From 902ff61e8d684bc640c73a4ccee6c6c1680a2340 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Sun, 2 Aug 2026 17:05:31 +0200
Subject: [PATCH] docs: record inspected SVG references

---
 CHANGELOG.md                      |  7 +++++++
 README.md                         |  3 ++-
 docs/REFERENCE_IMPLEMENTATIONS.md | 29 +++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 docs/REFERENCE_IMPLEMENTATIONS.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d62e7e2..73928ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes follow Keep a Changelog. Versions follow Semantic
 Versioning.
 
+## [Unreleased]
+
+### Documentation
+
+- Added the requested exact reference-implementation review and adoption
+  record.
+
 ## [0.1.0] - 2026-08-02
 
 ### Added
diff --git a/README.md b/README.md
index ad5cba8..fcb86f6 100644
--- a/README.md
+++ b/README.md
@@ -159,7 +159,8 @@ should keep `Cross-Origin-Resource-Policy: same-origin`. The Toolbox Portal
 
 ## Source and licence
 
-Corresponding source and inspected revisions are recorded in [SOURCE.md](SOURCE.md).
+Corresponding source and inspected revisions are recorded in [SOURCE.md](SOURCE.md)
+and [docs/REFERENCE_IMPLEMENTATIONS.md](docs/REFERENCE_IMPLEMENTATIONS.md).
 Third-party packages and adoption decisions are recorded in
 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) and [LICENSES](LICENSES/README.md).
 Project-authored fixtures contain no third-party artwork or text.
diff --git a/docs/REFERENCE_IMPLEMENTATIONS.md b/docs/REFERENCE_IMPLEMENTATIONS.md
new file mode 100644
index 0000000..bf73855
--- /dev/null
+++ b/docs/REFERENCE_IMPLEMENTATIONS.md
@@ -0,0 +1,29 @@
+# Reference implementations
+
+This record complements [`SOURCE.md`](../SOURCE.md). Revisions were inspected
+on 2026-08-01/02 while implementing SVG Tools 0.1.0. Reference code, fixtures,
+assets, branding and explanatory text were not copied or adapted; the shipped
+path, transform, security and test code is project-authored.
+
+| Reference        | Exact revision/version                                                    | Licence               | Purpose and decision                                                                                                                                                 |
+| ---------------- | ------------------------------------------------------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Toolbox SDK      | `ef2dab4b46c61812c9a877d8a19fe497b4a4630a` / packages 0.2.3               | Apache-2.0            | Adopted through its published contract, AppShell and testkit APIs.                                                                                                   |
+| Toolbox Portal   | `55b2b12434465511586eaa2d0a43e81770868738` (v0.9.3 before integration)    | AGPL-3.0-only         | Studied for release assembly, nested deployment, catalogue and shell conventions. SVG Tools is consumed only as an immutable release artifact.                       |
+| SVG-Edit         | `244a26c88e1ab1c32911c5b3637e214d7a7d8b25`                                | MIT                   | Interaction and implementation reference only. Its canvas/document model was not adopted because canonical SVG source must remain authoritative.                     |
+| SVG Path Editor  | `937d75a83b6be2bdda11d02b9b3594841315223a`                                | MIT                   | Path interaction reference only. Its source was not copied; SVG Tools uses its own source-ranged path model.                                                         |
+| SVGPathCommander | `9aa91dd2119ee6a65b1807d55d33e86b1ccb27fc`                                | MIT                   | Evaluated for parsing and geometry, then not shipped. The initial project-authored core is smaller and retains source-command fragments.                             |
+| DOMPurify        | `9365501773d6665aaf334d8afa55081b9930a684` / npm 3.4.12                   | MPL-2.0 OR Apache-2.0 | Adopted as the first projection-sanitization layer, followed by application-owned SVG, URL and parsed-CSS policy checks.                                             |
+| SVGO             | npm 4.0.2, published `gitHead` `b2309cf541aee11634eb653157b0ff86ab326e98` | MIT                   | Adopted behind a cancelable application worker. Direct GitHub cloning was unavailable in the build environment, so the exact locked npm source identity is recorded. |
+| css-tree         | npm 3.2.1                                                                 | MIT                   | Adopted for stylesheet, declaration and animation-value parsing.                                                                                                     |
+| fflate           | npm 0.8.3                                                                 | MIT                   | Adopted for deterministic SVGZ output and bounded streaming decompression.                                                                                           |
+
+Boxy SVG and SVGViewer were consulted only as public product/interaction
+references. Their proprietary source and assets were not used.
+
+No boolean geometry engine was adopted: PathBool.js was considered too early
+for a mandatory production dependency, while Paper.js and PathKit would add a
+large secondary geometry/runtime model before the required fixture and fuzz
+spikes. No third-party raster engine was adopted; 0.1.0 uses the browser SVG
+decoder and Canvas 2D behind explicit limits. These decisions deliberately
+leave boolean operations and deterministic cross-browser rasterization on the
+roadmap rather than overstating support.