PCB Canvas

PCB Canvas is a touch-native PCB layout editor for iPad, 457,000 lines of Swift with no CAD kernel underneath it, because there wasn't one to use. Board geometry is integer nanometres end to end. The renderer is hand-written Metal with two custom tessellators. Copper pours are computed on an integer lattice rather than through a floating-point polygon-boolean library, so numerical uncertainty can only remove copper, never invent an illegal connection, and every fill carries a content fingerprint, so a pour edited after its last fill is caught before export instead of scrapping a board.

Compatibility with KiCad is not a parse-and-re-emit round trip. The app holds a concrete syntax tree with stable byte anchors and patches only the ranges it owns, then a verifier proves byte-for-byte that everything else is untouched, anything it can't represent safely, it refuses to rewrite. What comes out the other end is checked by an adversary: an independent host gate that reparses the source board without the app's parser, runs the real kicad-cli to produce competing Gerbers, and raster-compares both at 40 px/mm through Gerbonara. Across five torture boards, 0.4 mm QFN with thermal vias, two-row BGA escape, mixed THT with a back-copper zone, dense passive field, the result is zero unmatched copper area on F.Cu, B.Cu and Edge.Cuts, zero KiCad DRC violations, and byte-identical output on a repeat run.

The parts problem was attacked with automation rather than headcount. A zero-dependency Swift package reads land patterns straight out of datasheet PDFs, including its own DEFLATE inflater and a PDF content-stream interpreter, reconstructing pin tables from x-anchor clustering with no OCR and no model, discarding rows it can't parse with a reason instead of guessing, and attaching a page-and-bounding-box proof to every value it keeps. A 10 GB corpus mined from 20,410 open-source boards backs 39,483 catalogued parts and 3,337 per-chip support-circuit templates, each element carrying its datasheet citation, a placement class, and a hard maximum distance from the pin it serves. Drop an MCU and its mandatory support offers itself, then a bounded maze search runs as a preflight to prove there is room to route it before the placement is allowed to commit. AI is in the loop, but under a frozen contract: it may reorder an immutable set of already-legal candidates by ID, and nothing else. It cannot return geometry, relabel a candidate legal, or touch the board.