refactor(scene): reference-only designation becomes a scene-scoped set (API v9)

Per the upstream review of the XDATA-based storage: the host no longer writes
its own state into the saved file. The marker record under the host-owned OCS
APPID, the on-first-use APPID registration and the verbatim-EED rewrite
handling are removed; the single source of truth is a scene-scoped in-memory
set of entity handles (Scene::reference_only) that dies with the drawing tab,
so a reopened file starts undesignated and the owning plugin re-marks on the
document-opened notification.

All behaviour sites are unchanged, driven by the set: the wire stamp moves
from an XDATA read to a set lookup threaded through the tessellation
pipelines (tessellate_entity and the dimension text path take the handle set
as a plain parameter), and the pick filters, selection retains and
update/erase refusals read Scene::is_reference_only.

Undo keeps the entity-write contract: set mutations are recorded as explicit
first-touch before/after values on each history delta (the parametric-
constraints channel pattern). A designation inside a plugin push_undo scope
joins it, a scope-less change is one step of its own, an idempotent re-mark
records nothing, erasing a designated entity drops the set entry with the
entity, and undo/redo restores entity and designation together.

The round-trip test is inverted: reference_only_designation_is_not_written_
to_dwg_or_dxf now asserts the marker appears in neither format's bytes, that
no OCS APPID or marker record survives a reload, and that the designation
stays live in memory.

src/scene/cache/block_cache.rs

@@ -772,6 +772,9 @@ fn tessellate_sub_local(
     // top-level entities, applied per-defn.
     let wires_out = if let EntityType::Dimension(dimension) = sub {
         use crate::entities::dimension::DimensionTess;
+        // Block-definition members never carry the reference-only
+        // designation (it targets top-level geometry — see the API v9
+        // known-limit note), so the block cache tessellates with an empty set.
         dimension.tessellate(
             doc,
             h,
@@ -784,6 +787,7 @@ fn tessellate_sub_local(
             bg_color,
             None,
             None,
+            &HashSet::default(),
         )
     } else {
         tessellate::tessellate(

src/scene/convert/tess.rs

@@ -473,6 +473,7 @@ fn section_symbol_wires(
 /// so it picks up the standard text LOD ladder (baseline / greek / full),
 /// then re-color the returned wires with the dimension's resolved text colour
 /// (so DIMCLRT / DIMSTYLE colours win over the synthetic Text's defaults).
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn tessellate_entity_dim_text(
     document: &codec::CadDocument,
     selected: &HashSet<Handle>,
@@ -483,6 +484,7 @@ pub(crate) fn tessellate_entity_dim_text(
     view_aabb: Option<[f32; 4]>,
     world_per_pixel: Option<f32>,
     text_color: [f32; 4],
+    reference_only: &HashSet<Handle>,
 ) -> Vec<WireModel> {
     let mut wires = tessellate_entity(
         document,
@@ -496,6 +498,7 @@ pub(crate) fn tessellate_entity_dim_text(
         view_aabb,
         world_per_pixel,
         false,
+        reference_only,
     );
     for w in &mut wires {
         // Synth dim text carries no real entity colour — paint everything
@@ -508,6 +511,7 @@ pub(crate) fn tessellate_entity_dim_text(
     }
     wires
 }
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn tessellate_entity(
     document: &codec::CadDocument,
     selected: &HashSet<Handle>,
@@ -520,6 +524,7 @@ pub(crate) fn tessellate_entity(
     view_aabb: Option<[f32; 4]>,
     world_per_pixel: Option<f32>,
     paper_space: bool,
+    reference_only: &HashSet<Handle>,
 ) -> Vec<WireModel> {
     let mut wires = tessellate_entity_inner(
         document,
@@ -533,6 +538,7 @@ pub(crate) fn tessellate_entity(
         view_aabb,
         world_per_pixel,
         paper_space,
+        reference_only,
     );
 
     let layer_plottable = document
@@ -550,8 +556,10 @@ pub(crate) fn tessellate_entity(
     // Reference-only entities (API v9) render and snap normally but must not
     // be picked by the built-in edit paths; the pick-side wire filters in
     // `scene::pick::hit_test` and the selection-gather retains consume the
-    // flag.
-    if crate::scene::reference_only::entity_is_reference_only(e) {
+    // flag. The stamp is driven by the scene's in-memory designation set —
+    // outside `Scene` this stays pure data, so the parallel tessellation
+    // workers only need the handle set, not scene access.
+    if reference_only.contains(&e.common().handle) {
         for wire in &mut wires {
             wire.reference_only = true;
         }
@@ -559,6 +567,7 @@ pub(crate) fn tessellate_entity(
 
     wires
 }
+#[allow(clippy::too_many_arguments)]
 fn tessellate_entity_inner(
     document: &codec::CadDocument,
     selected: &HashSet<Handle>,
@@ -577,6 +586,10 @@ fn tessellate_entity_inner(
     // Retained through recursive INSERT expansion; PSLTSCALE itself is applied
     // by the viewport's GPU uniform so it never changes resident wire content.
     _paper_space: bool,
+    // The scene's reference-only designation set (API v9): drives the
+    // `WireModel::reference_only` stamp for dimensions' synthesis paths that
+    // bypass the wrapper's post-stamp.
+    reference_only: &HashSet<Handle>,
 ) -> Vec<WireModel> {
     let contextual = crate::scene::annotative::entity_for_annotation_context(
         document,
@@ -1029,6 +1042,7 @@ fn tessellate_entity_inner(
             bg_color,
             view_aabb,
             world_per_pixel,
+            reference_only,
         );
         for w in &mut wires {
             w.aci = aci;

src/scene/dimension_assoc.rs

@@ -2279,7 +2279,7 @@ mod tests {
         scene.sync_diameter_association_angle(dimension);
 
         let recording = scene.take_undo_recording().expect("undo recording");
-        let (_, objects, _, _) = recording.into_recorded_images();
+        let (_, objects, _, _, _) = recording.into_recorded_images();
         assert!(objects
             .iter()
             .any(|(handle, before)| *handle == association && before.is_some()));

src/scene/mod.rs

@@ -82,6 +82,10 @@ pub(crate) use convert::tess::{
 
 /// Keep construction-history curves in the same per-entity tessellation memo
 /// as their parent, so navigation never rebuilds them on every frame.
+///
+/// `reference_only` is the scene's designation set: its membership decides
+/// whether the produced wires carry the `WireModel::reference_only` click-
+/// through stamp (see `scene::reference_only`).
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn tessellate_entity(
     document: &CadDocument,
@@ -95,6 +99,7 @@ pub(crate) fn tessellate_entity(
     view_aabb: Option<[f32; 4]>,
     world_per_pixel: Option<f32>,
     paper_space: bool,
+    reference_only: &HashSet<Handle>,
 ) -> Vec<WireModel> {
     let mut wires = convert::tess::tessellate_entity(
         document,
@@ -108,6 +113,7 @@ pub(crate) fn tessellate_entity(
         view_aabb,
         world_per_pixel,
         paper_space,
+        reference_only,
     );
     if matches!(entity, EntityType::Solid3D(_) | EntityType::Surface(_)) {
         let handle = entity.common().handle;
@@ -159,6 +165,7 @@ pub(crate) fn tessellate_entity(
                     view_aabb,
                     world_per_pixel,
                     paper_space,
+                    reference_only,
                 )
             };
             for wire in &mut construction {
@@ -758,6 +765,13 @@ pub struct UndoRecording {
     >,
     parametric_constraints_order: Vec<parametric_constraints::ParametricScope>,
     named_parameters_before: Option<named_parameters::ParameterTable>,
+    /// First-touch before-images of reference-only designations (API v9)
+    /// changed by the command — almost always empty. The designation set
+    /// lives on `Scene`, not in the document, so like
+    /// `parametric_constraints_before` it needs its own channel. Erasing a
+    /// designated entity drops its set entry here so undo restores entity
+    /// and designation together.
+    reference_designations_before: Vec<(Handle, bool)>,
     poisoned: bool,
 }
 
@@ -773,6 +787,7 @@ impl UndoRecording {
             && self.object_order.is_empty()
             && self.parametric_constraints_order.is_empty()
             && self.named_parameters_before.is_none()
+            && self.reference_designations_before.is_empty()
     }
 
     /// Consume the recording directories in deterministic first-touch
@@ -790,6 +805,7 @@ impl UndoRecording {
             parametric_constraints::ParametricConstraintSet,
         )>,
         Option<named_parameters::ParameterTable>,
+        Vec<(Handle, bool)>,
     ) {
         let entities = self
             .order
@@ -810,11 +826,13 @@ impl UndoRecording {
                     .map(|before| (scope, before))
             })
             .collect();
+        let reference_designations = std::mem::take(&mut self.reference_designations_before);
         (
             entities,
             objects,
             parametric_constraints,
             self.named_parameters_before,
+            reference_designations,
         )
     }
 
@@ -2062,6 +2080,11 @@ pub struct Scene {
     pub selected_constraint: Option<crate::scene::parametric_constraints::ConstraintId>,
     /// Session-only ISOLATEOBJECTS / HIDEOBJECTS state. Never written to DWG/DXF.
     pub object_isolation: ObjectIsolationState,
+    /// Scene-scoped reference-only designations (API v9): plugin-owned
+    /// display geometry the built-in edit paths refuse. In-memory only,
+    /// keyed by handle, lives and dies with this scene — never written to
+    /// DWG/DXF (see `scene::reference_only`).
+    pub(crate) reference_only: reference_only::ReferenceOnlyDesignation,
     /// Entity handles temporarily removed from the base render while an
     /// interactive grip preview draws their live replacement.
     /// Separate from object isolation so a grip can never activate the
@@ -2694,6 +2717,7 @@ impl Scene {
             selected_order: Vec::new(),
             selected_constraint: None,
             object_isolation: ObjectIsolationState::default(),
+            reference_only: Default::default(),
             preview_hidden: HashSet::default(),
             command_preview_hidden: HashSet::default(),
             refedit_keep: None,
@@ -3341,6 +3365,26 @@ impl Scene {
         }
     }
 
+    /// Record a reference-only designation's value before its first change
+    /// within the open delta recording (API v9). The designation set lives on
+    /// `Scene`, outside the document, so it needs its own channel — like
+    /// the parametric-constraint directory above — for undo to restore the
+    /// designation together with the entity it belongs to. First touch wins.
+    pub(crate) fn record_undo_reference_designation_before(&mut self, handle: Handle) {
+        if let Some(recording) = self.undo_recording.as_mut() {
+            if !recording
+                .reference_designations_before
+                .iter()
+                .any(|(recorded, _)| *recorded == handle)
+            {
+                let before = self.reference_only.is_marked(handle);
+                recording
+                    .reference_designations_before
+                    .push((handle, before));
+            }
+        }
+    }
+
     /// Flag the open recording as touching non-entity state (a new layer, a
     /// group edit, a `*D` block record) that a pure-entity delta cannot
     /// restore. The app's per-command predicate keeps this from firing.
@@ -3398,6 +3442,13 @@ impl Scene {
             }
         }
 
+        // History replay can apply an entity removal the designation channels
+        // predate (an "added" side rolled back). Sweep so the set never keeps
+        // an entry for an absent entity; exact designations come right after
+        // this from the delta's own channel.
+        if !self.reference_only.is_empty() {
+            self.reference_only.retain_present(&self.document);
+        }
         if !changes.is_empty() {
             self.invalidate_dependency_index();
         }
@@ -7250,6 +7301,7 @@ impl Scene {
                 None,
                 None,
                 anno_scale_override.is_some(),
+                self.reference_only.handles(),
             );
             // Solid B-rep corners snap via the mesh edge list (their wire
             // path is an empty shell). Enrich before the memo/assembly split
@@ -9153,9 +9205,15 @@ impl Scene {
     /// locked-layer entity while its owning plugin keeps write access through
     /// the plugin host API. Absent entities are never reference-only.
     pub fn is_reference_only(&self, handle: Handle) -> bool {
-        self.document
-            .get_entity(handle)
-            .is_some_and(reference_only::entity_is_reference_only)
+        self.reference_only.is_marked(handle) && self.document.get_entity(handle).is_some()
+    }
+
+    /// Insert or remove `handle` in the scene-scoped designation set,
+    /// returning whether membership changed. Pure storage: no epoch bump, no
+    /// undo bookkeeping — those belong to the callers (the plugin host API
+    /// mutation and the history channels).
+    pub(crate) fn set_reference_only_membership(&mut self, handle: Handle, on: bool) -> bool {
+        self.reference_only.set(handle, on)
     }
 
     /// The name of the locked layer `handle` sits on, if any (for messages).
@@ -11347,6 +11405,9 @@ impl Scene {
         // `world_offset` subtraction even though `current_layout != "Model"`.
         // Decide based on the block being tessellated, not the layout.
         let is_model_block = block_handle == self.model_space_block_handle();
+        // The reference-only designation set drives the wire stamp; captured
+        // as a shared ref like `doc`/`sel` so the rayon workers can read it.
+        let reference_only_set = self.reference_only.handles();
         let bg = if self.current_layout == "Model" {
             self.bg_color
         } else {
@@ -11470,6 +11531,7 @@ impl Scene {
                         view_aabb,
                         wpp,
                         paper,
+                        reference_only_set,
                     );
                     (e.common().handle, Arc::new(w))
                 })
@@ -11509,6 +11571,7 @@ impl Scene {
                         view_aabb,
                         wpp,
                         paper,
+                        reference_only_set,
                     )
                 })
                 .collect();
@@ -11543,6 +11606,7 @@ impl Scene {
                         view_aabb,
                         wpp,
                         paper,
+                        reference_only_set,
                     )),
                     Ok(None) => Some(Vec::new()),
                     Err(()) => None,
@@ -12563,6 +12627,7 @@ vis_index={:.1} visible_probe={:.1}",
             None,
             None,
             paper,
+            self.reference_only.handles(),
         );
         // Same solid-corner snaps as the resident paths, so one-off consumers
         // (overlay changed-wires, edit previews) agree with hit-test/snap.
@@ -14048,7 +14113,7 @@ mod delta_undo_tests {
         let handle = scene.add_entity(EntityType::RasterImage(image));
         let rec = scene.take_undo_recording().unwrap();
         assert!(!rec.is_poisoned());
-        let (entities, objects, _parametric_constraints, _named_parameters) =
+        let (entities, objects, _parametric_constraints, _named_parameters, _designations) =
             rec.into_recorded_images();
         assert_eq!(entities.len(), 1);
         assert_eq!(entities[0].0, handle);
@@ -14073,7 +14138,7 @@ mod delta_undo_tests {
         scene.erase_entities(&[h1]);
         let rec = scene.take_undo_recording().unwrap();
         assert!(!rec.is_poisoned());
-        let (entities, objects, _parametric_constraints, _named_parameters) =
+        let (entities, objects, _parametric_constraints, _named_parameters, _designations) =
             rec.into_recorded_images();
         assert_eq!(entities.len(), 1);
         assert_eq!(entities[0].0, h1);

src/scene/parametric_solve.rs

@@ -4502,7 +4502,7 @@ mod tests {
             .take_undo_recording()
             .expect("an undo recording should still be open");
 
-        let (entities, _objects, _parametric_constraints, _named_parameters) =
+        let (entities, _objects, _parametric_constraints, _named_parameters, _designations) =
             recording.into_recorded_images();
         let touched: std::collections::HashSet<_> = entities.iter().map(|(h, _)| *h).collect();
         assert!(
@@ -4559,7 +4559,7 @@ mod tests {
         let recording = scene
             .take_undo_recording()
             .expect("an undo recording should still be open");
-        let (_entities, _objects, parametric_constraints, _named_parameters) =
+        let (_entities, _objects, parametric_constraints, _named_parameters, _designations) =
             recording.into_recorded_images();
         assert_eq!(
             parametric_constraints.len(),

src/scene/pipeline/circle_gpu.rs

@@ -588,6 +588,7 @@ mod tests {
         let h = doc.add_entity(donut).unwrap();
         let entity = doc.get_entity(h).unwrap();
         let selected = rustc_hash::FxHashSet::default();
+        let reference_only = rustc_hash::FxHashSet::default();
         let wires = crate::scene::convert::tess::tessellate_entity(
             &doc,
             &selected,
@@ -600,6 +601,7 @@ mod tests {
             None,
             None,
             false,
+            &reference_only,
         );
         assert_eq!(
             wires.len(),

src/scene/reference_only.rs

@@ -7,143 +7,181 @@
 //! plugin keeps full write access through the plugin host API, so it can
 //! refresh derived geometry in place.
 //!
-//! The designation persists as a marker value inside an XDATA record under a
-//! host-owned APPID, so it round-trips DWG and DXF with the entity and never
-//! collides with plugin APPID namespaces (plugins register their own
-//! application names through their manifest).
+//! Storage is a scene-scoped in-memory set of entity handles — the host
+//! writes nothing of its own into the saved DWG/DXF: no APPID registration,
+//! no XDATA marker on the entity, no host-owned state a saved file depends
+//! on. The set lives and dies with the scene (per drawing tab): closing a
+//! tab forgets its designations, and a freshly opened drawing starts
+//! undesignated. The owning plugin re-marks its entities when the host
+//! dispatches the document-opened notification (API v9's
+//! `BuiltinPlugin::on_notification` surface), which makes the in-memory
+//! designation fully equivalent to a persisted one for its use case.
+//!
+//! Undo keeps the entity-write contract: a designation change performed
+//! inside a plugin-opened `push_undo` scope joins that scope, a scope-less
+//! change is one undo step of its own, and undo/redo restores the
+//! designation with the entities it belongs to. Because the set is not part
+//! of the document, set mutations are recorded as explicit first-touch
+//! before-images on the history delta (see
+//! `DeltaSnapshot::reference_designations`), the same channel pattern
+//! `parametric_constraints` uses.
 
-use codec::entities::EntityType;
-use codec::xdata::{ExtendedDataRecord, XDataValue};
+use codec::types::Handle;
+use rustc_hash::FxHashSet;
 
-/// Host-owned APPID carrying the designation. The name belongs to the host
-/// alone; plugin records live under the plugin's own registered APPIDs.
-pub const REFERENCE_ONLY_APP_ID: &str = "OCS";
-
-/// Marker value (DXF group code 1000) that flags an entity reference-only.
-/// Human-readable so an exported file explains itself.
-const REFERENCE_ONLY_MARKER: &str = "REFERENCE_ONLY";
-
-/// True when `value` is the reference-only marker.
-fn is_marker(value: &XDataValue) -> bool {
-    matches!(value, XDataValue::String(text) if text.as_str() == REFERENCE_ONLY_MARKER)
+/// The in-memory designation set owned by a [`Scene`](crate::Scene).
+///
+/// Deliberately tiny: a plain set of handles plus the operations the scene,
+/// the plugin host and the history channels use. Not `Serialize` — the set
+/// is never written anywhere and never leaves the process.
+#[derive(Debug, Default, Clone, PartialEq)]
+pub struct ReferenceOnlyDesignation {
+    handles: FxHashSet<Handle>,
 }
 
-/// True when `entity` carries the reference-only designation. Tolerant read:
-/// a record without the marker (foreign or damaged content) is not
-/// reference-only.
-pub fn entity_is_reference_only(entity: &EntityType) -> bool {
-    let Some(record) = entity
-        .common()
-        .extended_data
-        .get_record(REFERENCE_ONLY_APP_ID)
-    else {
-        return false;
-    };
-    record.values.iter().any(is_marker)
-}
-
-/// Set (or clear) the designation on `entity`, returning whether the entity
-/// changed. Only the marker value is added or removed; foreign values under
-/// the host APPID are preserved verbatim, and a record left without values is
-/// dropped so a cleared flag leaves no empty record behind.
-pub fn set_entity_reference_only(entity: &mut EntityType, reference_only: bool) -> bool {
-    if entity_is_reference_only(entity) == reference_only {
-        return false;
+impl ReferenceOnlyDesignation {
+    /// Raw membership (by handle) — the caller guarantees the entity exists,
+    /// or accepts a stale entry; [`Scene::is_reference_only`] does the
+    /// existential check.
+    pub(crate) fn is_marked(&self, handle: Handle) -> bool {
+        self.handles.contains(&handle)
     }
-    let xd = &mut entity.common_mut().extended_data;
-    if reference_only {
-        let mut record = xd
-            .get_record(REFERENCE_ONLY_APP_ID)
-            .cloned()
-            .unwrap_or_else(|| ExtendedDataRecord::new(REFERENCE_ONLY_APP_ID));
-        record
-            .values
-            .push(XDataValue::String(REFERENCE_ONLY_MARKER.to_owned()));
-        xd.upsert_record(record);
-    } else {
-        let Some(mut record) = xd.get_record(REFERENCE_ONLY_APP_ID).cloned() else {
-            return false;
-        };
-        record.values.retain(|value| !is_marker(value));
-        if record.values.is_empty() {
-            xd.remove_record(REFERENCE_ONLY_APP_ID);
+
+    /// Insert or remove `handle`, returning whether the membership changed.
+    /// Idempotent: re-marking a designated handle reports `false` and touches
+    /// nothing, which is what terminates the re-mark loop driven by the
+    /// document-changed notification dispatch.
+    pub(crate) fn set(&mut self, handle: Handle, on: bool) -> bool {
+        if on {
+            self.handles.insert(handle)
         } else {
-            xd.upsert_record(record);
+            self.handles.remove(&handle)
         }
     }
-    true
+
+    /// Forget `handle` — called when its entity is erased so the set never
+    /// leaks an entry for a removed entity. The undo channels restore the
+    /// entry together with the entity on undo.
+    pub(crate) fn remove(&mut self, handle: Handle) {
+        self.handles.remove(&handle);
+    }
+
+    /// The marked handles, for the tessellation pipelines (wire stamping)
+    /// and the history channels.
+    pub(crate) fn handles(&self) -> &FxHashSet<Handle> {
+        &self.handles
+    }
+
+    /// True when nothing is designated.
+    pub(crate) fn is_empty(&self) -> bool {
+        self.handles.is_empty()
+    }
+
+    /// Drop entries whose entities no longer exist. The undo/redo channels
+    /// model the exact designation state, so this is only a defensive sweep
+    /// after history replay (an entity the chosen delta side removed must
+    /// never stay designated through a stale entry).
+    pub(crate) fn retain_present(&mut self, document: &codec::CadDocument) {
+        self.handles
+            .retain(|handle| document.get_entity(*handle).is_some());
+    }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use codec::entities::Line;
+    use codec::entities::{EntityType, Line};
 
-    fn entity() -> EntityType {
-        EntityType::Line(Line::new())
+    fn handle(value: u64) -> Handle {
+        Handle::new(value)
     }
 
     #[test]
-    fn marking_flags_and_unmarking_clears() {
-        let mut entity = entity();
-        assert!(!entity_is_reference_only(&entity));
-        assert!(set_entity_reference_only(&mut entity, true));
-        assert!(entity_is_reference_only(&entity));
-        // Idempotent: a second mark changes nothing and reports it.
-        assert!(!set_entity_reference_only(&mut entity, true));
-        assert!(set_entity_reference_only(&mut entity, false));
-        assert!(!entity_is_reference_only(&entity));
-        assert!(!set_entity_reference_only(&mut entity, false));
-        // A cleared flag leaves no empty record behind.
-        assert!(entity
-            .common()
-            .extended_data
-            .get_record(REFERENCE_ONLY_APP_ID)
-            .is_none());
+    fn marking_and_unmarking_report_and_track_membership() {
+        let mut designation = ReferenceOnlyDesignation::default();
+        assert!(!designation.is_marked(handle(7)));
+        assert!(designation.set(handle(7), true));
+        assert!(designation.is_marked(handle(7)));
+        // Idempotent: a second mark changes nothing and reports it — the
+        // property that terminates re-mark loops.
+        assert!(!designation.set(handle(7), true));
+        assert!(designation.set(handle(7), false));
+        assert!(!designation.is_marked(handle(7)));
+        assert!(!designation.set(handle(7), false));
+        assert!(designation.handles().is_empty());
     }
 
     #[test]
-    fn foreign_values_under_the_host_app_id_survive() {
-        let mut entity = entity();
-        let mut record = ExtendedDataRecord::new(REFERENCE_ONLY_APP_ID);
-        record.values.push(XDataValue::Integer16(7));
-        entity.common_mut().extended_data.add_record(record);
-        // A record without the marker is not reference-only.
-        assert!(!entity_is_reference_only(&entity));
-        assert!(set_entity_reference_only(&mut entity, true));
-        let record = entity
-            .common()
-            .extended_data
-            .get_record(REFERENCE_ONLY_APP_ID)
-            .expect("record exists");
-        assert_eq!(
-            record.values,
-            vec![
-                XDataValue::Integer16(7),
-                XDataValue::String(REFERENCE_ONLY_MARKER.to_owned()),
-            ]
-        );
-        assert!(set_entity_reference_only(&mut entity, false));
-        let record = entity
-            .common()
-            .extended_data
-            .get_record(REFERENCE_ONLY_APP_ID)
-            .expect("record survives");
-        assert_eq!(record.values, vec![XDataValue::Integer16(7)]);
+    fn removing_a_handle_forgets_it() {
+        let mut designation = ReferenceOnlyDesignation::default();
+        designation.set(handle(7), true);
+        designation.remove(handle(7));
+        assert!(!designation.is_marked(handle(7)));
+        // Removing an unmarked handle is a no-op.
+        designation.remove(handle(8));
+        assert!(designation.is_empty());
     }
 
     #[test]
-    fn other_apps_are_untouched() {
-        let mut entity = entity();
-        assert!(set_entity_reference_only(&mut entity, true));
-        let mut foreign = ExtendedDataRecord::new("CVIFC");
-        foreign.values.push(XDataValue::String("road".to_owned()));
-        entity.common_mut().extended_data.add_record(foreign);
-        assert!(set_entity_reference_only(&mut entity, false));
-        assert!(entity
-            .common()
-            .extended_data
-            .get_record("CVIFC")
-            .is_some_and(|record| record.values.len() == 1));
+    fn retain_present_drops_entries_of_absent_entities() {
+        let mut document = codec::CadDocument::new();
+        let live = document.add_entity(EntityType::Line(Line::new())).unwrap();
+        let mut designation = ReferenceOnlyDesignation::default();
+        designation.set(live, true);
+        designation.set(handle(999_999), true);
+        designation.retain_present(&document);
+        assert!(designation.is_marked(live));
+        assert!(!designation.is_marked(handle(999_999)));
+    }
+
+    #[test]
+    fn scene_membership_is_guarded_by_entity_presence() {
+        let mut scene = crate::scene::Scene::new();
+        let handle = scene
+            .document
+            .add_entity(EntityType::Line(Line::new()))
+            .unwrap();
+        assert!(!scene.is_reference_only(handle));
+        assert!(scene.set_reference_only_membership(handle, true));
+        assert!(scene.is_reference_only(handle));
+        // A stale set entry alone never designates: absent entities are not
+        // reference-only even if the set still lists them.
+        scene.set_reference_only_membership(Handle::new(999_999), true);
+        assert!(!scene.is_reference_only(Handle::new(999_999)));
+    }
+
+    #[test]
+    fn tessellated_wires_stamp_from_the_designation_set() {
+        let document = codec::CadDocument::new();
+        let line = EntityType::Line(Line::new());
+        let handle = line.common().handle;
+        let selected: rustc_hash::FxHashSet<Handle> = Default::default();
+        let none: rustc_hash::FxHashSet<Handle> = Default::default();
+        let mut designated: rustc_hash::FxHashSet<Handle> = Default::default();
+        designated.insert(handle);
+        let context = crate::scene::cache::block_cache::BlockCache::default();
+        for designated in [&none, &designated] {
+            let wires = crate::scene::tessellate_entity(
+                &document,
+                &selected,
+                None,
+                [0.0, 0.0, 0.0, 1.0],
+                1.0,
+                None,
+                &line,
+                Some(&context),
+                None,
+                None,
+                false,
+                designated,
+            );
+            assert!(!wires.is_empty());
+            assert!(
+                wires
+                    .iter()
+                    .all(|wire| wire.reference_only == designated.contains(&handle)),
+                "every wire carries the set's stamp for its entity"
+            );
+        }
     }
 }

src/scene/selection.rs

@@ -1143,6 +1143,12 @@ impl Scene {
                     let before = self.document.objects.get(&manager_handle).cloned();
                     self.record_undo_object_before(manager_handle, before);
                 }
+                // The designation set is scene state, not document state: a
+                // designated entity's set entry joins the same first-touch
+                // recording so undo restores entity and designation together.
+                if self.reference_only.is_marked(h) {
+                    self.record_undo_reference_designation_before(h);
+                }
             }
             self.delete_solid_history(h);
             if let Some(settings_handle) = settings_handle {
@@ -1161,6 +1167,9 @@ impl Scene {
             }
             self.remember_removed_cache_categories(h);
             self.document.remove_entity_arc(h);
+            // The set entry dies with its entity (an absent entity is never
+            // reference-only). Undo restores it through the recorded channel.
+            self.reference_only.remove(h);
             selection_changed |= self.selected.remove(&h);
             self.selected_order.retain(|selected| *selected != h);
             if self.hover_highlight == Some(h) {

src/scene/view/render.rs

@@ -4163,6 +4163,7 @@ impl Scene {
                     None,
                     None,
                     content_viewport,
+                    self.reference_only.handles(),
                 );
                 for wire in &mut context_wires {
                     wire.color = tint;