PCB Canvas

PCB Canvas is a touch-native PCB layout editor for iPad — 457,000 lines of Swift with no CAD kernel underneath it, because there wasn't one to use. Board geometry is integer nanometres end to end. The renderer is hand-written Metal with two custom tessellators. Copper pours are computed on an integer lattice rather than through a floating-point polygon-boolean library, so numerical uncertainty can only remove copper, never invent an illegal connection — and every fill carries a content fingerprint, so a pour edited after its last fill is caught before export instead of scrapping a board.

Compatibility with KiCad is not a parse-and-re-emit round trip. The app holds a concrete syntax tree with stable byte anchors and patches only the ranges it owns, then a verifier proves byte-for-byte that everything else is untouched — anything it can't represent safely, it refuses to rewrite. What comes out the other end is checked by an adversary: an independent host gate that reparses the source board without the app's parser, runs the real kicad-cli to produce competing Gerbers, and raster-compares both at 40 px/mm through Gerbonara. Across five torture boards — 0.4 mm QFN with thermal vias, two-row BGA escape, mixed THT with a back-copper zone, dense passive field — the result is zero unmatched copper area on F.Cu, B.Cu and Edge.Cuts, zero KiCad DRC violations, and byte-identical output on a repeat run.

The parts problem was attacked with automation rather than headcount. A zero-dependency Swift package reads land patterns straight out of datasheet PDFs — including its own DEFLATE inflater and a PDF content-stream interpreter — reconstructing pin tables from x-anchor clustering with no OCR and no model, discarding rows it can't parse with a reason instead of guessing, and attaching a page-and-bounding-box proof to every value it keeps. A 10 GB corpus mined from 20,410 open-source boards backs 39,483 catalogued parts and 3,337 per-chip support-circuit templates, each element carrying its datasheet citation, a placement class, and a hard maximum distance from the pin it serves. Drop an MCU and its mandatory support offers itself — then a bounded maze search runs as a preflight to prove there is room to route it before the placement is allowed to commit. AI is in the loop, but under a frozen contract: it may reorder an immutable set of already-legal candidates by ID, and nothing else. It cannot return geometry, relabel a candidate legal, or touch the board.