &mut Dialog, act: Action, current
         }
         Action::Import => {
             // On the web the picked file arrives later and imports through `io::open_bytes`.
-            if let Some(f) = app.services.open_async.as_mut() {
-                f();
+            if crate::picks::open_async(app) {
                 return Ok(());
             }
             let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Print presets", PRESET_EXTS)], ..Default::default() };
diff --git a/crates/ui-egui/src/dialogs/tests_dxf.rs b/crates/ui-egui/src/dialogs/tests_dxf.rs
index 22429b1649..775562fa8f 100644
--- a/crates/ui-egui/src/dialogs/tests_dxf.rs
+++ b/crates/ui-egui/src/dialogs/tests_dxf.rs
@@ -50,13 +50,15 @@ fn the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom() {
     frame(&mut app);
     let d = app.ui.dialog.as_ref().unwrap();
     let fields = |d: &crate::state::Dialog| {
-        ["dxfPreset", "version", "unit", "scale", "colors", "preserve", "alterPaths", "outlineText"].map(|k| d.str(k)).join(" ")
+        ["dxfPreset", "version", "unit", "scale", "colors", "preserve", "alterPaths", "outlineText", "includeImages", "includeHatches"]
+            .map(|k| d.str(k))
+            .join(" ")
     };
-    assert_eq!(fields(d), "cnc 2000 Millimeters 1.0 256 editability false true");
+    assert_eq!(fields(d), "cnc 2000 Millimeters 1.0 256 editability false true false false");
     // Any change to a field the preset sets shows Custom, and keeps the other fields.
     set(&mut app, "colors", json!("true"));
     frame(&mut app);
-    assert_eq!(fields(app.ui.dialog.as_ref().unwrap()), "custom 2000 Millimeters 1.0 true editability false true");
+    assert_eq!(fields(app.ui.dialog.as_ref().unwrap()), "custom 2000 Millimeters 1.0 true editability false true false false");
     set(&mut app, "colors", json!("256"));
     frame(&mut app);
     assert_eq!(app.ui.dialog.as_ref().unwrap().str("dxfPreset"), "cnc", "matching every field again");
@@ -70,12 +72,12 @@ fn the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom() {
     assert_eq!(app.ui.dialog.as_ref().unwrap().str("dxfPreset"), "cnc");
     set(&mut app, "dxfPreset", json!("custom"));
     frame(&mut app);
-    assert_eq!(fields(app.ui.dialog.as_ref().unwrap()), "custom 2018 Millimeters 1.0 true appearance false false");
+    assert_eq!(fields(app.ui.dialog.as_ref().unwrap()), "custom 2018 Millimeters 1.0 true appearance false false true true");
     // A preset the command gives sets the fields it does not give.
     app.ui.dialog = None;
     app.run("ui.dxfOptionsDialog", json!({"dxfPreset": "cnc", "unit": "Inches"})).unwrap();
     let d = app.ui.dialog.as_ref().unwrap();
-    assert_eq!(fields(d), "custom 2000 Inches 1.0 256 editability false true");
+    assert_eq!(fields(d), "custom 2000 Inches 1.0 256 editability false true false false");
     // A preset set and confirmed without drawing (the control channel) sets its fields too.
     set(&mut app, "dxfPreset", json!("cnc"));
     confirm(&mut app).unwrap();
@@ -84,7 +86,7 @@ fn the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom() {
     app.run("ui.dxfOptionsDialog", json!({"dxfPreset": "custom"})).unwrap();
     let d = app.ui.dialog.as_mut().unwrap();
     set_field(d, "dxfPreset".into(), json!("cnc"));
-    assert_eq!(fields(d), "cnc 2000 Millimeters 1.0 256 editability false true");
+    assert_eq!(fields(d), "cnc 2000 Millimeters 1.0 256 editability false true false false");
     set_field(d, "unit".into(), json!("Inches"));
     assert_eq!(d.str("dxfPreset"), "custom");
     // Setting the preset again sets its fields again.
@@ -94,12 +96,51 @@ fn the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom() {
     // Setting Custom while Custom is shown still puts back the defaults.
     let mut reset = d.clone();
     set_field(&mut reset, "dxfPreset".into(), json!("custom"));
-    assert_eq!(fields(&reset), "custom 2018 Millimeters 1.0 true appearance false false");
+    assert_eq!(fields(&reset), "custom 2018 Millimeters 1.0 true appearance false false true true");
     confirm(&mut app).unwrap();
     let remembered = ["dxfPreset", "version", "unit"].map(|k| app.ui.dxf_options[k].as_str());
     assert_eq!(remembered, [Some("custom"), Some("2000"), Some("Inches")]);
 }
 
+#[test]
+fn include_placed_images_and_fill_hatches_follow_the_preset_and_a_change_shows_custom() {
+    let (mut app, written) = app(1);
+    let shown = |app: &VectorcraftApp| {
+        let d = app.ui.dialog.as_ref().unwrap();
+        (d.str("dxfPreset"), d.bool("includeImages"), d.bool("includeHatches"))
+    };
+    app.run("ui.dxfOptionsDialog", json!({"path": "/out/a.dxf"})).unwrap();
+    frame(&mut app);
+    assert_eq!(shown(&app), ("custom".into(), true, true));
+    confirm(&mut app).unwrap();
+    assert!(text(&written.borrow()[0].1).contains("\nHATCH\n"), "Custom keeps the fill's hatch");
+    app.run("ui.dxfOptionsDialog", json!({"path": "/out/b.dxf"})).unwrap();
+    set(&mut app, "dxfPreset", json!("cnc"));
+    frame(&mut app);
+    assert_eq!(shown(&app), ("cnc".into(), false, false));
+    // Either checkbox changed shows Custom; both back as the preset sets them show CNC / CAM.
+    set(&mut app, "includeHatches", json!(true));
+    frame(&mut app);
+    assert_eq!(shown(&app), ("custom".into(), false, true));
+    set(&mut app, "includeHatches", json!(false));
+    set(&mut app, "includeImages", json!(true));
+    frame(&mut app);
+    assert_eq!(shown(&app), ("custom".into(), true, false));
+    set(&mut app, "includeImages", json!(false));
+    frame(&mut app);
+    assert_eq!(shown(&app).0, "cnc");
+    confirm(&mut app).unwrap();
+    assert!(!text(&written.borrow()[1].1).contains("\nHATCH\n"), "CNC / CAM writes the fill's outline alone");
+    let remembered = ["includeImages", "includeHatches"].map(|k| app.ui.dxf_options[k].as_bool());
+    assert_eq!(remembered, [Some(false), Some(false)]);
+    // The next DXF Options start from them, and Custom turns both back on.
+    crate::menus::invoke(&mut app, "ui.dxfOptionsDialog", json!({}));
+    assert_eq!(shown(&app), ("cnc".into(), false, false));
+    set(&mut app, "dxfPreset", json!("custom"));
+    frame(&mut app);
+    assert_eq!(shown(&app), ("custom".into(), true, true));
+}
+
 #[test]
 fn bad_dxf_options_keep_the_dialog_open() {
     let (mut app, written) = app(1);
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index c9eb6522ee..4a85a6d6e1 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -2567,6 +2567,8 @@ digits	Malayalam	Малаялам
 	Range:	Диапазон:
 	Raster Effects	Растерен ефект
 	Raster File Format:	Растерен файлов формат:
+	Include Placed Images	Включване на поставените изображения
+	Include Fill Hatches	Включване на щриховките на запълванията
 	Raster Sample Size:	Растерен размер на пробата:
 	Raster/Vector Balance:	Баланс растер/вектор:
 	Rasterize	Растеризиране
@@ -2747,6 +2749,10 @@ digits	Malayalam	Малаялам
 	Replace Font	Замяна на шрифт
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Заменете го с друг файл или го игнорирайте: неговите изображения ще продължат да показват записания с документа преглед.
 	Replace Spine	Замяна на оста
+	Create Spine	Създаване на ос
+	Create Spine:	Създаване на ос:
+	Always	Винаги
+	Never	Никога
 	Replace Symbol	Замяна на символ
 	Reset Transformation	Нулиране на трансформацията
 	Replace With Font	Замяна с шрифт
@@ -5892,6 +5898,7 @@ axis	Y Axis	Y ос
 	Version: {version}	Версия: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Да се инсталира ли „{name}“ на мястото на приставката със същия ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Този файл не е приставката, инсталирана преди с този ID. Той получава настройките и кеша, пазени за този ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Автоматизация поиска инсталирането на тази приставка. За да я инсталирате, изберете Обект › Приставки › Инсталиране на приставка… сами.
 	File SHA-256: {hash}	SHA-256 на файла: {hash}
 	Read the objects it is given	Четене на обектите, които получава
 	Change, add and delete objects in the document	Промяна, добавяне и изтриване на обекти в документа
diff --git a/crates/ui-egui/src/i18n/bs.tsv b/crates/ui-egui/src/i18n/bs.tsv
index a151e75e1a..ff301cd5b2 100644
--- a/crates/ui-egui/src/i18n/bs.tsv
+++ b/crates/ui-egui/src/i18n/bs.tsv
@@ -256,6 +256,10 @@
 	Blend Options…	Opcije stapanja…
 	Expand	Proširi
 	Replace Spine	Zamijeni kičmu
+	Create Spine	Kreiraj kičmu
+	Create Spine:	Kreiraj kičmu:
+	Always	Uvijek
+	Never	Nikad
 	Reverse Spine	Obrni kičmu
 	Reverse Front to Back	Obrni od naprijed prema nazad
 	Envelope Distort	Izobličenje omotnicom
@@ -2362,6 +2366,8 @@ digits	Malayalam	Malajalam
 	Export Selected Art Only	Izvezi samo odabrani crtež
 	Number of Colors:	Broj boja:
 	Raster File Format:	Format rasterske datoteke:
+	Include Placed Images	Uključi postavljene slike
+	Include Fill Hatches	Uključi šrafure ispuna
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Prava boja zahtijeva verziju 2004 ili noviju: zapisuje se najbliža od 256 boja.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Tekst postaje obrisi, a potezi koje CAD linija ne može nacrtati postaju ispunjeni oblici.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Tekst ostaje tekst, a svaki potez je linija sa svojom debljinom i crticama.
@@ -5913,6 +5919,8 @@ axis	Y Axis	Y osa
 	Version: {version}	Verzija: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Instalirati „{name}” umjesto dodatka s istim ID-om?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Ova datoteka nije dodatak ranije instaliran s ovim ID-om. Dobija postavke i predmemoriju sačuvane za taj ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Automatizacija je zatražila instalaciju ovog dodatka. Da biste ga instalirali, izaberite Objekat › Dodaci › Instaliraj dodatak… sami.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Automatizacija je zatražila instalaciju ovog dodatka. Da biste ga instalirali, izaberite Objekat › Dodaci › Instaliraj dodatak… sami.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	„{name}” je drugi modul od dodatka s ID-om {_1} i dobio bi postavke i predmemoriju sačuvane za njega: instalirajte ga s `replace: true` kada korisnik pristane
 	File SHA-256: {hash}	SHA-256 datoteke: {hash}
 	Read the objects it is given	Čitati objekte koje dobije
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index dc9171c61c..3a570984aa 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -3310,6 +3310,8 @@ digits	Malayalam	Malaiàlam
 	Range:	Interval:
 	Raster Effects	Efectes de ràster
 	Raster File Format:	Format de fitxer de ràster:
+	Include Placed Images	Inclou les imatges col·locades
+	Include Fill Hatches	Inclou les trames dels emplenaments
 	Raster Sample Size:	Mida de mostra de ràster:
 	Raster/Vector Balance:	Equilibri ràster/vector:
 	Rasterize	Rasteritza
@@ -3496,6 +3498,10 @@ digits	Malayalam	Malaiàlam
 	Replace Font	Reemplaça el tipus de lletra
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Reemplaça’l per un altre fitxer o ignora’l: les seves imatges continuaran mostrant la previsualització desada amb el document.
 	Replace Spine	Reemplaça l’espina
+	Create Spine	Crea l’espina
+	Create Spine:	Crea l’espina:
+	Always	Sempre
+	Never	Mai
 	Replace Symbol	Reemplaça el símbol
 	Reset Transformation	Restableix la transformació
 	Replace With Font	Reemplaça per un tipus de lletra
@@ -6125,6 +6131,8 @@ digits	Malayalam	Malaiàlam
 	Version: {version}	Versió: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Instal·la «{name}» en lloc del complement amb el mateix ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Aquest fitxer no és el complement instal·lat abans amb aquest ID. Rep la configuració i la memòria cau desades per a aquest ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Una automatització ha demanat d’instal·lar aquest complement. Per instal·lar-lo, tria Objecte › Complements › Instal·la el complement… tu mateix.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Una automatització ha demanat d’instal·lar aquest complement. Per instal·lar-lo, tria Objecte › Complements › Instal·la el complement… tu mateix.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	«{name}» és un mòdul diferent del complement amb l’ID {_1} i rebria la configuració i la memòria cau desades per a aquest: instal·la’l amb `replace: true` quan l’usuari hi estigui d’acord
 	File SHA-256: {hash}	SHA-256 del fitxer: {hash}
 	Read the objects it is given	Llegir els objectes que rep
@@ -6187,6 +6195,12 @@ digits	Malayalam	Malaiàlam
 @msg	command {name}: `label` must be 1-64 printable characters	ordre {name}: `label` ha de tenir 1-64 caràcters imprimibles
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	ordre {name}: fes servir un id d’1-{MAX_COMMAND_ID} caràcters d’a-z 0-9 _ que comenci per una lletra
 @msg	command {name}: {e}	ordre {name}: {e}
+@msg	manifest: {e}	manifest: {e}
+@msg	manifest: {e} at line {line} column {column}	manifest: {e} (línia {line}, columna {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` ha de ser una llista d’ordres, cadascuna amb `id` i `label`
+@msg	command {name} must be an object with an `id` and a `label`	l’ordre {name} ha de ser un objecte amb `id` i `label`
+@msg	missing field `{key}`	falta el camp `{key}`
+@msg	duplicate field `{key}`	el camp `{key}` està repetit
 @msg	only a filter or a live effect declares `commands`	només un filtre o un efecte dinàmic declara `commands`
 @msg	“{name}” › {label}: {e}	«{name}» › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	el mòdul no té el SHA-256 que indica `hash`: no s’ha instal·lat res
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 46d4fde580..4459a0a482 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -262,6 +262,10 @@
 	Blend Options…	Možnosti prolnutí…
 	Expand	Rozložit
 	Replace Spine	Nahradit páteř
+	Create Spine	Vytvořit páteř
+	Create Spine:	Vytvořit páteř:
+	Always	Vždy
+	Never	Nikdy
 	Reverse Spine	Obrátit páteř
 	Reverse Front to Back	Obrátit pořadí zepředu dozadu
 	Envelope Distort	Deformace obálkou
@@ -2391,6 +2395,8 @@ digits	Malayalam	Malajálamské
 	Export Selected Art Only	Exportovat jen vybranou kresbu
 	Number of Colors:	Počet barev:
 	Raster File Format:	Formát rastrového souboru:
+	Include Placed Images	Zahrnout umístěné obrazy
+	Include Fill Hatches	Zahrnout šrafy výplní
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Plné barvy vyžadují verzi 2004 nebo novější: zapíše se nejbližší z 256 barev.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Text se převede na křivky a tahy, které čára CAD nedokáže vykreslit, se stanou vyplněnými tvary.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Text zůstane textem a každý tah bude čárou s vlastní tloušťkou a čárkováním.
@@ -6078,6 +6084,8 @@ axis	Y Axis	osa Y
 	Version: {version}	Verze: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Nainstalovat „{name}“ místo zásuvného modulu se stejným ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Tento soubor není zásuvný modul dříve nainstalovaný s tímto ID. Získá nastavení a mezipaměť uchovávané pro toto ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	O instalaci tohoto zásuvného modulu požádala automatizace. Chcete-li ho nainstalovat, zvolte Objekt › Zásuvné moduly › Nainstalovat zásuvný modul… sami.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	O instalaci tohoto zásuvného modulu požádala automatizace. Chcete-li ho nainstalovat, zvolte Objekt › Zásuvné moduly › Nainstalovat zásuvný modul… sami.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	„{name}“ je jiný modul než zásuvný modul s ID {_1} a získal by nastavení a mezipaměť uchovávané pro něj: nainstalujte ho s `replace: true`, jakmile uživatel souhlasí
 	File SHA-256: {hash}	SHA-256 souboru: {hash}
 	Read the objects it is given	Číst objekty, které dostane
@@ -6140,6 +6148,12 @@ axis	Y Axis	osa Y
 @msg	command {name}: `label` must be 1-64 printable characters	příkaz {name}: `label` musí mít 1-64 tisknutelných znaků
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	příkaz {name}: použijte id o 1-{MAX_COMMAND_ID} znacích z a-z 0-9 _, které začíná písmenem
 @msg	command {name}: {e}	příkaz {name}: {e}
+@msg	manifest: {e}	manifest: {e}
+@msg	manifest: {e} at line {line} column {column}	manifest: {e} (řádek {line}, sloupec {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` musí být seznam příkazů, každý s `id` a `label`
+@msg	command {name} must be an object with an `id` and a `label`	příkaz {name} musí být objekt s `id` a `label`
+@msg	missing field `{key}`	chybí pole `{key}`
+@msg	duplicate field `{key}`	pole `{key}` je uvedeno dvakrát
 @msg	only a filter or a live effect declares `commands`	`commands` deklaruje jen filtr nebo živý efekt
 @msg	“{name}” › {label}: {e}	„{name}“ › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	modul nemá SHA-256 uvedený v `hash`: nic nebylo nainstalováno
diff --git a/crates/ui-egui/src/i18n/da.tsv b/crates/ui-egui/src/i18n/da.tsv
index 68dcd3278d..68d14da27b 100644
--- a/crates/ui-egui/src/i18n/da.tsv
+++ b/crates/ui-egui/src/i18n/da.tsv
@@ -248,6 +248,10 @@
 	Blend Options…	Blandingsindstillinger…
 	Expand	Udvid
 	Replace Spine	Erstat rygrad
+	Create Spine	Opret rygrad
+	Create Spine:	Opret rygrad:
+	Always	Altid
+	Never	Aldrig
 	Reverse Spine	Omvend rygrad
 	Reverse Front to Back	Omvend fortil og bagtil
 	Envelope Distort	Kuvertforvrængning
@@ -2194,6 +2198,8 @@ digits	Malayalam	Malayalam
 	Export Selected Art Only	Eksportér kun markeret grafik
 	Number of Colors:	Antal farver:
 	Raster File Format:	Rasterfilformat:
+	Include Placed Images	Medtag placerede billeder
+	Include Fill Hatches	Medtag skraveringer af udfyldninger
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Ægte farve kræver version 2004 eller senere: den nærmeste af 256 farver skrives.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Tekst bliver til omrids, og konturer, som en CAD-linje ikke kan tegne, bliver til udfyldte figurer.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Tekst forbliver tekst, og hver kontur er en linje med sin linjevægt og streger.
@@ -5907,6 +5913,7 @@ axis	Y Axis	Y-akse
 	Version: {version}	Version: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Installér »{name}« i stedet for det plug-in, der har samme id?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Denne fil er ikke det plug-in, der før var installeret med dette id. Den får de indstillinger og den cache, der er gemt for dette id.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	En automatisering bad om at installere dette plug-in. Vælg selv Objekt › Plug-ins › Installér plug-in… for at installere det.
 	File SHA-256: {hash}	Filens SHA-256: {hash}
 	Read the objects it is given	Læse de objekter, den får
 	Change, add and delete objects in the document	Ændre, tilføje og slette objekter i dokumentet
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 4cef6ece78..a1eb6c7755 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2607,6 +2607,8 @@ digits	Malayalam	Malayalam
 	Range:	Bereich:
 	Raster Effects	Rastereffekte
 	Raster File Format:	Pixelbild-Dateiformat:
+	Include Placed Images	Platzierte Bilder einschließen
+	Include Fill Hatches	Füllschraffuren einschließen
 	Raster Sample Size:	Aufnahmebereich in Pixelbildern:
 	Raster/Vector Balance:	Pixelbild-Vektor-Abgleich:
 	Rasterize	In Pixelbild umwandeln
@@ -2788,6 +2790,10 @@ digits	Malayalam	Malayalam
 	Replace Font	Schrift ersetzen
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Ersetzen Sie sie durch eine andere Datei oder ignorieren Sie sie: Ihre Bilder zeigen weiterhin die mit dem Dokument gespeicherte Vorschau.
 	Replace Spine	Achse ersetzen
+	Create Spine	Achse erstellen
+	Create Spine:	Achse erstellen:
+	Always	Immer
+	Never	Nie
 	Replace Symbol	Symbol ersetzen
 	Reset Transformation	Transformation zurücksetzen
 	Replace With Font	Durch Schrift ersetzen
@@ -5669,6 +5675,8 @@ axis	Y Axis	Y-Achse
 	Version: {version}	Version: {version}
 	Install “{name}” in place of the plug-in with the same ID?	„{name}“ anstelle des Plug-ins mit derselben ID installieren?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Diese Datei ist nicht das Plug-in, das vorher mit dieser ID installiert war. Sie erhält die Einstellungen und den Cache, die für diese ID gespeichert sind.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Eine Automatisierung hat angefordert, dieses Plug-in zu installieren. Um es zu installieren, wählen Sie selbst „Objekt › Plug-ins › Plug-in installieren…“.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Eine Automatisierung hat angefordert, dieses Plug-in zu installieren. Um es zu installieren, wählen Sie selbst „Objekt › Plug-ins › Plug-in installieren…“.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	„{name}“ ist ein anderes Modul als das Plug-in mit der ID {_1} und würde die dafür gespeicherten Einstellungen und den Cache erhalten: Installieren Sie es mit `replace: true`, sobald der Benutzer zustimmt
 	File SHA-256: {hash}	Datei-SHA-256: {hash}
 	Read the objects it is given	Die Objekte lesen, die es erhält
@@ -5731,6 +5739,12 @@ axis	Y Axis	Y-Achse
 @msg	command {name}: `label` must be 1-64 printable characters	Befehl {name}: `label` muss 1-64 druckbare Zeichen haben
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	Befehl {name}: Verwenden Sie eine ID aus 1-{MAX_COMMAND_ID} Zeichen aus a-z 0-9 _, die mit einem Buchstaben beginnt
 @msg	command {name}: {e}	Befehl {name}: {e}
+@msg	manifest: {e}	Manifest: {e}
+@msg	manifest: {e} at line {line} column {column}	Manifest: {e} (Zeile {line}, Spalte {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` muss eine Liste von Befehlen sein, jeder mit `id` und `label`
+@msg	command {name} must be an object with an `id` and a `label`	der Befehl {name} muss ein Objekt mit `id` und `label` sein
+@msg	missing field `{key}`	fehlendes Feld `{key}`
+@msg	duplicate field `{key}`	doppeltes Feld `{key}`
 @msg	only a filter or a live effect declares `commands`	nur ein Filter oder ein Live-Effekt deklariert `commands`
 @msg	“{name}” › {label}: {e}	„{name}“ › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	das Modul hat nicht den SHA-256-Wert aus `hash`: Es wurde nichts installiert
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index a9ac60e824..3fe1ef597f 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -3287,6 +3287,8 @@ digits	Malayalam	Μαλαγιάλαμ
 	Randomly change saturation and brightness	Τυχαία αλλαγή κορεσμού και φωτεινότητας
 	Raster Effects	Εφέ ράστερ
 	Raster File Format:	Μορφή αρχείου ράστερ:
+	Include Placed Images	Συμπερίληψη τοποθετημένων εικόνων
+	Include Fill Hatches	Συμπερίληψη διαγραμμίσεων γεμισμάτων
 	Raster Sample Size:	Μέγεθος δείγματος ράστερ:
 	Raster/Vector Balance:	Ισορροπία ράστερ/διανυσμάτων:
 	Rasterize Unsupported Art	Μετατροπή μη υποστηριζόμενου σχεδίου σε ράστερ
@@ -3434,6 +3436,10 @@ digits	Malayalam	Μαλαγιάλαμ
 	Replace Font	Αντικατάσταση γραμματοσειράς
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Αντικαταστήστε το με άλλο αρχείο ή αγνοήστε το: οι εικόνες του θα συνεχίσουν να εμφανίζουν την προεπισκόπηση που αποθηκεύτηκε στο έγγραφο.
 	Replace Spine	Αντικατάσταση κεντρικής καμπύλης
+	Create Spine	Δημιουργία κεντρικής καμπύλης
+	Create Spine:	Δημιουργία κεντρικής καμπύλης:
+	Always	Πάντα
+	Never	Ποτέ
 	Replace Symbol	Αντικατάσταση συμβόλου
 	Reset Transformation	Επαναφορά μετασχηματισμού
 	Replace With Font	Αντικατάσταση με γραμματοσειρά
@@ -6029,6 +6035,8 @@ axis	Y Axis	Άξονας Y
 	Version: {version}	Έκδοση: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Να εγκατασταθεί το «{name}» στη θέση του πρόσθετου με το ίδιο αναγνωριστικό;
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Αυτό το αρχείο δεν είναι το πρόσθετο που ήταν εγκατεστημένο πριν με αυτό το αναγνωριστικό. Παίρνει τις ρυθμίσεις και την κρυφή μνήμη που διατηρούνται για αυτό το αναγνωριστικό.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Μια αυτοματοποίηση ζήτησε να εγκατασταθεί αυτό το πρόσθετο. Για να το εγκαταστήσετε, επιλέξτε Αντικείμενο › Πρόσθετα › Εγκατάσταση προσθέτου… μόνοι σας.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Μια αυτοματοποίηση ζήτησε να εγκατασταθεί αυτό το πρόσθετο. Για να το εγκαταστήσετε, επιλέξτε Αντικείμενο › Πρόσθετα › Εγκατάσταση προσθέτου… μόνοι σας.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	το «{name}» είναι άλλη λειτουργική μονάδα από το πρόσθετο με αναγνωριστικό {_1} και θα έπαιρνε τις ρυθμίσεις και την κρυφή μνήμη που διατηρούνται για αυτό: εγκαταστήστε το με `replace: true` μόλις συμφωνήσει ο χρήστης
 	File SHA-256: {hash}	SHA-256 αρχείου: {hash}
 	Read the objects it is given	Ανάγνωση των αντικειμένων που του δίνονται
@@ -6091,6 +6099,12 @@ axis	Y Axis	Άξονας Y
 @msg	command {name}: `label` must be 1-64 printable characters	εντολή {name}: το `label` πρέπει να έχει 1-64 εκτυπώσιμους χαρακτήρες
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	εντολή {name}: χρησιμοποιήστε αναγνωριστικό 1-{MAX_COMMAND_ID} χαρακτήρων από a-z 0-9 _ που αρχίζει με γράμμα
 @msg	command {name}: {e}	εντολή {name}: {e}
+@msg	manifest: {e}	αρχείο δηλώσεων: {e}
+@msg	manifest: {e} at line {line} column {column}	αρχείο δηλώσεων: {e} (γραμμή {line}, στήλη {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	το `commands` πρέπει να είναι λίστα εντολών, καθεμία με `id` και `label`
+@msg	command {name} must be an object with an `id` and a `label`	η εντολή {name} πρέπει να είναι αντικείμενο με `id` και `label`
+@msg	missing field `{key}`	λείπει το πεδίο `{key}`
+@msg	duplicate field `{key}`	το πεδίο `{key}` εμφανίζεται δύο φορές
 @msg	only a filter or a live effect declares `commands`	μόνο ένα φίλτρο ή ένα δυναμικό εφέ δηλώνει `commands`
 @msg	“{name}” › {label}: {e}	«{name}» › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	η λειτουργική μονάδα δεν έχει το SHA-256 που δίνει το `hash`: δεν εγκαταστάθηκε τίποτα
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 4f46bf3337..4c993aeb1f 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2641,6 +2641,8 @@ digits	Malayalam	Malayálam
 	Range:	Rango:
 	Raster Effects	Efectos de rasterización
 	Raster File Format:	Formato de archivo ráster:
+	Include Placed Images	Incluir imágenes colocadas
+	Include Fill Hatches	Incluir sombreados de relleno
 	Raster Sample Size:	Tamaño de muestra ráster:
 	Raster/Vector Balance:	Equilibrio ráster/vectorial:
 	Rasterize	Rasterizar
@@ -2822,6 +2824,10 @@ digits	Malayalam	Malayálam
 	Replace Font	Reemplazar fuente
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Reemplázalo con otro archivo o ignóralo: sus imágenes seguirán mostrando la vista previa guardada con el documento.
 	Replace Spine	Reemplazar eje
+	Create Spine	Crear eje
+	Create Spine:	Crear eje:
+	Always	Siempre
+	Never	Nunca
 	Replace Symbol	Reemplazar símbolo
 	Reset Transformation	Restablecer transformación
 	Replace With Font	Reemplazar con fuente
@@ -6020,6 +6026,8 @@ axis	Y Axis	Eje Y
 	Version: {version}	Versión: {version}
 	Install “{name}” in place of the plug-in with the same ID?	¿Instalar “{name}” en lugar del plugin con el mismo ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Este archivo no es el plugin instalado antes con este ID. Recibe la configuración y la caché guardadas para ese ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Una automatización pidió instalar este plugin. Para instalarlo, elige Objeto › Plugins › Instalar plugin… tú mismo.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Una automatización pidió instalar este plugin. Para instalarlo, elige Objeto › Plugins › Instalar plugin… tú mismo.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}” es un módulo distinto del plugin con ID {_1} y recibiría la configuración y la caché guardadas para él: instálalo con `replace: true` cuando el usuario lo acepte
 	File SHA-256: {hash}	SHA-256 del archivo: {hash}
 	Read the objects it is given	Leer los objetos que recibe
@@ -6082,6 +6090,12 @@ axis	Y Axis	Eje Y
 @msg	command {name}: `label` must be 1-64 printable characters	comando {name}: `label` debe tener 1-64 caracteres imprimibles
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	comando {name}: usa un id de 1-{MAX_COMMAND_ID} caracteres de a-z 0-9 _ que empiece por una letra
 @msg	command {name}: {e}	comando {name}: {e}
+@msg	manifest: {e}	manifiesto: {e}
+@msg	manifest: {e} at line {line} column {column}	manifiesto: {e} (línea {line}, columna {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` debe ser una lista de comandos, cada uno con `id` y `label`
+@msg	command {name} must be an object with an `id` and a `label`	el comando {name} debe ser un objeto con `id` y `label`
+@msg	missing field `{key}`	falta el campo `{key}`
+@msg	duplicate field `{key}`	el campo `{key}` está repetido
 @msg	only a filter or a live effect declares `commands`	solo un filtro o un efecto interactivo declara `commands`
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	el módulo no tiene el SHA-256 que indica `hash`: no se instaló nada
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index d3becbdf6c..f8e206739a 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -269,6 +269,10 @@
 	Blend Options…	Sulautuksen asetukset…
 	Expand	Laajenna
 	Replace Spine	Korvaa selkäranka
+	Create Spine	Luo selkäranka
+	Create Spine:	Luo selkäranka:
+	Always	Aina
+	Never	Ei koskaan
 	Reverse Spine	Käännä selkäranka
 	Reverse Front to Back	Käännä edestä taakse
 	Envelope Distort	Vääristyskuori
@@ -2350,6 +2354,8 @@ digits	Malayalam	Malajalam
 	Export Selected Art Only	Vie vain valittu kuvitus
 	Number of Colors:	Värien määrä:
 	Raster File Format:	Rasteritiedoston muoto:
+	Include Placed Images	Sisällytä sijoitetut kuvat
+	Include Fill Hatches	Sisällytä täyttöjen viivoitukset
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Täysväri vaatii version 2004 tai uudemman: käytetään lähintä 256 väristä.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Teksti muunnetaan ääriviivoiksi, ja viivat, joita CAD-viiva ei pysty piirtämään, muuttuvat täytetyiksi muodoiksi.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Teksti säilyy tekstinä, ja jokainen viiva on viiva, jolla on oma viivanpaksuutensa ja katkoviivansa.
@@ -6108,6 +6114,8 @@ axis	Y Axis	Y-akseli
 	Version: {version}	Versio: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Asennetaanko ”{name}” samaa tunnusta käyttävän laajennuksen tilalle?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Tämä tiedosto ei ole laajennus, joka oli aiemmin asennettu tällä tunnuksella. Se saa tälle tunnukselle säilytetyt asetukset ja välimuistin.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Automaatio pyysi tämän laajennuksen asentamista. Valitse itse Objekti › Laajennukset › Asenna laajennus…, jos haluat asentaa sen.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Automaatio pyysi tämän laajennuksen asentamista. Valitse itse Objekti › Laajennukset › Asenna laajennus…, jos haluat asentaa sen.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	”{name}” on eri moduuli kuin laajennus, jonka tunnus on {_1}, ja se saisi sille säilytetyt asetukset ja välimuistin: asenna se asetuksella `replace: true`, kun käyttäjä hyväksyy
 	File SHA-256: {hash}	Tiedoston SHA-256: {hash}
 	Read the objects it is given	Lukea sille annetut objektit
@@ -6170,6 +6178,12 @@ axis	Y Axis	Y-akseli
 @msg	command {name}: `label` must be 1-64 printable characters	komento {name}: `label`-kentässä on oltava 1-64 tulostettavaa merkkiä
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	komento {name}: käytä 1-{MAX_COMMAND_ID} merkin tunnusta merkeistä a-z 0-9 _, joka alkaa kirjaimella
 @msg	command {name}: {e}	komento {name}: {e}
+@msg	manifest: {e}	manifesti: {e}
+@msg	manifest: {e} at line {line} column {column}	manifesti: {e} (rivi {line}, sarake {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands`-kohdan on oltava luettelo komennoista, joilla kullakin on `id` ja `label`
+@msg	command {name} must be an object with an `id` and a `label`	komennon {name} on oltava objekti, jossa on `id` ja `label`
+@msg	missing field `{key}`	kenttä `{key}` puuttuu
+@msg	duplicate field `{key}`	kenttä `{key}` on kahdesti
 @msg	only a filter or a live effect declares `commands`	vain suodin tai live-tehoste määrittelee `commands`-kohdan
 @msg	“{name}” › {label}: {e}	”{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	moduulilla ei ole `hash`-kentän SHA-256-arvoa: mitään ei asennettu
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 0ebbce016e..02f897799e 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2633,6 +2633,8 @@ digits	Malayalam	Malayalam
 	Range:	Plage :
 	Raster Effects	Effets de pixellisation
 	Raster File Format:	Format du fichier pixellisé :
+	Include Placed Images	Inclure les images importées
+	Include Fill Hatches	Inclure les hachures des fonds
 	Raster Sample Size:	Taille de l’échantillon pixellisé :
 	Raster/Vector Balance:	Équilibre pixellisé/vectoriel :
 	Rasterize	Pixelliser
@@ -2814,6 +2816,10 @@ digits	Malayalam	Malayalam
 	Replace Font	Remplacer la police
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Remplacez-le par un autre fichier ou ignorez-le : ses images continueront d’afficher l’aperçu enregistré avec le document.
 	Replace Spine	Remplacer la dorsale
+	Create Spine	Créer une dorsale
+	Create Spine:	Créer une dorsale :
+	Always	Toujours
+	Never	Jamais
 	Replace Symbol	Remplacer le symbole
 	Reset Transformation	Réinitialiser la transformation
 	Replace With Font	Remplacer par la police
@@ -6073,6 +6079,8 @@ axis	Y Axis	Axe Y
 	Version: {version}	Version : {version}
 	Install “{name}” in place of the plug-in with the same ID?	Installer « {name} » à la place du module externe qui a le même ID ?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Ce fichier n’est pas le module externe installé auparavant avec cet ID. Il reçoit les réglages et le cache conservés pour cet ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Une automatisation a demandé l’installation de ce module externe. Pour l’installer, choisissez Objet › Modules externes › Installer un module externe… vous-même.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Une automatisation a demandé l’installation de ce module externe. Pour l’installer, choisissez Objet › Modules externes › Installer un module externe… vous-même.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	« {name} » est un autre module que le module externe d’ID {_1} et recevrait les réglages et le cache conservés pour celui-ci : installez-le avec `replace: true` une fois que l’utilisateur l’accepte
 	File SHA-256: {hash}	SHA-256 du fichier : {hash}
 	Read the objects it is given	Lire les objets qui lui sont transmis
@@ -6135,6 +6143,12 @@ axis	Y Axis	Axe Y
 @msg	command {name}: `label` must be 1-64 printable characters	commande {name} : `label` doit compter 1-64 caractères imprimables
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	commande {name} : utilisez un id de 1-{MAX_COMMAND_ID} caractères parmi a-z 0-9 _ commençant par une lettre
 @msg	command {name}: {e}	commande {name} : {e}
+@msg	manifest: {e}	manifeste : {e}
+@msg	manifest: {e} at line {line} column {column}	manifeste : {e} (ligne {line}, colonne {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` doit être une liste de commandes, chacune avec `id` et `label`
+@msg	command {name} must be an object with an `id` and a `label`	la commande {name} doit être un objet avec `id` et `label`
+@msg	missing field `{key}`	champ `{key}` manquant
+@msg	duplicate field `{key}`	champ `{key}` en double
 @msg	only a filter or a live effect declares `commands`	seul un filtre ou un effet dynamique déclare `commands`
 @msg	“{name}” › {label}: {e}	« {name} » › {label} : {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	le module n’a pas le SHA-256 indiqué par `hash` : rien n’a été installé
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index d9bb3ba4f7..35a3600fd2 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -3606,6 +3606,8 @@ antiAlias	Sharp	शार्प
 	Range:	रेंज:
 	Raster Effects	रीस्टर इफ़ेक्ट
 	Raster File Format:	रास्टर फ़ाइल फ़ॉर्मैट:
+	Include Placed Images	रखी गई छवियाँ शामिल करें
+	Include Fill Hatches	फ़िल हैच शामिल करें
 	Raster Sample Size:	रास्टर सैंपल साइज़:
 	Raster/Vector Balance:	रास्टर/वेक्टर बैलेंस:
 	Rasterize	रास्टराइज़ करें
@@ -3811,6 +3813,10 @@ antiAlias	Sharp	शार्प
 	Replace Missing Fonts	अनुपलब्ध फ़ॉन्ट रिप्लेस करें
 	Replace Missing Fonts…	अनुपलब्ध फ़ॉन्ट रिप्लेस करें…
 	Replace Spine	स्पाइन रिप्लेस करें
+	Create Spine	स्पाइन बनाएँ
+	Create Spine:	स्पाइन बनाएँ:
+	Always	हमेशा
+	Never	कभी नहीं
 	Replace Symbol	सिंबल रिप्लेस करें
 	Reset Transformation	रूपांतरण रीसेट करें
 	Replace With Font	इस फ़ॉन्ट से रिप्लेस करें
@@ -5377,6 +5383,8 @@ antiAlias	Sharp	शार्प
 	Version: {version}	संस्करण: {version}
 	Install “{name}” in place of the plug-in with the same ID?	समान ID वाले प्लग-इन की जगह “{name}” इंस्टॉल करें?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	यह फ़ाइल इस ID के साथ पहले इंस्टॉल किया गया प्लग-इन नहीं है। इसे उस ID के लिए रखी गई सेटिंग्स और कैश मिलते हैं।
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	एक ऑटोमेशन ने इस प्लग-इन को इंस्टॉल करने के लिए कहा। इसे इंस्टॉल करने के लिए, स्वयं ऑब्जेक्ट › प्लग-इन्स › प्लग-इन इंस्टॉल करें… चुनें।
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	एक ऑटोमेशन ने इस प्लग-इन को इंस्टॉल करने के लिए कहा। इसे इंस्टॉल करने के लिए, स्वयं ऑब्जेक्ट › प्लग-इन्स › प्लग-इन इंस्टॉल करें… चुनें।
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}” आईडी {_1} वाले प्लग-इन से अलग मॉड्यूल है और उसके लिए रखी गई सेटिंग्स और कैश पा लेगा: उपयोगकर्ता की सहमति मिलने पर इसे `replace: true` से इंस्टॉल करें
 	File SHA-256: {hash}	फ़ाइल SHA-256: {hash}
 	Read the objects it is given	उसे दिए गए ऑब्जेक्ट्स पढ़ना
@@ -5435,6 +5443,11 @@ antiAlias	Sharp	शार्प
 @msg	command {name}: `label` must be 1-64 printable characters	कमांड {name}: `label` में 1-64 प्रिंट करने योग्य वर्ण होने चाहिए
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	कमांड {name}: a-z 0-9 _ के 1-{MAX_COMMAND_ID} वर्णों वाली ऐसी id इस्तेमाल करें जो अक्षर से शुरू हो
 @msg	command {name}: {e}	कमांड {name}: {e}
+@msg	manifest: {e} at line {line} column {column}	प्रकटन: {e} (लाइन {line}, कॉलम {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` कमांड की एक सूची होनी चाहिए, हर एक में `id` और `label` हो
+@msg	command {name} must be an object with an `id` and a `label`	कमांड {name} एक ऑब्जेक्ट होना चाहिए जिसमें `id` और `label` हों
+@msg	missing field `{key}`	फ़ील्ड `{key}` नहीं है
+@msg	duplicate field `{key}`	फ़ील्ड `{key}` दो बार है
 @msg	only a filter or a live effect declares `commands`	केवल फ़िल्टर या लाइव इफ़ेक्ट ही `commands` घोषित करता है
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	मॉड्यूल का SHA-256 वह नहीं है जो `hash` बताता है: कुछ भी इंस्टॉल नहीं हुआ
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 9536aa2ead..a54bbe328a 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -3193,6 +3193,8 @@ mark-style	Japanese	Japán
 	Range:	Tartomány:
 	Raster Effects	Raszteres effektusok
 	Raster File Format:	Raszteres fájlformátum:
+	Include Placed Images	Elhelyezett képek hozzáadása
+	Include Fill Hatches	Kitöltések sraffozásainak hozzáadása
 	Raster Sample Size:	Raszteres mintaméret:
 	Raster/Vector Balance:	Raszter–vektor arány:
 	Rasterize	Raszterizálás
@@ -3362,6 +3364,10 @@ mark-style	Japanese	Japán
 	Replace Font	Betűtípus cseréje
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Cseréld le egy másik fájlra, vagy hagyd ki: a képei a dokumentummal mentett előnézetet mutatják tovább.
 	Replace Spine	Gerinc cseréje
+	Create Spine	Gerinc létrehozása
+	Create Spine:	Gerinc létrehozása:
+	Always	Mindig
+	Never	Soha
 	Replace Symbol	Szimbólum cseréje
 	Reset Transformation	Átalakítás visszaállítása
 	Replace With Font	Helyettesítő betűtípus
@@ -6061,6 +6067,8 @@ axis	Y Axis	Y tengely
 	Version: {version}	Verzió: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Telepíted a(z) „{name}” bővítményt az azonos azonosítójú bővítmény helyére?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Ez a fájl nem az a bővítmény, amely korábban ezzel az azonosítóval volt telepítve. Megkapja az ehhez az azonosítóhoz tárolt beállításokat és gyorsítótárat.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Egy automatizálás kérte ennek a bővítménynek a telepítését. A telepítéshez válaszd ki te magad az Objektum › Bővítmények › Bővítmény telepítése… parancsot.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Egy automatizálás kérte ennek a bővítménynek a telepítését. A telepítéshez válaszd ki te magad az Objektum › Bővítmények › Bővítmény telepítése… parancsot.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	a(z) „{name}” más modul, mint a(z) {_1} azonosítójú bővítmény, és megkapná az ahhoz tárolt beállításokat és gyorsítótárat: telepítsd a `replace: true` megadásával, miután a felhasználó beleegyezett
 	File SHA-256: {hash}	A fájl SHA-256 értéke: {hash}
 	Read the objects it is given	Olvashatja a kapott objektumokat
@@ -6123,6 +6131,12 @@ axis	Y Axis	Y tengely
 @msg	command {name}: `label` must be 1-64 printable characters	{name} parancs: a `label` 1-64 nyomtatható karakter legyen
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	{name} parancs: használj 1-{MAX_COMMAND_ID} karakteres, a-z 0-9 _ karakterekből álló, betűvel kezdődő azonosítót
 @msg	command {name}: {e}	{name} parancs: {e}
+@msg	manifest: {e}	leíró: {e}
+@msg	manifest: {e} at line {line} column {column}	leíró: {e} ({line}. sor, {column}. oszlop)
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands`: parancsok listája kell, mindegyikben `id` és `label` értékkel
+@msg	command {name} must be an object with an `id` and a `label`	a(z) {name} parancs csak `id` és `label` mezőt tartalmazó objektum lehet
+@msg	missing field `{key}`	hiányzó mező: `{key}`
+@msg	duplicate field `{key}`	ismétlődő mező: `{key}`
 @msg	only a filter or a live effect declares `commands`	`commands` értéket csak szűrő vagy élő effektus deklarálhat
 @msg	“{name}” › {label}: {e}	„{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	a modul SHA-256 értéke nem az, amit a `hash` megad: semmi sem lett telepítve
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 16d8eda582..1ef4759965 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -248,6 +248,10 @@
 	Blend Options…	Opsi blend…
 	Expand	Perluas
 	Replace Spine	Ganti spine
+	Create Spine	Buat spine
+	Create Spine:	Buat spine:
+	Always	Selalu
+	Never	Tidak pernah
 	Reverse Spine	Balikkan spine
 	Reverse Front to Back	Balikkan depan ke belakang
 	Envelope Distort	Distorsi amplop
@@ -2194,6 +2198,8 @@ digits	Malayalam	Malayalam
 	Export Selected Art Only	Ekspor hanya karya seni terpilih
 	Number of Colors:	Jumlah warna:
 	Raster File Format:	Format file raster:
+	Include Placed Images	Sertakan gambar yang ditempatkan
+	Include Fill Hatches	Sertakan arsiran isian
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Warna sejati memerlukan versi 2004 atau lebih baru: yang ditulis adalah warna terdekat dari 256 warna.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Teks menjadi garis luar, dan stroke yang tidak dapat digambar oleh garis CAD menjadi bentuk terisi.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Teks tetap berupa teks, dan setiap stroke menjadi garis dengan ketebalan dan pola putus-putusnya.
@@ -5907,6 +5913,7 @@ axis	Y Axis	Sumbu Y
 	Version: {version}	Versi: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Instal “{name}” sebagai pengganti plug-in dengan ID yang sama?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	File ini bukan plug-in yang sebelumnya diinstal dengan ID ini. File ini mendapatkan pengaturan dan cache yang disimpan untuk ID tersebut.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Otomatisasi meminta untuk menginstal plug-in ini. Untuk menginstalnya, pilih Objek › Plug-in › Instal plug-in… sendiri.
 	File SHA-256: {hash}	SHA-256 file: {hash}
 	Read the objects it is given	Membaca objek yang diberikan kepadanya
 	Change, add and delete objects in the document	Mengubah, menambah, dan menghapus objek dalam dokumen
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index f0d944be10..6d6681d2db 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -2683,6 +2683,8 @@ digits	Malayalam	Malayalam
 	Range:	Intervallo:
 	Raster Effects	Effetti raster
 	Raster File Format:	Formato file raster:
+	Include Placed Images	Includi immagini inserite
+	Include Fill Hatches	Includi tratteggi dei riempimenti
 	Raster Sample Size:	Dimensione campione raster:
 	Raster/Vector Balance:	Bilanciamento raster/vettoriale:
 	Rasterize	Rasterizza
@@ -2864,6 +2866,10 @@ digits	Malayalam	Malayalam
 	Replace Font	Sostituisci font
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Sostituiscilo con un altro file oppure ignoralo: le sue immagini continueranno a mostrare l'anteprima salvata con il documento.
 	Replace Spine	Sostituisci dorsale
+	Create Spine	Crea dorsale
+	Create Spine:	Crea dorsale:
+	Always	Sempre
+	Never	Mai
 	Replace Symbol	Sostituisci simbolo
 	Reset Transformation	Reimposta trasformazione
 	Replace With Font	Sostituisci con font
@@ -5703,6 +5709,8 @@ axis	Y Axis	Asse Y
 	Version: {version}	Versione: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Installare “{name}” al posto del plug-in con lo stesso ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Questo file non è il plug-in installato prima con questo ID. Riceve le impostazioni e la cache conservate per quell’ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Un’automazione ha chiesto di installare questo plug-in. Per installarlo, scegli Oggetto › Plug-in › Installa plug-in… di persona.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Un’automazione ha chiesto di installare questo plug-in. Per installarlo, scegli Oggetto › Plug-in › Installa plug-in… di persona.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}” è un modulo diverso dal plug-in con ID {_1} e riceverebbe le impostazioni e la cache conservate per esso: installalo con `replace: true` quando l’utente acconsente
 	File SHA-256: {hash}	SHA-256 del file: {hash}
 	Read the objects it is given	Leggere gli oggetti che riceve
@@ -5765,6 +5773,12 @@ axis	Y Axis	Asse Y
 @msg	command {name}: `label` must be 1-64 printable characters	comando {name}: `label` deve avere 1-64 caratteri stampabili
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	comando {name}: usa un id di 1-{MAX_COMMAND_ID} caratteri tra a-z 0-9 _ che inizi con una lettera
 @msg	command {name}: {e}	comando {name}: {e}
+@msg	manifest: {e}	manifest: {e}
+@msg	manifest: {e} at line {line} column {column}	manifest: {e} (riga {line}, colonna {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` deve essere un elenco di comandi, ciascuno con `id` e `label`
+@msg	command {name} must be an object with an `id` and a `label`	il comando {name} deve essere un oggetto con `id` e `label`
+@msg	missing field `{key}`	campo `{key}` mancante
+@msg	duplicate field `{key}`	campo `{key}` duplicato
 @msg	only a filter or a live effect declares `commands`	solo un filtro o un effetto dinamico dichiara `commands`
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	il modulo non ha lo SHA-256 indicato da `hash`: non è stato installato nulla
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index a33164f183..c380064663 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -290,6 +290,10 @@ digits	Malayalam	マラヤーラム数字
 	Blend Options…	ブレンドオプション…
 	Expand	拡張
 	Replace Spine	スパインを置き換え
+	Create Spine	スパインを作成
+	Create Spine:	スパインを作成:
+	Always	常に
+	Never	しない
 	Reverse Spine	スパインを反転
 	Reverse Front to Back	前後を反転
 	Envelope Distort	エンベロープ
@@ -2727,6 +2731,8 @@ mark-style	Japanese	日本式
 	Randomly change saturation and brightness	彩度と明度をランダムに変更
 	Range:	範囲:
 	Raster File Format:	ラスターファイル形式:
+	Include Placed Images	配置画像を含める
+	Include Fill Hatches	塗りのハッチングを含める
 	Raster Sample Size:	ラスターのサンプルサイズ:
 	Raster/Vector Balance:	ラスター／ベクターのバランス:
 	Rasterize Unsupported Art	非対応のアートをラスタライズ
@@ -5768,6 +5774,8 @@ axis	Y Axis	Y 軸
 	Version: {version}	バージョン: {version}
 	Install “{name}” in place of the plug-in with the same ID?	同じ ID のプラグインの代わりに「{name}」をインストールしますか？
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	このファイルは、以前にこの ID でインストールされていたプラグインではありません。この ID 用に保持されている設定とキャッシュを引き継ぎます。
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	自動操作がこのプラグインのインストールを要求しました。インストールするには、オブジェクト › プラグイン › プラグインをインストール… をご自身で選んでください。
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	自動操作がこのプラグインのインストールを要求しました。インストールするには、オブジェクト › プラグイン › プラグインをインストール… をご自身で選んでください。
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	「{name}」は ID {_1} のプラグインとは別のモジュールで、そのプラグイン用に保持されている設定とキャッシュを引き継ぐことになります。ユーザーが同意したら `replace: true` を指定してインストールしてください
 	File SHA-256: {hash}	ファイルの SHA-256: {hash}
 	Read the objects it is given	渡されたオブジェクトの読み取り
@@ -5830,6 +5838,12 @@ axis	Y Axis	Y 軸
 @msg	command {name}: `label` must be 1-64 printable characters	コマンド {name}: `label` は印刷可能な 1-64 文字にしてください
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	コマンド {name}: a-z 0-9 _ からなり英字で始まる 1-{MAX_COMMAND_ID} 文字の ID を使用してください
 @msg	command {name}: {e}	コマンド {name}: {e}
+@msg	manifest: {e}	マニフェスト: {e}
+@msg	manifest: {e} at line {line} column {column}	マニフェスト: {e} ({line} 行目、{column} 列目)
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` は、それぞれ `id` と `label` を持つコマンドのリストにしてください
+@msg	command {name} must be an object with an `id` and a `label`	コマンド {name} は `id` と `label` を持つオブジェクトにしてください
+@msg	missing field `{key}`	フィールド `{key}` がありません
+@msg	duplicate field `{key}`	フィールド `{key}` が重複しています
 @msg	only a filter or a live effect declares `commands`	`commands` を宣言できるのはフィルターかライブ効果だけです
 @msg	“{name}” › {label}: {e}	「{name}」 › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	モジュールの SHA-256 が `hash` の値と一致しません。何もインストールされませんでした
diff --git a/crates/ui-egui/src/i18n/ka.tsv b/crates/ui-egui/src/i18n/ka.tsv
index 3c2ce2a26e..9a557672e8 100644
--- a/crates/ui-egui/src/i18n/ka.tsv
+++ b/crates/ui-egui/src/i18n/ka.tsv
@@ -220,6 +220,10 @@
 	Blend Options…	გადასვლის პარამეტრები…
 	Expand	გაშლა
 	Replace Spine	ხერხემლის ჩანაცვლება
+	Create Spine	ხერხემლის შექმნა
+	Create Spine:	ხერხემლის შექმნა:
+	Always	ყოველთვის
+	Never	არასოდეს
 	Reverse Spine	ხერხემლის შებრუნება
 	Reverse Front to Back	რიგის შებრუნება წინიდან უკან
 	Envelope Distort	გარსით დეფორმაცია
@@ -2117,6 +2121,8 @@ digits	Malayalam	მალაიალამური
 	Export Selected Art Only	მხოლოდ მონიშნული ნახატის ექსპორტირება
 	Number of Colors:	ფერების რაოდენობა:
 	Raster File Format:	რასტრული ფაილის ფორმატი:
+	Include Placed Images	განთავსებული გამოსახულებების ჩართვა
+	Include Fill Hatches	შევსებების დაშტრიხვის ჩართვა
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	სრულ ფერს სჭირდება 2004 ან უფრო ახალი ვერსია: იწერება 256 ფერიდან უახლოესი.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	ტექსტი კონტურებად იქცევა, ხოლო ის კონტურები, რომლებსაც CAD-ხაზი ვერ ხატავს, შევსებულ ფიგურებად.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	ტექსტი ტექსტად რჩება, ყოველი კონტური კი ხაზია თავისი სისქითა და ტირეებით.
@@ -6029,6 +6035,8 @@ axis	Y Axis	Y ღერძი
 	Version: {version}	ვერსია: {version}
 	Install “{name}” in place of the plug-in with the same ID?	დავაყენოთ „{name}“ იმავე ID-ის მქონე პლაგინის ნაცვლად?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	ეს ფაილი არ არის ამ ID-ით ადრე დაყენებული პლაგინი. ის მიიღებს ამ ID-სთვის შენახულ პარამეტრებს და ქეშს.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	ავტომატიზაციამ ამ პლაგინის დაყენება მოითხოვა. მის დასაყენებლად აირჩიეთ ობიექტი › პლაგინები › პლაგინის დაყენება… თავად.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	ავტომატიზაციამ ამ პლაგინის დაყენება მოითხოვა. მის დასაყენებლად აირჩიეთ ობიექტი › პლაგინები › პლაგინის დაყენება… თავად.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	„{name}“ სხვა მოდულია, ვიდრე პლაგინი ID-ით {_1}, და მიიღებდა მისთვის შენახულ პარამეტრებს და ქეშს: მომხმარებლის თანხმობის შემდეგ დააყენეთ ის `replace: true` პარამეტრით
 	File SHA-256: {hash}	ფაილის SHA-256: {hash}
 	Read the objects it is given	მიღებული ობიექტების წაკითხვა
@@ -6091,6 +6099,12 @@ axis	Y Axis	Y ღერძი
 @msg	command {name}: `label` must be 1-64 printable characters	ბრძანება {name}: `label` უნდა შედგებოდეს 1-64 დასაბეჭდი სიმბოლოსგან
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	ბრძანება {name}: გამოიყენეთ 1-{MAX_COMMAND_ID} სიმბოლოიანი id a-z 0-9 _ სიმბოლოებიდან, რომელიც ასოთი იწყება
 @msg	command {name}: {e}	ბრძანება {name}: {e}
+@msg	manifest: {e}	მანიფესტი: {e}
+@msg	manifest: {e} at line {line} column {column}	მანიფესტი: {e} (სტრიქონი {line}, სვეტი {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` უნდა იყოს ბრძანებების სია, თითოეული `id`-ით და `label`-ით
+@msg	command {name} must be an object with an `id` and a `label`	ბრძანება {name} უნდა იყოს ობიექტი `id`-ით და `label`-ით
+@msg	missing field `{key}`	აკლია ველი `{key}`
+@msg	duplicate field `{key}`	ველი `{key}` ორჯერაა
 @msg	only a filter or a live effect declares `commands`	`commands`-ს მხოლოდ ფილტრი ან ცოცხალი ეფექტი აცხადებს
 @msg	“{name}” › {label}: {e}	„{name}“ › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	მოდულს არ აქვს `hash`-ში მითითებული SHA-256: არაფერი დაყენებულა
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index eb822f4793..4ab3a2c590 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -283,6 +283,10 @@ digits	Malayalam	말라얄람어
 	Blend Options…	블렌드 옵션…
 	Expand	확장
 	Replace Spine	스파인 바꾸기
+	Create Spine	스파인 만들기
+	Create Spine:	스파인 만들기:
+	Always	항상
+	Never	안 함
 	Reverse Spine	스파인 반전
 	Reverse Front to Back	앞뒤 반전
 	Envelope Distort	엔벨로프 왜곡
@@ -2717,6 +2721,8 @@ mark-style	Japanese	일본식
 	Randomly change saturation and brightness	채도와 명도를 무작위로 변경
 	Range:	범위:
 	Raster File Format:	래스터 파일 형식:
+	Include Placed Images	배치된 이미지 포함
+	Include Fill Hatches	칠 해치 포함
 	Raster Sample Size:	래스터 샘플 크기:
 	Raster/Vector Balance:	래스터/벡터 균형:
 	Rasterize Unsupported Art	지원되지 않는 아트웍 래스터화
@@ -5664,6 +5670,8 @@ axis	Y Axis	Y축
 	Version: {version}	버전: {version}
 	Install “{name}” in place of the plug-in with the same ID?	같은 ID의 플러그인 대신 “{name}”을(를) 설치하시겠습니까?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	이 파일은 이전에 이 ID로 설치된 플러그인이 아닙니다. 이 ID에 보관된 설정과 캐시를 받습니다.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	자동화가 이 플러그인 설치를 요청했습니다. 설치하려면 직접 개체 › 플러그인 › 플러그인 설치…를 선택하세요.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	자동화가 이 플러그인 설치를 요청했습니다. 설치하려면 직접 개체 › 플러그인 › 플러그인 설치…를 선택하세요.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}”은(는) ID {_1}의 플러그인과 다른 모듈이며 그 플러그인에 보관된 설정과 캐시를 받게 됩니다. 사용자가 동의하면 `replace: true`로 설치하세요
 	File SHA-256: {hash}	파일 SHA-256: {hash}
 	Read the objects it is given	전달받은 개체 읽기
@@ -5726,6 +5734,12 @@ axis	Y Axis	Y축
 @msg	command {name}: `label` must be 1-64 printable characters	명령 {name}: `label`은 인쇄 가능한 문자 1-64자여야 합니다
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	명령 {name}: a-z 0-9 _로 이루어지고 문자로 시작하는 1-{MAX_COMMAND_ID}자 ID를 사용하세요
 @msg	command {name}: {e}	명령 {name}: {e}
+@msg	manifest: {e}	매니페스트: {e}
+@msg	manifest: {e} at line {line} column {column}	매니페스트: {e} ({line}행 {column}열)
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands`는 각각 `id`와 `label`이 있는 명령 목록이어야 합니다
+@msg	command {name} must be an object with an `id` and a `label`	명령 {name}은(는) `id`와 `label`이 있는 객체여야 합니다
+@msg	missing field `{key}`	`{key}` 필드가 없습니다
+@msg	duplicate field `{key}`	`{key}` 필드가 중복되었습니다
 @msg	only a filter or a live effect declares `commands`	필터나 라이브 효과만 `commands`를 선언합니다
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	모듈의 SHA-256이 `hash`에 지정된 값과 다릅니다. 아무것도 설치되지 않았습니다
diff --git a/crates/ui-egui/src/i18n/nl.tsv b/crates/ui-egui/src/i18n/nl.tsv
index 828bf55a16..33eff87024 100644
--- a/crates/ui-egui/src/i18n/nl.tsv
+++ b/crates/ui-egui/src/i18n/nl.tsv
@@ -262,6 +262,10 @@
 	Blend Options…	Vermengopties…
 	Expand	Uitbreiden
 	Replace Spine	Rug vervangen
+	Create Spine	Rug maken
+	Create Spine:	Rug maken:
+	Always	Altijd
+	Never	Nooit
 	Reverse Spine	Rug omkeren
 	Reverse Front to Back	Van voor naar achter omkeren
 	Envelope Distort	Envelopvervorming
@@ -2208,6 +2212,8 @@ digits	Malayalam	Malayalam
 	Export Selected Art Only	Alleen geselecteerde artwork exporteren
 	Number of Colors:	Aantal kleuren:
 	Raster File Format:	Rasterbestandsindeling:
+	Include Placed Images	Geplaatste afbeeldingen opnemen
+	Include Fill Hatches	Arceringen van vullingen opnemen
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Echte kleur vereist versie 2004 of later: de dichtstbijzijnde van 256 kleuren wordt weggeschreven.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Tekst wordt omlijningen, en lijnen die een CAD-lijn niet kan tekenen, worden gevulde vormen.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Tekst blijft tekst en elke lijn wordt een lijn met zijn eigen lijndikte en streepjes.
@@ -5958,6 +5964,7 @@ axis	Y Axis	Y-as
 	Version: {version}	Versie: {version}
 	Install “{name}” in place of the plug-in with the same ID?	„{name}” installeren in plaats van de plug-in met dezelfde ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Dit bestand is niet de plug-in die eerder met deze ID was geïnstalleerd. Het krijgt de instellingen en cache die voor die ID bewaard zijn.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Een automatisering heeft gevraagd deze plug-in te installeren. Kies zelf Object › Plug-ins › Plug-in installeren… om hem te installeren.
 	File SHA-256: {hash}	SHA-256 van het bestand: {hash}
 	Read the objects it is given	De objecten lezen die het krijgt
 	Change, add and delete objects in the document	Objecten in het document wijzigen, toevoegen en verwijderen
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index e56e607ceb..0b80b55005 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -226,6 +226,10 @@
 	Blend Options…	Opcje przejścia…
 	Expand	Rozszerz
 	Replace Spine	Zastąp grzbiet
+	Create Spine	Utwórz grzbiet
+	Create Spine:	Utwórz grzbiet:
+	Always	Zawsze
+	Never	Nigdy
 	Reverse Spine	Odwróć grzbiet
 	Reverse Front to Back	Odwróć kolejność od przodu do tyłu
 	Envelope Distort	Zniekształcenie kopertowe
@@ -2306,6 +2310,8 @@ digits	Malayalam	Malajalam
 	Export Selected Art Only	Eksportuj tylko zaznaczoną kompozycję
 	Number of Colors:	Liczba kolorów:
 	Raster File Format:	Format pliku rastrowego:
+	Include Placed Images	Uwzględnij umieszczone obrazy
+	Include Fill Hatches	Uwzględnij kreskowania wypełnień
 	True colour needs version 2004 or later: the nearest of 256 colours is written.	Pełny kolor wymaga wersji 2004 lub nowszej: zapisywany jest najbliższy z 256 kolorów.
 	Type becomes outlines, and strokes a CAD line can't draw become filled shapes.	Tekst staje się konturami, a obrysy, których linia CAD nie narysuje, stają się wypełnionymi kształtami.
 	Type stays text, and every stroke is a line with its lineweight and dashes.	Tekst pozostaje tekstem, a każdy obrys jest linią z grubością i kreskami.
@@ -5932,6 +5938,8 @@ axis	Y Axis	Oś Y
 	Version: {version}	Wersja: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Zainstalować „{name}” zamiast wtyczki o tym samym ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Ten plik nie jest wtyczką zainstalowaną wcześniej z tym ID. Otrzyma ustawienia i pamięć podręczną przechowywane dla tego ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Automatyzacja poprosiła o zainstalowanie tej wtyczki. Aby ją zainstalować, wybierz Obiekt › Wtyczki › Zainstaluj wtyczkę… samodzielnie.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Automatyzacja poprosiła o zainstalowanie tej wtyczki. Aby ją zainstalować, wybierz Obiekt › Wtyczki › Zainstaluj wtyczkę… samodzielnie.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	„{name}” to inny moduł niż wtyczka o ID {_1} i otrzymałby przechowywane dla niej ustawienia i pamięć podręczną: zainstaluj go z `replace: true`, gdy użytkownik się zgodzi
 	File SHA-256: {hash}	SHA-256 pliku: {hash}
 	Read the objects it is given	Odczytywać obiekty, które otrzymuje
@@ -5994,6 +6002,12 @@ axis	Y Axis	Oś Y
 @msg	command {name}: `label` must be 1-64 printable characters	polecenie {name}: `label` musi mieć 1-64 drukowalnych znaków
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	polecenie {name}: użyj id z 1-{MAX_COMMAND_ID} znaków spośród a-z 0-9 _, zaczynającego się od litery
 @msg	command {name}: {e}	polecenie {name}: {e}
+@msg	manifest: {e}	manifest: {e}
+@msg	manifest: {e} at line {line} column {column}	manifest: {e} (wiersz {line}, kolumna {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` musi być listą poleceń, każde z `id` i `label`
+@msg	command {name} must be an object with an `id` and a `label`	polecenie {name} musi być obiektem z `id` i `label`
+@msg	missing field `{key}`	brak pola `{key}`
+@msg	duplicate field `{key}`	zduplikowane pole `{key}`
 @msg	only a filter or a live effect declares `commands`	`commands` deklaruje tylko filtr lub efekt na żywo
 @msg	“{name}” › {label}: {e}	„{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	moduł nie ma skrótu SHA-256 podanego w `hash`: nic nie zainstalowano
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 0f9f38b22f..fffafe665f 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -2203,6 +2203,8 @@ digits	Malayalam	Malaiala
 	Range:	Intervalo:
 	Raster Effects	Efeitos de Raster
 	Raster File Format:	Formato de Arquivo Raster:
+	Include Placed Images	Incluir Imagens Inseridas
+	Include Fill Hatches	Incluir Hachuras dos Preenchimentos
 	Raster Sample Size:	Tamanho da Amostra Raster:
 	Raster/Vector Balance:	Equilíbrio Raster/Vetor:
 	Rasterize Unsupported Art	Rasterizar Arte Não Suportada
@@ -2358,6 +2360,10 @@ digits	Malayalam	Malaiala
 	Replace:	Substituir:
 	Replace Font	Substituir Fonte
 	Replace Spine	Substituir Coluna
+	Create Spine	Criar Coluna
+	Create Spine:	Criar Coluna:
+	Always	Sempre
+	Never	Nunca
 	Replace Symbol	Substituir Símbolo
 	Reset Transformation	Redefinir Transformação
 	Replace With Font	Substituir Com Fonte
@@ -5993,6 +5999,8 @@ axis	Y Axis	Eixo Y
 	Version: {version}	Versão: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Instalar “{name}” no lugar do plug-in com o mesmo ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Este arquivo não é o plug-in instalado antes com este ID. Ele recebe as configurações e o cache guardados para esse ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Uma automação pediu para instalar este plug-in. Para instalá-lo, escolha Objeto › Plug-ins › Instalar Plug-in… você mesmo.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Uma automação pediu para instalar este plug-in. Para instalá-lo, escolha Objeto › Plug-ins › Instalar Plug-in… você mesmo.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}” é um módulo diferente do plug-in com ID {_1} e receberia as configurações e o cache guardados para ele: instale-o com `replace: true` depois que o usuário concordar
 	File SHA-256: {hash}	SHA-256 do arquivo: {hash}
 	Read the objects it is given	Ler os objetos que recebe
@@ -6055,6 +6063,12 @@ axis	Y Axis	Eixo Y
 @msg	command {name}: `label` must be 1-64 printable characters	comando {name}: `label` deve ter 1-64 caracteres imprimíveis
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	comando {name}: use um id de 1-{MAX_COMMAND_ID} caracteres de a-z 0-9 _ que comece com uma letra
 @msg	command {name}: {e}	comando {name}: {e}
+@msg	manifest: {e}	manifesto: {e}
+@msg	manifest: {e} at line {line} column {column}	manifesto: {e} (linha {line}, coluna {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` deve ser uma lista de comandos, cada um com `id` e `label`
+@msg	command {name} must be an object with an `id` and a `label`	o comando {name} deve ser um objeto com `id` e `label`
+@msg	missing field `{key}`	falta o campo `{key}`
+@msg	duplicate field `{key}`	campo `{key}` duplicado
 @msg	only a filter or a live effect declares `commands`	só um filtro ou um efeito dinâmico declara `commands`
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	o módulo não tem o SHA-256 indicado em `hash`: nada foi instalado
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 291f35ebb2..2bf552686b 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2670,6 +2670,8 @@ digits	Malayalam	Малаялам
 	Range:	Диапазон:
 	Raster Effects	Растровые эффекты
 	Raster File Format:	Формат растрового файла:
+	Include Placed Images	Включать размещенные изображения
+	Include Fill Hatches	Включать штриховку заливок
 	Raster Sample Size:	Размер растрового образца:
 	Raster/Vector Balance:	Баланс растровых/векторных:
 	Rasterize	Растеризовать
@@ -2851,6 +2853,10 @@ digits	Malayalam	Малаялам
 	Replace Font	Заменить шрифт
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Замените его другим файлом или игнорируйте: его изображения продолжат показывать предварительный просмотр, сохранённый с документом.
 	Replace Spine	Заменить остов
+	Create Spine	Создать остов
+	Create Spine:	Создать остов:
+	Always	Всегда
+	Never	Никогда
 	Replace Symbol	Заменить символ
 	Reset Transformation	Сбросить трансформацию
 	Replace With Font	Заменить шрифтом
@@ -5689,6 +5695,8 @@ axis	Y Axis	Ось Y
 	Version: {version}	Версия: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Установить «{name}» вместо модуля с тем же ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Этот файл не является модулем, установленным ранее с этим ID. Он получит настройки и кэш, сохранённые для этого ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Автоматизация запросила установку этого модуля. Чтобы установить его, выберите «Объект › Модули › Установить модуль…» сами.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Автоматизация запросила установку этого модуля. Чтобы установить его, выберите «Объект › Модули › Установить модуль…» сами.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	«{name}» отличается от модуля с ID {_1} и получил бы сохранённые для него настройки и кэш: установите его с `replace: true`, когда пользователь согласится
 	File SHA-256: {hash}	SHA-256 файла: {hash}
 	Read the objects it is given	Читать переданные ему объекты
@@ -5751,6 +5759,12 @@ axis	Y Axis	Ось Y
 @msg	command {name}: `label` must be 1-64 printable characters	команда {name}: `label` должен содержать 1-64 печатаемых символа
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	команда {name}: используйте id из 1-{MAX_COMMAND_ID} символов a-z 0-9 _, начинающийся с буквы
 @msg	command {name}: {e}	команда {name}: {e}
+@msg	manifest: {e}	манифест: {e}
+@msg	manifest: {e} at line {line} column {column}	манифест: {e} (строка {line}, столбец {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` должно быть списком команд, у каждой из которых есть `id` и `label`
+@msg	command {name} must be an object with an `id` and a `label`	команда {name} должна быть объектом с `id` и `label`
+@msg	missing field `{key}`	нет поля `{key}`
+@msg	duplicate field `{key}`	поле `{key}` указано дважды
 @msg	only a filter or a live effect declares `commands`	`commands` объявляет только фильтр или динамический эффект
 @msg	“{name}” › {label}: {e}	«{name}» › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	у модуля не тот SHA-256, что указан в `hash`: ничего не установлено
diff --git a/crates/ui-egui/src/i18n/sv.tsv b/crates/ui-egui/src/i18n/sv.tsv
index 2c4f4759c4..d267aa2658 100644
--- a/crates/ui-egui/src/i18n/sv.tsv
+++ b/crates/ui-egui/src/i18n/sv.tsv
@@ -2578,6 +2578,8 @@ digits	Malayalam	Malayalam
 	Range:	Omfång:
 	Raster Effects	Rastereffekter
 	Raster File Format:	Rasterfilformat:
+	Include Placed Images	Inkludera placerade bilder
+	Include Fill Hatches	Inkludera skrafferingar av fyllningar
 	Raster Sample Size:	Samplingsstorlek för raster:
 	Raster/Vector Balance:	Raster-/vektorbalans:
 	Rasterize	Rastrera
@@ -2758,6 +2760,10 @@ digits	Malayalam	Malayalam
 	Replace Font	Ersätt typsnitt
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Ersätt den med en annan fil eller ignorera den: dess bilder fortsätter att visa förhandsgranskningen som sparats med dokumentet.
 	Replace Spine	Ersätt ryggrad
+	Create Spine	Skapa ryggrad
+	Create Spine:	Skapa ryggrad:
+	Always	Alltid
+	Never	Aldrig
 	Replace Symbol	Ersätt symbol
 	Reset Transformation	Återställ transformering
 	Replace With Font	Ersätt med typsnitt
@@ -6100,6 +6106,8 @@ axis	Y Axis	Y-axel
 	Version: {version}	Version: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Installera ”{name}” i stället för det plugin som har samma id?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Den här filen är inte det plugin som tidigare installerades med detta id. Den får de inställningar och den cache som sparats för detta id.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	En automatisering bad om att installera det här pluginet. Välj själv Objekt › Plugins › Installera plugin… för att installera det.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	En automatisering bad om att installera det här pluginet. Välj själv Objekt › Plugins › Installera plugin… för att installera det.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	”{name}” är en annan modul än pluginet med id {_1} och skulle få de inställningar och den cache som sparats för det: installera det med `replace: true` när användaren har godkänt
 	File SHA-256: {hash}	Filens SHA-256: {hash}
 	Read the objects it is given	Läsa objekten den får
@@ -6158,6 +6166,11 @@ axis	Y Axis	Y-axel
 @msg	command {name}: `label` must be 1-64 printable characters	kommando {name}: `label` måste ha 1-64 utskrivbara tecken
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	kommando {name}: använd ett id med 1-{MAX_COMMAND_ID} tecken av a-z 0-9 _ som börjar med en bokstav
 @msg	command {name}: {e}	kommando {name}: {e}
+@msg	manifest: {e} at line {line} column {column}	manifest: {e} (rad {line}, kolumn {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` måste vara en lista med kommandon, vart och ett med `id` och `label`
+@msg	command {name} must be an object with an `id` and a `label`	kommandot {name} måste vara ett objekt med `id` och `label`
+@msg	missing field `{key}`	fältet `{key}` saknas
+@msg	duplicate field `{key}`	fältet `{key}` förekommer två gånger
 @msg	only a filter or a live effect declares `commands`	bara ett filter eller en live-effekt deklarerar `commands`
 @msg	“{name}” › {label}: {e}	”{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	modulen har inte den SHA-256 som `hash` anger: ingenting installerades
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index 4d0b3a9eb4..be5c132dbd 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -2027,6 +2027,38 @@ fn plugin_limit_errors_are_translated() {
     }
 }
 
+/// A manifest whose `commands` value has the wrong shape is refused with an error that every
+/// language of [`COMPLETE_MESSAGES`] translates whole, the command's name and the place in the
+/// manifest included.
+#[test]
+fn wrongly_shaped_plugin_commands_errors_are_translated() {
+    let many: Vec<String> = (0..=32).map(|i| format!(r#"{{"id":"c{i}","label":"C"}}"#)).collect();
+    let commands = [
+        r#"{"id":"x"}"#.to_string(),
+        r#""x""#.to_string(),
+        "[1]".to_string(),
+        r#"[{"id":1,"label":"A"}]"#.to_string(),
+        r#"[{"id":"x","label":true}]"#.to_string(),
+        r#"[{"label":"B"}]"#.to_string(),
+        r#"[{"id":"x"}]"#.to_string(),
+        r#"[{"id":"x","id":"y","label":"A"}]"#.to_string(),
+        format!("[{}]", many.join(",")),
+    ];
+    let english = ["must", "list", "missing", "field", "duplicate", "object", "line", "column", "each", "with", "invalid", "expected"];
+    for value in &commands {
+        let manifest = format!(r#"{{"id":"a","name":"x","kind":"filter","commands":{value}}}"#);
+        let e = vectorcraft_plugins::manifest::Manifest::parse(manifest.as_bytes()).unwrap_err().to_string();
+        let numbers: Vec<&str> = e.split(|c: char| !c.is_ascii_digit()).filter(|n| !n.is_empty()).collect();
+        for code in COMPLETE_MESSAGES {
+            let shown = message(Lang::from_code(code).expect("registered"), &e);
+            // Backticked names stay in English; the words around them are translated.
+            let words: String = shown.split('`').step_by(2).collect();
+            assert!(words.split(|c: char| !c.is_alphabetic()).all(|w| !english.contains(&w)), "{code}: {e} -> {shown}");
+            assert!(numbers.iter().all(|n| shown.contains(n)), "{code}: {e} -> {shown}");
+        }
+    }
+}
+
 /// The warnings of an Image Trace with keepColors, which the status bar shows and the scan above
 /// doesn't read, are translated in each language of [`COMPLETE_MESSAGES`], with the colors kept.
 #[test]
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 55567feb22..e30578bc0f 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -2450,6 +2450,8 @@ digits	Malayalam	Malayalam
 	Range:	Aralık:
 	Raster Effects	Raster Efektleri
 	Raster File Format:	Raster Dosya Formatı:
+	Include Placed Images	Yerleştirilen Görüntüleri Dahil Et
+	Include Fill Hatches	Dolgu Taramalarını Dahil Et
 	Raster Sample Size:	Raster Örnek Boyutu:
 	Raster/Vector Balance:	Raster/Vektör Dengesi:
 	Rasterize	Rasterleştir
@@ -2627,6 +2629,10 @@ digits	Malayalam	Malayalam
 	Replace Font	Yazı Tipini Değiştir
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Onu başka bir dosyayla değiştirin veya yok sayın: resimleri, belgeyle birlikte kaydedilen önizlemeyi göstermeye devam eder.
 	Replace Spine	Omurgayı Değiştir
+	Create Spine	Omurga Oluştur
+	Create Spine:	Omurga Oluştur:
+	Always	Her Zaman
+	Never	Asla
 	Replace Symbol	Sembolü Değiştir
 	Reset Transformation	Dönüşümü Sıfırla
 	Replace With Font	Yazı Tipiyle Değiştir
@@ -6034,6 +6040,8 @@ axis	Y Axis	Y ekseni
 	Version: {version}	Sürüm: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Aynı kimliğe sahip eklentinin yerine “{name}” yüklensin mi?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Bu dosya, daha önce bu kimlikle yüklenen eklenti değil. O kimlik için saklanan ayarları ve önbelleği alır.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Bir otomasyon bu eklentinin yüklenmesini istedi. Yüklemek için Nesne › Eklentiler › Eklentiyi Yükle… komutunu kendiniz seçin.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Bir otomasyon bu eklentinin yüklenmesini istedi. Yüklemek için Nesne › Eklentiler › Eklentiyi Yükle… komutunu kendiniz seçin.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}”, {_1} kimlikli eklentiden farklı bir modül ve onun için saklanan ayarları ve önbelleği alacak: kullanıcı onayladıktan sonra `replace: true` ile yükleyin
 	File SHA-256: {hash}	Dosya SHA-256: {hash}
 	Read the objects it is given	Kendisine verilen nesneleri okuma
@@ -6096,6 +6104,12 @@ axis	Y Axis	Y ekseni
 @msg	command {name}: `label` must be 1-64 printable characters	{name} komutu: `label` 1-64 yazdırılabilir karakter olmalıdır
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	{name} komutu: a-z 0-9 _ karakterlerinden oluşan ve harfle başlayan 1-{MAX_COMMAND_ID} karakterlik bir kimlik kullanın
 @msg	command {name}: {e}	{name} komutu: {e}
+@msg	manifest: {e}	bildirim: {e}
+@msg	manifest: {e} at line {line} column {column}	bildirim: {e} (satır {line}, sütun {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands`, her biri `id` ve `label` içeren bir komut listesi olmalıdır
+@msg	command {name} must be an object with an `id` and a `label`	{name} komutu `id` ve `label` içeren bir nesne olmalıdır
+@msg	missing field `{key}`	`{key}` alanı eksik
+@msg	duplicate field `{key}`	`{key}` alanı yinelenmiş
 @msg	only a filter or a live effect declares `commands`	`commands` yalnızca bir filtre veya canlı efekt tarafından bildirilir
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	modül `hash` içinde verilen SHA-256 değerine sahip değil: hiçbir şey yüklenmedi
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 67aab25e07..ed168e0905 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2675,6 +2675,8 @@ digits	Malayalam	Малаялам
 	Range:	Діапазон:
 	Raster Effects	Растрові ефекти
 	Raster File Format:	Формат растрового файлу:
+	Include Placed Images	Включати розміщені зображення
+	Include Fill Hatches	Включати штрихування заливок
 	Raster Sample Size:	Розмір растрового зразка:
 	Raster/Vector Balance:	Баланс растрових/векторних:
 	Rasterize	Растеризувати
@@ -2856,6 +2858,10 @@ digits	Malayalam	Малаялам
 	Replace Font	Замінити шрифт
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Замініть його іншим файлом або ігноруйте: зображення продовжать показувати попередній перегляд, збережений з документом.
 	Replace Spine	Замінити вісь
+	Create Spine	Створити вісь
+	Create Spine:	Створити вісь:
+	Always	Завжди
+	Never	Ніколи
 	Replace Symbol	Замінити символ
 	Reset Transformation	Скинути трансформацію
 	Replace With Font	Замінити шрифтом
@@ -5683,6 +5689,8 @@ axis	Y Axis	Вісь Y
 	Version: {version}	Версія: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Встановити «{name}» замість модуля з тим самим ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Цей файл не є модулем, установленим раніше з цим ID. Він отримає налаштування й кеш, збережені для цього ID.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Автоматизація попросила встановити цей модуль. Щоб установити його, виберіть «Об’єкт › Модулі › Встановити модуль…» самостійно.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Автоматизація попросила встановити цей модуль. Щоб установити його, виберіть «Об’єкт › Модулі › Встановити модуль…» самостійно.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	«{name}» відрізняється від модуля з ID {_1} і отримав би збережені для нього налаштування й кеш: встановіть його з `replace: true`, коли користувач погодиться
 	File SHA-256: {hash}	SHA-256 файлу: {hash}
 	Read the objects it is given	Читати передані йому об’єкти
@@ -5745,6 +5753,12 @@ axis	Y Axis	Вісь Y
 @msg	command {name}: `label` must be 1-64 printable characters	команда {name}: `label` має містити 1-64 друковані символи
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	команда {name}: використайте id з 1-{MAX_COMMAND_ID} символів a-z 0-9 _, що починається з літери
 @msg	command {name}: {e}	команда {name}: {e}
+@msg	manifest: {e}	маніфест: {e}
+@msg	manifest: {e} at line {line} column {column}	маніфест: {e} (рядок {line}, стовпець {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` має бути списком команд, кожна з `id` і `label`
+@msg	command {name} must be an object with an `id` and a `label`	команда {name} має бути об'єктом з `id` і `label`
+@msg	missing field `{key}`	немає поля `{key}`
+@msg	duplicate field `{key}`	поле `{key}` вказано двічі
 @msg	only a filter or a live effect declares `commands`	`commands` оголошує лише фільтр або динамічний ефект
 @msg	“{name}” › {label}: {e}	«{name}» › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	модуль має не той SHA-256, що вказаний у `hash`: нічого не встановлено
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index f6c5f9b816..e83518dc6e 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2981,6 +2981,8 @@ mark-style	Japanese	Kiểu Nhật
 	Range:	Phạm vi:
 	Raster Effects	Hiệu ứng raster
 	Raster File Format:	Định dạng tệp raster:
+	Include Placed Images	Bao gồm ảnh đã đặt
+	Include Fill Hatches	Bao gồm mẫu gạch của vùng tô
 	Raster Sample Size:	Kích thước mẫu raster:
 	Raster/Vector Balance:	Cân bằng raster/vector:
 	Rasterize	Raster hóa
@@ -3138,6 +3140,10 @@ mark-style	Japanese	Kiểu Nhật
 	Replace Font	Thay thế phông chữ
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	Thay thế bằng tệp khác hoặc bỏ qua: ảnh của nó vẫn hiển thị bản xem trước đã lưu cùng tài liệu.
 	Replace Spine	Thay thế trục
+	Create Spine	Tạo trục
+	Create Spine:	Tạo trục:
+	Always	Luôn luôn
+	Never	Không bao giờ
 	Replace Symbol	Thay thế ký hiệu
 	Reset Transformation	Đặt lại biến đổi
 	Replace With Font	Thay thế bằng phông chữ
@@ -5684,6 +5690,8 @@ axis	Y Axis	Trục Y
 	Version: {version}	Phiên bản: {version}
 	Install “{name}” in place of the plug-in with the same ID?	Cài đặt “{name}” thay cho plug-in có cùng ID?
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	Tệp này không phải là plug-in đã cài đặt trước đây với ID này. Tệp sẽ nhận cài đặt và bộ nhớ đệm được lưu cho ID đó.
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Một tác vụ tự động đã yêu cầu cài đặt plug-in này. Để cài đặt, hãy tự mình chọn lệnh Đối tượng › Plug-in › Cài đặt plug-in… trong menu.
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	Một tác vụ tự động đã yêu cầu cài đặt plug-in này. Để cài đặt, hãy tự mình chọn lệnh Đối tượng › Plug-in › Cài đặt plug-in… trong menu.
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}” là mô-đun khác với plug-in có ID {_1} và sẽ nhận cài đặt và bộ nhớ đệm được lưu cho plug-in đó: hãy cài đặt với `replace: true` khi người dùng đồng ý
 	File SHA-256: {hash}	SHA-256 của tệp: {hash}
 	Read the objects it is given	Đọc các đối tượng được trao cho nó
@@ -5746,6 +5754,12 @@ axis	Y Axis	Trục Y
 @msg	command {name}: `label` must be 1-64 printable characters	lệnh {name}: `label` phải có 1-64 ký tự in được
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	lệnh {name}: hãy dùng id gồm 1-{MAX_COMMAND_ID} ký tự từ a-z 0-9 _ và bắt đầu bằng một chữ cái
 @msg	command {name}: {e}	lệnh {name}: {e}
+@msg	manifest: {e}	manifest: {e}
+@msg	manifest: {e} at line {line} column {column}	manifest: {e} (dòng {line}, cột {column})
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` phải là một danh sách lệnh, mỗi lệnh có `id` và `label`
+@msg	command {name} must be an object with an `id` and a `label`	lệnh {name} phải là một đối tượng có `id` và `label`
+@msg	missing field `{key}`	thiếu trường `{key}`
+@msg	duplicate field `{key}`	trường `{key}` bị lặp
 @msg	only a filter or a live effect declares `commands`	chỉ bộ lọc hoặc hiệu ứng trực tiếp mới khai báo `commands`
 @msg	“{name}” › {label}: {e}	“{name}” › {label}: {e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	mô-đun không có SHA-256 mà `hash` cho biết: không có gì được cài đặt
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index b3c90c7a9e..72ec2b8c36 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2543,6 +2543,8 @@ digits	Malayalam	马拉雅拉姆数字
 	Range:	范围：
 	Raster Effects	栅格效果
 	Raster File Format:	栅格文件格式：
+	Include Placed Images	包含置入的图像
+	Include Fill Hatches	包含填色的图案填充
 	Raster Sample Size:	栅格取样大小：
 	Raster/Vector Balance:	栅格/矢量平衡：
 	Rasterize	栅格化
@@ -2722,6 +2724,10 @@ digits	Malayalam	马拉雅拉姆数字
 	Replace Font	替换字体
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	将其替换为其他文件，或忽略：其图像继续显示随文档保存的预览。
 	Replace Spine	替换脊线
+	Create Spine	创建脊线
+	Create Spine:	创建脊线：
+	Always	始终
+	Never	从不
 	Replace Symbol	替换符号
 	Reset Transformation	重置变换
 	Replace With Font	替换为字体
@@ -5916,6 +5922,8 @@ axis	Y Axis	Y 轴
 	Version: {version}	版本：{version}
 	Install “{name}” in place of the plug-in with the same ID?	要安装“{name}”来替换具有相同 ID 的插件吗？
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	此文件不是之前以此 ID 安装的插件。它将获得为该 ID 保存的设置和缓存。
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	自动化请求安装此增效工具。要安装它，请自行选择“对象 › 增效工具 › 安装增效工具…”。
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	自动化请求安装此增效工具。要安装它，请自行选择“对象 › 增效工具 › 安装增效工具…”。
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	“{name}”与 ID 为 {_1} 的插件是不同的模块，并会获得为其保存的设置和缓存：请在用户同意后使用 `replace: true` 安装
 	File SHA-256: {hash}	文件 SHA-256：{hash}
 	Read the objects it is given	读取交给它的对象
@@ -5978,6 +5986,12 @@ axis	Y Axis	Y 轴
 @msg	command {name}: `label` must be 1-64 printable characters	命令 {name}：`label` 必须是 1-64 个可打印字符
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	命令 {name}：请使用由 a-z 0-9 _ 组成、以字母开头的 1-{MAX_COMMAND_ID} 个字符的 ID
 @msg	command {name}: {e}	命令 {name}：{e}
+@msg	manifest: {e}	清单：{e}
+@msg	manifest: {e} at line {line} column {column}	清单：{e}（第 {line} 行，第 {column} 列）
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` 必须是命令列表，每个命令都有 `id` 和 `label`
+@msg	command {name} must be an object with an `id` and a `label`	命令 {name} 必须是包含 `id` 和 `label` 的对象
+@msg	missing field `{key}`	缺少字段 `{key}`
+@msg	duplicate field `{key}`	字段 `{key}` 重复
 @msg	only a filter or a live effect declares `commands`	只有滤镜或实时效果才能声明 `commands`
 @msg	“{name}” › {label}: {e}	“{name}” › {label}：{e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	模块的 SHA-256 与 `hash` 给出的不符：未安装任何内容
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 325023fcbb..6fed5ca832 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -3647,6 +3647,8 @@ digits	Malayalam	馬來亞拉姆數字
 	Range:	範圍：
 	Raster Effects	點陣效果
 	Raster File Format:	點陣檔案格式：
+	Include Placed Images	包含置入的影像
+	Include Fill Hatches	包含填色的圖案填充
 	Raster Sample Size:	點陣取樣大小：
 	Raster/Vector Balance:	點陣／向量平衡：
 	Rasterize	點陣化
@@ -3828,6 +3830,10 @@ digits	Malayalam	馬來亞拉姆數字
 	Replace Font	取代字體
 	Replace it with another file, or ignore it: its images keep showing the preview saved with the document.	以其他檔案取代，或忽略：其影像會繼續顯示隨文件儲存的預覽。
 	Replace Spine	取代脊線
+	Create Spine	建立脊線
+	Create Spine:	建立脊線：
+	Always	一律
+	Never	永不
 	Replace Symbol	取代符號
 	Reset Transformation	重設變形
 	Replace With Font	取代為字體
@@ -5721,6 +5727,8 @@ axis	Y Axis	Y 軸
 	Version: {version}	版本：{version}
 	Install “{name}” in place of the plug-in with the same ID?	要安裝「{name}」來取代具有相同 ID 的增效模組嗎？
 	This file is not the plug-in installed before with this ID. It gets the settings and cache kept for that ID.	此檔案不是先前以此 ID 安裝的增效模組。它會取得為該 ID 保存的設定和快取。
+	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	自動化要求安裝此增效模組。若要安裝，請自行選擇「物件 › 增效模組 › 安裝增效模組…」。
+@msg	Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.	自動化要求安裝此增效模組。若要安裝，請自行選擇「物件 › 增效模組 › 安裝增效模組…」。
 @msg	“{name}” is another module than the plug-in with id {_1} and would get the settings and cache kept for it: install it with `replace: true` once the user agrees	「{name}」與 ID 為 {_1} 的增效模組是不同的模組，並會取得為其保存的設定和快取：請在使用者同意後以 `replace: true` 安裝
 	File SHA-256: {hash}	檔案 SHA-256：{hash}
 	Read the objects it is given	讀取交給它的物件
@@ -5783,6 +5791,12 @@ axis	Y Axis	Y 軸
 @msg	command {name}: `label` must be 1-64 printable characters	指令 {name}：`label` 必須是 1-64 個可列印字元
 @msg	command {name}: use an id of 1-{MAX_COMMAND_ID} characters from a-z 0-9 _ that starts with a letter	指令 {name}：請使用由 a-z 0-9 _ 組成、以字母開頭的 1-{MAX_COMMAND_ID} 個字元的 ID
 @msg	command {name}: {e}	指令 {name}：{e}
+@msg	manifest: {e}	資訊清單：{e}
+@msg	manifest: {e} at line {line} column {column}	資訊清單：{e}（第 {line} 行，第 {column} 欄）
+@msg	`commands` must be a list of commands, each with an `id` and a `label`	`commands` 必須是指令清單，每個指令都有 `id` 和 `label`
+@msg	command {name} must be an object with an `id` and a `label`	指令 {name} 必須是包含 `id` 和 `label` 的物件
+@msg	missing field `{key}`	找不到欄位 `{key}`
+@msg	duplicate field `{key}`	欄位 `{key}` 重複
 @msg	only a filter or a live effect declares `commands`	只有濾鏡或即時效果才能宣告 `commands`
 @msg	“{name}” › {label}: {e}	「{name}」 › {label}：{e}
 @msg	the module doesn't have the SHA-256 `hash` gives: nothing was installed	模組的 SHA-256 與 `hash` 提供的不符：未安裝任何內容
diff --git a/crates/ui-egui/src/io/open.rs b/crates/ui-egui/src/io/open.rs
index 3ca34cdd77..4bdee0a6b6 100644
--- a/crates/ui-egui/src/io/open.rs
+++ b/crates/ui-egui/src/io/open.rs
@@ -215,16 +215,24 @@ fn permission_words(name: &str, commands: &[String]) -> String {
 /// place of another one with its id and get its settings and cache (`replace`); OK installs it if
 /// the module still has the hash the prompt showed, Cancel installs nothing → `{pending}` while it
 /// asks. The `grant` and `allowHeavy` of a request are ignored: only the dialog's OK approves.
+/// Every question opens the approval dialog ([`dialogs::plugin::ask_install`]). When automation
+/// asked ([`VectorcraftApp::automation_asked`]), the question has no OK that installs, its
+/// `replace: true` doesn't skip asking about replacing, and the answer while it asks adds
+/// `approval: "personMustStartInstall"`: the person starts Install Plug-in… to install it.
 /// Every text from the manifest is shown with its hidden characters escaped and its length capped
 /// ([`permissions::display_text`]).
 pub fn install_module(app: &mut VectorcraftApp, module: Value) -> Result<Value, String> {
+    let origin = if app.automation_asked() { dialogs::plugin::InstallOrigin::Automation } else { dialogs::plugin::InstallOrigin::Person };
+    let automated = origin == dialogs::plugin::InstallOrigin::Automation;
     let given = |k: &str| module.get(k).map(|v| (k.to_string(), v.clone()));
     let source = Value::Object(["path", "dataBase64", "name"].into_iter().filter_map(given).collect());
     let mut install = Value::Object(["path", "dataBase64", "name", "replace", "hash"].into_iter().filter_map(given).collect());
     let info = app.run("plugin.inspect", source)?;
     let (needs_grant, heavy) = (info["needsApproval"] == true, info["budget"] == "heavy");
-    // `replace: false` asks for no replacing, so only a module without `replace` asks.
-    let asks_replace = module.get("replace").is_none_or(Value::is_null) && info["needsReplace"] == true;
+    // `replace: false` asks for no replacing, so only a module without `replace` asks, or one whose
+    // `replace: true` automation gave.
+    let replace = module.get("replace").filter(|v| !v.is_null());
+    let asks_replace = info["needsReplace"] == true && replace.is_none_or(|r| automated && *r == true);
     if !needs_grant && !heavy && !asks_replace {
         let r = app.run("plugin.install", install)?;
         report_installed(app, &r);
@@ -245,13 +253,8 @@ pub fn install_module(app: &mut VectorcraftApp, module: Value) -> Result<Value,
     if asks_replace {
         install["replace"] = json!(true);
     }
-    // A client may pass `replace` itself, so taking another module's place alone needs no approval
-    // that only a person can give.
-    if !needs_grant && !heavy {
-        let message = crate::i18n::fmt(tl!("Install “{name}” in place of the plug-in with the same ID?"), &[("name", &name)]);
-        dialogs::confirm::ask(app, &message, &format!("{identity}\n\n{takes_place}"), "ui.installPlugin", install);
-        return Ok(json!({ "pending": dialogs::confirm::KIND }));
-    }
+    // Taking another module's place alone asks in the approval dialog too, whose params no request
+    // can rewrite.
     let asked = info["permissions"].as_array().cloned().unwrap_or_default();
     let mut paragraphs = vec![];
     if needs_grant {
@@ -285,8 +288,10 @@ pub fn install_module(app: &mut VectorcraftApp, module: Value) -> Result<Value,
     }
     let message = if needs_grant {
         crate::i18n::fmt(tl!("Install “{name}”, which asks for these permissions?"), &[("name", &name)])
-    } else {
+    } else if heavy {
         crate::i18n::fmt(tl!("Install “{name}”, which asks for a heavy budget?"), &[("name", &name)])
+    } else {
+        crate::i18n::fmt(tl!("Install “{name}” in place of the plug-in with the same ID?"), &[("name", &name)])
     };
     let approval = InstallApproval {
         id: info["id"].as_str().unwrap_or_default().to_string(),
@@ -294,7 +299,8 @@ pub fn install_module(app: &mut VectorcraftApp, module: Value) -> Result<Value,
         permissions: asked.iter().filter_map(Value::as_str).map(str::to_string).collect(),
         heavy,
     };
-    let pending = dialogs::plugin::PendingInstall { message, detail: paragraphs.join("\n\n"), params: install, approval, shown: Default::default() };
+    let pending =
+        dialogs::plugin::PendingInstall { message, detail: paragraphs.join("\n\n"), params: install, approval, origin, shown: Default::default() };
     Ok(dialogs::plugin::ask_install(app, pending))
 }
 
@@ -311,8 +317,7 @@ fn open_dialog_folder(app: &VectorcraftApp) -> Option<String> {
 
 /// File → Open…
 pub fn open_dialog(app: &mut VectorcraftApp) -> Result<(), String> {
-    if let Some(f) = app.services.open_async.as_mut() {
-        f();
+    if crate::picks::open_async(app) {
         return Ok(());
     }
     let path =
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 2d723d4427..be668e1e4f 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -122,7 +122,8 @@ pub use craft_ui::docking::Monitor as DockMonitor;
 #[cfg(test)]
 pub(crate) use services::browsable_url;
 pub use services::{
-    DownloadFn, ExistsFn, FileFilter, FilePick, Inbox, NativeInputHook, OpenUrlFn, PickOpen, PickSave, ReadFn, RevealFn, Services, WriteFn,
+    DownloadFn, ExistsFn, FileFilter, FilePick, Inbox, NativeInputHook, OpenUrlFn, PickOpen, PickSave, PickedInbox, ReadFn, RevealFn, Services,
+    WriteFn,
 };
 use state::{GeometryStamp, InputGeneration, PendingScreenshot, QueuedScreenshot};
 pub(crate) use state::{InputFrame, take_frame_once};
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index 2b24124e1b..1698e06ed4 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -77,7 +77,7 @@ pub(crate) use labels::lists_plugin;
 use labels::shows_a_name;
 pub use labels::{CONTEXT_LABELS, DYNAMIC_LABELS, display_label, dynamic_label, item_shortcut, menu_strings};
 pub use run::{check_params, run_ui_command};
-pub(crate) use run::{normalize_panel, opt_bool};
+pub(crate) use run::{normalize_panel, opt_bool, opt_index, opt_number};
 #[cfg(test)]
 use slots::RECENT_FONT_IDS;
 pub use state::{checked, enabled, plugin_revision, shortcut_of, shown_state};
diff --git a/crates/ui-egui/src/menus/run.rs b/crates/ui-egui/src/menus/run.rs
index 06e68e9e28..b5e2a3e3b4 100644
--- a/crates/ui-egui/src/menus/run.rs
+++ b/crates/ui-egui/src/menus/run.rs
@@ -25,6 +25,34 @@ pub(crate) fn opt_bool(p: &Value, key: &str) -> Result<Option<bool>, String> {
     }
 }
 
+/// An optional `{key?: number}` param: none when it is omitted or null.
+pub(crate) fn opt_number(p: &Value, key: &str) -> Result<Option<f64>, String> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v.as_f64().map(Some).ok_or_else(|| format!("`{key}` must be a number")),
+    }
+}
+
+/// An optional `{key?: index}` param, a whole number of 0 or more: none when it is omitted or null.
+pub(crate) fn opt_index(p: &Value, key: &str) -> Result<Option<usize>, String> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v.as_u64().and_then(|i| usize::try_from(i).ok()).map(Some).ok_or_else(|| format!("`{key}` must be a whole number of 0 or more")),
+    }
+}
+
+/// An optional `{key?: [x, y]}` param: none when it is omitted or null.
+fn opt_point(p: &Value, key: &str) -> Result<Option<vectorcraft_geom::Point>, String> {
+    match p.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => match v.as_array().map(Vec::as_slice) {
+            Some([x, y]) => x.as_f64().zip(y.as_f64()).map(|(x, y)| Some(vectorcraft_geom::Point::new(x, y))),
+            _ => None,
+        }
+        .ok_or_else(|| format!("`{key}` must be [x, y] numbers")),
+    }
+}
+
 /// Handle a UI command. `None` = not a UI command (the engine handles it).
 /// `params` has only keys the params description of engine command `id` names, or the parameter
 /// error naming the one it doesn't (#1442). The UI's own commands aren't checked yet: their
@@ -48,13 +76,18 @@ pub fn check_params(session: &vectorcraft_engine::Session, id: &str, params: &Va
 pub fn run_ui_command(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<Value, String>> {
     // Window menu items and the named panel function keys toggle against the checked state;
     // other commands that open panels show them.
-    if id == "window.panel" && p.get("toggle").and_then(Value::as_bool) == Some(true) && checked(app, id, p) == Some(true) {
+    let toggles = if id == "window.panel" { opt_bool(p, "toggle").and_then(|t| Ok((t, opt_bool(p, "toggleGroup")?))) } else { Ok((None, None)) };
+    let (toggle, toggle_group) = match toggles {
+        Ok(flags) => flags,
+        Err(e) => return Some(Err(e)),
+    };
+    if toggle == Some(true) && checked(app, id, p) == Some(true) {
         let panel = p.get("panel").and_then(Value::as_str).and_then(normalize_panel).unwrap_or_default();
         if app.ui.open_panel.as_deref() == Some(panel) {
             app.ui.open_panel = None;
             return Some(Ok(json!({"open": null})));
         }
-        if p.get("toggleGroup").and_then(Value::as_bool) == Some(true) {
+        if toggle_group == Some(true) {
             return Some(crate::panel_docking::hide_group(app, panel));
         }
         return Some(app.run("window.panel.close", json!({"panel": panel})));
@@ -131,7 +164,7 @@ fn run_ui_part1(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
         }
         // Bytes sent by an agent go straight to the engine; a path or nothing opens it here.
         "file.newFromTemplate" if p.get("dataBase64").is_none() => io::new_from_template(app, s("path")),
-        "file.revert" if p.get("confirmed").and_then(Value::as_bool) != Some(true) => io::ask_revert(app),
+        "file.revert" if opt_bool(p, "confirmed") != Ok(Some(true)) => opt_bool(p, "confirmed").and_then(|_| io::ask_revert(app)),
         "file.reveal" => io::reveal(app),
         "file.cancelExport" => Ok(io::cancel_exports(app)),
         "file.exportInBackground" => Ok(io::hide_exports(app)),
@@ -386,9 +419,11 @@ fn run_ui_part5(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
         }
         "view.setZoom" => {
             let print = app.session.prefs.display_print_size;
-            let z = crate::state::zoom_from_display_percent(p.get("zoom").and_then(Value::as_f64).unwrap_or(100.0), print);
-            let center =
-                p.get("center").and_then(Value::as_array).and_then(|a| Some(vectorcraft_geom::Point::new(a.first()?.as_f64()?, a.get(1)?.as_f64()?)));
+            let (zoom, center) = match opt_number(p, "zoom").and_then(|z| Ok((z, opt_point(p, "center")?))) {
+                Ok(given) => given,
+                Err(e) => return Some(Err(e)),
+            };
+            let z = crate::state::zoom_from_display_percent(zoom.unwrap_or(100.0), print);
             match app.view_mut() {
                 Some(v) => {
                     v.zoom = z.clamp(0.0313, 640.0);
@@ -417,7 +452,11 @@ fn run_ui_part5(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
             Ok(json!(app.ui.screen_mode))
         }
         "view.screenMode" => {
-            app.ui.screen_mode = match p.get("mode").and_then(Value::as_u64) {
+            let mode = match opt_index(p, "mode") {
+                Ok(mode) => mode,
+                Err(e) => return Some(Err(e)),
+            };
+            app.ui.screen_mode = match mode {
                 Some(m) => m.min(3) as u8,
                 // F cycles the three screen modes. Without a mode, the command also goes from
                 // Presentation Mode (not in the cycle) back to Normal.
@@ -683,9 +722,10 @@ fn run_ui_part7(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
         // Closing asks Save / Don't Save / Cancel for modified documents first (`unsaved`).
         // Without an `index`, the current window closes: one of several views of a document closes
         // without closing the document (Window › New Window).
-        "file.close" => match p.get("index").and_then(Value::as_u64).map(|i| i as usize) {
-            Some(i) => crate::unsaved::close(app, i),
-            None => {
+        "file.close" => match opt_index(p, "index") {
+            Err(e) => Err(e),
+            Ok(Some(i)) => crate::unsaved::close(app, i),
+            Ok(None) => {
                 app.session.active_index()?;
                 crate::doc_windows::close_current(app)
             }
@@ -697,8 +737,10 @@ fn run_ui_part7(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
             None => Err("missing `name`".into()),
         },
         "ui.newSwatch" => {
-            let on = |k: &str| p.get(k).and_then(Value::as_bool).unwrap_or(false);
-            crate::dialogs::new_swatch::open(app, on("spot"), on("global"), s("group").as_deref())
+            let on = |k: &str| opt_bool(p, k).map(|on| on.unwrap_or(false));
+            on("spot")
+                .and_then(|spot| Ok((spot, on("global")?)))
+                .and_then(|(spot, global)| crate::dialogs::new_swatch::open(app, spot, global, s("group").as_deref()))
         }
         "ui.newColorGroup" => {
             let names = p.get("swatches").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_str).map(str::to_string).collect());
@@ -721,7 +763,10 @@ fn run_ui_part7(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result<
         "ui.newParaStyle" => crate::panels::text_styles::open_new(app, crate::panels::text_styles::Kind::Para),
         "ui.symbolOptions" => {
             let name = s("name");
-            let edit = p.get("edit").and_then(Value::as_bool).unwrap_or(false);
+            let edit = match opt_bool(p, "edit") {
+                Ok(edit) => edit.unwrap_or(false),
+                Err(e) => return Some(Err(e)),
+            };
             if edit || name.is_some() {
                 crate::dialogs::symbol_options::open_edit(app, name.as_deref())
             } else {
@@ -924,9 +969,8 @@ fn run_ui_part11(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result
         crate::panels::actions::CONTINUE_PLAYBACK => crate::panels::actions::continue_playback(app, p),
         crate::panels::actions::DELETE_STEP => crate::panels::actions::delete_step(app, p),
         "ui.batchDialog" => {
-            let set = p.get("set").and_then(Value::as_u64).unwrap_or(0) as usize;
-            let action = p.get("action").and_then(Value::as_u64).unwrap_or(0) as usize;
-            crate::dialogs::action_batch::open(app, set, action)
+            let index = |k: &str| opt_index(p, k).map(|i| i.unwrap_or(0));
+            index("set").and_then(|set| Ok((set, index("action")?))).and_then(|(set, action)| crate::dialogs::action_batch::open(app, set, action))
         }
         crate::panels::actions::SAVE_SET => crate::panels::actions::save_set(app, p),
         crate::panels::actions::LOAD_SET => crate::panels::actions::load_set(app, p),
@@ -959,7 +1003,11 @@ fn run_ui_part12(app: &mut VectorcraftApp, id: &str, p: &Value) -> Option<Result
         // File → Export Selection…: the selection becomes one asset (`multiple: true`: one per
         // object), shown checked on Export for Screens' Assets tab.
         "file.exportSelection" => {
-            app.run("assets.add", json!({ "multiple": p.get("multiple").and_then(Value::as_bool).unwrap_or(false) })).map(|r| {
+            let multiple = match opt_bool(p, "multiple") {
+                Ok(multiple) => multiple.unwrap_or(false),
+                Err(e) => return Some(Err(e)),
+            };
+            app.run("assets.add", json!({ "multiple": multiple })).map(|r| {
                 let ids: Vec<u64> = r["assets"].as_array().into_iter().flatten().filter_map(Value::as_u64).collect();
                 crate::dialogs::open_export_for_screens_assets(app, Some(&ids));
                 json!({ "assets": ids })
diff --git a/crates/ui-egui/src/menus/ui_commands.rs b/crates/ui-egui/src/menus/ui_commands.rs
index b661682a3c..08ce08873a 100644
--- a/crates/ui-egui/src/menus/ui_commands.rs
+++ b/crates/ui-egui/src/menus/ui_commands.rs
@@ -1530,7 +1530,7 @@ pub const UI_COMMANDS: &[(&str, &str, &str, &str)] = &[
         "ui.installPlugin",
         "Install Plug-in…",
         "",
-        "{path?: a .wasm file | dataBase64?: the module, name?: the file name shown as its source (with dataBase64), replace?: bool (true: the user agreed it takes the place of the plug-in with its id, as plugin.install), hash?: the module's SHA-256 (as plugin.install)} install a WebAssembly plug-in (plugin.install); without a path pick one (the web opens the browser's file picker; File › Open of a .wasm installs it too). A plug-in that lists permissions the user hasn't granted it asks the user first, showing its name, id, version, file SHA-256 and what each permission lets it do, so does a filter that asks for a heavy budget, and so does one without replace that would take the place of another module with its id and get its settings and cache (needsReplace in plugin.inspect), showing its id and file SHA-256: OK installs it if the file still has the SHA-256 shown, Cancel installs nothing. Only a person can press OK when it asks about permissions or a heavy budget: ui.dialog.confirm, answer_dialog and synthetic input are refused → plugin.install's result | {pending: \"pluginInstall\"} while it asks about permissions or a heavy budget | {pending: \"confirm\"} while it asks only about replacing",
+        "{path?: a .wasm file | dataBase64?: the module, name?: the file name shown as its source (with dataBase64), replace?: bool (true: the user agreed it takes the place of the plug-in with its id, as plugin.install), hash?: the module's SHA-256 (as plugin.install)} install a WebAssembly plug-in (plugin.install); without a path pick one (the web opens the browser's file picker; File › Open of a .wasm installs it too). A plug-in that lists permissions the user hasn't granted it asks the user first, showing its name, id, version, file SHA-256 and what each permission lets it do, so does a filter that asks for a heavy budget, and so does one without replace that would take the place of another module with its id and get its settings and cache (needsReplace in plugin.inspect), showing its id and file SHA-256: OK installs it if the file still has the SHA-256 shown, Cancel installs nothing. Only a person can press OK: ui.dialog.confirm, answer_dialog and synthetic input are refused. When automation asked (a control or MCP request, synthetic input, or a file dialog one of them opened, even when the person picked the file), replace: true doesn't skip the question about replacing, and nothing in the dialog installs it, the person's OK included: the person chooses Object › Plug-ins › Install Plug-in… to install it → plugin.install's result | {pending: \"pluginInstall\"} while it asks | {pending: \"pluginInstall\", approval: \"personMustStartInstall\"} while it asks what automation asked | null on the web without path or dataBase64, once the browser's file picker opens (the picked file is handled as above)",
     ),
     (
         "plugin.cancelRuns",
diff --git a/crates/ui-egui/src/panels/blend.rs b/crates/ui-egui/src/panels/blend.rs
index e258cfbc09..a41c2946c7 100644
--- a/crates/ui-egui/src/panels/blend.rs
+++ b/crates/ui-egui/src/panels/blend.rs
@@ -1,13 +1,17 @@
-//! Blend panel (Window → Blend): Make, the Spacing and Orientation of the selected blend (with no
-//! blend selected, the options new blends start with), Reverse Front to Back, Reverse Spine,
-//! Replace Spine, Expand and Release. Each control runs its Object → Blend command
-//! (`object.blend.make`, `object.blend.options` and the others), so a change of the selected
-//! blend's spacing or orientation shows on the canvas at once as one undo step. Make is dimmed
-//! until two or more objects are selected. Spacing and Orientation are dimmed until a blend or two
-//! or more objects are selected, and the other buttons are dimmed until a blend is selected.
+//! Blend panel (Window → Blend): Make, Create Spine (whether new blends get a spine), the Spacing
+//! and Orientation of the selected blend (with no blend selected, the options new blends start
+//! with), Reverse Front to Back, Reverse Spine, Replace Spine, Expand and Release. Each control
+//! runs its Object → Blend command (`object.blend.make`, `object.blend.createSpine`,
+//! `object.blend.options` and the others), so a change of the selected blend's spacing or
+//! orientation shows on the canvas at once as one undo step. Make is dimmed until two or more
+//! objects are selected. Create Spine is always available. Spacing and Orientation are dimmed until
+//! a blend or two or more objects are selected, and the other buttons are dimmed until a blend is
+//! selected. Easing and Reverse Spine are dimmed for a blend made without a spine.
 
 use egui::Ui;
 use serde_json::{Value, json};
+use vectorcraft_doc::NodeKind;
+use vectorcraft_doc::live::BlendSpineMode;
 
 use super::selection_len;
 use crate::VectorcraftApp;
@@ -38,10 +42,18 @@ fn buttons(app: &mut VectorcraftApp, ui: &mut Ui, row: &[(&str, &str)]) {
     });
 }
 
-/// Can `cmd` run on the selection? Make needs two or more objects, and the other commands need a
-/// selected blend.
+/// Can `cmd` run on the selection? Make needs two or more objects, the other commands need a
+/// selected blend, and Reverse Spine needs every selected blend to have a spine.
 fn available(app: &VectorcraftApp, cmd: &str) -> bool {
-    crate::menus::enabled(app, cmd) && (cmd != "object.blend.make" || selection_len(app) >= 2)
+    crate::menus::enabled(app, cmd)
+        && (cmd != "object.blend.make" || selection_len(app) >= 2)
+        && (cmd != "object.blend.reverseSpine" || !selects_blend_without_spine(app))
+}
+
+/// Is a blend made without a spine selected?
+fn selects_blend_without_spine(app: &VectorcraftApp) -> bool {
+    let Ok(st) = app.session.doc() else { return false };
+    st.selection.objects.iter().any(|id| matches!(st.doc.node(*id).map(|n| &n.kind), Some(NodeKind::Blend { spec, .. }) if spec.no_spine))
 }
 
 /// `object.blend.options` parameters for spacing mode `mode`, with the step count and distance
@@ -95,8 +107,9 @@ fn settings(app: &mut VectorcraftApp, ui: &mut Ui) {
         }
     });
     let selected = info["target"] == "blend";
-    // Position easing needs a spine to run along: a replaced one, or Align to Path.
-    let spined = info["spine"]["explicit"] == true || info["orientation"] == "path";
+    // Position easing needs a spine to run along: a replaced one, or Align to Path. A blend made
+    // without a spine has none.
+    let spined = info["hasSpine"] != false && (info["spine"]["explicit"] == true || info["orientation"] == "path");
     ui.add_enabled_ui(selected && spined, |ui| {
         let modes = ["easeIn", "easeOut", "easeInOut", "easeOutIn"];
         let labels = [tl!("Ease In"), tl!("Ease Out"), tl!("Ease In Out"), tl!("Ease Out In")];
@@ -129,9 +142,30 @@ fn settings(app: &mut VectorcraftApp, ui: &mut Ui) {
     }
 }
 
+/// Create Spine: whether new blends get a spine. It shows the setting new blends take, whatever is
+/// selected, and a change runs `object.blend.createSpine`; blends already made keep theirs.
+fn create_spine(app: &mut VectorcraftApp, ui: &mut Ui) {
+    let current = app.session.prefs.blend_options.unwrap_or_default().create_spine;
+    let modes = BlendSpineMode::ALL;
+    let labels = [tl!("Auto"), tl!("Always"), tl!("Never")];
+    let shown = modes.iter().position(|m| *m == current).and_then(|i| labels.get(i)).copied().unwrap_or(labels[0]);
+    let mut change = None;
+    widgets::label_row(ui, tl!("Create Spine:"), LABEL_W, |ui| {
+        if let Some(mode) =
+            widgets::dropdown(ui, "blend-panel-create-spine", shown, &labels, ui.available_width().max(FIELD_W)).and_then(|i| modes.get(i))
+        {
+            change = Some(*mode);
+        }
+    });
+    if let Some(mode) = change {
+        app.run("object.blend.createSpine", json!({ "mode": mode.id() })).ok();
+    }
+}
+
 pub fn show(app: &mut VectorcraftApp, ui: &mut Ui) {
     let blend = crate::menus::enabled(app, "object.blend.release");
     buttons(app, ui, &[(tl!("Make"), "object.blend.make")]);
+    create_spine(app, ui);
     widgets::divider(ui);
     ui.add_enabled_ui(blend || selection_len(app) >= 2, |ui| settings(app, ui));
     widgets::label_row(ui, tl!("Direction:"), LABEL_W, |ui| buttons(app, ui, &[(tl!("Reverse Front to Back"), "object.blend.reverseFrontToBack")]));
diff --git a/crates/ui-egui/src/panels/libraries.rs b/crates/ui-egui/src/panels/libraries.rs
index ac92a42793..78ce76da32 100644
--- a/crates/ui-egui/src/panels/libraries.rs
+++ b/crates/ui-egui/src/panels/libraries.rs
@@ -827,8 +827,7 @@ pub(crate) fn import(app: &mut VectorcraftApp, p: Value) -> Result<Value, String
 /// Import Library…: a picked `.vclibrary` file becomes a new library (on the web the picked file
 /// arrives later through [`crate::io::open_bytes`]).
 fn import_picked(app: &mut VectorcraftApp) {
-    if let Some(f) = app.services.open_async.as_mut() {
-        f();
+    if crate::picks::open_async(app) {
         return;
     }
     let pick = crate::FilePick { filters: vec![crate::FilePick::filter("Libraries", LIBRARY_EXTS)], ..Default::default() };
diff --git a/crates/ui-egui/src/panels/library_panel.rs b/crates/ui-egui/src/panels/library_panel.rs
index f7ee6020af..292fd498c5 100644
--- a/crates/ui-egui/src/panels/library_panel.rs
+++ b/crates/ui-egui/src/panels/library_panel.rs
@@ -584,10 +584,7 @@ pub(crate) fn pick_library_file(
     path: Option<String>,
     filters: Vec<(&'static str, &'static [&'static str])>,
 ) -> Result<Option<String>, String> {
-    if path.is_none()
-        && let Some(f) = app.services.open_async.as_mut()
-    {
-        f();
+    if path.is_none() && crate::picks::open_async(app) {
         return Ok(None);
     }
     path.or_else(|| {
diff --git a/crates/ui-egui/src/panels/tests_blend.rs b/crates/ui-egui/src/panels/tests_blend.rs
index b79823237b..46521d3a65 100644
--- a/crates/ui-egui/src/panels/tests_blend.rs
+++ b/crates/ui-egui/src/panels/tests_blend.rs
@@ -1,8 +1,8 @@
 //! The Blend panel drawn headless: Window › Blend opens it, and its controls do nothing until the
 //! selection allows them. Make needs two or more objects, Spacing and Orientation need a blend or
-//! two or more objects, and the other buttons need a blend. Make blends the selection, Spacing and
-//! Orientation edit the selected blend through `object.blend.options`, and each other button runs
-//! its Object › Blend command.
+//! two or more objects, and the other buttons need a blend. Make blends the selection, Create Spine
+//! sets whether new blends get a spine, Spacing and Orientation edit the selected blend through
+//! `object.blend.options`, and each other button runs its Object › Blend command.
 
 use egui::{Event, Pos2, Rect, pos2, vec2};
 use serde_json::json;
@@ -39,6 +39,11 @@ impl Frames {
 
     /// The center of the text `label` the panel draws.
     fn text(&mut self, app: &mut VectorcraftApp, label: &str) -> Pos2 {
+        self.find_text(app, label).unwrap_or_else(|texts| panic!("no {label:?} in {texts:?}"))
+    }
+
+    /// The center of the text `label` the panel draws, or every text it draws.
+    fn find_text(&mut self, app: &mut VectorcraftApp, label: &str) -> Result<Pos2, Vec<(String, Rect)>> {
         self.run(app, vec![]);
         let out = self.run(app, vec![]);
         let mut texts = vec![];
@@ -50,7 +55,7 @@ impl Frames {
             }
         }
         out.shapes.iter().for_each(|c| collect(&c.shape, &mut texts));
-        texts.iter().find(|(t, _)| t == label).unwrap_or_else(|| panic!("no {label:?} in {texts:?}")).1.center()
+        texts.iter().find(|(t, _)| t == label).map(|(_, r)| r.center()).ok_or(texts)
     }
 
     /// The center of the button that screen readers name `label`.
@@ -124,7 +129,19 @@ fn window_blend_opens_the_panel() {
     crate::menus::invoke(&mut app, "window.panel", item.params.clone());
     assert!(crate::panel_docking::showing(&app.ui, ID));
     let text = crate::tests_labels::painted_text(&mut app, |app, ui| super::show_icon_panel(app, ui, ID));
-    for label in ["Make", "Spacing:", "Orientation:", "Direction:", "Reverse Front to Back", "Reverse Spine", "Replace Spine", "Expand", "Release"] {
+    for label in [
+        "Make",
+        "Create Spine:",
+        "Auto",
+        "Spacing:",
+        "Orientation:",
+        "Direction:",
+        "Reverse Front to Back",
+        "Reverse Spine",
+        "Replace Spine",
+        "Expand",
+        "Release",
+    ] {
         assert!(text.contains(label), "{label} in {text}");
     }
     assert!(!text.contains("on the roadmap"), "{text}");
@@ -226,6 +243,39 @@ fn each_button_runs_its_blend_command() {
     assert!(objects.len() >= 2 && objects.iter().all(|(_, blend)| !blend), "the keys are back: {objects:?}");
 }
 
+#[test]
+fn create_spine_sets_what_new_blends_get_whatever_is_selected() {
+    let (mut app, id) = blended();
+    let (before, depth) = (spec(&app, id), undo_depth(&app));
+    let mode = |app: &mut VectorcraftApp| app.session.execute("object.blend.createSpine", &json!({})).unwrap()["mode"].clone();
+    let mut f = Frames::new();
+    f.text(&mut app, "Create Spine:");
+    f.click_text(&mut app, "Auto");
+    f.click_text(&mut app, "Never");
+    assert_eq!(mode(&mut app), "never");
+    assert_eq!((spec(&app, id), undo_depth(&app)), (before, depth), "the selected blend and the undo history stay as they were");
+    f.text(&mut app, "Never");
+    // Nothing selected: the dropdown still shows and sets the setting.
+    app.run("select.none", json!({})).unwrap();
+    f.click_text(&mut app, "Never");
+    f.click_text(&mut app, "Always");
+    assert_eq!(mode(&mut app), "always");
+    f.click_text(&mut app, "Always");
+    f.click_text(&mut app, "Never");
+    // A blend made now has no spine: Reverse Spine and easing are dimmed for it.
+    app.run("edit.undo", json!({})).unwrap();
+    app.run("select.all", json!({})).unwrap();
+    f.click_text(&mut app, "Make");
+    let (g, blend) = top(&app)[0];
+    assert!(blend && spec(&app, g).no_spine, "{:?}", top(&app));
+    let made = spec(&app, g);
+    let depth = undo_depth(&app);
+    f.click_text(&mut app, "Reverse Spine");
+    f.click_text(&mut app, "Ease In");
+    assert!(f.find_text(&mut app, "Ease Out In").is_err(), "the Type menu did not open");
+    assert_eq!((spec(&app, g), undo_depth(&app), app.ui.status.as_str()), (made, depth, ""), "nothing ran");
+}
+
 #[test]
 fn panel_easing_type_ramp_and_shift_edit_the_blend_and_undo() {
     // Type and Ramp need a spine: Align to Path gives the blend one.
diff --git a/crates/ui-egui/src/picks.rs b/crates/ui-egui/src/picks.rs
index 4122c19410..7699516d78 100644
--- a/crates/ui-egui/src/picks.rs
+++ b/crates/ui-egui/src/picks.rs
@@ -105,6 +105,9 @@ struct Waiting {
     /// The automation roots in force when it was asked for: the entry runs again under them, not
     /// with the desktop's access of the frame the answer comes in.
     scope: ScopeHandle,
+    /// Automation asked for it ([`VectorcraftApp::automation_asked`]): the entry runs again as
+    /// automation's ([`as_automated`]).
+    automated: bool,
 }
 
 /// The app's file dialogs ([`VectorcraftApp`]'s `picks`).
@@ -122,6 +125,13 @@ pub(crate) struct Picks {
     replacing: Option<Replacing>,
     /// The file that question's OK allows to be replaced while what asked runs again.
     replace_ok: Option<String>,
+    /// What runs now handles the answer of a file dialog automation opened ([`as_automated`]).
+    automated: bool,
+    /// The web's file pickers opened ([`open_async`]) that have not answered yet
+    /// (`Services::picked_inbox`).
+    web_opens: u32,
+    /// Automation opened one of them: their answers are automation's.
+    web_open_automated: bool,
 }
 
 /// A save dialog's answer that names, once the app gave it an extension, a file that is there.
@@ -152,6 +162,23 @@ impl Picks {
         self.entry = None;
         self.answer = None;
         self.replace_ok = None;
+        self.automated = false;
+    }
+
+    /// What runs now handles the answer of a file dialog automation opened ([`as_automated`]).
+    pub(crate) fn automated(&self) -> bool {
+        self.automated
+    }
+
+    /// One of the web's file pickers answered (a file, or canceled): whether the answer is
+    /// automation's. Once none is waiting, the next one the person opens answers for the person.
+    pub(crate) fn answer_web_open(&mut self) -> bool {
+        let automated = self.web_open_automated;
+        self.web_opens = self.web_opens.saturating_sub(1);
+        if self.web_opens == 0 {
+            self.web_open_automated = false;
+        }
+        automated
     }
 
     /// The kind of dialog open off the UI thread (`ui.inspect`'s `fileDialog`).
@@ -188,6 +215,29 @@ pub(crate) fn as_entry<R>(app: &mut VectorcraftApp, entry: impl FnOnce() -> Entr
     r
 }
 
+/// Run `f` as handling the answer of a file dialog automation opened when `automated` (and inside
+/// one already, as that): [`VectorcraftApp::automation_asked`] is true meanwhile.
+pub(crate) fn as_automated<R>(app: &mut VectorcraftApp, automated: bool, f: impl FnOnce(&mut VectorcraftApp) -> R) -> R {
+    let outer = app.picks.automated;
+    app.picks.automated = outer || automated;
+    let r = f(app);
+    app.picks.automated = outer;
+    r
+}
+
+/// Opens the web's file picker, whose file arrives later through `Services::picked_inbox`, noting
+/// whether automation asked for it ([`VectorcraftApp::automation_asked`]) → false when the host has
+/// none. While a picker automation opened has not answered, every answer is automation's, also one
+/// to a picker the person opened.
+pub(crate) fn open_async(app: &mut VectorcraftApp) -> bool {
+    let automated = app.automation_asked();
+    let Some(f) = app.services.open_async.as_mut() else { return false };
+    f();
+    app.picks.web_opens += 1;
+    app.picks.web_open_automated |= automated;
+    true
+}
+
 /// [`as_entry`] for a panel's or a dialog's button that `f` handles.
 pub(crate) fn button(app: &mut VectorcraftApp, f: impl Fn(&mut VectorcraftApp) + 'static) {
     let f = Rc::new(f);
@@ -319,8 +369,8 @@ fn ask(app: &mut VectorcraftApp, request: PickRequest) -> Option<PickAnswer> {
     match (app.picks.entry.clone(), app.services.start_pick.as_mut()) {
         (Some(entry), Some(start)) => {
             if let Some(answer) = start(request.clone()) {
-                let doc = entry.document(app);
-                app.picks.waiting = Some(Waiting { request, answer, entry, doc, scope: ScopeHandle::capture() });
+                let (doc, automated) = (entry.document(app), app.automation_asked());
+                app.picks.waiting = Some(Waiting { request, answer, entry, doc, scope: ScopeHandle::capture(), automated });
                 return None;
             }
         }
@@ -367,7 +417,7 @@ pub(crate) fn poll(app: &mut VectorcraftApp, ctx: &egui::Context) {
         // The dialog's thread is gone: as cancelled.
         Err(TryRecvError::Disconnected) => vec![],
     };
-    let Some(Waiting { request, entry, doc, scope, .. }) = app.picks.waiting.take() else { return };
+    let Some(Waiting { request, entry, doc, scope, automated, .. }) = app.picks.waiting.take() else { return };
     app.picks.refused = false;
     // Once more: what waited for the dialog (files from the Finder, the menu bar) goes on.
     ctx.request_repaint();
@@ -379,7 +429,7 @@ pub(crate) fn poll(app: &mut VectorcraftApp, ctx: &egui::Context) {
             return;
         }
         app.picks.answer = Some((request, answer));
-        rerun(app, entry);
+        as_automated(app, automated, |app| rerun(app, entry));
         // An entry that took another way this time leaves the answer unused.
         app.picks.answer = None;
     });
diff --git a/crates/ui-egui/src/services.rs b/crates/ui-egui/src/services.rs
index 45395b8fa7..de038296ab 100644
--- a/crates/ui-egui/src/services.rs
+++ b/crates/ui-egui/src/services.rs
@@ -47,6 +47,9 @@ pub type ExistsFn = Box<dyn Fn(&str) -> bool>;
 
 pub type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 
+/// The web open picker's answers in order: the picked file, or `None` when it was canceled.
+pub type PickedInbox = Arc<Mutex<Vec<Option<(String, Vec<u8>)>>>>;
+
 /// Starts a browser download of the bytes under a file name; an error when it couldn't be started
 /// (the save or export then fails as a refused write does: #1693).
 pub type DownloadFn = Box<dyn FnMut(&str, &[u8]) -> Result<(), String>>;
@@ -89,11 +92,17 @@ pub struct Services {
     /// save panel's name names once the app gives it an extension ([`picks::ask_to_replace`]).
     /// Without it, no file counts as there.
     pub exists: Option<ExistsFn>,
-    /// Files that arrived asynchronously (web open / drops): (name, bytes).
+    /// Files that arrived asynchronously (web drops): (name, bytes).
     pub inbox: Option<Inbox>,
+    /// Web: the open picker's answers (`open_async`). A file opens as automation's when automation
+    /// opened a picker that has not answered yet.
+    pub picked_inbox: Option<PickedInbox>,
+    /// Web: files the page's script handed over (`window.vectorcraft.openFile`). They open as
+    /// automation's.
+    pub page_inbox: Option<Inbox>,
     /// Web: trigger a browser download instead of writing a path.
     pub download: Option<DownloadFn>,
-    /// Web: start an async open (bytes arrive via `inbox`).
+    /// Web: start an async open (bytes arrive via `picked_inbox`).
     pub open_async: Option<Box<dyn FnMut()>>,
     /// Read the system clipboard's text (desktop). Without it, pasted text only arrives with
     /// egui's Paste event (web, and keyboard paste everywhere).
diff --git a/crates/ui-egui/src/tests/automation.rs b/crates/ui-egui/src/tests/automation.rs
index ee876b2e71..df2fe29912 100644
--- a/crates/ui-egui/src/tests/automation.rs
+++ b/crates/ui-egui/src/tests/automation.rs
@@ -630,9 +630,11 @@ fn an_unidentifiable_stale_injected_batch_fails_closed() {
     let _ = std::fs::remove_dir_all(base);
 }
 
-/// A plug-in's permissions are approved only by a person. A control request (or MCP, which comes
-/// through it) can't pass `grant`, can't answer the approval dialog or rewrite what it installs,
-/// and a frame of synthetic input can't press its OK; the person at the keyboard can.
+/// A plug-in's permissions are approved only by a person who asked for the install. A control
+/// request (or MCP, which comes through it) can't pass `grant`, can't answer the approval dialog or
+/// rewrite what it installs, and a frame of synthetic input can't press its OK. The person can't
+/// approve the question automation asked either: they start Install Plug-in… themselves, which asks
+/// again, and its OK installs.
 #[test]
 fn automation_cannot_approve_a_plugin_install() {
     let (tx, rx) = std::sync::mpsc::channel();
@@ -650,8 +652,9 @@ fn automation_cannot_approve_a_plugin_install() {
 
     let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": {"dataBase64": data}}));
     assert_eq!(r["result"]["pending"], crate::dialogs::plugin::INSTALL_KIND, "{r}");
+    assert_eq!(r["result"]["approval"], crate::dialogs::plugin::PERSON_MUST_START_INSTALL, "{r}");
     let r = request(&mut app, &tx, "ui.dialog.confirm", json!({}));
-    refused(&r, "Only the person at the keyboard");
+    refused(&r, ASKED);
     assert!(app.ui.dialog.is_some(), "the refused answer leaves it open");
     assert!(vectorcraft_plugins::registry::get(id).is_none());
 
@@ -662,22 +665,293 @@ fn automation_cannot_approve_a_plugin_install() {
     let r = request(&mut app, &tx, "ui.dialog.set", json!({"fields": [{"field": "__params", "value": {"dataBase64": "AAAA"}}]}));
     assert!(r.get("error").is_none(), "{r}");
     let r = request(&mut app, &tx, "ui.dialog.confirm", json!({}));
-    refused(&r, "Only the person at the keyboard");
+    refused(&r, ASKED);
     assert!(app.ui.dialog.is_some() && vectorcraft_plugins::registry::get(id).is_none());
-    // Shown for long enough for a person's OK, it still refuses automation.
+    // Shown for long enough for a person's OK, it still refuses automation, and the person too.
+    super::plugins::show_approval(&mut app);
+    let r = request(&mut app, &tx, "ui.dialog.confirm", json!({}));
+    refused(&r, ASKED);
+    app.synthetic_frame = true;
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED));
+    assert!(vectorcraft_plugins::registry::get(id).is_none());
+    app.synthetic_frame = false;
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED), "a person's OK on automation's question");
+    assert!(app.ui.dialog.is_some() && vectorcraft_plugins::registry::get(id).is_none() && vectorcraft_plugins::registry::granted(id).is_none());
+
+    // The person starts Install Plug-in… with the file: a new question, which a person's OK approves
+    // once it was shown for the delay, and which automation still can't.
+    let r = app.run("ui.installPlugin", json!({"dataBase64": data})).unwrap();
+    assert_eq!(r, json!({"pending": crate::dialogs::plugin::INSTALL_KIND}), "the person's question");
+    assert_eq!(crate::dialogs::confirm(&mut app).unwrap()["pending"], crate::dialogs::plugin::INSTALL_KIND, "not shown yet");
     super::plugins::show_approval(&mut app);
     let r = request(&mut app, &tx, "ui.dialog.confirm", json!({}));
     refused(&r, "Only the person at the keyboard");
-    app.synthetic_frame = true;
-    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains("Only the person at the keyboard"));
-    assert!(vectorcraft_plugins::registry::get(id).is_none());
-    app.synthetic_frame = false;
-
     crate::dialogs::confirm(&mut app).unwrap();
     assert_eq!(vectorcraft_plugins::registry::granted(id).map(|g| g.hash), Some(vectorcraft_plugins::permissions::sha256_hex(&bytes)));
     app.run("plugin.remove", json!({"id": id})).unwrap();
 }
 
+/// The refusal of an OK on an install question automation asked.
+const ASKED: &str = "Automation asked to install this plug-in. To install it, choose Object › Plug-ins › Install Plug-in… yourself.";
+
+/// The approval module `id` that lists `doc.read`, and its bytes as base64.
+fn approval_module(id: &str) -> (Vec<u8>, String) {
+    let manifest = format!(r#"{{"id":"{id}","name":"Approval","version":"1","kind":"filter","permissions":["doc.read"]}}"#);
+    let bytes = wat::parse_str(vectorcraft_plugins::wat::returning(&manifest, r#"{"objects":[]}"#)).unwrap();
+    let data = vectorcraft_format::base64_encode(&bytes);
+    (bytes, data)
+}
+
+/// An install question that a control request asked keeps OK disabled in the person's window, even
+/// once it was shown for the delay: a person's click, Enter or Space install nothing, and the dialog
+/// says to start Install Plug-in…. Cancel still closes it at once.
+#[test]
+fn a_person_cannot_approve_an_install_question_automation_asked() {
+    use super::plugins::{at, click_ok, ok_enabled, waiting, window};
+    use egui_kittest::kittest::Queryable;
+    let id = "test.ui.approval.asked";
+    let (tx, rx) = std::sync::mpsc::channel();
+    let app = VectorcraftApp::new(Session::new(), Default::default()).with_control(rx);
+    let mut h = window(app);
+    let (_, data) = approval_module(id);
+    let r = request(h.state_mut(), &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": {"dataBase64": data}}));
+    assert_eq!(r["result"]["approval"], crate::dialogs::plugin::PERSON_MUST_START_INSTALL, "{r}");
+    at(&mut h, 10.0);
+    at(&mut h, 10.0);
+    at(&mut h, 10.6);
+    assert!(!ok_enabled(&h), "OK stays disabled past the delay");
+    assert!(h.query_by_label(ASKED).is_some(), "the dialog says what to do");
+    click_ok(&mut h, 10.7);
+    at(&mut h, 10.8);
+    assert!(waiting(h.state(), id), "a person's click");
+    for (key, time) in [(egui::Key::Enter, 10.9), (egui::Key::Space, 11.0)] {
+        h.key_press(key);
+        at(&mut h, time);
+        assert!(waiting(h.state(), id), "{key:?}");
+    }
+    assert!(crate::dialogs::confirm(h.state_mut()).unwrap_err().contains(ASKED), "a confirm that skips the button");
+    assert!(waiting(h.state(), id));
+    h.get_by_label("Cancel").click();
+    at(&mut h, 11.1);
+    assert!(h.state().ui.dialog.is_none() && h.state().pending_plugin_install.is_none(), "Cancel");
+    assert!(vectorcraft_plugins::registry::get(id).is_none() && vectorcraft_plugins::registry::granted(id).is_none());
+}
+
+/// A question automation asks in place of the one a person asked can't be approved: it keeps
+/// automation's origin, though the person's question was shown and ready.
+#[test]
+fn automation_replacing_a_persons_install_question_does_not_take_its_approval() {
+    let (tx, rx) = std::sync::mpsc::channel();
+    let mut app = VectorcraftApp::new(Session::new(), Default::default()).with_control(rx);
+    let (mine, theirs) = ("test.ui.approval.mine", "test.ui.approval.theirs");
+    app.run("ui.installPlugin", json!({"dataBase64": approval_module(mine).1})).unwrap();
+    super::plugins::show_approval(&mut app);
+    let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": {"dataBase64": approval_module(theirs).1}}));
+    assert_eq!(r["result"]["approval"], crate::dialogs::plugin::PERSON_MUST_START_INSTALL, "{r}");
+    super::plugins::show_approval(&mut app);
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED));
+    for id in [mine, theirs] {
+        assert!(vectorcraft_plugins::registry::get(id).is_none() && vectorcraft_plugins::registry::granted(id).is_none(), "{id}");
+    }
+    // Asked again by automation with the same file, it is still automation's.
+    let r = request(&mut app, &tx, "engine.execute", json!({"command": "ui.installPlugin", "params": {"dataBase64": approval_module(mine).1}}));
+    assert_eq!(r["result"]["approval"], crate::dialogs::plugin::PERSON_MUST_START_INSTALL, "{r}");
+    super::plugins::show_approval(&mut app);
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED));
+    assert!(vectorcraft_plugins::registry::get(mine).is_none());
+}
+
+/// A file a person picks in the file dialog that a control request opened (Install Plug-in… or
+/// File › Open with no path) is automation's request: its question can't be approved. The file
+/// dialog a person opens asks a question they can approve. On the desktop the dialog answers later
+/// ([`crate::picks`]); on the web the file arrives through the picker's inbox, apart from drops and
+/// the page's script, which is automation.
+#[test]
+fn a_file_picked_in_a_dialog_automation_opened_stays_automations() {
+    let base = std::env::temp_dir().join(format!("vc-ui-approval-picked-{}", std::process::id()));
+    std::fs::create_dir_all(&base).unwrap();
+    let (desktop, web) = ("test.ui.approval.picked", "test.ui.approval.picked.web");
+    let (bytes, _) = approval_module(desktop);
+    let wasm = base.join("picked.wasm");
+    std::fs::write(&wasm, &bytes).unwrap();
+    let mut services = Services::default();
+    let (shown, _) = super::picks::off_the_ui_thread(&mut services);
+    services.read = Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string())));
+    let (tx, rx) = std::sync::mpsc::channel();
+    let mut app = VectorcraftApp::new(Session::new(), services).with_control(rx);
+    let pick = |app: &mut VectorcraftApp| {
+        shown.answer(&[&s(wasm.clone())]);
+        crate::picks::poll(app, &egui::Context::default());
+    };
+    for command in ["ui.installPlugin", "file.open"] {
+        let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": command, "params": {}}));
+        assert!(app.file_dialog_open(), "{command}: {r}");
+        pick(&mut app);
+        assert!(super::plugins::waiting(&app, desktop), "{command}: {:?}", app.ui.status);
+        super::plugins::show_approval(&mut app);
+        assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED), "{command}");
+        crate::dialogs::cancel(&mut app);
+    }
+    let _ = app.run("ui.installPlugin", json!({}));
+    assert!(app.file_dialog_open());
+    pick(&mut app);
+    super::plugins::show_approval(&mut app);
+    crate::dialogs::confirm(&mut app).unwrap();
+    assert_eq!(vectorcraft_plugins::registry::granted(desktop).map(|g| g.hash), Some(vectorcraft_plugins::permissions::sha256_hex(&bytes)));
+    app.run("plugin.remove", json!({"id": desktop})).unwrap();
+
+    // The web: the browser's file picker answers through its own inbox, apart from the files a
+    // person drops and the ones the page's script hands over.
+    let (dropped, page) = <(crate::services::Inbox, crate::services::Inbox)>::default();
+    let picked = crate::services::PickedInbox::default();
+    let services = Services {
+        open_async: Some(Box::new(|| {})),
+        inbox: Some(dropped.clone()),
+        picked_inbox: Some(picked.clone()),
+        page_inbox: Some(page.clone()),
+        ..Default::default()
+    };
+    let (tx, rx) = std::sync::mpsc::channel();
+    let mut app = VectorcraftApp::new(Session::new(), services).with_control(rx);
+    let (by_drop, by_page) = ("test.ui.approval.picked.dropped", "test.ui.approval.picked.page");
+    let file = |id: &str| (format!("{id}.wasm"), approval_module(id).0);
+    let hand_over = |app: &mut VectorcraftApp, inbox: &crate::services::Inbox, id: &str| {
+        inbox.lock().unwrap().push(file(id));
+        app.drain_inbox();
+    };
+    // The picker answers with a file, or `None` when it is canceled.
+    let answer = |app: &mut VectorcraftApp, id: Option<&str>| {
+        picked.lock().unwrap().push(id.map(file));
+        app.drain_inbox();
+    };
+    let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": {}}));
+    assert!(r.get("error").is_none(), "{r}");
+    // A file the person drops before the picker answers stays the person's.
+    hand_over(&mut app, &dropped, by_drop);
+    super::plugins::show_approval(&mut app);
+    crate::dialogs::confirm(&mut app).unwrap();
+    assert!(vectorcraft_plugins::registry::granted(by_drop).is_some());
+    answer(&mut app, Some(web));
+    super::plugins::show_approval(&mut app);
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED), "the web");
+    crate::dialogs::cancel(&mut app);
+    app.run("ui.installPlugin", json!({})).unwrap();
+    answer(&mut app, Some(web));
+    super::plugins::show_approval(&mut app);
+    crate::dialogs::confirm(&mut app).unwrap();
+    assert!(vectorcraft_plugins::registry::granted(web).is_some());
+    // Opening the picker again as the person before it answers automation leaves the answer
+    // automation's.
+    let (again, after) = ("test.ui.approval.picked.again", "test.ui.approval.picked.after");
+    let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": {}}));
+    assert!(r.get("error").is_none(), "{r}");
+    app.run("ui.installPlugin", json!({})).unwrap();
+    answer(&mut app, Some(again));
+    super::plugins::show_approval(&mut app);
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED), "opened again");
+    crate::dialogs::cancel(&mut app);
+    // Once the other picker is canceled, the next one the person opens answers for them again.
+    answer(&mut app, None);
+    app.run("ui.installPlugin", json!({})).unwrap();
+    answer(&mut app, Some(after));
+    super::plugins::show_approval(&mut app);
+    crate::dialogs::confirm(&mut app).unwrap();
+    assert!(vectorcraft_plugins::registry::granted(after).is_some());
+    // The page's script is automation.
+    hand_over(&mut app, &page, by_page);
+    super::plugins::show_approval(&mut app);
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED), "the page's script");
+    crate::dialogs::cancel(&mut app);
+    assert!(vectorcraft_plugins::registry::granted(by_page).is_none());
+    for id in [web, by_drop, after] {
+        app.run("plugin.remove", json!({"id": id})).unwrap();
+    }
+    let _ = std::fs::remove_dir_all(base);
+}
+
+/// A `.wasm` that a control request opens by path (`app.open`) asks a question that can't be
+/// approved; one the person opens can be.
+#[test]
+fn a_plugin_automation_opened_by_path_asks_a_question_no_one_approves() {
+    let base = std::env::temp_dir().join(format!("vc-ui-approval-open-{}", std::process::id()));
+    std::fs::create_dir_all(&base).unwrap();
+    let id = "test.ui.approval.opened";
+    let (bytes, _) = approval_module(id);
+    let wasm = base.join("opened.wasm");
+    std::fs::write(&wasm, &bytes).unwrap();
+    let services = Services { read: Some(Box::new(|p: &str| std::fs::read(p).map_err(|e| e.to_string()))), ..Default::default() };
+    let (tx, rx) = std::sync::mpsc::channel();
+    let mut app = VectorcraftApp::new(Session::new(), services).with_control(rx);
+    let r = request(&mut app, &tx, "app.open", json!({"path": s(wasm.clone())}));
+    assert!(r.get("error").is_none(), "{r}");
+    assert!(super::plugins::waiting(&app, id));
+    super::plugins::show_approval(&mut app);
+    assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED));
+    crate::dialogs::cancel(&mut app);
+    crate::io::open_path(&mut app, &s(wasm.clone())).unwrap();
+    super::plugins::show_approval(&mut app);
+    crate::dialogs::confirm(&mut app).unwrap();
+    assert!(vectorcraft_plugins::registry::granted(id).is_some());
+    app.run("plugin.remove", json!({"id": id})).unwrap();
+    let _ = std::fs::remove_dir_all(base);
+}
+
+/// A module that takes the place of another with its id, and asks for nothing else: automation's
+/// `replace: true` doesn't skip the question and its question can't be approved. The question a
+/// person asked keeps what it installs out of reach of `ui.dialog.set`, refuses a control confirm,
+/// and the person's own OK replaces.
+#[test]
+fn automation_cannot_approve_replacing_a_plugin() {
+    let (tx, rx) = std::sync::mpsc::channel();
+    let mut app = VectorcraftApp::new(Session::new(), Default::default()).with_control(rx);
+    let id = "test.ui.approval.replaced";
+    let plain = |output: &str| {
+        wat::parse_str(vectorcraft_plugins::wat::returning(&format!(r#"{{"id":"{id}","name":"Plain","kind":"filter"}}"#), output)).unwrap()
+    };
+    let (first, other) = (plain(r#"{"objects":[]}"#), plain(r#"{"objects":[],"error":null}"#));
+    let installed = || vectorcraft_plugins::registry::get(id).map(|p| p.hash().to_string());
+    let first_hash = vectorcraft_plugins::permissions::sha256_hex(&first);
+    let data = vectorcraft_format::base64_encode(&other);
+    app.run("ui.installPlugin", json!({"dataBase64": vectorcraft_format::base64_encode(&first)})).unwrap();
+    assert_eq!(installed(), Some(first_hash.clone()));
+
+    for params in [json!({"dataBase64": data}), json!({"dataBase64": data, "replace": true})] {
+        let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": params}));
+        assert_eq!(r["result"]["pending"], crate::dialogs::plugin::INSTALL_KIND, "{params}: {r}");
+        assert_eq!(r["result"]["approval"], crate::dialogs::plugin::PERSON_MUST_START_INSTALL, "{params}: {r}");
+        let pending = app.pending_plugin_install.as_ref().unwrap();
+        assert_eq!(pending.message, "Install “Plain” in place of the plug-in with the same ID?");
+        super::plugins::show_approval(&mut app);
+        assert!(crate::dialogs::confirm(&mut app).unwrap_err().contains(ASKED), "{params}");
+        let r = request(&mut app, &tx, "ui.dialog.confirm", json!({}));
+        assert!(r["error"].as_str().is_some_and(|e| e.contains(ASKED)), "{r}");
+        crate::dialogs::cancel(&mut app);
+        assert_eq!(installed(), Some(first_hash.clone()), "{params}");
+    }
+
+    // The person's question: a control request can't point its OK at other bytes, nor press it.
+    let r = app.run("ui.installPlugin", json!({"dataBase64": data})).unwrap();
+    assert_eq!(r, json!({"pending": crate::dialogs::plugin::INSTALL_KIND}));
+    let evil = vectorcraft_format::base64_encode(&plain(r#"{"objects":[{"name":"x"}]}"#));
+    let r = request(&mut app, &tx, "ui.dialog.set", json!({"fields": [{"field": "__params", "value": {"dataBase64": evil, "replace": true}}]}));
+    assert!(r.get("error").is_none(), "{r}");
+    super::plugins::show_approval(&mut app);
+    let r = request(&mut app, &tx, "ui.dialog.confirm", json!({}));
+    assert!(r["error"].as_str().is_some_and(|e| e.contains("Only the person at the keyboard")), "{r}");
+    assert_eq!(installed(), Some(first_hash.clone()));
+    crate::dialogs::confirm(&mut app).unwrap();
+    assert_eq!(installed(), Some(vectorcraft_plugins::permissions::sha256_hex(&other)), "the bytes the question showed");
+    app.run("plugin.remove", json!({"id": id})).unwrap();
+    // A module that asks for nothing still installs at once when automation asks.
+    let free = "test.ui.approval.free";
+    let module = wat::parse_str(vectorcraft_plugins::wat::returning(&format!(r#"{{"id":"{free}","name":"Free","kind":"filter"}}"#), "{}")).unwrap();
+    let params = json!({"dataBase64": vectorcraft_format::base64_encode(&module)});
+    let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": params}));
+    assert!(r["result"]["pending"].is_null() && app.ui.dialog.is_none(), "{r}");
+    assert!(vectorcraft_plugins::registry::get(free).is_some());
+    app.run("plugin.remove", json!({"id": free})).unwrap();
+}
+
 type DialogHarness = egui_kittest::Harness<'static, VectorcraftApp>;
 
 /// Runs one UI pass of `h` for each batch of synthetic input the control path queued, each taken
@@ -702,10 +976,10 @@ fn still_waiting(h: &DialogHarness, id: &str) -> bool {
         && vectorcraft_plugins::registry::granted(id).is_none()
 }
 
-/// Keys and pointer input sent through the control path approve nothing at the open install
-/// approval: Enter and Space press nothing with no button focused, and with OK focused they and a
-/// `ui.click` on it press it and are refused. `ui.pointer` drives the canvas. A person's click on
-/// the same button approves.
+/// Keys and pointer input sent through the control path approve nothing at the install approval a
+/// person asked for: Enter and Space press nothing with no button focused, and with OK focused they
+/// and a `ui.click` on it press it and are refused. `ui.pointer` drives the canvas. A person's click
+/// on the same button approves.
 #[test]
 fn injected_keys_and_pointer_input_cannot_approve_a_plugin_install() {
     use egui_kittest::kittest::{NodeT, Queryable};
@@ -717,8 +991,8 @@ fn injected_keys_and_pointer_input_cannot_approve_a_plugin_install() {
     let manifest = format!(r#"{{"id":"{id}","name":"Approval","version":"1","kind":"filter","permissions":["doc.read"]}}"#);
     let bytes = wat::parse_str(vectorcraft_plugins::wat::returning(&manifest, r#"{"objects":[]}"#)).unwrap();
     let data = vectorcraft_format::base64_encode(&bytes);
-    let r = request(&mut app, &tx, "ui.menu.invoke", json!({"command": "ui.installPlugin", "params": {"dataBase64": data}}));
-    assert_eq!(r["result"]["pending"], crate::dialogs::plugin::INSTALL_KIND, "{r}");
+    let r = app.run("ui.installPlugin", json!({"dataBase64": data})).unwrap();
+    assert_eq!(r, json!({"pending": crate::dialogs::plugin::INSTALL_KIND}), "the person's question");
     let mut fonts = false;
     let mut h: DialogHarness = egui_kittest::Harness::builder().with_size(egui::vec2(900.0, 800.0)).build_ui_state(
         move |ui, app: &mut VectorcraftApp| {
diff --git a/crates/ui-egui/src/tests/plugins.rs b/crates/ui-egui/src/tests/plugins.rs
index 105c223261..0a80254db0 100644
--- a/crates/ui-egui/src/tests/plugins.rs
+++ b/crates/ui-egui/src/tests/plugins.rs
@@ -45,11 +45,11 @@ pub(super) fn show_approval(app: &mut VectorcraftApp) {
     panic!("the approval's OK never took input");
 }
 
-type Window = egui_kittest::Harness<'static, VectorcraftApp>;
+pub(super) type Window = egui_kittest::Harness<'static, VectorcraftApp>;
 
 /// The dialog layer of `app` in a window, each frame drawn at the time [`at`] gives it. Building it
 /// draws frames at times of its own, so a test opens the dialog after.
-fn window(app: VectorcraftApp) -> Window {
+pub(super) fn window(app: VectorcraftApp) -> Window {
     let mut fonts = false;
     egui_kittest::Harness::builder().with_size(egui::vec2(900.0, 800.0)).build_ui_state(
         move |ui, app: &mut VectorcraftApp| {
@@ -64,26 +64,26 @@ fn window(app: VectorcraftApp) -> Window {
 }
 
 /// Draws a frame of `h` at `time` seconds.
-fn at(h: &mut Window, time: f64) {
+pub(super) fn at(h: &mut Window, time: f64) {
     h.input_mut().time = Some(time);
     h.step();
 }
 
 /// Whether the approval's OK is enabled, as a screen reader reads it.
-fn ok_enabled(h: &Window) -> bool {
+pub(super) fn ok_enabled(h: &Window) -> bool {
     use egui_kittest::kittest::{NodeT, Queryable};
     !h.get_by_label("OK").accesskit_node().is_disabled()
 }
 
 /// Clicks the approval's OK as a person does, on a frame at `time` seconds.
-fn click_ok(h: &mut Window, time: f64) {
+pub(super) fn click_ok(h: &mut Window, time: f64) {
     use egui_kittest::kittest::Queryable;
     h.get_by_label("OK").click();
     at(h, time);
 }
 
 /// The approval is open and plug-in `id` neither installed nor granted.
-fn waiting(app: &VectorcraftApp, id: &str) -> bool {
+pub(super) fn waiting(app: &VectorcraftApp, id: &str) -> bool {
     app.ui.dialog.as_ref().is_some_and(|d| d.kind == dialogs::plugin::INSTALL_KIND)
         && vectorcraft_plugins::registry::get(id).is_none()
         && vectorcraft_plugins::registry::granted(id).is_none()
@@ -184,7 +184,7 @@ fn plugin_effects_open_the_effect_dialog_with_their_schema() {
 
 /// A filter `id` named `name` whose manifest lists `permissions` (a JSON list), at a version with
 /// a bidirectional override, a tab and a bell in it.
-fn asking(id: &str, name: &str, permissions: &str) -> Vec<u8> {
+pub(super) fn asking(id: &str, name: &str, permissions: &str) -> Vec<u8> {
     let manifest = json!({"id": id, "name": name, "version": "3.0\u{202E}\t\u{0007}", "kind": "filter"}).to_string();
     let manifest = format!(r#"{},"permissions":{permissions}}}"#, manifest.trim_end_matches('}'));
     wat::parse_str(tpl::returning(&manifest, r#"{"objects":[]}"#)).unwrap()
@@ -522,9 +522,8 @@ fn the_install_approval_waits_again_when_the_focus_leaves_and_comes_back_between
     h.state_mut().run("plugin.remove", json!({"id": id})).unwrap();
 }
 
-/// A module with other bytes than the one installed with its id asks before taking its place: in
-/// the ordinary confirm when it needs nothing that only a person can approve, and in the approval
-/// dialog, with its id and file hash, when it also asks for a heavy budget.
+/// A module with other bytes than the one installed with its id asks before taking its place, in
+/// the approval dialog, with its id and file hash, also when it asks for a heavy budget.
 #[test]
 fn installing_a_plugin_over_another_module_asks_first() {
     let mut app = app();
@@ -538,10 +537,13 @@ fn installing_a_plugin_over_another_module_asks_first() {
     let other = plain(r#"{"objects":[],"error":null}"#);
     let other_hash = vectorcraft_plugins::permissions::sha256_hex(&other);
     let r = app.run("ui.installPlugin", module(&other)).unwrap();
-    assert_eq!(r["pending"], dialogs::confirm::KIND);
-    let d = app.ui.dialog.as_ref().unwrap();
-    assert_eq!(d.str("message"), "Install “Plain” in place of the plug-in with the same ID?");
-    assert_eq!(d.str("detail"), format!("ID: {id}\nFile SHA-256: {other_hash}\n\n{takes_place}"));
+    assert_eq!(r, json!({"pending": dialogs::plugin::INSTALL_KIND}));
+    let pending = app.pending_plugin_install.as_ref().unwrap();
+    assert_eq!(pending.message, "Install “Plain” in place of the plug-in with the same ID?");
+    assert_eq!(pending.detail, format!("ID: {id}\nFile SHA-256: {other_hash}\n\n{takes_place}"));
+    assert_eq!(pending.params["replace"], json!(true), "OK replaces the one installed");
+    assert_eq!(dialogs::confirm(&mut app).unwrap()["pending"], dialogs::plugin::INSTALL_KIND, "it waits like any other question");
+    show_approval(&mut app);
     dialogs::confirm(&mut app).unwrap();
     assert!(app.ui.dialog.is_none());
     assert_eq!(vectorcraft_plugins::registry::get(id).map(|p| p.hash().to_string()), Some(other_hash));
diff --git a/crates/ui-egui/src/tests/rotateview.rs b/crates/ui-egui/src/tests/rotateview.rs
index dbdb0283fd..715610f08e 100644
--- a/crates/ui-egui/src/tests/rotateview.rs
+++ b/crates/ui-egui/src/tests/rotateview.rs
@@ -117,7 +117,8 @@ fn control_rotate_view_keeps_press_coordinates_and_shift_snapping_across_request
         send(&mut app, &ctx, "ui.pointer", json!({"mods": {"shift": true}, "events": [{"kind": "drag", "x": x, "y": y}]}));
         assert_eq!(app.view().unwrap().rotation, 45.0, "the same document point does not turn again as the view changes");
     }
-    send(&mut app, &ctx, "ui.pointer", json!({"events": [{"kind": "up", "x": x, "y": y}]}));
+    // Null `mods` keep the default, as an omitted value does.
+    send(&mut app, &ctx, "ui.pointer", json!({"mods": null, "events": [{"kind": "up", "x": x, "y": y, "mods": null}]}));
     assert_eq!(app.view().unwrap().rotation, 45.0);
 }
 
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index efc0fc182e..0384adc08a 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -217,7 +217,9 @@ export's own parameters); `ui.dialog.confirm` writes the file. An importer plug-
 `pluginImport` dialog when `file.openWith` is given no `params`: one field per parameter, `__plugin`, and `__open`
 (`path` and `importer`); `ui.dialog.confirm` opens the file. `ui.installPlugin {path?}` installs a `.wasm` (without
 a path it asks for one); one that needs approval opens the `pluginInstall` dialog, which only a person can confirm
-(`ui.dialog.confirm` and injected input are refused); see [plugins.md](plugins.md).
+(`ui.dialog.confirm` and injected input are refused). When a control request opened it, directly or through a file
+dialog, the reply adds `approval: "personMustStartInstall"` and nobody can confirm it: the person chooses Object ›
+Plug-ins › Install Plug-in… to install the plug-in; see [plugins.md](plugins.md).
 
 Overprint Black: the Edit → Edit Colors → Overprint Black… menu item opens a `command` parameter dialog for
 `edit.colors.overprintBlack` (fields `remove`, `percentage`, `fill`, `stroke`, `includeCmyBlacks`,
@@ -711,8 +713,9 @@ with.
 DXF Options: Export As… with the DXF format (`file.exportAs {format: "dxf"}`, then the save dialog), or
 `ui.dxfOptionsDialog {path?, …document.exportDxf options}` for agents, opens the `dxfOptions` dialog. Its fields are
 `document.export` params: `dxfPreset` (`custom`, `cnc`), `version`, `unit` (a unit name such as `Millimeters`), `scale`,
-`scaleLineweights`, `colors` (`8`, `16`, `256`, `true`), `rasterFormat` (`png`, `jpeg`), `preserve` (`appearance`,
-`editability`), `selectedOnly`, `alterPaths`, `outlineText`, plus `path` and the artboard choice. Setting `dxfPreset` to
+`scaleLineweights`, `colors` (`8`, `16`, `256`, `true`), `rasterFormat` (`png`, `jpeg`), `includeImages` (Include
+Placed Images), `preserve` (`appearance`, `editability`), `selectedOnly`, `alterPaths`, `outlineText`, `includeHatches`
+(Include Fill Hatches), plus `path` and the artboard choice. Setting `dxfPreset` to
 `cnc` sets the fields it sets (see `document.exportDxf`), and `dxfPreset` reads `custom` again once one of them is
 changed; setting it to `custom` puts back the defaults. `ui.dialog.confirm` checks them (a bad value, or
 Export Selected Art Only with nothing selected, keeps the dialog open), remembers them for the next DXF Options and
@@ -1066,7 +1069,7 @@ app:
 | `vectorcraft.docInspect(params)` / `vectorcraft.uiInspect(params)` | `document.inspect` / `ui.inspect` |
 | `vectorcraft.inspect()` | `ui.inspect` (the name before `uiInspect`) |
 | `vectorcraft.screenshot(params)` | `ui.screenshot` (no `path`: the PNG comes back inline, as `data` and as `pngBase64`) |
-| `vectorcraft.openFile(name, bytes)` | opens the bytes the way a dropped file opens (returns `true` once queued) |
+| `vectorcraft.openFile(name, bytes)` | opens the bytes the way a dropped file opens, as automation: a plug-in install it asks for has to be started by the person (returns `true` once queued) |
 | `vectorcraft.captureDownloads(on)` | while on, a save or export is kept in the page instead of downloaded |
 | `vectorcraft.files()` / `vectorcraft.readFile(name)` | the kept files (`{path, size}`) / one of them as a `Uint8Array` |
 
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 2e3a67ae4a..e2721d431b 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -290,7 +290,7 @@ Names in the editing data that aren't UTF-8 (layers, objects, artboards, colors,
 | EPS | open, place, save | yes (own PostScript L3 interpreter, Illustrator EPS editing data structure) | yes (L2/L3, TIFF previews) | CIDFonts the file doesn't carry not drawn, but for those over a predefined Unicode CMap (`UniJIS-UCS2-H`), set as type in the font of the CIDFont's name; name-keyed fonts in a FontSet set as type by name; #505; images encoded with `CCITTFaxDecode` (ITU-T T.4 Group 3 and T.6 Group 4, with `K`, `Columns`, `Rows`, `EndOfBlock`, `EndOfLine`, `EncodedByteAlign` and `BlackIs1`) draw, and damaged data keeps the rows decoded before its first damaged row; Type 42 (TrueType) fonts set type at its size (#1553); an embedded Type 1 font's encrypted part is read for its glyphs, which space its type, outline it and draw glyphs without a character, in plain and composite fonts; a Type 42 font that carries its TrueType font gives each code its character by its glyph name or, for names that say nothing (`/g12`), by the glyph's entry in the font's own character map, spaces its type by its own widths and draws glyphs that stand for no character from its outlines; the show operators' spacing along the baseline (`ashow`, `widthshow`, `xshow`, `yshow`, `xyshow`, and the moves of `kshow`'s procedure, run between each two characters) is kept on live type as tracking, so type in a font that isn't installed keeps the file's line lengths (spacing that moves characters off the baseline, as `yshow`, `xyshow` or a `kshow` procedure can, places each character as its own text object); composite (Type 0) fonts with the 8/8 mapping, as PDF-to-PostScript converters write two-byte fonts, draw a Type 42 descendant's glyphs from the TrueType outlines it carries and an embedded Type 1 descendant's from its charstrings, and set other descendants' characters as type at the composite font's size (other mappings are still set as type in the font of their name); CID-keyed fonts (`composefont`, `FMapType` 9 over a CMap built with the CIDInit operators or `Identity-H`/`Identity-V`; `bfchar` and `bfrange` mappings give a base-font descendant its codes or glyph names) draw the glyphs of the Type 0 CIDFonts (Type 1 charstrings in their `StartData` binary data or `GlyphDirectory`) and Type 2 CIDFonts (TrueType glyphs through `CIDMap`) they carry, and the CID-keyed fonts of a FontSet's Compact Font Format data (Type 2 charstrings); a clip only counts as covering the page when its shape does (#1542); an EPS another app copied pastes as editable vector art (`clipboard.importEps`, #1499); a stitched shading keeps its hard colour changes on import (#1654); sampled functions (type 0) interpolate between their samples, multilinearly or by cubics with `Order 3`, and a sampled axial or radial gradient has a stop at each sample; a gradient the page paints as a row of abutting one-colour strips (as Level 2 writers draw smooth shades) imports as one linear gradient, without the seams the strips leave when each is drawn alone; CMYK images, CMYK JPEGs included, keep their ink amounts on import, as from PDF, and the pixels a `MaskColor` or `ImageType 3` mask hides become a grayscale opacity mask; ruzstd 0.9.1 for compressed editing data (#1807, RUSTSEC-2026-0344) |
 | PostScript `.ps` | open, place | yes (the EPS reader reads its first page; `.epsf` files open and place as EPS) | via Print to PostScript | `tests_epsimport.rs` |
 | SVG / SVGZ | open, place, save | yes | yes (SVG Options, Preserve Editing, symbols, filters, rich text) | strongest format; tests in `crates/svg/tests`; text on a path follows basic shapes as their SVG 2 equivalent paths (#1527); CSS transforms and the `font` shorthand (#1565), percentage lengths in symbols (#1596), Inkscape flowed text as area type (#1568) and Inkscape pages as artboards (#1601) import; an unsupported filter is named in its warning (#1598); an artboard exported on its own (Export As with Use Artboards, Export for Screens, Asset Export) has the artboard's name as `<title>`, Save the document's (#3544); attributes in other applications' XML namespaces (`plotter:pen="2"`) kept on their objects from import to export, as `data-*` attributes are (`crates/svg/tests/it/foreign_attributes.rs`); simple shapes export as `<rect>`, `<circle>`, `<ellipse>`, `<line>`, `<polygon>` and `<polyline>` where they draw the same as the path (#4652, `crates/svg/tests/it/basic_shapes.rs`); the regions of exported masks and filters (opacity masks, inverted masks, knockout groups) cover the art they apply to, and over type keep a region that covers any artwork (#6401, `crates/svg/tests/it/blend_export.rs`) |
-| DXF | open, export | yes | yes (R12–2018) | R13–2018 closed SPLINE flags and control-point closure on import verified (#1299); circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE while non-circular curves keep the existing fallback (`crates/cad/src/tests.rs`); [Autodesk group 70](https://help.autodesk.com/cloudhelp/2024/ENU/AutoCAD-DXF/files/GUID-E1F884F8-AA90-4864-A215-3182D47A9C74.htm). DXF 2000–2018 LAYOUT objects write the paper image origin as 148/149 (was a stray 158), the shade plot codes (2004+) and the model type flag, and the plot style placeholder carries no subclass marker (#3085; structure test `r2000_and_later_files_have_the_structure_cad_apps_require`, checked with ezdxf's audit; not yet confirmed in Autodesk Fusion). CNC preset and VCarve QA remain open |
+| DXF | open, export | yes | yes (R12–2018) | R13–2018 closed SPLINE flags and control-point closure on import verified (#1299); circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE while non-circular curves keep the existing fallback (`crates/cad/src/tests.rs`); [Autodesk group 70](https://help.autodesk.com/cloudhelp/2024/ENU/AutoCAD-DXF/files/GUID-E1F884F8-AA90-4864-A215-3182D47A9C74.htm). DXF 2000–2018 LAYOUT objects write the paper image origin as 148/149 (was a stray 158), the shade plot codes (2004+) and the model type flag, and the plot style placeholder carries no subclass marker (#3085; structure test `r2000_and_later_files_have_the_structure_cad_apps_require`, checked with ezdxf's audit; not yet confirmed in Autodesk Fusion). DXF Options' Preset menu and `document.exportDxf`'s `dxfPreset: "cnc"` set the CNC / CAM options (#5500); VCarve QA remains open |
 | HP-GL/2 `.plt`, `.hpgl`, `.hgl`, `.hpg` | — | yes (pen moves, pens and widths, line types and attributes, circles, arcs, wedges and Bézier curves, filled and edged rectangles, wedges and polygons, encoded polylines, scaling and rotation; labels, symbol mode, raster images and hatching aren't drawn) | yes (`.plt`: each visible path once along its line, a pen per color or a pen table, type as outlines, clipping applied, HP-GL or HP-GL/2 with pen colors and encoded polylines) | recognized by its first instructions after any printer escapes, under its own extensions or one no other format reads; `crates/cad/src/hpgl/tests.rs`, `crates/cad/src/hpgl/write/tests.rs` (plots read back by the reader), `tests_hpgl.rs`, `import_fuzz.rs` |
 | DWG | open, export | no | no | no open spec; DXF instead |
 | EMF / WMF | open, export | yes | yes | an oversized embedded PNG or JPEG is refused from its header, before any pixels are decoded (#1776) |
diff --git a/docs/gaps.md b/docs/gaps.md
index 3a72e15433..4186fa64dd 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -323,8 +323,7 @@ macOS cursor delivery (#2292) is narrowed to a native host adapter using the exi
 
 - **Done:** Numeric fields keep a text drag's start when the pointer gains focus and movement exceeds the click threshold (#1326, in part). A completed focus click selects the whole value; keyboard focus, double-click and numeric stepping remain regression-tested. Short movements still classified as clicks can select all; that case remains open.
 
-- **Done:** DXF reads control-point SPLINE closure (#1299 follow-up after #1320); open curves keep their open state. DXF export now recognizes circular cubic paths conservatively and writes native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE, and a non-circular ellipse keeps the existing fallback. Alter Paths for Appearance outlines only the strokes a CAD line can't draw (aligned, profiled, offset dashes, wider than 2.11 mm, or in R13 and R14), so a 1 pt circle or arc stays a CIRCLE or ARC. CNC preset and VCarve QA remain open. Escape leaves Artboard editing for Selection; during a drag it first cancels the gesture. Headless egui key events cover idle Escape, active-drag cancellation and a subsequent Escape in `tests/distortkeys.rs`.
-- **Done:** DXF reads control-point SPLINE closure (#1299 follow-up after #1320); open curves keep their open state. DXF export now recognizes circular cubic paths conservatively and writes native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE. A closed four-cubic ellipse, or a circle scaled out of proportion, is written as a native ELLIPSE in R13 and later; R12 keeps the existing fallback. CNC preset and VCarve QA remain open. Escape leaves Artboard editing for Selection; during a drag it first cancels the gesture. Headless egui key events cover idle Escape, active-drag cancellation and a subsequent Escape in `tests/distortkeys.rs`.
+- **Done:** DXF reads control-point SPLINE closure (#1299 follow-up after #1320); open curves keep their open state. DXF export now recognizes circular cubic paths conservatively and writes native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE. A closed four-cubic ellipse, or a circle scaled out of proportion, is written as a native ELLIPSE in R13 and later; R12 keeps the existing fallback. Alter Paths for Appearance outlines only the strokes a CAD line can't draw (aligned, profiled, offset dashes, wider than 2.11 mm, or in R13 and R14), so a 1 pt circle or arc stays a CIRCLE or ARC. DXF Options' Preset menu and `document.exportDxf`'s `dxfPreset: "cnc"` set the CNC / CAM options (#5500); VCarve QA remains open. Escape leaves Artboard editing for Selection; during a drag it first cancels the gesture. Headless egui key events cover idle Escape, active-drag cancellation and a subsequent Escape in `tests/distortkeys.rs`.
 
 - **Done:** Simplify and Add Anchor Points clear stale component selections on rewritten paths; Simplify previews and reports original/new point counts (#1272).
 - **Done:** Object › Path › Simplify opens its slider at the Auto-Simplify level for the selection and previews that result, as the [manual-simplify page](https://helpx.adobe.com/illustrator/desktop/draw-shapes-and-paths/modify-paths/manually-simplify-paths.html) describes; simplifying only a Direct Selection part of a path is done too (G1).
diff --git a/docs/mcp.md b/docs/mcp.md
index ce29408fed..4dc867afbf 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -153,6 +153,11 @@ the suite) keep the agent to the folders you give it:
   and `modified` the document keeps of that file. Each row keeps its id, `name` (`fileName`), status and other
   fields. This applies to every document, also one the person or a client with wider roots opened. The paths a
   client gives `links.relink` and `links.unembed` stay in their replies, and the document's links are not changed.
+- `prefs.get`, `prefs.list`, `prefs.set` and `prefs.reset` show a folder preference outside the read roots
+  (`fontsFolder`, `pluginsFolder`, `scratchPrimary`, `scratchSecondary`, `recoveryFolder`, `templatesFolder`) as
+  `null`; an empty folder and the scratch disk choices `Startup` and `None` stay. In `prefs.get {}` and
+  `prefs.reset`, an export preset in `screenExportPresets` leaves out its `folder` when the folder is outside the
+  read roots, and the preset stays. The preferences themselves are not changed.
 - Each flag may be given more than once (#3546): a path inside any of the read roots may be read, one inside any
   of the write roots written, so one session can read a project folder and a shared assets folder, or write to an
   output folder and a scratch folder, without widening a root to their common parent. A folder given twice
@@ -1336,6 +1341,22 @@ fails with no change. A description with a `…` entry takes more keys than it l
 object can carry several formats' options). A command that takes its own reply back
 (`document.setup`, `text.areaOptions`) says so the same way.
 
+The app's own commands are not checked against their descriptions, but those listed here refuse a value of the wrong
+type and change nothing: `view.setZoom` (`zoom`, `center`), `view.screenMode` (`mode`), `window.panel` (`toggle`,
+`toggleGroup`), `file.revert` (`confirmed`), `file.close` (`index`), `ui.newSwatch` (`spot`, `global`),
+`ui.symbolOptions` (`edit`), `ui.batchDialog` (`set`, `action`) and `file.exportSelection` (`multiple`). So do the
+control channel's `ui.key`, `ui.move`, `ui.wheel`, `ui.click`, `ui.drag`, `ui.pointer`, `ui.resize`, `ui.screenshot`,
+`ui.render` and `ui.set` for their numbers, switches and `mods`, and the headless session's key, pointer and screenshot
+calls. Omitting a param or giving null keeps its default, with two exceptions: `ui.click`'s `count` and `ui.drag`'s
+`count` and `steps` refuse null, and a headless pointer event needs its `x` and `y`. A pointer event's `pressure`,
+`holdMs`, `tiltX`, `tiltY` and `rotation` must be numbers and its `space` must be `doc` or `screen`. A pointer packet
+with one malformed event sends none of its events:
+
+```json
+{"id": "view.setZoom", "params": {"zoom": "200"}}
+→ `zoom` must be a number
+```
+
 Saved actions aren't checked this way. When the Actions panel plays an action (Play at any speed, an action's function
 key, the Batch dialog or `ui.action.play`), a key a command no longer reads, recorded by an older version, is ignored
 and the action still plays. `Session::replay` plays a journal the same way. The command still refuses an effect
@@ -5925,8 +5946,11 @@ DXF layer (hidden layers switched off, locked ones locked, non-printing ones not
 straight paths become polylines (an open path of one straight segment becomes a line, except for a stroke weight
 before 2000), curved ones cubic splines through every anchor, fills their outlines followed by
 solid hatches (laser and cutter software reads the outlines and skips hatches; R12 has no hatches: the outlines
-alone), strokes lines with their lineweight and a linetype per dash pattern, and placed images image entities linked
-to PNG or JPEG files (`rasterFormat`) written next to the drawing (`linked` in the result). Coordinates are y up
+alone; an open path's fill outline is closed, as the fill is), strokes lines with their lineweight and a linetype per dash pattern, and placed images image entities linked
+to PNG or JPEG files (`rasterFormat`) written next to the drawing (`linked` in the result). `includeImages: false`
+leaves placed images out, with no image entity, no linked file and no decoding of their pixels, and `includeHatches:
+false` writes each filled area as its outlines alone, without its solid hatch (both default to `true`; these two
+options are VectorCraft's own). Either one, when it leaves something out, adds one note to `warnings`. Coordinates are y up
 from the bottom-left corner of the first artboard (or `artboard`), in drawing units: `scale` units per `unit` (default
 1 mm = 1 unit, which sets `$INSUNITS`); `scaleLineweights` scales the lineweights with them. `colors` is `8`, `16` or
 `256` indexed colours, or `true` (default; true colour with the nearest index, DXF 2004 and later). `preserve:
@@ -5939,7 +5963,8 @@ selected objects in their layers (every export takes it), and `useArtboards: tru
 artboard holding the art over it. `dxfPreset: "cnc"` (CNC / CAM; default `"custom"`) sets the options for cutting
 software that the call does not give: version `2000` (the oldest version that has both lightweight polylines and lineweights), `unit:
 "mm"` and `scale: 1`, `colors: 256` (all version 2000 holds), `preserve: "editability"` with `alterPaths: false` (every
-stroke a center line), `outlineText: true` (type as paths), and `rasterFormat: "png"`. DXF Options has the same choice as its Preset menu,
+stroke a center line), `outlineText: true` (type as paths), `includeImages: false` and `includeHatches: false` (the
+cutting paths alone: fills as their outlines, no image files), and `rasterFormat: "png"`. DXF Options has the same choice as its Preset menu,
 which shows Custom again once a field it sets is changed. What DXF can't hold (gradients and patterns as one colour,
 blending, opacity masks, raster effects, clipping) comes back in `warnings`. In R13 and later, an image that can't be decoded is left out with
 no linked file, and `warnings` carries "an image couldn't be decoded and is missing from the picture" once for all such
@@ -7045,7 +7070,9 @@ the middle of its bounding box's right side, hollow on point type and filled on
 Type and Convert To Point Type. Either keeps the text and its styles and is one undo step; `ids` picks the objects
 (default: the selection). A frame of threaded text that `type.convertToPointType` converts leaves its thread with the
 text it holds, and the story flows through the other frames without that text; a thread left with one frame is no
-longer a thread.
+longer a thread. Area type with Dynamic Text (Block) on becomes point type with Dynamic Text off, at the sizes Block
+set its lines to, as `type.dynamicText {on: false}` leaves them; converting it back to area type does not turn Block
+on again.
 
 ```json
 {"name":"run_command","arguments":{"command":"type.convertToAreaType","params":{"ids":[42]}}}
@@ -8062,7 +8089,10 @@ needs a person's approval too, and `plugin.install` refuses `grant: [permission]
 app connected, `ui.installPlugin` opens the approval dialog and returns `{pending: "pluginInstall"}`; `answer_dialog`,
 `ui.dialog.confirm` and injected input can't confirm it. Its OK takes input only once the question has been on screen
 in the focused window for half a second, counted again for every new question and after the window gets the focus
-back. A `vectorcraft-cli mcp` started with `--allow-plugin-grants`
+back. A question that a request asked, directly or through a file dialog it opened, can't be approved by the person
+either: the reply adds `approval: "personMustStartInstall"`, OK stays disabled, and the person installs the plug-in
+with Object › Plug-ins › Install Plug-in… themselves. A request's `replace: true` doesn't skip the question about
+taking another module's place. A `vectorcraft-cli mcp` started with `--allow-plugin-grants`
 accepts `grant` and `allowHeavy` from any request, in that session only (headless; it can't be combined with
 `--connect`, `--automation-read-root` or `--automation-write-root`). A server confined to folders has no plug-in
 store, so it reads no `grants.json`, and a module that lists permissions or asks for a heavy budget does not install
@@ -8606,7 +8636,8 @@ keys without bounds make 1 step. `starts` gives, per object, the anchor of its f
 from (as the Blend tool's clicks on anchor points do; an open path's last anchor runs it the other way). With the
 Blend tool, `press_key` Escape drops the object clicked first and stops the next click adding to the blend
 just made; the document and the selection stay as they are. A blend
-among the objects takes the others in as more key objects, keeping its options, name and transparency:
+among the objects takes the others in as more key objects, keeping its options, name, transparency and whether it
+has a spine:
 
 ```json
 {"name":"run_command","arguments":{"command":"object.blend.make","params":{"ids":[12,15],"starts":[0,2],"steps":8}}}
@@ -8614,6 +8645,23 @@ among the objects takes the others in as more key objects, keeping its options,
 {"name":"run_command","arguments":{"command":"object.blend.info","params":{}}}
 ```
 
+`object.blend.createSpine {mode?: "auto" | "always" | "never"}` is the Blend panel's Create Spine menu: whether new
+blends get a spine (the [help page](https://helpx.adobe.com/illustrator/desktop/manage-colors/apply-transparency-and-blending/blend-panel-overview.html)
+describes the three choices). Without `mode` it reads the setting; both return `{mode}`. Auto, the default, and Always
+give every new blend a straight spine between the key centers, as before, whatever its key objects are. Never makes blends without a spine: their steps sit where a straight spine puts them, and
+`object.blend.info` reports `hasSpine: false` and no `spine`. Such a blend has no easing (`easingType` and `ramp` are
+refused, and the Blend panel dims Type and Ramp), Reverse Spine and the `object.blend.spine.*` commands refuse it
+("the blend has no spine"), and Release gives back its keys with no spine path. Replace Spine gives it a spine. The
+setting is kept with the preferences, is not an undo step and does not change blends already made, and
+`object.blend.make {createSpine}` chooses for one new blend. Any other value is refused ("`mode` must be one of auto,
+always, never") and changes nothing. A blend saved without a spine keeps `noSpine` in the native file; `.ai` and
+EPS files hold its drawn steps, as they do for every blend:
+
+```json
+{"name":"run_command","arguments":{"command":"object.blend.createSpine","params":{"mode":"never"}}}
+{"name":"run_command","arguments":{"command":"object.blend.make","params":{"ids":[20,31],"createSpine":"always"}}}
+```
+
 With the Blend tool active, `tool.select {tool: "blend"}` finishes the blend, as a click on the tool's button or W
 does: it drops the object clicked first and stops the next click adding to the blend just made. The document and the
 selection stay as they are. Choosing any other tool that is already active leaves its work as it is.
@@ -8624,7 +8672,7 @@ the spine passes nearest, `object.blend.spine.moveAnchor {anchor, x, y}` moves a
 `handle: "in" | "out"` it places that handle), `object.blend.spine.convertAnchor {anchor, to: "smooth" | "corner", x?, y?}` converts a point's handles (a Smooth drag with `x, y` creates opposite handles; Corner retracts both), `object.blend.spine.reshapeSegment {segment, t, dx, dy, perpendicular?}` bends a segment
 so its point at `t` moves by (dx, dy), turning a straight spine into a curve (`perpendicular` works as in `path.reshapeSegment`), and `object.blend.spine.removeAnchor
 {anchor}` deletes a point no key sits on; the first edit turns the spine into a path. Moving a key moves its end of the spine. Release
-(`object.blend.release`) leaves the spine as a path that paints nothing (`spines` in the result):
+(`object.blend.release`) leaves the spine of a blend that has one as a path that paints nothing (`spines` in the result):
 
 ```json
 {"name":"run_command","arguments":{"command":"object.blend.spine.addAnchor","params":{"id":40,"x":150,"y":100}}}
diff --git a/docs/plugins.md b/docs/plugins.md
index dacf59b218..d3af5fa06c 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -217,7 +217,16 @@ capability model proposed for PhotoCraft plug-ins
   https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/security-considerations-for-browser-ui.md
   gives for dialog boxes), so a click, Enter or Space, or a press begun before then, installs nothing. The half second
   starts over for every new question, even one that reads the same, and when the window gets the focus back. Cancel
-  and Escape work at once.
+  and Escape work at once. A module that would take the place of the installed plug-in with its id asks in the same
+  dialog.
+- **An install that automation asked for is not approved in its dialog.** When a control request, MCP, injected input,
+  or a file dialog that one of them opened (even when the person picks the file there) leads to the approval dialog, its
+  OK stays disabled, a confirm is refused even after the half second, and the dialog says that automation asked for the
+  install. `ui.installPlugin` returns `{pending: "pluginInstall", approval: "personMustStartInstall"}`. Cancel still
+  closes it. To install the plug-in, the person chooses Object › Plug-ins › Install Plug-in… and picks the file, or
+  opens it with File › Open or drops it on the window: the module is inspected again and the new question waits its
+  half second. A request's `replace: true` does not skip asking about taking another module's place. A module that
+  needs no approval still installs at once from any request. This is VectorCraft's own rule.
 - `plugin.install` refuses the module, naming the permissions it needs, unless this module already has a recorded grant
   (`plugin.inspect`'s `needsApproval` tells it beforehand). A request's `grant` is refused too: `plugin.install` takes
   it only with the approval the dialog gives. A `vectorcraft-cli mcp` or `run` started with `--allow-plugin-grants`
@@ -262,14 +271,16 @@ capability model proposed for PhotoCraft plug-ins
   write the module to the `Plug-ins` folder, or can't remove the grant from `grants.json`, the folder keeps the module
   it held and `grants.json` keeps the grant. The new module runs until the session ends. When the grant can't be
   removed and the module already stored can't be read back or written back, the new module stays in the folder, and
-  the grant does not count for the rest of the session. The grant also does not count when the folder held no module
-  for that id. A
+  the grant stops counting. The grant also stops counting when the folder held no module for that id. A
   `grants.json` larger than 1 MiB, or one that is not a JSON list, grants nothing: the new module stays in the folder,
   and `plugin.remove` removes the plug-in. A `grants.json` that can't be opened or read counts as a grant that can't be
   removed. When VectorCraft loads the `Plug-ins` folder, it forgets any grant for an id whose stored module lists no
-  permissions. When it can't remove that grant from `grants.json`, or can't read the file, the grant does not count for
-  the rest of the session, or until the plug-in is granted again, including for the next load, which tries the removal
-  again. In Safe Mode, and for
+  permissions. When it can't remove that grant from `grants.json`, or can't read the file, the grant stops counting,
+  including for the next load, which tries the removal again. A grant that stops counting in either of these cases
+  does not count for any session in the same process that uses the same `Plug-ins` folder, by any path to it, until
+  `grants.json` can be written for that plug-in, as when the plug-in is granted again. Another process on the same
+  folder, for example `vectorcraft-cli` beside the app, still reads `grants.json` as it is written. A grant for the
+  same id kept in another `Plug-ins` folder counts. In Safe Mode, and for
   a stored module that the user disabled,
   VectorCraft does not read the module, and `grants.json` keeps the grant for its id. The Additional Plug-ins Folder
   and `plugin.reload` do not change the `Plug-ins` folder: when they leave a module that lists no permissions under an
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index e4fa67b0eb..2ac05ba6ba 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -238,7 +238,7 @@ dominate; 3D, graphs and automation are specialist). They sum to 105. Feature de
 | Image Trace, graphs, image tools | 3 | 75% | graph Column designs, Image Trace Create Strokes depth (Create Object Mosaic is done; junction-returning piece survival has source-generated regressions in `image-trace-quality.md`; large images trace with a warning; Auto Color keeps rare distinct colours) | 5–8 | estimated (raised from 72%); quick presets reveal adjustment controls, Properties reopens them |
 | Layers, artboards, document setup | 5 | 78% | Selected-artboard deletion is consistent across panel actions (all-selected retains artboard 1); history prunes removed indices while preserving valid multiselection; remaining:  30.0's artboard locking and colours and managing artboards from the canvas, Layers panel row context menus and Collect for Export (click-to-fit objects is done, #1227) | 5–8 | estimated (lowered from 82%: target moved); Artboard deletion keys keep artwork and the first of an all-selected set; Artboard Options' Show Center Mark and Show Cross Hairs draw on the canvas only (exports and print leave them out), regression-tested; Artboard Options' Show Video Safe Areas and Video Ruler Pixel Aspect Ratio (per artboard, native format) are done ([video display options](#evidence-what-ships-today-by-area)), score unchanged |
 | View & navigation | 3 | 70% | multiple windows and the rest of Arrange (Cascade, Float in Window, Float All in Windows) | 9–14 | estimated; Window › Arrange › Tile and Consolidate All Windows done (score/hours unchanged); document-tab artwork hover/copy and lossless transfer tested (2026-10-22; score/hours unchanged); cached canvas reprojection preserves scale during resize, rotation and DPI changes (regression and contributor original-file evidence below; scores/hours unchanged); cached canvas dimensions match the renderer limit before cache-key creation, view construction and worker submission (regression evidence below) |
-| File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), no writing of Illustrator's editing data (#868), FreeHand/CorelDRAW/DWG/HEIC import, 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified  PDF marked-text batching covered by M4 evidence (#6309); cross-line/style ActualText layout (#6165) and styled-cluster limits remain.| 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`; the distance from the path under Align to Path is measured from the top of each character's em box, half the height of the top of its H or the bottom of its font's bounding box (`tests_native::aligned_type_lies_as_far_from_its_path_as_the_file_lays_it_out`), and the fit under Gravity does not reproduce the file's layout), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. PDF ActualText preserved in editable import (#6165; bounded synthetic coverage below); score/hours unchanged. |
+| File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), no writing of Illustrator's editing data (#868), FreeHand/CorelDRAW/DWG/HEIC import, 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified  PDF marked-text batching covered by M4 evidence (#6309); cross-line/style ActualText layout (#6165) and styled-cluster limits remain.| 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); DXF export's Include Placed Images and Include Fill Hatches options, off in CNC / CAM (`images_and_hatches_are_left_out_independently_and_the_cnc_preset_leaves_out_both`; score, gaps and hours unchanged); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`; the distance from the path under Align to Path is measured from the top of each character's em box, half the height of the top of its H or the bottom of its font's bounding box (`tests_native::aligned_type_lies_as_far_from_its_path_as_the_file_lays_it_out`), and the fit under Gravity does not reproduce the file's layout), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. PDF ActualText preserved in editable import (#6165; bounded synthetic coverage below); score/hours unchanged. |
 | File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), a saved `.ai`'s editing copy without live effects on objects other than paths, compound paths and groups that qualify (at most a fill and a stroke, a non-zero fill rule when filled, no large canvas) and whose appearance and effects the art-style writer supports, and with live objects as their art (#868), FreeHand/CorelDRAW/DWG/HEIC import, textures, map art and shading in 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified  PDF marked-text batching covered by M4 evidence (#6309); cross-line/style ActualText layout (#6165) and styled-cluster limits remain.| 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. PDF ActualText preserved in editable import (#6165; bounded synthetic coverage below); score/hours unchanged. |
 | File formats | 6 | 75% | `.ai` files open with a flattened or wrong layer structure in real cases (#951), a saved `.ai`'s editing copy without live effects on objects other than paths, compound paths and groups that qualify (at most a fill and a stroke, a non-zero fill rule when filled, no large canvas) and whose appearance and effects the art-style writer supports, and with live objects as their art (#868), FreeHand/CorelDRAW/DWG/HEIC import, 3D export; see [file-format-parity.md](file-format-parity.md); EPS legacy mesh/opacity-mask and raster comparison follow-up verified  PDF marked-text batching covered by M4 evidence (#6309); cross-line/style ActualText layout (#6165) and styled-cluster limits remain.| 10–20 | estimated (lowered from 85%: open issues); DXF control-point SPLINE import closure regression-tested (#1299 follow-up after #1320); PDF writer metadata, reader streaming and immutable backend checks in `crates/pdf/src/tests.rs`, `crates/pdf/src/tests/reader_streaming.rs` and `xtask/src/pdf_deps.rs`; PDF Place and clipboard paste retain live text (synthetic regressions); SVG CSS classes survive export and repeated import in all four styling modes (#2480); current-main integration retains event attributes and scripts; EPS ordinary Save retains the page frame and editable document (2026-10-26); `.ai`/EPS editing data checked against a user's files (2026-10-30): case setting (`ate::tests`, `tests_native::type_from_the_text_document_keeps_its_case_setting`), placed-file placements (`tests_native::a_small_placed_file_goes_where_it_draws_closer_to_the_page`), pages cropped to the art (`tests_native::type_on_the_copies_of_a_page_cropped_to_the_art_is_read_once`), mesh corner weights and state (`ai::mesh::tests::corners_with_handle_weights_of_zero_are_read`, `ai::tests::a_gradient_mesh_takes_the_transparency_written_after_it`), type on a path spacing (`tests_native::type_round_a_circle_is_spaced_as_the_file_lays_it_out`), blend state (`ai::tests::a_blends_transparency_follows_its_record`); scores and estimates unchanged. PDF ActualText preserved in editable import (#6165; bounded synthetic coverage below); score/hours unchanged. |
 | View & navigation | 3 | 70% | multiple windows and the rest of Arrange (Cascade, Float in Window, Float All in Windows) | 9–14 | estimated; Window › Arrange › Tile and Consolidate All Windows done (score/hours unchanged); document-tab artwork hover/copy and lossless transfer tested (2026-10-22; score/hours unchanged); cached canvas reprojection preserves scale during resize, rotation and DPI changes (regression and contributor original-file evidence below; scores/hours unchanged) |
@@ -761,6 +761,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - `ui.inspect` under `--automation-read-root`: the documents still opening, the recent files, library panels' files and folder preferences (saved, and in an open Preferences dialog) outside the read roots are left out of the reply, a library loaded from outside them shows by its file name in `ui.inspect` and `ui.docking`, and the app's state is not changed. `crates/ui-egui/src/tests/automation.rs` (`ui_inspect_leaves_out_paths_outside_the_read_root`).
   - Link replies under `--automation-read-root`: `links.list`, `links.check`, `links.info` and `document.open`'s link rows leave out the path, found path and folder of a linked file outside the read roots, and the stored size and date of it in `links.info`; each row keeps its id, file name and status, and the document's links are not changed. `crates/engine/src/tests/linkspanel.rs` (`link_paths_outside_the_read_roots_are_left_out`), `crates/engine/src/tests/placed_document.rs` (`link_info_leaves_out_a_placed_documents_path_outside_the_read_roots`).
   - Swatch, brush, symbol and graphic style library lists under `--automation-read-root`: library files and the user library folder outside the read roots are left out, a library loaded from outside them is listed and found by its file name, and the app's own list is not changed. `crates/engine/src/tests/library_roots.rs`.
+  - Preferences commands under `--automation-read-root`: `prefs.get`, `prefs.list`, `prefs.set` and `prefs.reset` show folder preferences outside the read roots as `null` and leave out an export preset's folder outside them, and the preferences are not changed. `crates/engine/src/tests/prefs_roots.rs`.
   - Scripts: `alert`, `confirm` and `prompt` open dialogs during a run, each with a Stop button that ends the run and puts every document back. In the app the run waits at the call for the person's answer; a run over MCP or the command line takes its answers in order from `script.run`'s `answers`, and the report lists each dialog with its answer. `crates/engine/src/tests/script_dialogs.rs`, `crates/ui-egui/src/tests/script_dialogs.rs`.
   - Parameter keys: the engine refuses a key that a command's params description doesn't name before the command runs, in every build and for every caller, including the app's own calls, the commands a command runs and the steps of `command.batch` and `action.batch`. An action recorded by an older version still plays from the Actions panel and the Batch dialog (`Session::replay`). `crates/engine/tests/it/param_keys.rs`.
   - MCP server with 33 tools (drawing, text, effects, Pathfinder, transforms, graphs, text wrap, export, screenshots, undo/redo, UI inspect/screenshot aliases, any command), attached to the running app or headless. Headless and remote `command_list` include desktop `UI_COMMANDS` (`ui: true`); a UI-only id still needs `--connect` to run. Eight prompts (poster, icon-set, recolor, trace-and-style, export-set, check-spelling, variables-bind, path-tools). Effect ids are not command ids. Prefer a CLI built from the checkout when a release binary lags (#6460). `vectorcraft://commands/reference` serves the API reference. Tool descriptions and replies agree with the engine: format lists come from its format table, `save_file` says it keeps the document's own format, `inspect_document` reports the paint type's characters show, and selection exports report the encoder's warnings. `--automation-read-root` / `--automation-write-root` (on `vectorcraft-cli mcp` and on `vectorcraft --control`) confine the files commands read and write to chosen folders, links followed, with the flags PhotoCraft takes (#832); each flag may be given more than once, a path inside any of its folders being allowed (#3546, `file_access::tests::several_roots_of_a_kind_each_grant_their_access`, `cli::mcp_automation_roots_take_several_folders`). A long export can be cancelled (`notifications/cancelled` stops it at the next page or group and writes nothing), reports page progress to a client that sent a progress token, and does not make other requests wait: engine-free ones answer at once, the rest are refused as busy after two seconds (#2165, #2171, #2172).
@@ -773,6 +774,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap, with the built-ins the next two entries list. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only the built-ins present: 4,280 of 4,286 runs pass (4 of the others expect the completion values of later editions, and 2 expect a configurable function `length`). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`.
   - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects. A method visits only the indices that exist when its range is longer than 4,096 indices and more than 8 times the properties on the object and its prototypes, so `new Array(4294967295).join("")` ends at once; a shorter range is visited index by index, holes included, and each index takes fuel. `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 6,798 of 6,866 runs pass (the 34 failing tests expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit and checks that its `stringify` and `parse` agree with the built-in `JSON`. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`.
   - `vectorcraft-js` has `String`, `Number`, `RegExp` and `Date` as ECMAScript 5.1 defines them (sections 15.5, 15.7, 15.9 and 15.10, https://262.ecma-international.org/5.1/), with Annex B's `substr`, `getYear`, `setYear` and `toGMTString`. `toFixed`, `toExponential` and `toPrecision` format a number from its exact decimal value, and `toString(radix)` writes any base from 2 to 36. Regular expressions (flags `g`, `i` and `m`) run on a backtracking matcher whose choice points and capture state count against the heap limit and which takes fuel for every step, so a catastrophic pattern stops at the fuel limit and 50,000 nested groups give a `SyntaxError` at the default depth limit. A string method that would build a string past the heap limit stops before it allocates. `Date` reads the clock and time zone the host sets (`Realm::set_clock`, `Realm::set_time_zone`; local time is UTC by default). `cargo xtask test262` runs the suite's `built-ins` tests for the four (https://github.com/tc39/test262): of the runs of the ES5 tests that need only the built-ins present, 1,379 of 1,411 pass for `String`, 298 of 298 for `Number`, 954 of 988 for `RegExp` and 8 of 8 for `Date`. The others expect later editions' rules (built-in functions whose `length` can be deleted, flags given with a RegExp object, a negative `lastIndex`, `RegExp.prototype` as a plain object, and `RegExp.prototype`'s `global`, `ignoreCase` and `multiline` properties that can be deleted). Tests: `crates/js/src/text_tests.rs`, `crates/js/tests/test262.rs`.
+  - With `Options::e4x` set, an E4X name standing alone (`@a`, `@ns::a`, `@[expr]`, `ns::a`, `*`) inside `with` or a filter predicate can be assigned, with `=` or a compound operator, incremented, decremented, deleted and used as a `for` or `for each` variable, as well as read. Each of these uses the nearest XML or XMLList value in scope that holds the name and evaluates the name once. When no XML value in scope holds the name, the read or write throws a `ReferenceError` before the right-hand side runs and creates no child or attribute, as ECMA-357 section 11.1 (https://ecma-international.org/publications-and-standards/standards/ecma-357/) specifies, so a filter such as `list.(@id == '1')` throws when an item has no `@id` and no outer XML value holds one. Tests: `crates/js/src/xml_tests.rs`.
   - `vectorcraft-js` runs ECMAScript for XML (ECMA-357, 2nd edition, https://ecma-international.org/publications-and-standards/standards/ecma-357/) when `Options::e4x` is set, which it is not by default: XML and XMLList literals with embedded `{}` expressions, the `..`, `.@`, `.*`, `.()` and `::` selectors, assignment and `delete` on selected nodes, `for each`, `default xml namespace`, and the `XML`, `XMLList`, `Namespace` and `QName` objects with their methods and settings (`xpath` is not provided). `<!DOCTYPE>` in an XML string gives a `SyntaxError`. An XML declaration at the start of an XML string, after optional white space, is checked against XML 1.0's grammar (https://www.w3.org/TR/xml/#NT-XMLDecl): a version of `1.` and digits, then an optional encoding name and an optional standalone `yes` or `no`, in that order; any other declaration, or one with a character XML does not allow, gives a `SyntaxError`. The parser takes fuel for the length of every name, white space run and declaration it scans, and for the text it searched when a quote, CDATA section, comment or processing instruction is not closed. Parsing, serializing, comparing and copying trees use no native stack, and each takes fuel and counts against the heap limit. Inserting a node into itself or its descendants throws a `TypeError` before the tree changes, a literal or XML string nested past `Options::max_depth` gives a `SyntaxError`, and a tree built past that depth stops at the heap limit. Tests: `crates/js/src/xml_tests.rs`.
 - **UI:** Illustrator 2026 layout restyled to measured values:
   - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
@@ -1186,7 +1188,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   With Optical Margin Alignment on, or Roman Hanging Punctuation on in the first paragraph, the glyphs at the ends of left-to-right type on a path hang outside its brackets, measured along the path. The type hangs at the start bracket when its line is placed there, hangs at the end bracket when the line is placed there, and hangs at both when it is centered. Glyphs that hang past the end bracket do not make the type overflow, and a hang stops at an open path's end. SVG export writes such type as outlines.
   Type on a Path Options › Align to Path (option names as in [Create type on a path](https://helpx.adobe.com/illustrator/desktop/design-with-text/edit-format-text/create-type-on-a-path.html)) moves each character by its own font, size and vertical scale: Ascender runs the top of the font's em box along the path (the ideographic em box that its `BASE` table, its typographic or `hhea` box or its ideographs give, else an em box centered on the cap height), Descender runs the bottom of the font's bounding box along it, and Center runs a line at half the height of the top of the font's H above the baseline along it. In vertical type, Ascender and Descender move the characters half an em, and Center leaves them on the path. These distances are VectorCraft's own values (`tests::on_path_align_runs_each_glyph_by_its_own_metrics`, `tests::on_path_align_finds_the_em_box_of_each_kind_of_face`, `tests::on_path_align_in_vertical_type_moves_half_an_em`).
   Type › Dynamic Text (`type.dynamicText`, also on the Contextual Task Bar for type on a path) sizes type on a path to fill the span between its start and end brackets and fits it again after each edit to the text, the path or a bracket ([Dynamic Text overview](https://helpx.adobe.com/photoshop/desktop/text-typography/work-with-dynamic-text/dynamic-text-overview.html), [start and end points](https://helpx.adobe.com/photoshop/desktop/text-typography/work-with-dynamic-text/reposition-start-and-end-points.html)). VectorCraft's own rules: one factor scales every size, leading and baseline shift; the first character's size moves in 0.1 pt steps within 0.1 to 1,296 pt; turning it off or threading the type keeps the drawn sizes; SVG, EPS and the editing data write the drawn sizes (`crates/text/src/tests/fit.rs`, `crates/engine/src/tests/dynamic_text.rs`).
-  Dynamic Text on area type is Block (Type › Dynamic Text, the Contextual Task Bar, Area Type Options › Block, the Properties panel's Dynamic Text checkbox with Word Gap and Line Gap; [Dynamic Text overview](https://helpx.adobe.com/photoshop/desktop/text-typography/work-with-dynamic-text/dynamic-text-overview.html)): each line as typed is set to the frame's width by its font size, again after every edit to the text or the frame. VectorCraft's own rules: lines are not broken again, the first character's size moves in 0.1 pt steps within 0.1 to 1,296 pt, Word Gap (0 to 1,000 %, default 100) is the Desired word spacing and Line Gap (-1,296 to 1,296 pt, default 0) is added to each size for the leading, the sizes are written into the characters, and threaded frames cannot use it (`crates/engine/src/cmd/typecmd/block_tests.rs`).
+  Dynamic Text on area type is Block (Type › Dynamic Text, the Contextual Task Bar, Area Type Options › Block, the Properties panel's Dynamic Text checkbox with Word Gap and Line Gap; [Dynamic Text overview](https://helpx.adobe.com/photoshop/desktop/text-typography/work-with-dynamic-text/dynamic-text-overview.html)): each line as typed is set to the frame's width by its font size, again after every edit to the text or the frame. VectorCraft's own rules: lines are not broken again, the first character's size moves in 0.1 pt steps within 0.1 to 1,296 pt, Word Gap (0 to 1,000 %, default 100) is the Desired word spacing and Line Gap (-1,296 to 1,296 pt, default 0) is added to each size for the leading, the sizes are written into the characters, threaded frames cannot use it, and Convert To Point Type turns it off, keeping the sizes (`crates/engine/src/cmd/typecmd/block_tests.rs`).
   Type › Dynamic Text Presets › Circle, Arch and Bow (`type.dynamicTextPreset`) put point type or type on a path on a circular, upward-curving or downward-curving path with Dynamic Text on, with the text's position against the path (above, center, below) and its direction ([Dynamic Text overview](https://helpx.adobe.com/photoshop/desktop/text-typography/work-with-dynamic-text/dynamic-text-overview.html)). VectorCraft's own rules: the circle is as wide as the text and the text starts at its bottom; Arch and Bow are a 120° arc whose chord is as wide as the text; above, center and below are Align to Path's Descender, Center and Ascender (`crates/engine/src/tests/dynamic_text.rs`).
   The frames of threaded text share one Optical Margin Alignment setting: turning it on or off in one frame sets it in every frame, threading frames gives the thread its first frame's setting, and frames taken out of a thread keep it.
   The frames of threaded text share one writing direction: Type › Type Orientation (`type.orientation.vertical`, `type.orientation.horizontal`) in one frame sets every frame, threading frames gives the thread its first frame's direction, frames taken out of a thread keep theirs, and the story flows through every frame in the thread's direction.
@@ -1281,6 +1283,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   A drag with the Live Paint Selection tool draws a marquee and selects the faces and edges it touches, partly enclosed ones included, and a Shift-drag adds them to the selection or removes them from it ([Modify Live Paint groups](https://web.archive.org/web/20261006115247/https://helpx.adobe.com/illustrator/desktop/paint-and-fill/learn-painting-basics/modify-live-paint-groups.html)). A click and a marquee change the selection on release, and Escape before the release leaves the selection as it was. Locked Live Paint groups, those on a locked layer or artboard, and in isolation mode those outside the isolated art are not highlighted or selected.
   When the object the Blend tool picked first is deleted or undone away before the second click, the next click on an object picks that object first instead of doing nothing. Regression tests: `blend_tool_picks_again_when_its_first_pick_is_gone` in `meshblend.rs` and `the_blend_tool_picks_again_when_its_first_pick_is_deleted` in `tests/blendopts.rs`.
   Window › Blend opens the Blend panel: Make, the selected blend's Spacing and Orientation (with no blend selected, the options new blends start with), Reverse Front to Back, Reverse Spine, Replace Spine, Expand and Release, each running its Object › Blend command. Make is dimmed until two or more objects are selected. Spacing and Orientation are dimmed until a blend or two or more objects are selected, and the other buttons are dimmed until a blend is selected.
+  The Blend panel's Create Spine menu (Auto, Always, Never; `object.blend.createSpine`) sets whether new blends get a spine, from the Blend tool, Make and `object.blend.make` alike ([Blend panel overview](https://helpx.adobe.com/illustrator/desktop/manage-colors/apply-transparency-and-blending/blend-panel-overview.html)). Auto and Always give every new blend a straight spine, as before; Never makes blends without one, which keep their steps on the straight lines between the keys, have Type and Ramp dimmed, refuse Reverse Spine and spine edits, release without a spine path, and get a spine from Replace Spine. The setting is kept with the preferences and leaves blends already made as they are; Auto as the starting value and keeping the setting across sessions are VectorCraft's own rules. Builds on #5177 by adambelis. Evidence: `tests::blendopts::{create_spine_sets_whether_new_blends_get_a_spine, a_blend_without_a_spine_has_none_to_edit_reverse_ease_or_release, whether_a_blend_has_a_spine_is_saved_and_old_blends_have_one}` and `panels::tests_blend::create_spine_sets_what_new_blends_get_whatever_is_selected`.
   With the Blend tool, Escape drops the object clicked first and stops the next click adding to the blend just made, so the next click picks a new first object; the document and the selection stay as they are. Regression tests: `escape_drops_the_blend_tools_first_pick` in `meshblend.rs` and `tests/blendopts.rs`.
   Objects on Path (#2545): a click with the Objects on Path tool (in Edit Toolbar's Modify section and the Blend tool's flyout; Object › Objects on Path › Attach and the context menu with two or more objects selected choose it) attaches the selected objects to the path clicked, open or closed, in an Objects on Path group with the path at its bottom. The objects go along the path column by column from left to right, spread evenly from its first anchor (the last one sits on the end of an open path), each turned to the path at its attachment point; Pivot and Rotate set where each one attaches and how far it tilts (`object.objectsOnPath.attach`, `object.objectsOnPath.options`), and with Objects on Path groups selected the Properties panel's Objects on Path Options section shows them as a nine-point Pivot grid and a Rotate field with common angles, each change one undo step for every selected group. Editing the path moves the objects, an object moved on its own goes back, objects moved into or out of the group in the Layers panel join or leave the path, and Object › Objects on Path › Expand leaves a plain group. The group saves and reopens live and exports as plain art. With one Objects on Path group selected, the Selection and Objects on Path tools show the Rotate All widget beside its first object: dragging it turns every object about its attachment point by the angle the pointer turns, adding it to the group's Rotate in one undo step, in 15° steps with Shift ([Objects on Path](https://helpx.adobe.com/illustrator/using/objects-on-path.html)). The Select/Move widget and Detach are missing.
   Objects on Path Space widget: with one Objects on Path group of two or more objects selected, the Selection and Objects on Path tools show a square handle beyond its last object; dragging it along the path, round its bends, sets the distance between the objects' attachment points in one undo step, the first object staying where it is, and with Alt (Option on macOS) the objects spread from both ends toward the center; the distance shows next to the pointer during the drag, in the document's units ([Rearrange and edit objects on a path](https://helpx.adobe.com/illustrator/desktop/manage-objects/arrange-objects/rearrange-and-edit-objects-on-a-path.html), [Objects on Path](https://helpx.adobe.com/illustrator/using/objects-on-path.html)). The group keeps the distance (`object.objectsOnPath.options {spacing, start}`) through Pivot and Rotate changes, path edits, copies, saving and reopening, and scales it with the group; by default (`"auto"`) the objects are spread evenly as before. Evidence: `objects_on_path::tests::{space_sets_the_distance_between_the_stops, space_on_a_closed_path_wraps_at_the_first_anchor_and_stops_short_of_the_first_object}` in `crates/doc`, `tests::objects_on_path::space_sets_the_distance_between_the_objects_in_one_undo_step` in `crates/engine`, `objects_on_path::tests::dragging_the_space_widget_spaces_the_objects_from_the_first_one` in `crates/tools`.
@@ -1515,7 +1518,8 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - EPS and PostScript import keeps a CMYK image's ink amounts, as PDF import does: the samples of `image` and `colorimage` in a CMYK color space, and of a CMYK JPEG read through `DCTDecode`, come in as a CMYK TIFF, read through the image's Decode array, and the pixels a `MaskColor` or `ImageType 3` mask hides become a grayscale opacity mask (`crates/eps/src/import/tests_images.rs`). Such images came in as RGB PNGs.
   - EPS and PostScript import reads image data through `CCITTFaxDecode`: Group 4 (ITU-T T.6) and Group 3 one-dimensional and mixed (ITU-T T.4) data, with the filter's `K`, `Columns`, `Rows`, `EndOfBlock`, `EndOfLine`, `EncodedByteAlign` and `BlackIs1` parameters, decodes to 1-bit rows for `image` and `imagemask`. Damaged data keeps the rows decoded before it (damage in the first row is a PostScript `ioerror`), and parameters out of range or past the 256 MiB limit on decoded data are refused (`crates/eps/src/import/tests_images.rs`). Reading such a file stopped at an error naming the filter, and the file opened from a fallback, such as its preview or the art drawn before the image, or did not open.
   - EPS and PostScript `.ai` import undoes the TIFF predictor (`/Predictor 2`) of `FlateDecode` and `LZWDecode` data at 1, 2, 4 and 16 bits a component as well as 8: each component adds the same component of the pixel to its left within its bit width, 16-bit components add as big-endian numbers, and each row starts again (ISO 32000-1 §7.4.4.4; `crates/eps/src/import/tests_images.rs`, `crates/engine/src/cmd/fileio/tests_epsimport.rs`). At those depths the image drew the stored differences instead of its samples.
-  - DXF control-point SPLINE import honors its closed flag (#1299 follow-up after #1320 fixed export), including rational curves; open curves whose endpoints meet stay open. Own-fixture regressions cover controls/knots, fit-point fallback and all export versions (`crates/cad/src/import/tests.rs`, `crates/cad/src/tests.rs`); native save/read checked. Circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE, and a non-circular ellipse keeps the existing fallback (`crates/cad/src/tests.rs`); an open path of one straight segment exports as a LINE (R12 to R14 strokes with a weight stay polylines, which carry the width) and reads back as the same segment (`crates/cad/src/tests.rs`, `crates/cad/src/import/tests.rs`); DXF Options' Preset menu and `document.exportDxf`'s `dxfPreset: "cnc"` set the CNC / CAM options (version 2000, 1 mm = 1 unit, 256 colors, Maximize Editability with Alter Paths off, Outline Text, PNG placed images), and the menu shows Custom once a field changes (`the_cnc_preset_writes_version_2000_in_millimeters_with_type_as_paths_and_strokes_as_lines`, `the_cnc_preset_sets_the_options_that_are_not_given`, `the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom`); VCarve QA remains pending.
+  - DXF control-point SPLINE import honors its closed flag (#1299 follow-up after #1320 fixed export), including rational curves; open curves whose endpoints meet stay open. Own-fixture regressions cover controls/knots, fit-point fallback and all export versions (`crates/cad/src/import/tests.rs`, `crates/cad/src/tests.rs`); native save/read checked. Circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; R12 weighted strokes remain POLYLINE, and a non-circular ellipse keeps the existing fallback (`crates/cad/src/tests.rs`); an open path of one straight segment exports as a LINE (R12 to R14 strokes with a weight stay polylines, which carry the width) and reads back as the same segment (`crates/cad/src/tests.rs`, `crates/cad/src/import/tests.rs`); DXF Options' Preset menu and `document.exportDxf`'s `dxfPreset: "cnc"` set the CNC / CAM options (version 2000, 1 mm = 1 unit, 256 colors, Maximize Editability with Alter Paths off, Outline Text, placed images and fill hatches left out), and the menu shows Custom once a field changes (`the_cnc_preset_writes_version_2000_in_millimeters_with_type_as_paths_and_strokes_as_lines`, `the_cnc_preset_sets_the_options_that_are_not_given`, `the_cnc_cam_preset_sets_the_fields_and_a_change_shows_custom`); VCarve QA remains pending.
+  - DXF export's Include Placed Images and Include Fill Hatches (`includeImages`, `includeHatches`; VectorCraft's own options, on by default and off in CNC / CAM) leave out placed images with their linked files, without decoding them, and the solid hatch after each filled area's outlines, each on its own, with one note in `warnings` when something was left out; R12 keeps its own notes. An open path's fill outline is closed, as the fill is, in every version (`an_open_path_s_fill_outline_keeps_its_closing_edge`, `fills_without_hatches_keep_their_outlines`, `images_can_be_left_out_with_their_files`, `images_and_hatches_are_left_out_independently_and_the_cnc_preset_leaves_out_both`, `placed_images_and_fill_hatches_can_be_left_out`, `include_placed_images_and_fill_hatches_follow_the_preset_and_a_change_shows_custom`).
   - DXF export writes a path of straight segments and circular arcs (a slot, a D shape, a rounded rectangle, a pie) as one polyline whose vertices carry a bulge (group 42) for each arc: an LWPOLYLINE in R14 and later, a POLYLINE with VERTEX entities in R12 and R13, closed when the path is closed, and it reads back as the same outline (#1299, `crates/cad/src/tests.rs`). Such a path was written as one SPLINE (a flattened polyline in R12); a path with any other curve still is. A shallow curve becomes an ARC or a bulge only when it lies on the circle within 5e-4 of its own extent as well as of the radius, and the drawing extents (`$EXTMIN`, `$EXTMAX`) reach the furthest points of every ARC and bulge.
   - Affinity documents in (AF.1–AF.4): `.af` (Affinity 3) and `.afdesign`/`.afphoto`/`.afpub` (Affinity 1 and 2, container versions 8–12) open and place as editable art: layers and sublayers, groups (pass-through or isolated), artboards (with their names and backgrounds) and Publisher pages side by side, curves with live corners, parametric shapes (rectangles with corner radii, ellipses, polygons, stars, pies, triangles, trapezoids), compound shapes, solid/linear/elliptical gradient fills and strokes (weight, dashes, alignment, scale-with-object), clipping by nesting, vector and pixel masks, artistic and frame text with fonts, sizes, tracking, leading and alignment, placed images (their original JPEG/PNG) and pixel layers (8/16-bit RGB, CMYK), opacity, visibility, locking and blend modes, at the document's resolution in points. Effects, adjustments, brushes and pressure profiles, transparency gradients, master pages, symbol instances (imported as their cached picture), special shapes (cloud, heart, cog…, imported as ellipses) and Affinity-only blend modes are named in the import warning. A file whose native data can't be read opens as its embedded preview with the reason, and that preview can't be placed. Save never writes back over the Affinity file and there is no Affinity export. AF.5 (from DesignCraft's import, storytold/designcraft#291) adds master pages (on a locked layer behind the pages that show them), tables (area type per cell and a line per edge), each paragraph's alignment, indents, spacing and leading, horizontal text scale, outlined text, frame text sized by its text scale, drop shadows and outer glows as live effects (inner shadows as inner glows), outline effects as strokes, colour and gradient overlays baked into the paint, embedded Affinity documents as editable content (their artboards don't become artboards), pixel layers over 64 MP at a reduced resolution and HEIC photos from their stored pixels; automatic leading (size plus the font's line gap) fitted on thumbnails; underlines and strikethrough; strokes whose style is None (every shape stores one) left out, which also brings 6 public files closer to their thumbnails; line breaks inside a paragraph; table cell text centred as Affinity centres it, also where it is taller than its cell; CMYK pixel layers converted through the document's embedded CMYK profile (relative colorimetric with black-point compensation, as each layer's colour settings name), or kept as CMYK images when there is none; outline effects on stroked shapes around their stroke; artistic text whose paragraphs align differently aligned within its longest line, a frame's first baseline at cap height, and frames whose last lines' descenders hang out made tall enough to show them (all measured on a local document's own PDF export: baselines match to 0.1 pt); a local 56-artboard document's mean thumbnail difference went from 16.2 to 11.4, and its pages' mean difference from the owner's PDF export from 12.9 to 9.3. AF.4 adds Affinity 3 artboard recognition and actual-outline clipping, source-backed JPEG/PNG raster tiles, Unicode text-run recovery, stored fallback/exact installed fonts, OpenType feature flags and compound-geometry limits. 51 public CC0/MIT/Apache-2.0 files (33 current `.af`), pinned and sha256-verified (`cargo xtask corpus --affinity`), test native retention and every-board native/SVG/PDF/PSD output for current files; selected files compare their saved thumbnails. No Affinity reopen or independent paired PSD oracle was available; [source audit and complex-font gaps](affinity-validation.md); [scope, provenance and limits](../crates/affinity/README.md).
   - Placed documents: File › Place of a `.vectorcraft` file links to it by default (`file.place`'s `link`): one locked object showing an artboard of the document (or its art's bounds), read the way placing it without Link reads it, its symbols, patterns and images kept apart from the document's; without Link (or from bytes, not a file) it is an editable copy as before. It stays vectors in every output (SVG, PDF, EPS, EMF, DXF), and so do placed documents inside it, read from their own files up to 8 levels deep (documents that place each other stop there). On screen they draw from bitmaps cached per file and zoom step, shared by every copy and made in the background (a placeholder until ready), so a sheet of them redraws in about a millisecond; exports and prints draw them exactly. Like linked images, a save keeps only a preview of each (JPEG when opaque) unless Include Linked Files; output, and zooming past the preview, read the file again, falling back to the preview with a warning when it is gone or changed. Saves for older versions write them as plain art. Links check, update, relink, Update Links on open, Link Info (the artboard's size), Placement Options, Break Link (also Embed, Object › Expand: the editable copy placing without Link gives, its resources joining the document), Edit Original (the document in a new tab) and the Links panel cover them; saving a document updates the open documents that place it. The native format (v4) keeps data of 8 KB or more after the JSON instead of base64 in it.
@@ -1703,7 +1707,9 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
 - **Plug-in approval needs a person (G17):** a plug-in's permissions and heavy budget are approved in a dialog that only a person can confirm: the control channel, MCP and injected input are refused, and `plugin.install` takes `grant` or `allowHeavy` only with that approval. `vectorcraft-cli mcp` and `run` refuse them unless started with `--allow-plugin-grants`. Regressions: `crates/engine/src/tests/plugins.rs`, `crates/ui-egui/src/tests/automation.rs`, `apps/vectorcraft-cli/tests/it/cli.rs`. Scores and hours unchanged.
 - **Only an approval records a plug-in grant (G17):** `vectorcraft_plugins::registry::grant` takes a `GrantToken`, which the engine makes after an approval and when it loads `grants.json`, and `registry::install`, `install_bytes` and folder loads refuse a module that lists permissions no recorded grant gives this very module (`Error::NeedsApproval`), leaving the plug-in under its id and the revision as they were. A module without `permissions`, or with an empty list, installs as before. `docs/plugins.md` says what the approval does not protect against (native code linked into the app, another program running as the same user, the unsigned `grants.json`). Regressions: `crates/plugins/src/registry.rs`, `crates/plugins/tests/grant_sites.rs`, `crates/engine/src/tests/plugins.rs`. Scores and hours unchanged.
 - **Plug-in approval waits before OK (G17):** the approval dialog's OK stays disabled until its question has been on screen in the focused window for half a second, VectorCraft's own value; a click, Enter, Space, or a press begun before then installs nothing, and the dialog stays open. The wait starts over for every new question, even one that reads the same, and when the window gets the focus back, so a question swapped in just before a click is not approved by it. Cancel works at once. Regressions: `crates/ui-egui/src/tests/plugins.rs`. Scores and hours unchanged.
+- **An install automation asked for needs the person to start it (G17):** an approval question that a control request, MCP, injected input or a file dialog one of them opened leads to keeps OK disabled and refuses every confirm, a person's click included; it says to choose Object › Plug-ins › Install Plug-in…, and `ui.installPlugin` answers `approval: "personMustStartInstall"`. The person's own Install Plug-in…, File › Open or drop inspects the module again and asks a new question. Automation's `replace: true` no longer skips the question about taking another module's place, and that question now opens in the approval dialog for everyone. VectorCraft's own rule. Regressions: `crates/ui-egui/src/tests/automation.rs`, `crates/ui-egui/src/tests/plugins.rs`. Scores and hours unchanged.
 - **A plug-in with no permissions ends its id's grant (G17):** installing a module that lists no permissions under a granted id forgets the grant, in the process and in `grants.json`, so the formerly approved bytes need a new approval. Attaching a `Plug-ins` folder whose module for that id lists no permissions forgets it too, and plug-in folders forget the process's grant. A refused install leaves the grant. Regressions: `crates/engine/src/tests/plugins.rs`, `crates/engine/tests/plugin_safe_mode.rs`. Scores and hours unchanged.
+- **A grant that can't be forgotten stops counting in the whole process (G17):** when such a grant can't be removed from `grants.json`, no session in the process that uses the same `Plug-ins` folder, by any path to it, counts it for `plugin.inspect`, `plugin.install` or loading plug-ins, until `grants.json` can be written for that plug-in; another process on the folder reads `grants.json` as it is. Regressions: `crates/engine/src/tests/plugins.rs`. Scores and hours unchanged.
 - **Plug-in commands (G17):** a filter or live effect may declare up to 32 `commands` (`{id, label, params?}`); each is the command `plugin.<id>.<command>` while the plug-in is installed, in a submenu named after the plug-in under Object › Plug-ins (Effect › Plug-ins for a live effect) whatever menu the manifest names, with its label escaped. Commands are recorded in actions, listed in Keyboard Shortcuts for the user to give a shortcut, and run through `run` and MCP with their parameters checked first (a command with parameters opens a dialog from its menu item or shortcut). A run uses the plug-in's permissions (a live effect with commands may also hold `doc.write` and `state`, and gets them without a `permissions` list), is one undo step named after the command, and on failure (a trap or an exhausted instruction budget) leaves the document and the undo history as they were with an error naming the plug-in and the command. For a command and for `plugin.run`, an `ids` that is not a list of object ids is an error rather than the selection. A malformed entry is refused by name when the module is installed. Regressions: `crates/plugins/src/manifest.rs`, `crates/plugins/src/permissions.rs`, `crates/engine/src/tests/plugins.rs`, `crates/engine/tests/plugin_fuzz.rs`, `crates/ui-egui/src/tests/plugins.rs`. Scores and hours unchanged.
 - **Filter plug-ins call commands (G17, #2186):** a filter at plug-in API level 2 with the `commands` permission names the commands it may run in its manifest's `commandAllowlist` and runs them with `env.vc_call`, reading each result with `env.vc_call_result`. Each call sees what the calls before it changed; the calls and the filter's output are one undo step, and a run that fails, is canceled or makes a call that fails leaves every document, its selection and its history as they were. Commands that read or write files, use the clipboard, change preferences or the view, run scripts, actions or plug-ins, switch documents or undo are never called, and a manifest that lists one is refused when the module is installed. The install dialog lists the allowed commands. A run makes at most 1,000 calls, and each call costs 10,000 instructions of its budget. Regressions: `crates/plugins/tests/call.rs`, `crates/engine/tests/plugin_call.rs`, `crates/engine/src/cmd/plugin_call.rs`. Scores and hours unchanged.
 - **A drag ended by a command with Real-time Drawing off:** when Undo, Redo, a filter that calls commands or a plug-in command that calls commands ends a drag whose preview Real-time Drawing off has not applied yet, the preview is applied first and kept as an undo step of its own, as releasing the drag keeps it; a preview that fails cancels the drag. The filter or plug-in command is then given the objects where the drag left them. Regressions: `crates/engine/src/tests/plugins.rs`, `crates/engine/src/tests/prefs.rs`. Scores and hours unchanged.
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 6a843326c0..68ca786226 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -436,7 +436,7 @@ next unit in the order a right-click on a ruler lists them, from Feet back to Po
 | Window › Help Bar shows or hides the tool-help strip apart from the status bar; kept with the preferences and in saved workspaces; Presentation Mode hides both bars | done | `window.helpBar`; `help_bar_toggle_is_independent_and_saved_in_workspaces`, `help_bar_and_status_bar_render_independently`, `legacy_help_bar_visibility_follows_each_layouts_status_bar` |
 | Background Export: a progress dialog with the file name, the artboard count and a bar (busy for one artboard and for formats made in one go), Cancel (Esc) and Continue in Background; it opens after 0.4 s and never over another dialog. A cancelled export writes no file | done | #2564; on the shared `vectorcraft_doc::cancel` token (#2546), so a cancelled render keeps no half-drawn pattern tile or effect raster. The bar moves between artboards, not within one. Save As, Export for Screens and Export Selection don't show it yet |
 | Swatch, graphic style and symbol library panels: each library opens in a panel of its own, several at once, that floats, groups, docks and closes like any panel; opening an open library brings its panel forward; Previous / Next Library change the library in place; the panel menu's Persistent reopens the panel at startup with its view and find field (a library loaded from a file is read again; when its file is missing the panel reopens showing the file's path with Locate Library…, and the status bar names the file) | done | #2603; panel ids `library:<kind>:<id>`, `ui.libraryPanel {panel, library?, view?, showFind?, persistent?}`, `ui.libraryPanel.locate {panel, path?}`; the library panels have no sort option, as before |
-| DXF export/import preserves intended curve closure | done | #1299; R13–2018 closed SPLINE bit set/read; an open curve ending at its start stays open; knots and control points unchanged; native CIRCLE/ARC export and CNC preset remain pending |
+| DXF export/import preserves intended curve closure | done | #1299; R13–2018 closed SPLINE bit set/read; an open curve ending at its start stays open; knots and control points unchanged; circular cubic paths export as native CIRCLE/ARC where stroke semantics permit; DXF Options' Preset menu and `document.exportDxf`'s `dxfPreset: "cnc"` set the CNC / CAM options (#5500) |
 | macOS save sheet: choose the format from a menu | done | #866; the save panel is VectorCraft's own `NSSavePanel` with its Format menu set before the sheet opens (`apps/vectorcraft/src/mac_save_format.rs`); #1855 had withdrawn the menu that was added after the sheet began, which made Save As, Save a Copy and the first Save show no sheet |
 | Preferences: every option acts | partial | 2 stored but unused (#394, audited 2026-10-30): Scratch Disks, Legacy vector clipboard; the rest act (Units › East Asian Type since 2026-10-31; Open Documents As Tabs: cleared, new documents open in floating windows). General › Corner Radius drives the Rounded Rectangle tool and follows its ↑/↓ (2026-10-24) |
 | Preferences › General › Constrain Angle | done | arrow keys and Shift drags along the turned axes; the Rectangle, Rounded Rectangle, Ellipse and grid tools, point and area type and the shape size dialogs draw along them with the bounding box turned; Shift-drawn polygons and stars keep the turned base orientation; the Line Segment tool's Shift steps count from it (#394, <https://helpx.adobe.com/illustrator/desktop/manage-objects/arrange-objects/rotate-objects-by-specific-angles.html>); arcs, spirals, flares and Pen paths are not turned |