feat(open): open drawings in the running editor

Double-clicking a drawing started a whole second copy of the app. Now it
lands as a tab in the editor already open, and that window comes forward.

The election is the bind itself: every GUI launch tries a deterministic
per-user loopback port, and the OS grants it to exactly one process and
releases it on any death, SIGKILL included. Nothing to reap, no PID to
probe, no stale lock after a crash. The winner serves the port from an
iced subscription; the loser checks it is talking to a matching editor,
hands the paths over and exits. Every surprise — no answer, a stranger on
the port, a timeout — boots a normal window, i.e. the old behaviour: the
feature can degrade, but it cannot lose the file.

The gate in main is positional, after every headless mode has returned.
The plugin runner is this same binary re-spawning itself, so a flag list
would rot the first time a mode is added; a position cannot.

Handing a drawing over that is already open switches to its tab instead
of loading a second copy, comparing resolved paths so a symlink or a
`..` hop is still recognised as the same file.

`opening` is a single slot that a second open would overwrite, and
on_file_opened drops any result arriving once it is clear — so drawings
handed over at once would silently vanish. They queue in pending_opens,
drained from every path that clears the slot, error and cancel included.

Exec becomes %F so one launch takes the whole selection; the CLI takes a
list and boot fans it out through the same door. --new-instance forces a
separate process; --read-only / --script / --new always get their own.

Not reused: the automation server. It dispatches arbitrary commands and
writes arbitrary paths, and its open replaces the active tab's document
in place — publishing that on a port every local process can reach would
be unforced privilege escalation. Only its JSON-lines framing is shared.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/update/file.rs

@@ -350,6 +350,35 @@ pub(super) fn on_open_file(&mut self) -> Task<Message> {
                 }
     }
 
+    /// Index of a tab already showing `path`, or `None`.
+    ///
+    /// Compares resolved paths, so the same drawing reached through a symlink,
+    /// a `..` segment or a different relative spelling is recognised as the one
+    /// already open rather than loaded a second time. A path that cannot be
+    /// resolved (deleted since) matches nothing and falls through to the normal
+    /// open, which reports the miss.
+    pub(in crate::app) fn tab_showing(&self, path: &std::path::Path) -> Option<usize> {
+        let want = std::fs::canonicalize(path).ok()?;
+        self.tabs.iter().position(|t| {
+            t.current_path
+                .as_deref()
+                .and_then(|p| std::fs::canonicalize(p).ok())
+                .is_some_and(|p| p == want)
+        })
+    }
+
+    /// Start the next drawing a second launch handed us, if any.
+    ///
+    /// Must be called from EVERY path that clears `opening` — completion, error
+    /// and cancel alike. Draining only the success path would strand the queue
+    /// forever the first time a file fails to parse.
+    pub(in crate::app) fn drain_pending_open(&mut self) -> Task<Message> {
+        match self.pending_opens.pop_front() {
+            Some(p) => Task::done(Message::OpenExternal(p)),
+            None => Task::none(),
+        }
+    }
+
     pub(super) fn on_file_opened(&mut self, name: String, path: std::path::PathBuf, doc: acadrust::CadDocument, caches: crate::scene::DerivedCaches) -> Task<Message> {
                 // If the user clicked Cancel while the parser was running, the
                 // overlay state was cleared and we silently drop the result.
@@ -558,7 +587,7 @@ pub(super) fn on_open_file(&mut self) -> Task<Message> {
                 self.tabs[i].dirty = false;
                 self.tabs[i].history = crate::app::document::HistoryState::default();
                 self.refresh_selected_grips();
-                Task::none()
+                self.drain_pending_open()
     }
 
     pub(super) fn on_wblock_save_result_some(&mut self, block_name: String, path: std::path::PathBuf) -> Task<Message> {

src/app/update/mod.rs

@@ -272,6 +272,45 @@ impl OpenCADStudio {
                 }
             }
 
+            Message::OpenExternal(path) => {
+                // A second launch forwarded this drawing. Route it through
+                // `OpenRecent` so the redirect and a cold start share one path:
+                // it stats the file and reports a missing one visibly, instead
+                // of a boot that appears to do nothing.
+                //
+                // Raising is best-effort and cannot be made reliable from here.
+                // `gain_focus` reaches winit's `focus_window`, which on Wayland
+                // has an empty body — it is `request_user_attention` that walks
+                // the xdg-activation path, and it mints its token without a seat
+                // serial, which a compositor may refuse to honour. So expect an
+                // attention mark rather than a raise on Wayland; X11 does raise.
+                // A real raise needs the activation token from the launching
+                // process, and neither iced 0.14 nor winit 0.30 can apply one to
+                // an existing window.
+                let raise = match self.main_window {
+                    Some(id) => Task::batch([
+                        iced::window::gain_focus(id),
+                        iced::window::request_user_attention(
+                            id,
+                            Some(iced::window::UserAttention::Critical),
+                        ),
+                    ]),
+                    None => Task::none(),
+                };
+                // Already open → go to that tab rather than load a second copy
+                // of the same drawing. Checked before the queue: switching is
+                // instant and needs no load slot.
+                if let Some(idx) = self.tab_showing(&path) {
+                    return Task::batch([raise, self.update(Message::TabSwitch(idx))]);
+                }
+                if self.opening.is_some() {
+                    self.pending_opens.push_back(path);
+                    raise
+                } else {
+                    Task::batch([raise, self.update(Message::OpenRecent(path))])
+                }
+            }
+
             Message::RecentRemove(path) => {
                 self.remove_recent(&path);
                 Task::none()
@@ -318,7 +357,7 @@ impl OpenCADStudio {
                     self.command_line
                         .push_info(&format!("Open cancelled: \"{}\"", p.name));
                 }
-                Task::none()
+                self.drain_pending_open()
             }
 
             Message::FileOpened(Ok((name, path, doc, caches))) => {
@@ -332,7 +371,9 @@ impl OpenCADStudio {
                 if was_open && e != "Cancelled" {
                     self.command_line.push_error(&format!("Open failed: {e}"));
                 }
-                Task::none()
+                // A drawing that fails to parse must not strand the ones queued
+                // behind it.
+                self.drain_pending_open()
             }
 
             Message::ImagePick => {