WBLOCK, SAVEALL, and web ARCHIVE now serialize through the Web Worker
like SAVE/AUTOSAVE: prepare on the main thread, writer pass on the
worker, inline fallback on any worker failure. SAVEALL clears each
tab's dirty flag under the same unchanged-tab race guard the single
save uses; ARCHIVE assembles the ZIP in the completion handler so the
transmittal matches the snapshot taken at command time.
The review of the previous fix commit found the collision refusal
still REPLACED the registry bytes — the exact silent retargeting it
was meant to prevent. The refusal now keeps the old registration, the
extraction settings picker reports refused picks in the wizard's error
slot (previously silent, and the stale collision flag could surface as
a wrong-file warning on an unrelated browse), and the xref registry's
same-name ambiguity is documented as a browser fundamental (native
distinguishes by folder): newest registration wins consistently for
resolution, ARCHIVE, and XRELOAD — matching what the drawing displays.
Also: the Quit pending-close survives a successful web tab-save
(continue the quit instead of dropping it), the last ZIP64 sentinel
(central size) is rejected like the other four, and the new behaviors
gained regression tests (collision keeps old bytes, registry eviction,
including the deadlock fix for the guard-scoping that test exposed).
Full verification of the XREF/data/ARCHIVE/worker wave (three
reviewers, one forensic) found no blockers and no crossfire damage;
five majors and several minors are fixed here.
- ARCHIVE now packages XREFs: the bytes registry added by the same
commit is consulted (the in-code 'no xref store exists' comment was
false within the commit), and the drawing is packaged only after
the full save preparation — without it kernel solids shipped
without their ACIS data.
- PendingClose stores the stable tab id instead of a vector index:
the web save now completes asynchronously, and closing a lower tab
during the serialization window shifted indices — closing the WRONG
tab, or panicking on a stale one. All producers and consumers
resolve the id at use.
- The xref bytes registry is capped (6 entries, oldest evicted): every
open, drop, and pick registered full drawing bytes with no bound —
an OOM waiting to happen. Reopened recents register too, so any
entry path can serve as another drawing's xref.
- A re-picked data-link source with the same name but different bytes
no longer silently replaces the first (the browser hands back bare
names, so two same-named files collided and every reference read
the newer pick): the pick is refused and the user is told why.
- The unresolved-xref warning lists file names (what to drop on the
page), not internal block names; the ZIP writer refuses the ZIP64
sentinel values (0xFFFF counts, 0xFFFFFFFF sizes/offsets) instead
of emitting archives that send strict readers hunting for a ZIP64
EOCD that is absent; docs note the worker-side saves.
Known follow-ups documented, not fixed here: the serde-skipped
ExtendedEntity/CadDocument raw bytes still drop on worker crossings
(needs acadrust accessors — upstream), and WBLOCK/SAVEALL/ARCHIVE
still serialize inline (the worker route is a small follow-up).
The last four big web-vs-desktop gaps.
XREFs: XATTACH reads the picked drawing's bytes and registers them
name-keyed (the image/PDF-underlay pattern), pre-parses on the web
worker, and the commit merge produces the same xref block flow as
native. Opened drawings resolve xrefs from the registry (trailing-name
match) before cache build; unresolved references produce ONE warning
listing the names and the fix — drop the referenced files on the page
(drops and picker opens now register their bytes) and reopen or
XRELOAD. XRELOAD works off the registry on unsaved drawings too.
Data Link & Extraction: spreadsheet links read picked xlsx/csv bytes
(calamine from slices / CSV from string) through a session registry,
so preview, refresh, and table-insert work on web; extraction takes
external drawings via a multi-file picker parsed on the worker, and
outputs CSV/TXT/.dxex via download_bytes. The disabled 'Add folder'
button explains why.
ARCHIVE/ETRANSMIT: assembles the drawing plus registered images, PDF
underlays, and session plot tables into a deterministic ZIP (minimal
writer over flate2 — no new dependency) delivered as
{stem}_transmit.zip; skipped dependencies are reported by name.
Save/autosave off the UI thread: the parse worker gains a serialize
action (protocol v5) — the document is prepared once on the main
thread (clone, styles, dimension bake), then the DWG/DXF writer pass,
the dominant cost, runs on the worker; any worker failure falls back
to inline serialization with the identical shared implementation.
The save path also clears the dirty flag only when the tab didn't
change mid-write, and the runtime-fields sidecar now carries
graphic_data, fixing a pre-existing loss of raw DWG round-trip bytes
on web-opened documents.
A fresh web-vs-desktop audit found the remaining gaps; this closes the
top ten.
Raster images: IMAGE attach read the picked file via image::open on a
name-only path (dead on wasm), and raster references inside opened
drawings decoded the same way. Picked bytes are now registered in a
name-keyed store (the PDF-underlay pattern), decoding runs from memory,
and dropped .png/.jpg/.bmp/.tif files register by name so unresolved
references in opened drawings re-resolve and render (and export to PDF).
Command gaps fixed with the bytes-at-pick / download_bytes pattern:
- WBLOCK now downloads the extracted block instead of failing on fs.
- SAVEALL saves every dirty tab instead of printing a no-op message.
- SCRIPT picks and reads the .scr file through the browser picker.
- CENTERLTYPEFILE picks the .lin/.dnl file and populates from text.
- Custom .ctb tables picked on web now parse, register for the
session, appear in the plot dialog list, and apply (load_named
previously returned builtin-only on wasm).
- LAYTRANS 'Load standards file' parses the picked drawing on the
existing web worker.
- INSERT 'from file' in the block palette parses picked bytes and
feeds the shared import path.
Text fidelity: TTF-named styles rendered as thin stroke glyphs on web
because the font database was empty. Fetched Noto faces are now
registered into it with a family alias table (Arial, Times New Roman,
Cambria, ... -> Noto Sans/Serif), so those styles render filled, shape,
export to PDF as vector fills, and appear in the style picker.
ViewCube labels request semibold again on web.
docs/native-vs-web.md: the hatch and font rows were stale (both work on
web now), the GPU row claimed WebGPU is used where available (the
backend is pinned to OpenGL), and the parallelism row missed the parse
worker — all corrected.
The last review pass over the hardening commit found no blockers; two
minors are fixed here. Decimation's force-retain used index arithmetic
that the seam entry pushed right after a stride doubling invalidates,
duplicating the last segment at exact halving boundaries — it now
compares against the last kept entry. The f64 endpoint map's first-wins
buckets are 4 f32 ulp wide, so two distinct near-coincident segments
can collide and hand a geom the WRONG endpoints; lookups now verify the
hit against the geom's own f32 pair (within an ulp) and fall back to
the widened pair on mismatch, restoring the closest-match semantics of
the scan the map replaced.
Five reviewers (PDF, snap, commands, otrack/help, printing) covered the
eight issue-fix commits; every blocker and major is fixed here.
Printing (#1261 follow-up):
- printto params now quote the printer name and pad the empty driver/
port slots handlers substitute ("Microsoft Print to PDF" was split
into three arguments and the job silently lost).
- Level-2 enumeration also merges when the level-4 list omits the
configured default, not only when it is empty; a level-2 error no
longer discards the default-printer merge.
- The printer list loads in a background task instead of blocking the
UI thread (level-2 queries can wait out RPC timeouts).
- CTB registration: collisions keep the existing file but now say so,
and only container-parsed tables are registered (the permissive
zlib heuristic stays session-only so junk cannot persist).
Snapping (#1030/#1319 follow-up):
- Edge-wire key_vertices gain NaN separators: junctions between
unrelated mesh edges no longer fabricate phantom midpoints.
- The wire cap counts segments (not separator points) and decimates
instead of dropping, so dense meshes keep partial endpoint coverage
instead of losing snap entirely.
- f64 endpoint recovery is a one-shot per-wire map instead of an
O(points x geoms) rescan on every mouse move.
Commands (#1082 class): the same typed-value-on-web bug also hit
CYLINDER/BOX/WEDGE/CONE/PYRAMID heights, HELIX final height (wrong
value, not just dropped), and SWEEP reference/new lengths — all now
commit as text at exactly those steps, each pinned by a regression
test that fails without the override (plus the missing native-route
twin for EXTRUDE).
PDF (#702 follow-up): heavy CTB pens bypass the Form XObject (their
half-width exceeds the /BBox SDF margin and was flat-chopped), CTM
scale entries round to 4 significant digits (0.01 quantized small
text by ~1%), degenerate quads skip emission, the atlas snapshot is
taken once per export instead of per text entity, and the rounding
comments no longer conflate page points with glyph-plane units.
OTRACK (#1313 follow-up): the guide's polar quantization diverges
from the snapper's drafting-gated polar during window-corner drags —
documented; an orphaned grid-step doc block is reunited with its
function.
Printer enumeration used EnumPrinters level 4 only, which is served
from the local registry cache and misses Win11 per-user network
printers; an empty result now retries with level 2 (spooler RPC) and
merges the resolved default. The dialog's 'System default printer'
used to delegate to the shell print verb — the default PDF handler's
own printer choice, not the system default; it now resolves
GetDefaultPrinterW and dispatches printto naming that printer
explicitly. Every dispatch probes OpenPrinterW first, so a printer
that vanished between listing and printing produces a clear error
instead of ShellExecute's silent nothing, and all SE_ERR_* codes carry
readable reasons.
Legacy CTB: picking an unparseable table used to swallow the failure
(.ok()) — the user saw nothing at all. Load errors now reach the
command line, the picker accepts .stb alongside .ctb (the container
gains the STBVER1 header; .stb application errors state the actual
reason), and a table loaded from anywhere is copied into the user's
plot-styles folder so it persists in the dialog, matching AutoCAD.
Buffer parsing for both EnumPrinters layouts is unit-tested; the
missing-printer path was exercised against the real spooler (existence
probe only, no job).
Volume entities (Solid3D/Region/Body/Surface, OBJ-imported and SubD
meshes, polyface meshes) render through the mesh pipeline and their
wire path was deliberately empty, so the snapper had no candidates:
END/MID/NEA/PER/INT never fired on them — only Insertion at the
reference point. Each volume entity now contributes one interaction-
only edge wire (B-rep edge chains where the entity stores them, LOD-0
triangle edges otherwise, 100k-point cap), invisible to rendering and
PDF export, riding the normal wire set so the interaction index,
tiers, and 2D-wins priority apply unchanged. The SubD key_vertices
list no longer fabricates floating midpoints. Scene-level test drives
the exact OBJ-import path (Solid3D + meshes cache) through the real
snapper; INSERT-nested solids remain scoped out (block-cache path has
no mesh cache yet).
otrack_snap reports a single active ray, and the overlay painted only
that — with two acquired points the second vector was invisible even
while the cursor locked to their intersection. Each acquired point now
gets its own infinite dashed vector (active full strength, others at
half alpha along their cursor-relevant direction), and when a non-
active vector passes through the locked point an intersection X marks
the crossing, mirroring the OSNAP intersection glyph. Pure view-layer
change; snap math and state machines untouched.
HELP now opens docs/command-reference.md on GitHub — a 600-command
reference grouped by category with default shortcuts and selection
behavior, generated from the in-repo command registry. A staleness
test fails when the registry and the page drift apart; regenerate
with UPDATE_COMMAND_REFERENCE=1 cargo test command_reference. The
command-line notice is localized in all 21 languages.
A text-heavy sheet re-emitted every glyph occurrence as a full page-
space outline (~4 KB per character at f32 round-trip precision), so
PRINT of a simple Vietnamese-text A4 produced ~128 MB. Each unique
glyph is now baked once into a shared compressed Form XObject keyed
by atlas tile (mirroring the image XObject cache, shared across
pages); repeats replay one cm + /Do. Glyph path points, CTM entries,
and decoration quads round to 0.01 pt (~3.5 µm, visually lossless);
run-level colors dedupe outside the per-glyph q/Q so state persists;
the stroke-font pen is re-set per glyph under its CTM, pre-divided by
the quad's area scale.
200-entity Vietnamese repro: 51.5 MB -> 1.28 MB (40x, ~99 B per
glyph occurrence); stroke-font pages 2.0x; hatch/polyline pages
byte-identical. Validated lossless by 300 dpi Ghostscript pixel diff
(residuals confined to 2 px glyph-edge phase) and pypdf structure
check. Raster quality presets and vector geometry are untouched.
The analytic intersection path accepted only wires carrying exactly
one tangent geom, so a triangle drawn as one closed LwPolyline (three
Line geoms) fell back to the segment sweep against the circle's
48-chord tessellation — every crossing sits r*(1-cos(pi/48)) ~ 5.3e-3
inside the true circle, and MEASURE reads 2.9947 instead of 3.0000
(END is exact because key_vertices are f64).
Decompose a wire into one analytic curve per geom (declining
entirely if any geom fails to convert, so nothing silently drops),
recover f64 line endpoints from the double-single tessellation for
survey-scale coordinates, and extend line pieces by ~|world|*4*eps so
crossings exactly on a shared endpoint survive the kernel's bounded
extent test. Vertex snap error drops from 5.3e-3 to <= 4.4e-16; tests
cover the 3-4-5 circumcircle at 16 approach directions, survey
coordinates, and the previously fixed all-Line case.
On wasm the canvas holds focus, so a typed value reaches the dynamic
Distance field through CommandAppendChar+CommandFinalize — and
try_dyn_commit only commits as text when wants_text() && !
point_step_accepts_keywords(), or dyn_commit_as_text(). EXTRUDE's
Height step accepts keywords and never overrode dyn_commit_as_text
(unlike PRESSPULL and REVOLVE), so the value resolved as an in-plane
point whose height is ~0 and silently re-prompted. Commit the Height
step as text, matching its siblings; regression test drives the
exact web message sequence.
sample_entity_xy stitches exploded segment samples with
pts[sp[1..]] guarded only by last()==first(); a segment that samples
to EMPTY (zero-length edge, or an edge-on-OCS arc whose
entity_curve_xy returns None) while the accumulator is still empty
made None==None true and sliced a length-0 vec — 'range start index
1 out of range' — and on web the unwind then tripped winit's held
RefCell borrow. Guard both stitching sites (the EXTRIM preview
sibling had the same pattern) and pin the join semantics plus the
degenerate cases with tests.
Three attack agents (state-machine tracing, executable input fuzzing,
browser-API review) found two breaks and several degradations; all are
fixed here, with the fuzzer's 22 tests kept as regression suites.
Breaks:
- Untitled tabs (and dot-names like ".dxf") autosave as DXF, but the
restore name defaulted to .dwg — the worker dispatches its reader by
the name's extension, so the only copy of unsaved work could never
be restored and was re-offered forever. recovered_name now uses the
worker's rsplit('.') convention and defaults extensionless names to
dxf, matching new-document serialization.
- " (recovered)" stacked one suffix per crash-restore cycle; the
marker is now stripped idempotently before appending.
- Opening a file (Ctrl+O / OPEN / automation) while a web open was in
flight clobbered it: the in-flight open's bytes were lost and every
queued restore prompt stalled for the session. on_open_file now
refuses while an open is running (web only).
Hardening:
- Escape on the Recover Drawing modal defers instead of deleting the
only snapshot; the Discard button still removes it.
- A cap-rejected restore enqueue warns in-app and re-offers the next
snapshot; the drop queue cap rises to 32.
- Exiting mid-round no longer races snapshot removals (deferrals are
drained, the sweep skips while a round is in flight); closing a tab
with "Don't save" now also removes its web snapshot; the snapshot
key derivation is shared via web_autosave_key.
- The plot-preview overlay no longer leaks a full PDF copy per preview
(the Download closure lives in a replaceable registry).
- A corrupt autosave index.json fails the round/boot instead of
silently resetting every row; plot pages with non-finite or non-
positive sheet dimensions error instead of emitting a NaN MediaBox.
- The drop filter accepts dot-less "DWG"/"dxf" names the worker
parses (same rsplit convention on both gates).
A queued AutosaveRestore startup modal can outlive the pending list
that justifies it: a file opened while the prompt is up displaces the
modal, the entry is consumed, and the after-message hook then resurfaces
a stale, empty Recover Drawing prompt. The hook now drops queued
restore prompts whose pending list is empty.
Second review pass found the restore marker matched WebFileOpened by
display name: any same-named open finishing while the recovered one
was still queued deleted the only copy. The snapshot key now travels
with the queued file (tagged queue entries), the marker records the
open id assigned at dispatch, and success, failure, and cancel all
match that id. Cancelling an unrelated open no longer clears a
pending restore marker.
Also: the boot scan removes dead index rows (missing or zero-byte
snapshot files) that no other path could discard, and the drop
listener install only latches when the listeners really registered.
Review of the drop-open and autosave commits surfaced one blocker and
five majors; all are fixed here, and two claims in the autosave commit
message are corrected by this one: tab close does NOT clear a snapshot
(matches native .sv$ semantics — saving, restoring, discarding, exit,
and the capped boot scan do), and serialization runs on the main
thread between awaits, not off the paint path.
- The restore prompt can no longer appear with no entries (empty
"Recover Drawing" modal on every boot once the autosave dir exists).
- Restore no longer consumes the snapshot before the open succeeds:
the recovered drawing goes through the guarded drop queue, and the
snapshot is deleted only after the tab opens; cancel or parse
failure keeps the only copy.
- Saving during an autosave round defers its snapshot cleanup until
the round finishes, so a stale round can no longer resurrect a
snapshot newer than the save.
- The boot scan no longer deletes snapshots by mtime comparison
(re-opening a drawing refreshes the recent copy's mtime, which
silently destroyed wanted snapshots); GC is now a 16-entry cap with
oldest-first eviction.
- OPFS write failures abort the writable stream (a leaked lock could
stall the same-key writer and disable autosave for the session), and
DOMException errors now carry their name/message.
- Empty (crash-window) snapshots are never offered; an unreadable one
warns and stays discardable instead of looping forever.
- Drop-open polish: reads start inside the handler and complete in
drop order (legacy WebKit safety, deterministic multi-file order),
dragenter is canceled too, the install guard only latches on
success, non-drawing drops don't steal propagation, a lock-poison
panic can't cross into JS, and re-dropping an open drawing no
longer risks clobbering an in-flight open (it re-queues).
- The model-space sheet floor is per-axis (a thin 8x400 mm profile
keeps its length) and centers content on the enlarged page.
The web build had no autosave: on_autosave was a no-op and the
subscription was native-only. Both gates are gone; every savetime tick
now serializes each dirty tab (same pre-serialize sync as the web save
path, no thumbnail, serialized serially off the critical paint path)
into a dedicated opencadstudio-autosave OPFS directory, keyed by
drawing name, without touching the dirty flag, downloads, or recents.
On boot the web app scans that directory and offers any snapshot
newer than the last saved copy in a localized Recover Drawing modal
(Restore opens it as "name (recovered).dwg" through the standard
open pipeline; Discard removes it; Escape discards). Saving or
closing a drawing clears its snapshot; the boot scan also garbage-
collects stale entries. run_web now requests navigator.storage.persist
so settings and OPFS data survive browser eviction.
STLOUT/STEPOUT wrote via std::fs and IMPORTOBJ read via std::fs, all
of which fail on wasm32. The export pickers now mirror the PDF path
(pick_*_owned returns a name-only PathBuf; the browser download names
the file) and the write tail swaps fs::write for sys::download_bytes.
OBJ import reads the picked file's bytes directly, like the web open
picker.
Opening by drag-and-drop was dead on the web build: winit never emits
FileDropped there. A wasm-gated io::web_drop module installs DOM
dragover/drop listeners, filters .dwg/.dxf, reads the File bytes
async, and queues them; the existing 50 ms PollWebControl tick drains
the queue into the same open path the picker uses (progress overlay,
recovery, OPFS recent cache).
Also floors the model-space plot sheet: extents smaller than 10 mm
(or the 0x0 paper a fresh unsaved drawing carries) now fall back to
the standard sheet instead of producing a ~3 pt page.
Three reviewers (security, correctness, performance) converged on:
- Download PDF died on the second click: Closure::once_into_js throws
when invoked twice. The handler is now a plain FnMut kept for the
overlay's lifetime.
- Rasterisation was bounded by page count, not pixels: 12 A0 sheets at
150 DPI peaked near 1.8 GB of RGBA plus ~1.7 GB of decoded images,
and a drawing declaring absurd paper sizes made the rasteriser
saturate its u16 dimensions into a ~17 GB allocation that aborts the
tab. Preview now computes a uniform DPI under a 64-Mpx total budget
(floor 24 DPI) from the page tree before allocating, with a per-page
4096-px edge clamp.
- Overlays stacked when previewing twice and their blob URLs were only
revoked via Close. The overlay is now single-instance (id-tagged);
a replacement or Close revokes every URL through a shared registry.
- emit_image resampled before probing the XObject cache, so a title
block placed on 12 layouts ran 12 Lanczos passes to embed once.
The cache is now probed with the target dimensions first.
- Preview downloads are named {stem}_preview.pdf instead of a constant
plot_preview.pdf, and the page label says 'first N of M' when the
preview is capped while the PDF keeps every page.
Web builds identify drawings by bare file name (the browser picker
exposes no real path), so two tabs with the same name also share the
single browser-stored copy: the last save silently replaces the other
tab's. Warn on open instead of letting that surface later.
AutoCAD's plot preview renders the plotted result on screen instead of
producing a file. The web build now does the same: the plotted PDF bytes
are rasterised with the hayro pipeline already used for PDF underlays
(150 DPI, first 12 pages) and shown in an in-page overlay with
Download-PDF and Close actions.
The previous strategy opened a new tab via window.open from the async
plot task; browsers withhold popups without a live user gesture, and
embedded hosts ship no PDF viewer plugin at all — so the fallback
download fired and preview behaved like an export. Plain PNG <img>
elements need neither permission.
Trunk passes TRUNK_STAGING_DIR as an extended-length path (\?\C:\...)
on Windows, which MSYS sh tools cannot stat, so post_build failed and
the whole web build aborted. Strip the prefix with sed before use;
Linux CI paths are unaffected. Also apply rustfmt to pdf_export.rs.
- plot dialog: the web build defaults to 'Save to PDF file...' (its only
output choice); native dropdowns and defaults are untouched.
- on_plot_dlg_commit forces to_file on wasm so a stale page setup can no
longer route the web build into the (unreachable) printer path; both
preview branches now go through preview_page_pdf, which is identical to
the old inline temp-PDF + OS-viewer flow on desktop.
- Print ribbon / PRINTALL on wasm render the PDF and open it in a tab
instead of erroring; PrintAllPdf picks a virtual path and downloads.
- pdf_plot_options maps the dialog's Quality dropdown into PdfPlotOptions.
- pdf_export: drop the stale wasm32 gates (printpdf 0.9.1 compiles for
wasm; the memchr/lopdf incompatibility is gone with memchr 2.8.3).
Rendering is portable via render_pdf_bytes; only persistence differs:
atomic temp-file write on desktop, browser download on the web.
pick_pdf_path_owned on wasm returns a virtual path so the existing
message flow works unchanged.
- printpdf moves from the native-only dependency table to the shared one.
- print_to_printer: preview_page_pdf / preview_pages_pdf render the same
bytes and open them in a browser tab on the web (the browser's print
dialog takes over); desktop keeps the temp-PDF + OS-viewer flow.
- sys: open_bytes_in_new_tab (blob URL, popup-blocked falls back to a
download).
- New PlotQuality preset caps embedded raster resolution (High = native,
Normal = 300 DPI, Low = 150 DPI effective); vector output is untouched.
The image resource cache keys on the post-resample dims so one pixels
Arc placed at different effective DPIs embeds per-placement XObjects.
Afonsop