Merge fix/621 into batch 13 (sweep panic guard)

# Conflicts:
#	contributors/people.toml

.github/workflows/freebsd.yml

@@ -1,13 +1,12 @@
 # Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
-# (GitHub has no FreeBSD runners).
-# It then runs packaging/freebsd/package.sh, the script the release job runs, and checks the
-# tarball, so a broken FreeBSD package fails here before it can fail a release. Nothing is
-# uploaded and no secrets are used.
+# (GitHub has no FreeBSD runners). It then runs packaging/freebsd/package.sh, the script
+# the release job runs, and checks the tarball, so a broken FreeBSD package fails here
+# before it can fail a release. Nothing is uploaded and no secrets are used.
 name: FreeBSD
 
-# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every push
-# or dependency change: a drifted dependency still shows up within a day, and always before a
-# release ships. PRs that change the FreeBSD packaging itself still run it.
+# The VM build takes one to several hours, so it runs nightly on main rather than on every push
+# or dependency change: a drifted dependency still shows up within a day. PRs that change the
+# FreeBSD packaging itself still run it.
 on:
   schedule:
     - cron: "17 2 * * *"
@@ -29,36 +28,8 @@ permissions:
 
 jobs:
   freebsd:
-    name: FreeBSD 14 (build + test + package)
-    runs-on: ubuntu-latest
-    timeout-minutes: 300
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build, test and package in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Nothing to bring back; copying the target dir out of the VM fails on large builds.
-          copyback: false
-          # dejavu: the text tests need one real font, as the Ubuntu runner has.
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 dejavu
-            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-          run: |
-            set -e
-            . "$HOME/.cargo/env"
-            # The checkout is synced in under another owner; let tests that call git read it.
-            git config --global --add safe.directory "*"
-            rustc --version
-            CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
-            # The release package, as release.yml builds it. Free the debug build's disk first.
-            rm -rf target/debug
-            CARGO_BUILD_JOBS=4 bash packaging/freebsd/package.sh
-            tar -tzf dist/release/figcraft-*-freebsd-x86_64.tar.gz >"$HOME/freebsd-contents.txt"
-            for f in '/bin/figcraft$' '/share/applications/ai\.storyteller\.figcraft\.desktop$' '/share/doc/figcraft/LICENSE-MIT$'; do
-              grep -E "$f" "$HOME/freebsd-contents.txt"
-            done
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
+    with:
+      run-package-check: true
+      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104

.github/workflows/nix.yml

@@ -0,0 +1,23 @@
+# Evaluates the Nix flake (no build, about a minute): `nix build` / `nix develop` stop at evaluation
+# when Cargo.lock gains something nix/package.nix can't vendor, and nothing else would notice.
+name: Nix
+
+on:
+  push:
+    branches: [main]
+    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+  pull_request:
+    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  nix:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main

.github/workflows/packaging-lint.yml

@@ -19,58 +19,7 @@ concurrency:
 
 jobs:
   lint:
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    env:
-      ACTIONLINT_VERSION: 1.7.12
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends shellcheck desktop-file-utils appstream libxml2-utils python3-yaml
-          curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
-            | tar -xz -C "$RUNNER_TEMP" actionlint
-      - name: actionlint
-        run: |
-          "$RUNNER_TEMP/actionlint" -color
-      - name: shellcheck
-        run: shellcheck packaging/*.sh packaging/*/*.sh packaging/linux/AppRun
-      - name: Server install script (Caddyfile handling)
-        run: bash packaging/server/install-test.sh
-      - name: AppImage AppRun desktop integration
-        run: bash packaging/linux/apprun-test.sh
-      - name: PowerShell
-        shell: pwsh
-        run: |
-          foreach ($f in Get-ChildItem packaging/windows/*.ps1) {
-            $errors = $null
-            [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors) | Out-Null
-            if ($errors) { $errors | ForEach-Object { Write-Output "::error file=$($f.Name)::$_" }; exit 1 }
-            Write-Output "ok $($f.Name)"
-          }
-          ./packaging/windows/check-icons.ps1
-      - name: FreeBSD package layout (dry run, no build)
-        run: bash packaging/freebsd/package.sh --dry-run
-      - name: No template leftovers from other apps in package metadata
-        run: |
-          if grep -rniE 'photoshop|psd|photocraft|vectorcraft|illustrator|adobe|figma' packaging/ .github/ --exclude=packaging-lint.yml; then
-            echo "::error::package metadata mentions another product (see above)"
-            exit 1
-          fi
-      - name: XML, desktop entry, AppStream, Flatpak manifest
-        run: |
-          xmllint --noout packaging/windows/figcraft.wxs packaging/windows/figcraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
-          desktop-file-validate packaging/linux/ai.storyteller.figcraft.desktop
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.figcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.figcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.figcraft.metainfo.xml"
-          python3 - <<'EOF'
-          import yaml
-          src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.figcraft.yml"))
-          bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.figcraft.bundle.yml"))
-          for m in (src, bundle):
-              assert m["id"] == "ai.storyteller.figcraft" and m["command"] == "figcraft", m["id"]
-          for key in ("runtime", "runtime-version", "sdk", "finish-args"):
-              assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}"
-          print("Flatpak manifests ok")
-          EOF
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
+    with:
+      extra-checks-script: packaging/check-app-specific.sh

.github/workflows/release.yml

@@ -1,11 +1,3 @@
-# Release pipeline: every push to `release` builds signed installers for every platform and
-# creates or updates the draft GitHub Release "FigCraft v<version>". See docs/releasing.md.
-#
-# Only the jobs that read secrets (macOS and Windows signing, and the draft release) run in the
-# `release` environment (restricted to the `release` branch), which holds the signing secrets; the
-# rest build on any branch, so `gh workflow run release.yml --ref <branch>` is a real dry run.
-# Every secret is optional: missing ones produce unsigned artifacts and a warning, never a failed
-# build. Playbook: storytold/craftrules release/playbook.md.
 name: Release
 
 on:
@@ -19,543 +11,34 @@ on:
         default: ""
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: release-${{ github.ref }}
-  # Never cancel a run mid-notarization or mid-upload; a newer push waits its turn.
   cancel-in-progress: false
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-  RUST_BACKTRACE: 1
-  FIGCRAFT_BUILD_SHA: ${{ github.sha }}
-  INPUT_VERSION: ${{ inputs.version }}
-  # craft-fonts (https://github.com/storytold/craft-fonts): shared font assets every release
-  # embeds (Inter and the Latin presentation fonts from fonts/latin-manifest.txt; the web build
-  # embeds Inter only, see crates/text/build.rs). An optional build input for everyone else.
-  # crates/text/build.rs needs fonts/latin-manifest.txt, so the pin must include it. Bump
-  # deliberately; every build job checks out this commit.
-  CRAFT_FONTS_REF: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
-
 jobs:
-  version:
-    timeout-minutes: 10
-    name: version
-    runs-on: ubuntu-latest
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    outputs:
-      version: ${{ steps.v.outputs.version }}
-      date: ${{ steps.v.outputs.date }}
-      prerelease: ${{ steps.v.outputs.prerelease }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: v
-        name: Resolve version
-        run: |
-          . packaging/env.sh
-          v="${INPUT_VERSION#v}"
-          v="${v:-$VERSION}"
-          if ! printf '%s' "$v" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'; then
-            echo "::error::'$v' is not a version like 1.2.3 or 1.2.3-rc.1"
-            exit 1
-          fi
-          case "$v" in *-*) pre=true ;; *) pre=false ;; esac
-          {
-            echo "version=$v"
-            echo "date=$(date -u +%Y-%m-%d)"
-            echo "prerelease=$pre"
-          } >>"$GITHUB_OUTPUT"
-          echo "### FigCraft v$v (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
-
-  macos:
-    timeout-minutes: 90
-    name: macOS universal
-    needs: version
-    runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
-    environment: release
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-macos-universal
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Import signing certificate
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: packaging/macos/import-cert.sh
-      - name: Build, sign, notarize
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/macos/package.sh --arch universal
-      # Unpacks the CLI zip and checks the binary users get: Developer ID, hardened runtime,
-      # timestamp, and Gatekeeper's notarization lookup (codesign --verify, spctl). Also the DMG's
-      # stapled ticket. Strict when the signing secrets are present, warnings otherwise.
-      - name: Verify signatures and notarization
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: packaging/macos/verify.sh --arch universal
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-macos
-          path: dist/release/*
-          if-no-files-found: error
-      - name: Remove temporary keychain
-        if: always()
-        run: |
-          if [ -n "${MACOS_KEYCHAIN:-}" ]; then security delete-keychain "$MACOS_KEYCHAIN" || true; fi
-
-  windows:
-    timeout-minutes: 90
-    name: Windows ${{ matrix.arch }}
-    needs: version
-    runs-on: windows-latest
-    environment: release
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x64, target: x86_64-pc-windows-msvc }
-          - { arch: x86, target: i686-pc-windows-msvc }
-          # Windows on ARM: cross-compiled on the x64 runner, so signing and WiX run as above.
-          # .github/workflows/windows-arm64.yml installs and runs it on ARM64 hardware.
-          - { arch: arm64, target: aarch64-pc-windows-msvc }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-windows-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        shell: bash
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Install WiX
-        shell: pwsh
-        run: |
-          dotnet tool install --global wix --version 5.0.2
-          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
-      - name: Build, sign, package
-        shell: pwsh
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
-          AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
-          AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-windows-${{ matrix.arch }}
-          path: dist/release/*
-          if-no-files-found: error
-
-  linux:
-    timeout-minutes: 90
-    name: Linux ${{ matrix.arch }}
-    needs: version
-    # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
-    # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-22.04, deb: amd64 }
-          - { arch: aarch64, runner: ubuntu-22.04-arm, deb: arm64 }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      NFPM_VERSION: 2.47.0
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - name: Install build and packaging tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
-            desktop-file-utils appstream python3-yaml zsync
-          curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
-            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
-          sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-linux-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Build and package (AppImage, deb, rpm, tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/linux/package.sh
-      - name: Check the packages
-        run: |
-          dpkg-deb --info dist/release/*.deb
-          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/figcraft$|metainfo|applications'
-          ldd target/release/figcraft
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.figcraft.yml')); assert m['id'] == 'ai.storyteller.figcraft'"
-          for appimage in dist/release/*.AppImage; do
-            chmod +x "$appimage"
-            APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
-            # Update information is embedded, and the .zsync for delta updates sits beside it.
-            "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|'
-            test -s "$appimage.zsync"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/release/*
-          if-no-files-found: error
-
-  server:
-    timeout-minutes: 90
-    name: Server Linux ${{ matrix.arch }}
-    needs: version
-    # The headless collaboration server (docs/server.md): figcraft-server-<v>-linux-<arch>.tar.gz
-    # with the binary, licences, docs/server.md and the deployment examples. Same runners as the
-    # app, so the same glibc floor; no craft-fonts (the server draws no text).
-    # shortcut: Linux only (where servers run); add macOS/Windows archives, signed like figcraft-cli,
-    # when people host there.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-22.04 }
-          - { arch: aarch64, runner: ubuntu-22.04-arm }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-server-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Build and package (tar.gz)
-        run: packaging/server/package.sh
-      - name: Check the archive
-        run: |
-          tar -tzf "dist/release/figcraft-server-$FIGCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz" | tee "$RUNNER_TEMP/server-contents.txt"
-          for f in '/figcraft-server$' '/figcraft-server\.service$' '/Caddyfile$' '/nginx\.conf$' '/install\.sh$' '/figcraft-backup\.timer$' '/server\.md$' '/LICENSE-MIT$'; do
-            grep -E "$f" "$RUNNER_TEMP/server-contents.txt"
-          done
-          ldd target/release/figcraft-server
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-server-linux-${{ matrix.arch }}
-          path: dist/release/*.tar.gz
-          if-no-files-found: error
-
-  flatpak:
-    timeout-minutes: 90
-    name: Flatpak ${{ matrix.arch }}
-    needs: [version, linux]
-    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
-    # build here. 24.04 for a newer flatpak-builder (1.4) than 22.04 ships.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-24.04 }
-          - { arch: aarch64, runner: ubuntu-24.04-arm }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/linux
-      - name: Install flatpak-builder
-        run: |
-          sudo apt-get update
-          # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's
-          # `appstreamcli compose`, which renders the scalable icon and fails without it.
-          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
-          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      - name: Build the Flatpak bundle
-        run: packaging/linux/flatpak-bundle.sh "dist/linux/figcraft-$FIGCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-flatpak-${{ matrix.arch }}
-          path: dist/release/*.flatpak
-          if-no-files-found: error
-
-  freebsd:
-    name: FreeBSD x86_64
-    needs: version
-    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM, the same image and packages as
-    # .github/workflows/freebsd.yml. A private repo's ubuntu-latest has 2 vCPUs and 7 GB, too small
-    # for this VM (QEMU "cannot set up guest memory"), so it runs on the org's 16-core larger runner.
-    runs-on: github-ubuntu-16core
-    timeout-minutes: 180
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - name: Build and package in a FreeBSD VM (tar.gz)
-        # vmactions/freebsd-vm v1.5.9, pinned by commit (it runs our build).
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Passed into the VM by name; never templated into the script below.
-          envs: "FIGCRAFT_VERSION FIGCRAFT_BUILD_DATE FIGCRAFT_BUILD_SHA INPUT_VERSION"
-          # The FreeBSD CI packages, plus bash for the packaging script.
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-          run: |
-            set -e
-            . "$HOME/.cargo/env"
-            git config --global --add safe.directory "$PWD"
-            # Build outside the checkout so only dist/ is copied back out of the VM (copying the
-            # target dir back fails on large builds). 4 jobs: more runs the VM out of memory.
-            export CARGO_TARGET_DIR=/var/tmp/figcraft-target CARGO_BUILD_JOBS=4
-            if [ -n "$INPUT_VERSION" ]; then cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"; fi
-            # craft-fonts was checked out next to the sources and synced into the VM with them.
-            export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
-            bash packaging/freebsd/package.sh
-            tar -tzf dist/release/figcraft-*-freebsd-x86_64.tar.gz >"$HOME/freebsd-contents.txt"
-            for f in '/bin/figcraft$' '/share/applications/ai\.storyteller\.figcraft\.desktop$' '/share/doc/figcraft/LICENSE-MIT$'; do
-              grep -E "$f" "$HOME/freebsd-contents.txt"
-            done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-freebsd-x86_64
-          path: dist/release/*
-          if-no-files-found: error
-
-  web:
-    timeout-minutes: 90
-    name: Web (wasm)
-    needs: version
-    runs-on: ubuntu-latest
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      TRUNK_VERSION: 0.21.14
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-web
-      - name: Install trunk
-        run: |
-          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
-            | tar -xz -C "$HOME/.cargo/bin" trunk
-          trunk --version
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      # The wasm32 build embeds only Inter from craft-fonts (crates/text/build.rs): browsers have
-      # no system fonts to fall back on, and the rest would push the wasm towards
-      # packaging/web/package.sh's 24 MiB gate.
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - name: Build and zip
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/web/package.sh
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-web
-          path: dist/release/*
-          if-no-files-found: error
-
-  linux-riscv64:
-    timeout-minutes: 90
-    name: Linux riscv64
-    needs: version
-    # Cross-compiled on x86_64 (no hosted RISC-V runners) against the runner's own Ubuntu release
-    # from ports.ubuntu.com, so the binaries need that release's glibc (24.04: 2.39). 22.04's
-    # riscv64 ports lag its amd64 updates, which breaks the multiarch install. tar.gz only; the
-    # CLI is smoke-tested under QEMU.
-    runs-on: ubuntu-24.04
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: riscv64gc-unknown-linux-gnu
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-linux-riscv64
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Install cross-compilation dependencies
-        run: |
-          . /etc/os-release
-          sudo dpkg --add-architecture riscv64
-          # Pin the existing (archive.ubuntu.com) sources to amd64; riscv64 comes from ports.
-          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
-            sudo sed -i '/^Types: deb/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
-          fi
-          if [ -f /etc/apt/sources.list ]; then
-            sudo sed -i 's/^deb /deb [arch=amd64] /g' /etc/apt/sources.list
-            sudo sed -i 's/^deb-src /deb-src [arch=amd64] /g' /etc/apt/sources.list
-          fi
-          for suite in "$VERSION_CODENAME" "$VERSION_CODENAME-updates" "$VERSION_CODENAME-security"; do
-            echo "deb [arch=riscv64] http://ports.ubuntu.com/ubuntu-ports $suite main universe restricted multiverse"
-          done | sudo tee /etc/apt/sources.list.d/riscv64.list
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            gcc-riscv64-linux-gnu binutils-riscv64-linux-gnu libc6-dev-riscv64-cross libc6-dev:riscv64 qemu-user \
-            libxkbcommon-dev:riscv64 libwayland-dev:riscv64 libx11-dev:riscv64 libxrandr-dev:riscv64 \
-            libxi-dev:riscv64 libgl1-mesa-dev:riscv64
-      - name: Build and package (tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-          CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_LINKER: riscv64-linux-gnu-gcc
-          PKG_CONFIG_SYSROOT_DIR: /
-          PKG_CONFIG_PATH: /usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
-          PKG_CONFIG_ALLOW_CROSS: "1"
-          CROSS_ARCH: riscv64
-          CROSS_TARGET: riscv64gc-unknown-linux-gnu
-          CROSS_COMPILE: riscv64-linux-gnu-
-          EMULATOR: qemu-riscv64
-          QEMU_LD_PREFIX: /usr/riscv64-linux-gnu
-        run: packaging/linux/package.sh --formats tar
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-linux-riscv64
-          path: dist/release/*.tar.gz
-          if-no-files-found: error
-
   release:
-    timeout-minutes: 10
-    name: Draft GitHub Release
-    needs: [version, macos, windows, linux, linux-riscv64, flatpak, freebsd, web, server]
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: write
-    env:
-      VERSION: ${{ needs.version.outputs.version }}
-      PRERELEASE: ${{ needs.version.outputs.prerelease }}
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      GH_REPO: ${{ github.repository }}
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: release-*
-          path: artifacts
-          merge-multiple: true
-      - name: Checksums
-        working-directory: artifacts
-        run: |
-          sha256sum -- * | tee SHA256SUMS.txt
-      - name: Create or update the draft release
-        working-directory: artifacts
-        run: |
-          tag="v$VERSION"
-          title="FigCraft v$VERSION"
-          pre=()
-          if [ "$PRERELEASE" = true ]; then pre=(--prerelease); fi
-          if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
-            if [ "$draft" != "true" ]; then
-              echo "::error::Release $tag is already published. Bump the version (cargo run -p xtask -- version set X.Y.Z) before pushing to release."
-              exit 1
-            fi
-            echo "Updating draft $tag: replacing its assets"
-            gh release view "$tag" --json assets --jq '.assets[].name' | while read -r asset; do
-              gh release delete-asset "$tag" "$asset" --yes
-            done
-            gh release edit "$tag" --draft --title "$title" --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
-            gh release upload "$tag" --clobber -- *
-          else
-            echo "Creating draft $tag"
-            gh release create "$tag" --draft --title "$title" --target "$GITHUB_SHA" --generate-notes "${pre[@]}" -- *
-          fi
-          {
-            echo "Draft release **$title** at \`${GITHUB_SHA::9}\`:"
-            echo
-            sed 's/^/    /' SHA256SUMS.txt
-          } >>"$GITHUB_STEP_SUMMARY"
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
+    with:
+      app-name: figcraft
+      app-title: FigCraft
+      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+      has-server: true
+      version: ${{ inputs.version }}
+    secrets:
+      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+      KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
+      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
+      AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}

.github/workflows/windows-arm64.yml

@@ -24,77 +24,10 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-
 jobs:
-  package:
-    name: package (cross-compiled on x64)
-    runs-on: windows-latest
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
-        with:
-          targets: aarch64-pc-windows-msvc
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          key: windows-arm64-package
-      - name: Install WiX
-        shell: pwsh
-        run: |
-          dotnet tool install --global wix --version 5.0.2
-          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
-      - name: Build and package (unsigned)
-        shell: pwsh
-        env:
-          DIST: ${{ github.workspace }}\dist\arm64
-        run: ./packaging/windows/package.ps1 -Arch arm64
-      - uses: actions/upload-artifact@v4
-        with:
-          name: figcraft-windows-arm64
-          path: dist/arm64/*
-          if-no-files-found: error
-          retention-days: 7
-
-  install:
-    name: install and run on ARM64
-    needs: package
-    runs-on: windows-11-arm
-    timeout-minutes: 30
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: figcraft-windows-arm64
-          path: dist
-      - name: Install the MSI, check it, run it, uninstall it
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $msi = (Get-ChildItem dist/*.msi | Select-Object -First 1).FullName
-          $p = Start-Process msiexec.exe -ArgumentList '/i', "`"$msi`"", '/qn', '/l*v', 'install.log' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { Get-Content install.log -Tail 60; throw "msiexec /i exited $($p.ExitCode)" }
-          $dir = Join-Path $env:ProgramFiles 'FigCraft'
-          # figcraft-cli.exe ships once apps/figcraft-cli exists; check it when installed.
-          foreach ($exe in 'figcraft.exe', 'figcraft-cli.exe') {
-            $path = Join-Path $dir $exe
-            if (-not (Test-Path $path)) {
-              if ($exe -eq 'figcraft-cli.exe') { Write-Output "skip $exe (not in this build)"; continue }
-              throw "$exe not installed in $dir"
-            }
-            $bytes = [System.IO.File]::ReadAllBytes($path)
-            $machine = [BitConverter]::ToUInt16($bytes, [BitConverter]::ToInt32($bytes, 0x3C) + 4)
-            if ($machine -ne 0xAA64) { throw "$exe is for machine 0x$('{0:X}' -f $machine), not ARM64" }
-            Write-Output "ok $path (ARM64)"
-          }
-          # The installed binary runs natively on ARM64 (the CLI when present, else the app's --version).
-          $cli = Join-Path $dir 'figcraft-cli.exe'
-          if (-not (Test-Path $cli)) { $cli = Join-Path $dir 'figcraft.exe' }
-          $out = & $cli --version 2>&1 | Out-String
-          if ($LASTEXITCODE -ne 0) { Write-Output $out; throw "$cli --version exited $LASTEXITCODE" }
-          Write-Output "ok $(Split-Path -Leaf $cli) --version: $($out.Trim())"
-          $p = Start-Process msiexec.exe -ArgumentList '/x', "`"$msi`"", '/qn' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { throw "msiexec /x exited $($p.ExitCode)" }
-          if (Test-Path (Join-Path $dir 'figcraft.exe')) { throw 'uninstall left figcraft.exe behind' }
-          Write-Output 'ok uninstalled'
+  windows-arm64:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
+    with:
+      app-name: figcraft
+      app-dir: FigCraft

Cargo.lock

@@ -259,6 +259,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "windows-sys 0.60.2",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -1734,6 +1735,12 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -2820,6 +2827,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -3204,6 +3220,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3264,6 +3290,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
@@ -4574,6 +4611,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "ttf-parser"
 version = "0.25.1"
@@ -5726,6 +5774,24 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"

README.md

@@ -228,7 +228,7 @@ The desktop app also offers a loopback-only control channel (`figcraft --control
 - **Runs in the browser:** the whole engine and UI compile to WebAssembly.
 - **Accessible:** screen readers get names, roles, values and states for the tools, layer rows, fields, dropdowns, tabs and menus (AccessKit on desktop), F6 moves the keyboard between the toolbar, layers, canvas and properties (Tab within them, Escape back to the canvas), the system's reduce-motion setting is honoured, and panel text meets WCAG AA contrast in both themes.
 - **Languages:** English, Russian and Turkish (reviewed by native speakers), and Spanish, French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Czech and Indonesian drafts, picked in Preferences or taken from the system or browser and switched live; adding a language is one catalog file ([`docs/translating.md`](docs/translating.md)).
-- **Plugins:** sandboxed WebAssembly plugins (a metered, pure-Rust interpreter with a memory cap and no file or network access, in the browser too) that act through the same commands, each run one undo step, within the permissions their manifest asks for. A Rust SDK and two example plugins are in [`plugins/`](plugins); see [`docs/plugins.md`](docs/plugins.md).
+- **Plugins:** sandboxed WebAssembly plugins (a metered, pure-Rust interpreter with a memory cap and no file or network access, in the browser too) that act through the same commands, each run one undo step, within the permissions their manifest asks for. A Rust SDK and three example plugins are in [`plugins/`](plugins); see [`docs/plugins.md`](docs/plugins.md).
 - **Live sessions (preview):** share the open file from the app (Share ▸ Start sharing: online through a server, or on your local network), give the others the short join code it shows (or the invite link), and edit it together: everyone's changes sync live, with cursors, selections, avatars and follow, and undo takes back only your own changes. Others join from the desktop app (invite links open it) or from the browser build. See [`docs/collab-protocol.md`](docs/collab-protocol.md).
 - **A server of your own (preview):** `figcraft-server` keeps a team's files, publishes them from the app (File ▸ Publish to server…, or Share ▸ Online with your server in Preferences) and hands out share links and join codes that let people edit or only view; files survive restarts and apps reconnect where they were. No accounts yet: links are the access. Releases ship it for Linux, and the desktop app joins over `wss://`; [hosting it on a rented Linux server](docs/server.md#deploy-on-a-linux-server) takes a systemd unit and Caddy or nginx (or Docker). See [`docs/server.md`](docs/server.md).
 - **Never crashes:** no `unwrap`, `expect` or `panic` in shipped code, enforced by clippy; commands run behind a guard so a bug fails one action, not your session.

ROADMAP.md

@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (system theme on first run; recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading (#207), SVG import budgets (#190), Leptos code (#223), full screen (#227), server snapshots readable again (#188), owner-only preferences (#200), ruzstd 0.9.1 (#182), layer cycle repair (#205), batch rollback, Direct3D 12 on Windows, plugin metering (#192); vector edit mode regions: hover hatch, selection and drag; SVG/PDF exports refuse over-depth documents (#208); bounded MCP/control framing, connections and queues (#201); plugin log limits (#191); live-session revert guard (#198); attached MCP no longer replays after a lost reply (#194); repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; starter templates, a Templates tab and Getting started tips on the home screen; your online files; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; Windows QA pass with eight fixes; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (number variables in the text content picker (#629); frames and sections convert into each other (#719); bounded canvas pan overscan; community fixes from #478 up and a control-channel fix (#589); bounded canvas pan overscan; Typography spacing icons support scrubbing (#373); font scans skip named pipes; system theme on first run; recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading (#207), SVG import budgets (#190), Leptos code (#223), full screen (#227), server snapshots readable again (#188), owner-only preferences (#200), ruzstd 0.9.1 (#182), layer cycle repair (#205), batch rollback, Direct3D 12 on Windows, plugin metering (#192); vector edit mode regions: hover hatch, selection and drag; SVG/PDF exports refuse over-depth documents (#208); bounded MCP/control framing, connections and queues (#201); plugin log limits (#191); live-session revert guard (#198); attached MCP no longer replays after a lost reply (#194); repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; starter templates, a Templates tab and Getting started tips on the home screen; your online files; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; Windows QA pass with eight fixes; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -111,7 +111,7 @@ native speakers' reviews of the six language drafts need people.
 | Korean | ko | 100% | draft (needs native review) |
 | Vietnamese | vi | 0% | none |
 
-No other languages. Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
+Also shipped: Swedish (`sv`: every UI string, 120 of 588 command labels and menu wordings; native review welcome). Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
 (Brazil); FigCraft has the localization layer, English and Spanish (Spain and Latin America),
 French, German, Brazilian Portuguese, Japanese, Korean and Simplified Chinese drafts (Preferences ▸
 Language; Traditional Chinese has no catalog; CJK UI
@@ -131,6 +131,8 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 ## Progress log
 
+- **2026-10-17** · Number variables on text content (M3, #629): the Typography section's variable picker also lists number variables for a text layer's content, as the engine already accepted (the text shows the number, e.g. 42.5, and follows the variable). Other text fields keep their own types. Numbers unchanged.
+- **2026-10-17** · Frames and sections convert into each other (M1, #719): `object.convertToSection` turns a frame on the page or in a section into a section in place (same box, name, fill and layers, which stay where they are; what only a frame has goes: auto layout, clipping, layout grids, guides, scrolling), and `object.convertToFrame` now also turns a section into a frame that keeps its fill and doesn't clip, so the look stays. Nested frames, instances, main components and sections holding sections are refused with the reason; one undo step each. Both are in the canvas context menu (Convert to section / Convert to frame) and in Spanish. Numbers unchanged.
 - **2026-10-14** · Corner handles win over the corner-radius handles (M1, #292): a press on the inner half of a corner handle's square picked the radius handle 10 px in, so the drag neither resized nor (dragging outward) rounded anything. Inside the drawn square the corner now resizes both sides (in ratio with Shift or the link); further in the radius handle still answers. Regression test in the transform behaviour suite. Numbers unchanged.
 - **2026-10-14** · Home screen recent files as cards (M7): each card shows the picture its file carries on its first page's colour, the file's icon, name and "Edited ... ago"; sort by name, creation or last change either way; a table view; a click selects, a double-click or Enter opens, arrow keys move; Open, Show in folder and Remove from recents on right-click. Numbers unchanged.
 - **2026-10-13** · Vector edit mode regions (M4): with the Move tool, the filled area under the pointer is hatched with "/" lines in the selection colour, clipped by the area's own fill rule so holes stay clear; the hatch goes near points (3.5 px) and segments (2 px), and its spacing follows octave folding (8 px at every power-of-two zoom), fixed to the shape. A click selects the area with its points (they move with it but keep the unselected look), Shift adds or removes one, a press on a selected area drags the whole selection as one undo step, and a click on an empty spot clears the areas and stays in edit mode. `vector.edit.select {regions}` and `vector.edit.state` (`regions`, `regionVertices`, `regionHover`); `vector_regions_tests` and `regions_tests`. Numbers unchanged.
@@ -313,6 +315,13 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-17 | minor | Number variables on text content (M3, #629): the Typography section's variable picker also lists number variables for a text layer's content, as the engine already accepted (the text shows the number, e.g. 42.5, and follows the variable). Other text fields keep their own types. Numbers unchanged. |
+| 2026-10-17 | minor | Frames and sections convert into each other (M1, #719): `object.convertToSection` turns a frame on the page or in a section into a section in place (same box, name, fill and layers, which stay where they are; what only a frame has goes: auto layout, clipping, layout grids, guides, scrolling), and `object.convertToFrame` now also turns a section into a frame that keeps its fill and doesn't clip, so the look stays. Nested frames, instances, main components and sections holding sections are refused with the reason; one undo step each. Both are in the canvas context menu (Convert to section / Convert to frame) and in Spanish. Numbers unchanged. |
+| 2026-10-16 | minor | Community fixes from #478 up (batches #591, #598, #602; 69 PRs) and a control-channel fix: a line that isn't JSON now ends a `--control` connection, so a web page can't drive the app through a browser request (#589). Highlights: page copies keep navigation, flows, prototype settings and guides; Find and Replace keeps line endings and case-insensitive matches; text hyperlinks survive import and export; recent colours record only what was picked; MCP screenshots respect `maxSize`; Swedish catalog (UI strings), Czech plurals; bounded canvas overscan while panning; Korean fallback at the run's weight; many vector-edit, guide, page and .fig round-trip fixes. Numbers unchanged |
+| 2026-10-15 | minor | Drop files anywhere to open them (M7): dragging files over the window shows a "Drop to open" (home) or "Drop to import" (canvas) overlay. On the home screen each supported file opens as a document of its own and other files are turned away with a toast; on the canvas the files import at the drop point. Both wait behind a small card that is on screen before a large file blocks the window. A canvas import stays with the document and page that received the drop even if the tab or page changes meanwhile, and is cancelled with a message if that document or page is gone. Numbers unchanged. |
+| 2026-10-15 | minor | M7: system font discovery skips entries observed as non-regular files before opening them, avoiding the reproduced named-pipe stall. Regular-file symlinks remain supported; directory depth, font limits and priorities are unchanged. Numbers unchanged. |
+| 2026-10-15 | minor | Canvas retains a bounded margin while panning so newly exposed strips can reuse the previous render. Numbers unchanged. |
+| 2026-10-15 | minor | Typography spacing icons scrub with the shared number-field gesture, modifier rates and one Undo step per drag (#373). Units and selected-character targeting are preserved. Numbers unchanged. |
 | 2026-10-14 | minor | System theme on first run (M7): preferences without a theme default to System; the first frame reads the OS appearance directly, including when returning from a manual theme. Saved Light/Dark choices stay explicit; unavailable OS appearance falls back to Light. Numbers unchanged. |
 | 2026-10-14 | minor | Home screen recent files as cards (M7): each card shows the picture its file carries on its first page's colour, the file's icon, name and "Edited ... ago"; sort by name, creation or last change either way; a table view; a click selects, a double-click or Enter opens, arrow keys move; Open, Show in folder and Remove from recents on right-click. Numbers unchanged. |
 | 2026-10-14 | minor | Lost images reported on loading (#207): a `.figcraft` file whose image member is damaged, too large or missing no longer loads in silence; each lost image (up to 20, then a count) is listed in `repairs` on `file.open` with its hash and the reason, and the app shows it as a toast. Saving still writes the file without the lost images. Numbers unchanged |

apps/figcraft-cli/src/files.rs

@@ -38,7 +38,7 @@ fn write(path: &str, bytes: &[u8]) -> CliResult<()> {
 
 fn page_named(doc: &Document, name: Option<&str>) -> CliResult<NodeId> {
     match name {
-        None => doc.first_page().ok_or_else(|| CliError::Failed("the document has no pages".into())),
+        None => doc.first_open_page().or_else(|| doc.first_page()).ok_or_else(|| CliError::Failed("the document has no pages".into())),
         Some(n) => doc
             .pages
             .iter()
@@ -333,17 +333,32 @@ pub fn run_script(script: &str, input: Option<&str>, out: Option<&str>) -> CliRe
         }
         None => Session::new(),
     };
-    for (i, (cmd, params)) in steps.iter().enumerate() {
-        let r = s.execute(cmd, params);
-        s.ui_requests.clear();
-        match r {
-            Ok(v) => println!("{}", json!({"step": i, "command": cmd, "ok": true, "result": v})),
-            Err(e) => {
-                println!("{}", json!({"step": i, "command": cmd, "ok": false, "error": e.to_string()}));
-                eprintln!("error: step {i} ({cmd}) failed: {e}");
-                return Ok(ExitCode::from(1));
-            }
+    // One undo step and all-or-nothing, the way the same commands behave through `command.batch`
+    // (MCP, the control channel, plugins): `{"$step": n}` resolves against the steps before it, and
+    // a step that fails takes the whole script back instead of leaving the earlier steps applied.
+    // The result lines are held back until the script is through, so none of them reports work that
+    // was rolled back.
+    let mut results: Vec<Value> = Vec::with_capacity(steps.len());
+    let mut failed_at = 0;
+    let outcome = s.grouped(&format!("run {script}"), |s| {
+        for (i, (cmd, params)) in steps.iter().enumerate() {
+            failed_at = i;
+            let v = s.batch_step(&results, i, cmd, params)?;
+            s.ui_requests.clear();
+            results.push(v);
         }
+        Ok(())
+    });
+    if let Err(e) = outcome {
+        let cmd = steps.get(failed_at).map_or("", |(cmd, _)| cmd.as_str());
+        let i = failed_at;
+        println!("{}", json!({"step": i, "command": cmd, "ok": false, "error": e.to_string(), "rolledBack": true}));
+        eprintln!("error: step {i} ({cmd}) failed: {e}");
+        eprintln!("the script's document changes were rolled back");
+        return Ok(ExitCode::from(1));
+    }
+    for (i, ((cmd, _), v)) in steps.iter().zip(&results).enumerate() {
+        println!("{}", json!({"step": i, "command": cmd, "ok": true, "result": v}));
     }
     if let Some(out) = out {
         let ds = s.ds().map_err(|e| CliError::Failed(e.to_string()))?;
@@ -380,6 +395,22 @@ mod tests {
         assert_eq!(sanitize(""), "layer");
     }
 
+    #[test]
+    fn default_page_skips_leading_divider() {
+        let mut doc = Document::new("divider");
+        let page = doc.first_page().unwrap();
+        doc.create(page, figcraft_doc::NodeKind::Frame, "First", 0.0, 0.0, 40.0, 30.0).unwrap();
+        let divider = doc.add_page("- Divider");
+        doc.pages.retain(|p| *p != divider);
+        doc.pages.insert(0, divider);
+        assert!(doc.is_divider(divider));
+        assert_eq!(page_named(&doc, None).unwrap(), page);
+        assert_eq!(page_named(&doc, Some("- Divider")).unwrap(), divider);
+        let pm = render_page(&doc, page_named(&doc, None).unwrap(), 1.0).unwrap();
+        assert_eq!((pm.width(), pm.height()), (40, 30));
+        assert!(render_page(&doc, divider, 1.0).is_err());
+    }
+
     #[test]
     fn export_depth_errors_preserve_conversion_destinations() {
         let mut doc = Document::new("export depth");
@@ -406,4 +437,62 @@ mod tests {
         assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 2);
         std::fs::remove_dir_all(dir).unwrap();
     }
+
+    fn temp_dir(tag: &str) -> std::path::PathBuf {
+        let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let dir = std::env::temp_dir().join(format!("figcraft-cli-{tag}-{}-{stamp}", std::process::id()));
+        std::fs::create_dir(&dir).unwrap();
+        dir
+    }
+
+    /// A script resolves `{"$step": n}` like the same commands through `command.batch`. Each step
+    /// used to run on its own, so the reference reached `parent` unresolved, `node.create` read it
+    /// as "no parent" and the layer landed on the page — with every step reporting success.
+    #[test]
+    fn a_script_puts_a_layer_in_a_layer_an_earlier_step_made() {
+        let dir = temp_dir("run-step");
+        let script = dir.join("script.json");
+        std::fs::write(
+            &script,
+            r#"[
+                {"command": "node.create", "params": {"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 200, "height": 100}},
+                {"command": "node.create", "params": {"type": "rectangle", "name": "child", "parent": {"$step": 0}, "x": 10, "y": 10, "width": 20, "height": 20}}
+            ]"#,
+        )
+        .unwrap();
+        let out = dir.join("out.figcraft");
+        run_script(script.to_str().unwrap(), None, Some(out.to_str().unwrap())).unwrap();
+
+        let mut s = Session::empty();
+        s.execute("file.open", &json!({"path": out.to_str().unwrap()})).unwrap();
+        let doc = s.doc().unwrap();
+        let page = s.page().unwrap();
+        let top = doc.node(page).unwrap().children.clone();
+        assert_eq!(top.len(), 1, "only the frame is top level, not the rectangle too");
+        assert_eq!(doc.node(top[0]).unwrap().name, "Card");
+        let inner = doc.node(top[0]).unwrap().children.clone();
+        assert_eq!(inner.len(), 1, "the rectangle went inside the frame");
+        assert_eq!(doc.node(inner[0]).unwrap().name, "child");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    /// A step that fails takes the whole script back: nothing is written, and the failure says so.
+    #[test]
+    fn a_failed_step_leaves_no_output() {
+        let dir = temp_dir("run-rollback");
+        let script = dir.join("script.json");
+        std::fs::write(
+            &script,
+            r#"[
+                {"command": "node.create", "params": {"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 200, "height": 100}},
+                {"command": "node.set", "params": {"ids": [99999], "props": {"name": "nope"}}}
+            ]"#,
+        )
+        .unwrap();
+        let out = dir.join("out.figcraft");
+        // The failure is the script's, not the call's: the CLI reports it and exits non-zero.
+        run_script(script.to_str().unwrap(), None, Some(out.to_str().unwrap())).unwrap();
+        assert!(!out.exists(), "a script that failed writes nothing");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
 }

apps/figcraft-cli/src/perf.rs

@@ -438,44 +438,66 @@ fn measure_components(table: &mut Table, col: usize, instances: usize) -> CliRes
         mean(3, |i| exec(&mut s, "node.set", json!({"ids": labels, "props": {"fontSize": 13 + (i % 2) * 2}}))),
     );
     let doc = s.doc().map_err(failed)?.clone();
-    let (card, _) = instance_with(&doc, &inst, ds.card, &["Footer button", "Icon", "Glyph"]).ok_or_else(|| failed("no card"))?;
-    table.put(
-        col,
-        "switch a card's variant (nested overrides kept)",
-        mean(5, |i| {
-            exec(&mut s, "instance.setProperties", json!({"ids": [card], "properties": {"Size": if i % 2 == 0 { "Large" } else { "Small" }}}))
-        }),
-    );
-    let (nav, _) = instance_with(&doc, &inst, ds.nav, &["Profile"]).ok_or_else(|| failed("no nav"))?;
-    table.put(col, "reset all changes on a nav", timed(&mut s, "component.resetInstance", json!({"ids": [nav]}), true));
-    table.put(col, "detach a nav", timed(&mut s, "component.detach", json!({"ids": [nav]}), true));
-    let (button, bglyph) = instance_with(&doc, &inst, ds.button, &["Icon", "Glyph"]).ok_or_else(|| failed("no button"))?;
-    table.put(col, "push a button's changes to its main", timed(&mut s, "component.pushChanges", json!({"id": button}), true));
-    // A button glyph the drop really lands on: screens can overlap (text sizes differ without
-    // fonts), so ask the hit test the swap uses.
-    let now = s.doc().map_err(failed)?.clone();
-    let page = s.page().map_err(failed)?;
-    let b = std::iter::once(bglyph)
-        .chain(inst.iter().filter_map(|i| {
-            let NodeKind::Instance { component, .. } = &now.node(*i)?.kind else { return None };
-            (figcraft_engine::components::variant_set(&now, *component) == Some(ds.button)).then(|| find_path(&now, *i, &["Icon", "Glyph"]))?
-        }))
-        .filter_map(|g| now.world_bounds(g))
-        .find(|b| figcraft_engine::drop::swap_target(&now, page, b.center(), None, None).is_some())
-        .ok_or_else(|| failed("no button glyph to drop on"))?;
-    let other = ds.icons.get(5).copied().unwrap_or(icon0);
-    table.put(
-        col,
-        "Alt-drop swap onto an instance",
-        timed(&mut s, "instance.swapAt", json!({"component": other, "x": b.center().x, "y": b.center().y}), true),
-    );
-    exec(&mut s, "edit.copy", json!({"ids": [nav]}));
-    table.put(col, "copy + paste a nav", timed(&mut s, "edit.paste", json!({}), true));
+    // Small workloads may not contain every instance type; the rows needing a missing one stay empty.
+    if let Some((card, _)) = instance_with(&doc, &inst, ds.card, &["Footer button", "Icon", "Glyph"]) {
+        table.put(
+            col,
+            "switch a card's variant (nested overrides kept)",
+            mean(5, |i| {
+                exec(&mut s, "instance.setProperties", json!({"ids": [card], "properties": {"Size": if i % 2 == 0 { "Large" } else { "Small" }}}))
+            }),
+        );
+    } else {
+        table.put(col, "switch a card's variant (nested overrides kept)", f64::NAN);
+    }
+    let nav = instance_with(&doc, &inst, ds.nav, &["Profile"]).map(|(nav, _)| nav);
+    if let Some(nav) = nav {
+        table.put(col, "reset all changes on a nav", timed(&mut s, "component.resetInstance", json!({"ids": [nav]}), true));
+        table.put(col, "detach a nav", timed(&mut s, "component.detach", json!({"ids": [nav]}), true));
+    } else {
+        table.put(col, "reset all changes on a nav", f64::NAN);
+        table.put(col, "detach a nav", f64::NAN);
+    }
+    if let Some((button, bglyph)) = instance_with(&doc, &inst, ds.button, &["Icon", "Glyph"]) {
+        table.put(col, "push a button's changes to its main", timed(&mut s, "component.pushChanges", json!({"id": button}), true));
+        // A button glyph the drop really lands on: screens can overlap (text sizes differ without
+        // fonts), so ask the hit test the swap uses.
+        let now = s.doc().map_err(failed)?.clone();
+        let page = s.page().map_err(failed)?;
+        let drop_at = std::iter::once(bglyph)
+            .chain(inst.iter().filter_map(|i| {
+                let NodeKind::Instance { component, .. } = &now.node(*i)?.kind else { return None };
+                (figcraft_engine::components::variant_set(&now, *component) == Some(ds.button)).then(|| find_path(&now, *i, &["Icon", "Glyph"]))?
+            }))
+            .filter_map(|g| now.world_bounds(g))
+            .find(|b| figcraft_engine::drop::swap_target(&now, page, b.center(), None, None).is_some());
+        let other = ds.icons.get(5).copied().unwrap_or(icon0);
+        table.put(
+            col,
+            "Alt-drop swap onto an instance",
+            match drop_at {
+                Some(b) => timed(&mut s, "instance.swapAt", json!({"component": other, "x": b.center().x, "y": b.center().y}), true),
+                None => f64::NAN,
+            },
+        );
+    } else {
+        table.put(col, "push a button's changes to its main", f64::NAN);
+        table.put(col, "Alt-drop swap onto an instance", f64::NAN);
+    }
+    if let Some(nav) = nav {
+        exec(&mut s, "edit.copy", json!({"ids": [nav]}));
+        table.put(col, "copy + paste a nav", timed(&mut s, "edit.paste", json!({}), true));
+    } else {
+        table.put(col, "copy + paste a nav", f64::NAN);
+    }
     table.put(col, "undo (deep main edit)", mean(10, |_| _ = s.undo()));
     table.put(col, "redo", mean(10, |_| _ = s.redo()));
 
     // As a library: publish it, use it from another file, publish a change, accept the update.
-    let dir = std::env::temp_dir().join(format!("figcraft-perf-{}", std::process::id()));
+    // One directory per run, so concurrent runs in a process don't delete each other's files.
+    static RUNS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    let run = RUNS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let dir = std::env::temp_dir().join(format!("figcraft-perf-{}-{run}", std::process::id()));
     std::fs::create_dir_all(&dir).map_err(failed)?;
     let path = dir.join("design-system.figcraft").to_string_lossy().into_owned();
     let (lib_doc, lib_ds) = design_system_document(&spec).map_err(failed)?;
@@ -533,6 +555,14 @@ mod tests {
         assert!(t.rows.iter().all(|r| r.1.len() == 1 && r.1[0].is_finite()), "{:?}", t.rows);
     }
 
+    #[test]
+    fn measures_components_with_a_single_instance() {
+        let mut t = super::Table { rows: Vec::new() };
+        super::measure_components(&mut t, 0, 1).unwrap();
+        assert!(t.rows.iter().all(|r| r.1.len() == 1), "{:?}", t.rows);
+        assert!(t.rows.iter().any(|r| r.0.starts_with("build design system") && r.1[0].is_finite()), "{:?}", t.rows);
+    }
+
     #[test]
     fn measures_a_small_document() {
         let mut t = super::Table { rows: Vec::new() };

apps/figcraft-server/src/config.rs

@@ -135,9 +135,23 @@ impl Config {
     /// abuse contact, or one whose clients would all count as its proxy).
     pub fn warnings(&self) -> Vec<String> {
         let mut out = Vec::new();
+        let client_max = NetLimits::default().max_server_message >> 20;
+        if usize::try_from(self.file_mb()).is_ok_and(|mb| mb >= client_max) {
+            out.push(format!(
+                "max_file_mb is {}: the app opens files of up to {} MiB, so a file that large can't be opened",
+                self.file_mb(),
+                client_max - 1
+            ));
+        }
         if !self.open_publish {
             return out;
         }
+        if self.file_mb() > 64 {
+            out.push(format!(
+                "open_publish is on with max_file_mb = {}: anyone may send messages that large, and the memory set aside for reading and queueing them grows to eight times it; keep it at 64 or less on a public server",
+                self.file_mb()
+            ));
+        }
         if self.operator_contact.trim().is_empty() {
             out.push("open_publish is on but operator_contact is empty: people can't reach you about abuse; set it (and terms_url)".into());
         }
@@ -253,8 +267,9 @@ impl Config {
         }
     }
 
-    /// Largest message a client may send when open to the public: a whole file (or plugin bundle)
-    /// and a margin, not the core's 64 MiB.
+    /// Largest message a client may send: a whole file (or plugin bundle) and a margin. Open to the
+    /// public this is also the cap (strangers' files stay small); a private server never goes below
+    /// the core's 64 MiB, and a `max_file_mb` above it raises the cap with it.
     fn open_message(&self) -> usize {
         usize::try_from(self.file_mb().max(self.max_plugin_mb).saturating_add(1).saturating_mul(1 << 20)).unwrap_or(usize::MAX)
     }
@@ -265,9 +280,9 @@ impl Config {
     fn core(&self) -> figcraft_collab::Limits {
         let base = figcraft_collab::Limits { max_peers: self.max_people, ..figcraft_collab::Limits::default() };
         if !self.open_publish {
-            return base;
+            return figcraft_collab::Limits { max_message_bytes: base.max_message_bytes.max(self.open_message()), ..base };
         }
-        let max = self.open_message().min(base.max_message_bytes);
+        let max = self.open_message();
         let file = usize::try_from(self.file_mb().saturating_mul(1 << 20)).unwrap_or(usize::MAX);
         figcraft_collab::Limits { max_message_bytes: max, max_log_bytes: (file / 4).max(256 << 10), ..base }
     }
@@ -279,21 +294,24 @@ impl Config {
     pub fn net(&self) -> NetLimits {
         let base = NetLimits { max_connections: self.max_connections, trusted_proxy: self.proxy().ok().flatten(), ..NetLimits::default() };
         if !self.open_publish {
-            return base;
+            let max = base.max_client_message.max(self.open_message());
+            return NetLimits { max_client_message: max, max_queued_bytes: base.max_queued_bytes.max(max.saturating_add(1 << 20)), ..base };
         }
-        let max = self.open_message().min(base.max_client_message);
+        let max = self.open_message();
         // Shared budgets: one block of addresses (an IPv4 address, an IPv6 /48) gets at most an
-        // eighth of each, and its biggest consumers are dropped first.
-        let (queued, reading) = (256usize << 20, 192usize << 20);
+        // eighth of each, and its biggest consumers are dropped first. Each still fits one whole
+        // message, or a file as large as `max_file_mb` could never arrive.
+        let one = max.saturating_add(1 << 20);
+        let (queued, reading) = ((256usize << 20).max(one.saturating_mul(8)), (192usize << 20).max(one.saturating_mul(8)));
         NetLimits {
             max_per_address: self.max_connections_per_ip,
             max_client_message: max,
-            max_queued_bytes: max.saturating_add(1 << 20),
+            max_queued_bytes: one,
             max_queued_block: queued / 8,
             max_queued_total: queued,
-            max_reading_block: max.saturating_add(1 << 20).min(reading / 8),
+            max_reading_block: one.min(reading / 8),
             max_reading_total: reading,
-            max_in_flight: 128 << 20,
+            max_in_flight: (128usize << 20).max(one),
             reserve_for_sessions: self.max_connections / 8,
             request_idle: std::time::Duration::from_secs(20),
             ..base

apps/figcraft-server/src/disk.rs

@@ -8,8 +8,10 @@
 //!   length (u32 LE), CRC-32 (u32 LE), one [`Journal`] entry in the wire encoding.
 //!
 //! Compaction writes the next generation's snapshot, then an empty log of that generation. A log
-//! whose generation isn't the snapshot's is from before a compaction that was cut short: what it
-//! holds is in the snapshot already. A log ends at its first damaged record (a write cut short).
+//! whose generation isn't the snapshot's is usually from before a compaction that was cut short
+//! (what it holds is in the snapshot already), but no checksum covers either generation, so the
+//! store replays such a log anyway and reports any change the snapshot lacked. A log ends at its
+//! first damaged record (a write cut short).
 
 use std::fs::{self, File};
 use std::io::{self, Read, Write};

apps/figcraft-server/src/public_tests.rs

@@ -413,7 +413,7 @@ fn open_mode_has_safe_defaults_and_warns_the_operator() {
     assert_eq!(open.net().request_idle, Duration::from_secs(20), "idle one-shot requests go quickly");
     assert_eq!(open.net().reserve_for_sessions, 512 / 8);
     assert_eq!(open.net().max_client_message, 17 << 20);
-    assert_eq!(private.net().max_client_message, NetLimits::default().max_client_message, "unchanged when private");
+    assert_eq!(private.net().max_client_message, 65 << 20, "private: a 64 MiB file and a margin");
     let w = open.warnings().join("\n");
     assert!(w.contains("operator_contact is empty") && w.contains("trusted_proxy"), "{w}");
     let set = Config { operator_contact: "[email protected]".into(), trusted_proxy: Some("127.0.0.1".into()), max_file_mb: Some(8), ..open };
@@ -493,3 +493,34 @@ fn open_connections_never_reach_what_needs_the_key() {
     assert!(!format!("{info:?}").contains(&k));
     server.stop();
 }
+
+#[test]
+fn files_above_64_mib_fit_every_limit() {
+    // `max_file_mb` may go up to 4096: every cap a whole file's message meets on its way in must
+    // follow it, or the upload is dropped by the transport before the server can say why.
+    for open_publish in [false, true] {
+        let cfg = Config { open_publish, max_file_mb: Some(256), public_url: Some("wss://figcraft.example.com/".into()), ..Config::default() };
+        let (net, core, file) = (cfg.net(), cfg.store().core, 256usize << 20);
+        assert!(net.max_client_message > file, "open={open_publish}: {}", net.max_client_message);
+        assert!(net.max_queued_bytes > file && net.max_reading_block > file && net.max_in_flight > file, "open={open_publish}: {net:?}");
+        assert!(net.max_reading_total >= net.max_reading_block && net.max_queued_total >= net.max_queued_block);
+        assert!(core.max_message_bytes > file, "open={open_publish}: {}", core.max_message_bytes);
+    }
+    // A client takes such a file too, but caps what any server may make it buffer at 1 GiB.
+    assert_eq!(NetLimits::default().max_server_message, 1 << 30);
+}
+
+#[test]
+fn large_files_warn_the_operator() {
+    let public_url = Some("wss://figcraft.example.com/".into());
+    let warns = |open_publish, mb| {
+        Config { open_publish, max_file_mb: Some(mb), public_url: public_url.clone(), ..Config::default() }.warnings().join(
+            "
+",
+        )
+    };
+    assert!(!warns(true, 64).contains("max_file_mb"), "{}", warns(true, 64));
+    assert!(warns(true, 65).contains("open_publish is on with max_file_mb = 65"), "{}", warns(true, 65));
+    assert!(!warns(false, 1023).contains("max_file_mb"), "{}", warns(false, 1023));
+    assert!(warns(false, 1024).contains("can't be opened"), "{}", warns(false, 1024));
+}

apps/figcraft-server/src/store.rs

@@ -347,14 +347,14 @@ impl Store {
         let key = load_key(root)?;
         let dir = root.join(FILES);
         fs::create_dir_all(&dir).map_err(|e| format!("can't create {}: {e}", dir.display()))?;
-        let (directory, problems) = Directory::open(root, cfg.directory);
+        let (directory, startup_problems) = Directory::open(root, cfg.directory);
         let abuse = Abuse::new(cfg.hosting.abuse);
         let mut store = Store {
             root: root.to_path_buf(),
             cfg,
             key,
             files: BTreeMap::new(),
-            problems,
+            problems: Vec::new(),
             directory,
             abuse,
             served: figcraft_collab_net::net::Bucket::new(LIBRARY_RATE, LIBRARY_BURST),
@@ -368,6 +368,9 @@ impl Store {
             free: None,
             _lock: lock,
         };
+        for problem in startup_problems {
+            store.note(problem);
+        }
         store.scan(&dir);
         store.blocked = store.read_list::<String>(BLOCKED).iter().filter_map(|s| s.parse().ok()).map(ip_key).collect();
         store.reports = store.read_list(REPORTS);
@@ -385,7 +388,7 @@ impl Store {
         match disk::read_capped(&path, 16 << 20).and_then(|b| serde_json::from_slice(&b).map_err(|e| format!("{name} is damaged ({e})"))) {
             Ok(list) => list,
             Err(e) => {
-                self.problems.push(e);
+                self.note(e);
                 Vec::new()
             }
         }
@@ -394,7 +397,7 @@ impl Store {
     fn scan(&mut self, dir: &Path) {
         let entries = match fs::read_dir(dir) {
             Ok(e) => e,
-            Err(e) => return self.problems.push(format!("can't list {}: {e}", dir.display())),
+            Err(e) => return self.note(format!("can't list {}: {e}", dir.display())),
         };
         let mut ids: Vec<(String, PathBuf)> = entries.flatten().map(|e| (e.file_name().to_string_lossy().into_owned(), e.path())).collect();
         ids.sort();
@@ -403,18 +406,18 @@ impl Store {
                 continue;
             }
             if !valid_id(&id) {
-                self.problems.push(format!("skipped {}: not a file folder of this server", path.display()));
+                self.note(format!("skipped {}: not a file folder of this server", path.display()));
                 continue;
             }
             if self.files.len() >= self.cfg.max_files {
-                self.problems.push(format!("skipped file {id}: over the {}-file cap", self.cfg.max_files));
+                self.note(format!("skipped file {id}: over the {}-file cap", self.cfg.max_files));
                 continue;
             }
             match self.check(&path) {
                 Ok(entry) => {
                     self.files.insert(id, entry);
                 }
-                Err(why) => self.problems.push(format!("skipped file {id}: {why}")),
+                Err(why) => self.note(format!("skipped file {id}: {why}")),
             }
         }
     }
@@ -437,7 +440,7 @@ impl Store {
             && let Ok(log) = disk::read_log(&bytes)
             && log.generation != generation
         {
-            log::info!("file at {}: its log predates the last compaction; it is ignored", path.display());
+            log::info!("file at {}: its log isn't of its snapshot's generation; it is replayed over it when the file opens", path.display());
         }
         let bytes = [SNAPSHOT, LOG].iter().filter_map(|n| fs::metadata(path.join(n)).ok()).map(|m| m.len()).sum();
         Ok(Entry { meta, links, log: None, bytes, forced: 0 })
@@ -1123,8 +1126,32 @@ impl Store {
                     fresh_log = true;
                 }
             }
-            // From before a compaction that was cut short: the snapshot has it all.
-            Ok(_) => {}
+            // From before a compaction that was cut short, the snapshot has it all; or a generation
+            // field damaged, which no checksum covers. Replaying tells them apart without trusting
+            // it: entries the snapshot holds are skipped, so only edits it lacks change anything.
+            Ok(log) => {
+                let before = server.seq();
+                let mut stopped = None;
+                for entry in log.entries {
+                    if let Err(e) = server.replay(entry) {
+                        stopped = Some(e);
+                        break;
+                    }
+                }
+                let (snap, found, recovered) = (generation, log.generation, server.seq().saturating_sub(before));
+                if recovered > 0 {
+                    issues.push(format!(
+                        "file {file}: its log's generation ({found}) doesn't match its snapshot's ({snap}), but it held \
+                         {recovered} changes the snapshot didn't; they were recovered"
+                    ));
+                }
+                if let Some(e) = stopped {
+                    issues.push(format!(
+                        "file {file}: its log's generation ({found}) doesn't match its snapshot's ({snap}) and it stops \
+                         making sense after {recovered} newer changes ({e}); the rest was dropped"
+                    ));
+                }
+            }
             Err(why) => issues.push(format!("file {file}: {why}; starting a new log")),
         }
         for i in issues {

apps/figcraft-server/tests/header_recovery.rs

@@ -0,0 +1,139 @@
+//! A generation field damaged after an abrupt stop must not make the server drop a log that still
+//! holds confirmed edits (#408): the log is replayed over the snapshot, which only the changes the
+//! snapshot lacks survive, and the damage is reported. A genuine leftover of a compaction cut short
+//! still restores silently.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use figcraft_collab::message::{Access, ClientMsg};
+use figcraft_collab::{Client, Outgoing, Replica, Server};
+use figcraft_collab_net::hub::Backend;
+use figcraft_doc::Document;
+use figcraft_server::config::Config;
+use figcraft_server::disk::{self, LOG, SNAPSHOT};
+use figcraft_server::store::{FILES, Store};
+use std::fs;
+use std::path::{Path, PathBuf};
+
+struct Fixture(PathBuf);
+
+impl Fixture {
+    fn new() -> Self {
+        let path = std::env::temp_dir().join(format!("figcraft-header-recovery-{}", figcraft_collab_net::token::file_id().unwrap()));
+        fs::create_dir(&path).unwrap();
+        Self(path)
+    }
+}
+
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+fn page_name(server: &Server) -> String {
+    let doc = server.document();
+    doc.node(doc.first_page().unwrap()).unwrap().name.clone()
+}
+
+/// A published file whose first page was renamed "Kept", flushed to its log (not compacted), then
+/// the store dropped without stopping (an abrupt stop). Returns the file id and the final state.
+fn renamed_and_stopped(data: &Path) -> (String, Server) {
+    let mut store = Store::open(data, Config::default().store()).unwrap();
+    let snapshot = Replica::new(Document::new("Fixture")).snapshot().unwrap();
+    let (info, _, _) = store.publish("Fixture", &snapshot).unwrap();
+    let id = info.id;
+    let mut server = store.open(&id).unwrap();
+    let ClientMsg::Hello(hello) = Client::hello("f", "", "Editor", "#FF8800") else { panic!("not a hello") };
+    let (_, messages) = server.join_as(hello, Access::Edit).unwrap();
+    let Some(Outgoing::To(_, welcome)) = messages.into_iter().next() else { panic!("no welcome") };
+    let mut client = Client::join(welcome).unwrap();
+    store.changed(&id, &mut server);
+    let mut edited = client.document().clone();
+    let page = edited.first_page().unwrap();
+    edited.node_mut(page).unwrap().name = "Kept".into();
+    let change = client.edit(&edited).unwrap().unwrap();
+    assert!(!server.receive(client.id(), change).is_empty());
+    store.changed(&id, &mut server);
+    assert!(store.flush().is_empty(), "the edit must reach disk");
+    assert_eq!(page_name(&server), "Kept");
+    let dir = data.join(FILES).join(&id);
+    assert!(!disk::read_log(&fs::read(dir.join(LOG)).unwrap()).unwrap().entries.is_empty());
+    assert_eq!(disk::decode_snapshot(&fs::read(dir.join(SNAPSHOT)).unwrap()).unwrap().1.seq, 0, "the rename is only in the log");
+    drop(store);
+    (id, server)
+}
+
+/// Reopen the data directory: the file's first page name and the problems reported.
+fn reopen(data: &Path, id: &str) -> (String, Vec<String>) {
+    let mut store = Store::open(data, Config::default().store()).unwrap();
+    let server = store.open(id).unwrap();
+    (page_name(&server), store.problems().to_vec())
+}
+
+fn flip(path: &Path, at: usize) {
+    let mut bytes = fs::read(path).unwrap();
+    bytes[at] ^= 1;
+    fs::write(path, bytes).unwrap();
+}
+
+/// The generation field's first byte in both headers (after the magic and the format byte).
+const GENERATION_AT: usize = 5;
+
+#[test]
+fn an_intact_log_restores_its_edits_without_a_report() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept");
+    assert!(problems.is_empty(), "{problems:?}");
+}
+
+#[test]
+fn a_damaged_log_generation_keeps_the_edits_and_is_reported() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    let log = fixture.0.join(FILES).join(&id).join(LOG);
+    flip(&log, GENERATION_AT);
+    // The records themselves still read: only the header's generation changed.
+    let read = disk::read_log(&fs::read(&log).unwrap()).unwrap();
+    assert!(read.damaged.is_none() && !read.entries.is_empty());
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept", "the flushed rename must survive");
+    assert!(problems.iter().any(|p| p.contains(&id) && p.contains("generation")), "{problems:?}");
+    // And it stays: the recovered edit is now in the file's snapshot.
+    assert_eq!(reopen(&fixture.0, &id).0, "Kept");
+}
+
+#[test]
+fn a_damaged_snapshot_generation_keeps_the_edits_and_is_reported() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    let snapshot = fixture.0.join(FILES).join(&id).join(SNAPSHOT);
+    flip(&snapshot, GENERATION_AT);
+    assert!(disk::check_snapshot(&fs::read(&snapshot).unwrap()).is_ok(), "the generation is outside the checksum");
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept", "the flushed rename must survive");
+    assert!(problems.iter().any(|p| p.contains(&id) && p.contains("generation")), "{problems:?}");
+    assert_eq!(reopen(&fixture.0, &id).0, "Kept");
+}
+
+#[test]
+fn a_damaged_log_format_is_still_reported() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    flip(&fixture.0.join(FILES).join(&id).join(LOG), 4);
+    let (_, problems) = reopen(&fixture.0, &id);
+    assert!(problems.iter().any(|p| p.contains(&id) && p.contains("format")), "{problems:?}");
+}
+
+#[test]
+fn a_log_left_by_a_compaction_cut_short_restores_without_a_report() {
+    let fixture = Fixture::new();
+    let (id, server) = renamed_and_stopped(&fixture.0);
+    // The next snapshot was written (it holds the rename); the old log wasn't replaced yet.
+    let bytes = disk::encode_snapshot(2, &server.state().unwrap()).unwrap();
+    fs::write(fixture.0.join(FILES).join(&id).join(SNAPSHOT), bytes).unwrap();
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept");
+    assert!(problems.is_empty(), "a leftover log is expected, not damage: {problems:?}");
+}

apps/figcraft-server/tests/problem_retention.rs

@@ -0,0 +1,40 @@
+use figcraft_server::config::Config;
+use figcraft_server::store::{FILES, Store};
+
+#[test]
+fn startup_problem_retention() {
+    let root = std::env::temp_dir().join(format!("figcraft-problem-cap-{}", std::process::id()));
+    assert!(!root.exists());
+    let result = (|| -> Result<(), String> {
+        for count in [3u32, 200, 201] {
+            let data = root.join(count.to_string());
+            for i in 0..count {
+                std::fs::create_dir_all(data.join(FILES).join(format!("{i:016x}"))).map_err(|e| e.to_string())?;
+            }
+            let cfg = Config { open_publish: true, data: data.clone(), ..Config::default() };
+            cfg.check()?;
+            let store = Store::open(&data, cfg.store())?;
+            let expected = (count as usize).min(200);
+            let problems = store.problems().to_vec();
+            let no_loaded_files = store.is_empty();
+            drop(store);
+            if !problems.iter().all(|p| p.contains("meta.json")) || !no_loaded_files {
+                return Err("unexpected diagnostic or loaded file".into());
+            }
+            if problems.len() != expected {
+                return Err(format!("expected {expected} retained problems, got {}", problems.len()));
+            }
+            // The latest problems stay, in scan order: the first folder's is the one dropped.
+            let first_kept = count as usize - expected;
+            for (n, p) in problems.iter().enumerate() {
+                let id = format!("{:016x}", first_kept + n);
+                if !p.contains(&id) {
+                    return Err(format!("problem {n} should be about {id}: {p}"));
+                }
+            }
+        }
+        Ok(())
+    })();
+    std::fs::remove_dir_all(&root).unwrap();
+    assert!(result.is_ok(), "{}", result.unwrap_err());
+}

apps/figcraft-web/src/main.rs

@@ -14,7 +14,16 @@
 //!   join from other machines.
 //!
 //! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU.
+//!
+//! URL fragment: `#join=<invite link or join code>` joins that live session once the page has
+//! loaded, so a bookmark opens a shared file. `join` takes the rest of the fragment: put it last.
+//! The link carries the session's secret; a fragment is never sent to the web host, but the address
+//! bar and the browser history keep it, so the URL is as private as the link itself.
 
+#[cfg(any(target_arch = "wasm32", test))]
+mod query;
+#[cfg(test)]
+mod query_tests;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/figcraft-web/src/query.rs

@@ -0,0 +1,15 @@
+//! The page's URL: the invite link its fragment names.
+
+/// The invite link in `#join=<link>` (`fragment` is `location.hash`, with or without its `#`), still
+/// escaped. The fragment, unlike the query, never leaves the browser, so the link's secret stays out
+/// of the web host's logs and `Referer` headers. `join` takes the rest of the fragment, so a pasted
+/// `figcraft://join?host=…&file=…&token=…` keeps its own `&`s. Anything longer than an escaped invite
+/// link can be is ignored; what is left is checked by `collab.join` like a link the desktop app is
+/// opened with.
+pub fn join_link(fragment: &str) -> Option<&str> {
+    // An invite link is at most 2 KiB; every byte of it escaped is three.
+    const MAX: usize = 3 * 2048;
+    let fragment = fragment.strip_prefix('#').unwrap_or(fragment);
+    let start = if fragment.starts_with("join=") { 0 } else { fragment.find("&join=")? + 1 };
+    fragment.get(start + "join=".len()..).filter(|link| !link.is_empty() && link.len() <= MAX)
+}

apps/figcraft-web/src/query_tests.rs

@@ -0,0 +1,29 @@
+//! `#join=` in the page's URL.
+
+use crate::query::join_link;
+
+#[test]
+fn join_takes_the_rest_of_the_fragment() {
+    let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv";
+    assert_eq!(join_link(&format!("#join={link}")), Some(link), "a pasted link keeps its own &s");
+    assert_eq!(join_link(&format!("#x=1&join={link}")), Some(link), "after other entries");
+    assert_eq!(join_link("#join=figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), Some("figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), "escaped, decoded later");
+    assert_eq!(join_link("join=K7M-2QX-9TD"), Some("K7M-2QX-9TD"), "a join code, no leading #");
+}
+
+#[test]
+fn no_join_without_the_entry() {
+    assert_eq!(join_link(""), None);
+    assert_eq!(join_link("#"), None);
+    assert_eq!(join_link("#join="), None);
+    assert_eq!(join_link("#rejoin=x"), None, "only the whole entry name");
+    assert_eq!(join_link("#xjoin=x&a=1"), None);
+    assert_eq!(join_link("?join=x"), None, "the query isn't read: it goes to the web host");
+}
+
+#[test]
+fn an_overlong_link_is_ignored() {
+    let long = format!("#join=figcraft://join?host=h&file=f&token={}", "a".repeat(7000));
+    assert_eq!(join_link(&long), None);
+    assert_eq!(join_link(&format!("#join={}", "é".repeat(4000))), None, "length counts bytes");
+}

apps/figcraft-web/src/web.rs

@@ -40,7 +40,13 @@ pub fn start() {
                     // on the socket wakes the page for a frame.
                     let ctx = cc.egui_ctx.clone();
                     session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint()))));
-                    let fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+                    // `#join=<link>`: join that session, as opening an invite link does on the desktop.
+                    let hash = web_sys::window().and_then(|w| w.location().hash().ok()).unwrap_or_default();
+                    if let Some(link) = crate::query::join_link(&hash) {
+                        let link = js_sys::decode_uri_component(link).ok().and_then(|s| s.as_string()).unwrap_or_else(|| link.to_string());
+                        figcraft_ui_egui::live::open_invite(&mut fig, &link);
+                    }
                     Ok(Box::new(WebShell { fig }))
                 }),
             )

apps/figcraft/Cargo.toml

@@ -21,7 +21,7 @@ eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
-arboard = { workspace = true, features = ["image-data"] }
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }
 webbrowser = { workspace = true }
 image = { workspace = true }
 env_logger = { version = "0.11", default-features = false, features = ["auto-color", "humantime"] }

apps/figcraft/src/apple_events.rs

@@ -50,7 +50,7 @@ pub fn poll(inbox: &Inbox, fig: &mut FigApp, ctx: &egui::Context) {
 /// Open `paths` as File › Open does; a file that fails shows its error and the others still open.
 pub fn open_documents(fig: &mut FigApp, paths: Vec<PathBuf>) {
     for p in paths {
-        if fig.run("file.open", json!({"path": p.to_string_lossy()})).is_some() {
+        if fig.run_user("file.open", json!({"path": p.to_string_lossy()})).is_some() {
             fig.ui.home = false;
         }
     }

apps/figcraft/src/control_server.rs

@@ -111,7 +111,13 @@ fn serve(mut out: TcpStream, queue: Queue, ctx: CtxSlot, timeout: Duration) -> s
                     }
                 }
             }
-            Err(e) => json!({"id": null, "ok": false, "error": format!("bad JSON: {e}")}),
+            Err(e) => {
+                // A line that isn't JSON ends the connection: a web page can make the browser send
+                // an HTTP request here, and its header lines must not let the JSON lines of its body
+                // through as commands.
+                writeln!(out, "{}", json!({"id": null, "ok": false, "error": format!("bad JSON: {e}")}))?;
+                break;
+            }
         };
         writeln!(out, "{reply}")?;
     }

apps/figcraft/src/control_server_tests.rs

@@ -53,9 +53,8 @@ fn valid_frames_keep_their_order_ids_and_parameters() {
     let pending = queue();
     let q = pending.clone();
     let worker = std::thread::spawn(move || serve(server, q, context(), Duration::from_secs(5)));
-    client.write_all(b"\r\n{bad JSON}\n{\"id\":\"test\",\"method\":\"engine.execute\",\"params\":{\"command\":\"shape.rectangle\"}}\r\n").unwrap();
+    client.write_all(b"\r\n{\"id\":\"test\",\"method\":\"engine.execute\",\"params\":{\"command\":\"shape.rectangle\"}}\r\n").unwrap();
     let mut reader = BufReader::new(client);
-    assert_eq!(reply(&mut reader)["ok"], false);
     let start = Instant::now();
     let r = loop {
         if let Some(r) = pending.lock().unwrap().pop() {
@@ -73,6 +72,23 @@ fn valid_frames_keep_their_order_ids_and_parameters() {
     worker.join().unwrap().unwrap();
 }
 
+#[test]
+fn a_line_that_is_not_json_ends_the_connection_before_anything_after_it_runs() {
+    // What a browser sends when a web page posts to the port: the JSON line in its body never runs.
+    let (mut client, server) = pair();
+    let pending = queue();
+    let q = pending.clone();
+    let worker = std::thread::spawn(move || serve(server, q, context(), Duration::from_secs(5)));
+    let body = "{\"id\":1,\"method\":\"engine.execute\",\"params\":{\"command\":\"file.save\"}}\n";
+    let http = format!("POST / HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Type: text/plain\r\nContent-Length: {}\r\n\r\n{body}", body.len());
+    client.write_all(http.as_bytes()).unwrap();
+    let mut reader = BufReader::new(client);
+    assert_eq!(reply(&mut reader)["ok"], false);
+    assert_eq!(reader.read(&mut [0]).unwrap(), 0, "the connection is closed");
+    worker.join().unwrap().unwrap();
+    assert!(pending.lock().unwrap().is_empty(), "nothing was dispatched");
+}
+
 #[test]
 fn full_queue_rejects_before_dispatch_and_ui_queue_stays_bounded() {
     let (mut client, server) = pair();
@@ -144,7 +160,11 @@ fn connection_limit_rejects_excess_clients_and_reuses_finished_slots() {
     assert_eq!(workers.len(), 1);
     client.write_all(b"invalid\n").unwrap();
     assert_eq!(reply(&mut BufReader::new(client.try_clone().unwrap()))["ok"], false);
-    client.shutdown(Shutdown::Both).unwrap();
+    // The server closes this connection after answering an invalid request, and shutting down
+    // a socket whose peer has already closed is ENOTCONN on macOS and the BSDs where Linux
+    // returns Ok. Closing the client is what the worker is waiting for, so the result is moot:
+    // the other shutdowns in this file run while the peer is still open and stay checked.
+    let _ = client.shutdown(Shutdown::Both);
     workers.pop().unwrap().join().unwrap();
 }
 

apps/figcraft/src/services.rs

@@ -223,12 +223,47 @@ fn picked(pick: impl Future<Output = Option<rfd::FileHandle>> + 'static) -> Dial
     Box::pin(async move { pick.await.map(|f| f.path().to_path_buf()) })
 }
 
+/// How long a clipboard read may wait on the app that copied (Linux and the BSDs).
+#[cfg(all(unix, not(target_os = "macos")))]
+const CLIPBOARD_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(2);
+
+/// Read the clipboard. On Linux and the BSDs the read runs on a helper thread with its own handle
+/// and gives up after [`CLIPBOARD_TIMEOUT`]: a Wayland read waits on the app that copied with no
+/// timeout of its own, so an app that hangs must not hang the window too.
+#[cfg(all(unix, not(target_os = "macos")))]
+fn read_clipboard<T: Send + 'static>(_: &mut arboard::Clipboard, read: fn(&mut arboard::Clipboard) -> Option<T>) -> Option<T> {
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let _ = tx.send(arboard::Clipboard::new().ok().and_then(|mut c| read(&mut c)));
+    });
+    rx.recv_timeout(CLIPBOARD_TIMEOUT).ok().flatten()
+}
+
+/// Read the clipboard (the system's own reads don't wait on the app that copied).
+#[cfg(not(all(unix, not(target_os = "macos"))))]
+fn read_clipboard<T>(c: &mut arboard::Clipboard, read: fn(&mut arboard::Clipboard) -> Option<T>) -> Option<T> {
+    read(c)
+}
+
+/// Native Save as filters; other callers keep their existing combined filter.
+fn save_filters<'a>(exts: &'a [&'a str]) -> Vec<(&'static str, &'a [&'a str])> {
+    if exts == ["figcraft", "fig"] {
+        vec![("FigCraft (.figcraft)", &exts[..1]), (figcraft_ui_egui::i18n::tr(".fig (experimental)"), &exts[1..])]
+    } else {
+        vec![("File", exts)]
+    }
+}
+
 impl Services for Desktop {
     fn pick_open(&mut self, title: &str, exts: &[&str]) -> DialogFuture {
         picked(dialog(title).add_filter("Supported files", exts).pick_file())
     }
     fn pick_save(&mut self, title: &str, name: &str, exts: &[&str]) -> DialogFuture {
-        picked(dialog(title).set_file_name(name).add_filter("File", exts).save_file())
+        let mut dialog = dialog(title).set_file_name(name);
+        for (label, extensions) in save_filters(exts) {
+            dialog = dialog.add_filter(label, extensions);
+        }
+        picked(dialog.save_file())
     }
     fn pick_folder(&mut self, title: &str) -> DialogFuture {
         picked(dialog(title).pick_folder())
@@ -239,7 +274,10 @@ impl Services for Desktop {
         }
     }
     fn clipboard_get_text(&mut self) -> Option<String> {
-        self.clipboard.as_mut()?.get_text().ok()
+        read_clipboard(self.clipboard.as_mut()?, |c| c.get_text().ok())
+    }
+    fn clipboard_get_html(&mut self) -> Option<String> {
+        read_clipboard(self.clipboard.as_mut()?, |c| c.get().html().ok())
     }
     fn clipboard_set_png(&mut self, w: u32, h: u32, rgba: &[u8]) {
         if let Some(c) = self.clipboard.as_mut() {
@@ -247,7 +285,7 @@ impl Services for Desktop {
         }
     }
     fn clipboard_get_image(&mut self) -> Option<(u32, u32, Vec<u8>)> {
-        let img = self.clipboard.as_mut()?.get_image().ok()?;
+        let img = read_clipboard(self.clipboard.as_mut()?, |c| c.get_image().ok())?;
         let (w, h) = (u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?);
         // Refuse absurd sizes (and mismatched buffers) rather than allocate.
         if w == 0 || h == 0 || u64::from(w) * u64::from(h) > 100_000_000 || img.bytes.len() != (w as usize) * (h as usize) * 4 {
@@ -297,3 +335,24 @@ pub fn window_icon() -> Option<egui::IconData> {
     let (w, h) = img.dimensions();
     Some(egui::IconData { rgba: img.into_raw(), width: w, height: h })
 }
+
+#[cfg(test)]
+mod save_filter_tests {
+    use super::save_filters;
+
+    #[test]
+    fn native_and_fig_save_filters_are_separate_with_native_first() {
+        let extensions = ["figcraft", "fig"];
+        assert_eq!(
+            save_filters(&extensions),
+            vec![("FigCraft (.figcraft)", &extensions[..1]), (figcraft_ui_egui::i18n::tr(".fig (experimental)"), &extensions[1..])]
+        );
+    }
+
+    #[test]
+    fn other_save_filters_keep_one_combined_group() {
+        for extensions in [&["figcraft"][..], &["fig"][..], &["png"][..], &["png", "jpg", "webp"][..], &[][..]] {
+            assert_eq!(save_filters(extensions), vec![("File", extensions)]);
+        }
+    }
+}

contributors/people.toml

@@ -38,4 +38,18 @@ real_name = "Justin John"
 [people.Losminek]
 
 [people.RevDonz]
+
+[people.Nael-Nathanael]
+sync_github_name = true
+
+[people.volkovskey]
+real_name = "Andrii Volkov"
+
+[people.marcoarnulfo]
+real_name = "Marco Arnulfo"
+display_name = "Marco Arnulfo"
+sync_github_name = false
+
+[people.krinry]
+display_name = "krinry"
 sync_github_name = true

crates/collab-net/src/limits.rs

@@ -12,7 +12,9 @@ pub struct NetLimits {
     /// before: its hello.
     pub max_client_message: usize,
     pub max_hello: usize,
-    /// Largest message a client accepts from the host (a welcome carries the whole document).
+    /// Largest message a client accepts from the host (a welcome carries the whole document): 1 GiB,
+    /// room for any file up to 1023 MiB and well past the servers' defaults, while a hostile server
+    /// (any link can name one) can't make the app or a browser tab buffer more than that.
     pub max_server_message: usize,
     /// Messages a client may send per second on average, and in a burst; beyond that it is
     /// disconnected.
@@ -61,7 +63,7 @@ impl Default for NetLimits {
             max_connections: 64,
             max_client_message: figcraft_collab::Limits::default().max_message_bytes,
             max_hello: 64 << 10,
-            max_server_message: figcraft_collab::Limits::default().max_message_bytes,
+            max_server_message: 1 << 30,
             rate: 100.0,
             burst: 400.0,
             hello_timeout: Duration::from_secs(10),

crates/color/src/lib.rs

@@ -11,6 +11,7 @@ use serde::{Deserialize, Serialize};
 mod blend;
 mod hsx;
 mod icc;
+mod named;
 mod profile;
 pub use blend::BlendMode;
 pub use hsx::*;
@@ -139,7 +140,13 @@ impl Color {
         Some(Self::from_rgba8(r, g, b, a))
     }
 
-    /// Parse a CSS colour: hex, `rgb()/rgba()`, `hsl()/hsla()` or a few common names.
+    /// What a colour field accepts: hex as [`Color::from_hex`] reads it, or a CSS colour name
+    /// (`red` → `FF0000`, `Cornflower Blue` → `6495ED`; opaque).
+    pub fn from_hex_or_name(s: &str) -> Option<Self> {
+        Self::from_hex(s).or_else(|| named::lookup(s).map(|[r, g, b]| Self::from_rgba8(r, g, b, 255)))
+    }
+
+    /// Parse a CSS colour: hex, `rgb()/rgba()`, `hsl()/hsla()`, a CSS colour name or `transparent`.
     pub fn parse_css(s: &str) -> Option<Self> {
         let t = s.trim().to_ascii_lowercase();
         if t.starts_with('#') {
@@ -166,21 +173,10 @@ impl Color {
             let alpha = parts.get(3).and_then(|a| parse_alpha(a)).unwrap_or(1.0);
             return Some(Hsl { h, s, l }.to_color().with_alpha(alpha));
         }
-        let named = match t.as_str() {
-            "black" => Color::BLACK,
-            "white" => Color::WHITE,
-            "transparent" => Color::TRANSPARENT,
-            "red" => Color::from_rgb8_const(255, 0, 0),
-            "green" => Color::from_rgb8_const(0, 128, 0),
-            "lime" => Color::from_rgb8_const(0, 255, 0),
-            "blue" => Color::from_rgb8_const(0, 0, 255),
-            "yellow" => Color::from_rgb8_const(255, 255, 0),
-            "orange" => Color::from_rgb8_const(255, 165, 0),
-            "purple" => Color::from_rgb8_const(128, 0, 128),
-            "gray" | "grey" => Color::from_rgb8_const(128, 128, 128),
-            _ => return Self::from_hex(&t),
-        };
-        Some(named)
+        if t == "transparent" {
+            return Some(Color::TRANSPARENT);
+        }
+        Self::from_hex_or_name(&t)
     }
 
     /// CSS `rgba(...)` / hex text for copy-as-CSS.

crates/color/src/named.rs

@@ -0,0 +1,197 @@
+//! The CSS named colours (CSS Color Module Level 4 §6.1), so a colour field takes `red` as well as
+//! `FF0000`.
+
+/// Every CSS named colour except `transparent`, sorted by name for binary search.
+const NAMED: [(&str, [u8; 3]); 148] = [
+    ("aliceblue", [240, 248, 255]),
+    ("antiquewhite", [250, 235, 215]),
+    ("aqua", [0, 255, 255]),
+    ("aquamarine", [127, 255, 212]),
+    ("azure", [240, 255, 255]),
+    ("beige", [245, 245, 220]),
+    ("bisque", [255, 228, 196]),
+    ("black", [0, 0, 0]),
+    ("blanchedalmond", [255, 235, 205]),
+    ("blue", [0, 0, 255]),
+    ("blueviolet", [138, 43, 226]),
+    ("brown", [165, 42, 42]),
+    ("burlywood", [222, 184, 135]),
+    ("cadetblue", [95, 158, 160]),
+    ("chartreuse", [127, 255, 0]),
+    ("chocolate", [210, 105, 30]),
+    ("coral", [255, 127, 80]),
+    ("cornflowerblue", [100, 149, 237]),
+    ("cornsilk", [255, 248, 220]),
+    ("crimson", [220, 20, 60]),
+    ("cyan", [0, 255, 255]),
+    ("darkblue", [0, 0, 139]),
+    ("darkcyan", [0, 139, 139]),
+    ("darkgoldenrod", [184, 134, 11]),
+    ("darkgray", [169, 169, 169]),
+    ("darkgreen", [0, 100, 0]),
+    ("darkgrey", [169, 169, 169]),
+    ("darkkhaki", [189, 183, 107]),
+    ("darkmagenta", [139, 0, 139]),
+    ("darkolivegreen", [85, 107, 47]),
+    ("darkorange", [255, 140, 0]),
+    ("darkorchid", [153, 50, 204]),
+    ("darkred", [139, 0, 0]),
+    ("darksalmon", [233, 150, 122]),
+    ("darkseagreen", [143, 188, 143]),
+    ("darkslateblue", [72, 61, 139]),
+    ("darkslategray", [47, 79, 79]),
+    ("darkslategrey", [47, 79, 79]),
+    ("darkturquoise", [0, 206, 209]),
+    ("darkviolet", [148, 0, 211]),
+    ("deeppink", [255, 20, 147]),
+    ("deepskyblue", [0, 191, 255]),
+    ("dimgray", [105, 105, 105]),
+    ("dimgrey", [105, 105, 105]),
+    ("dodgerblue", [30, 144, 255]),
+    ("firebrick", [178, 34, 34]),
+    ("floralwhite", [255, 250, 240]),
+    ("forestgreen", [34, 139, 34]),
+    ("fuchsia", [255, 0, 255]),
+    ("gainsboro", [220, 220, 220]),
+    ("ghostwhite", [248, 248, 255]),
+    ("gold", [255, 215, 0]),
+    ("goldenrod", [218, 165, 32]),
+    ("gray", [128, 128, 128]),
+    ("green", [0, 128, 0]),
+    ("greenyellow", [173, 255, 47]),
+    ("grey", [128, 128, 128]),
+    ("honeydew", [240, 255, 240]),
+    ("hotpink", [255, 105, 180]),
+    ("indianred", [205, 92, 92]),
+    ("indigo", [75, 0, 130]),
+    ("ivory", [255, 255, 240]),
+    ("khaki", [240, 230, 140]),
+    ("lavender", [230, 230, 250]),
+    ("lavenderblush", [255, 240, 245]),
+    ("lawngreen", [124, 252, 0]),
+    ("lemonchiffon", [255, 250, 205]),
+    ("lightblue", [173, 216, 230]),
+    ("lightcoral", [240, 128, 128]),
+    ("lightcyan", [224, 255, 255]),
+    ("lightgoldenrodyellow", [250, 250, 210]),
+    ("lightgray", [211, 211, 211]),
+    ("lightgreen", [144, 238, 144]),
+    ("lightgrey", [211, 211, 211]),
+    ("lightpink", [255, 182, 193]),
+    ("lightsalmon", [255, 160, 122]),
+    ("lightseagreen", [32, 178, 170]),
+    ("lightskyblue", [135, 206, 250]),
+    ("lightslategray", [119, 136, 153]),
+    ("lightslategrey", [119, 136, 153]),
+    ("lightsteelblue", [176, 196, 222]),
+    ("lightyellow", [255, 255, 224]),
+    ("lime", [0, 255, 0]),
+    ("limegreen", [50, 205, 50]),
+    ("linen", [250, 240, 230]),
+    ("magenta", [255, 0, 255]),
+    ("maroon", [128, 0, 0]),
+    ("mediumaquamarine", [102, 205, 170]),
+    ("mediumblue", [0, 0, 205]),
+    ("mediumorchid", [186, 85, 211]),
+    ("mediumpurple", [147, 112, 219]),
+    ("mediumseagreen", [60, 179, 113]),
+    ("mediumslateblue", [123, 104, 238]),
+    ("mediumspringgreen", [0, 250, 154]),
+    ("mediumturquoise", [72, 209, 204]),
+    ("mediumvioletred", [199, 21, 133]),
+    ("midnightblue", [25, 25, 112]),
+    ("mintcream", [245, 255, 250]),
+    ("mistyrose", [255, 228, 225]),
+    ("moccasin", [255, 228, 181]),
+    ("navajowhite", [255, 222, 173]),
+    ("navy", [0, 0, 128]),
+    ("oldlace", [253, 245, 230]),
+    ("olive", [128, 128, 0]),
+    ("olivedrab", [107, 142, 35]),
+    ("orange", [255, 165, 0]),
+    ("orangered", [255, 69, 0]),
+    ("orchid", [218, 112, 214]),
+    ("palegoldenrod", [238, 232, 170]),
+    ("palegreen", [152, 251, 152]),
+    ("paleturquoise", [175, 238, 238]),
+    ("palevioletred", [219, 112, 147]),
+    ("papayawhip", [255, 239, 213]),
+    ("peachpuff", [255, 218, 185]),
+    ("peru", [205, 133, 63]),
+    ("pink", [255, 192, 203]),
+    ("plum", [221, 160, 221]),
+    ("powderblue", [176, 224, 230]),
+    ("purple", [128, 0, 128]),
+    ("rebeccapurple", [102, 51, 153]),
+    ("red", [255, 0, 0]),
+    ("rosybrown", [188, 143, 143]),
+    ("royalblue", [65, 105, 225]),
+    ("saddlebrown", [139, 69, 19]),
+    ("salmon", [250, 128, 114]),
+    ("sandybrown", [244, 164, 96]),
+    ("seagreen", [46, 139, 87]),
+    ("seashell", [255, 245, 238]),
+    ("sienna", [160, 82, 45]),
+    ("silver", [192, 192, 192]),
+    ("skyblue", [135, 206, 235]),
+    ("slateblue", [106, 90, 205]),
+    ("slategray", [112, 128, 144]),
+    ("slategrey", [112, 128, 144]),
+    ("snow", [255, 250, 250]),
+    ("springgreen", [0, 255, 127]),
+    ("steelblue", [70, 130, 180]),
+    ("tan", [210, 180, 140]),
+    ("teal", [0, 128, 128]),
+    ("thistle", [216, 191, 216]),
+    ("tomato", [255, 99, 71]),
+    ("turquoise", [64, 224, 208]),
+    ("violet", [238, 130, 238]),
+    ("wheat", [245, 222, 179]),
+    ("white", [255, 255, 255]),
+    ("whitesmoke", [245, 245, 245]),
+    ("yellow", [255, 255, 0]),
+    ("yellowgreen", [154, 205, 50]),
+];
+
+/// Longest name in [`NAMED`]; anything longer can't match.
+const LONGEST: usize = 20;
+
+/// The opaque sRGB bytes of a CSS colour name. Case, spaces, `-` and `_` are ignored, so
+/// `Light Blue`, `light-blue` and `lightblue` are the same colour.
+pub fn lookup(s: &str) -> Option<[u8; 3]> {
+    let key: String = s.chars().filter(|c| !c.is_whitespace() && *c != '-' && *c != '_').take(LONGEST + 1).collect::<String>().to_ascii_lowercase();
+    if key.is_empty() || key.len() > LONGEST {
+        return None;
+    }
+    NAMED.binary_search_by(|(name, _)| name.cmp(&key.as_str())).ok().and_then(|i| NAMED.get(i)).map(|(_, rgb)| *rgb)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn table_is_sorted_and_unique() {
+        assert!(NAMED.windows(2).all(|w| w[0].0 < w[1].0));
+        assert_eq!(NAMED.iter().map(|(n, _)| n.len()).max(), Some(LONGEST));
+    }
+
+    #[test]
+    fn every_name_is_found() {
+        for (name, rgb) in NAMED {
+            assert_eq!(lookup(name), Some(rgb), "{name}");
+        }
+    }
+
+    #[test]
+    fn lookup_normalises() {
+        assert_eq!(lookup("Red"), Some([255, 0, 0]));
+        assert_eq!(lookup("  CORNFLOWER blue "), Some([100, 149, 237]));
+        assert_eq!(lookup("light-goldenrod_yellow"), Some([250, 250, 210]));
+        assert_eq!(lookup(""), None);
+        assert_eq!(lookup("transparent"), None);
+        assert_eq!(lookup("reddish"), None);
+        assert_eq!(lookup("rédé"), None);
+        assert_eq!(lookup(&"a".repeat(10_000)), None);
+    }
+}

crates/color/src/tests.rs

@@ -17,6 +17,23 @@ fn css_parsing() {
     assert_eq!(Color::parse_css("rgba(0 0 255 / 50%)").unwrap().to_rgba8(), [0, 0, 255, 128]);
     assert_eq!(Color::parse_css("hsl(120, 100%, 50%)").unwrap().to_hex(), "00FF00");
     assert_eq!(Color::parse_css("white").unwrap(), Color::WHITE);
+    assert_eq!(Color::parse_css("RebeccaPurple").unwrap().to_hex(), "663399");
+    assert_eq!(Color::parse_css("transparent").unwrap(), Color::TRANSPARENT);
+}
+
+#[test]
+fn colour_fields_take_names() {
+    assert_eq!(Color::from_hex_or_name("red").unwrap().to_css_hex(), "#FF0000");
+    assert_eq!(Color::from_hex_or_name(" Cornflower Blue ").unwrap().to_hex(), "6495ED");
+    assert_eq!(Color::from_hex_or_name("darkblue").unwrap().to_rgba8(), [0, 0, 139, 255]);
+    // Hex wins: every digit string still reads as hex.
+    assert_eq!(Color::from_hex_or_name("abc").unwrap().to_hex(), "AABBCC");
+    assert_eq!(Color::from_hex_or_name("#0D99FF").unwrap().to_hex(), "0D99FF");
+    // Names are opaque; `transparent` is not a field colour.
+    assert!(Color::from_hex_or_name("transparent").is_none());
+    for junk in ["", "#", "redd", "re d d", "12345", "\u{0}", "🟥", &"x".repeat(100_000)] {
+        assert!(Color::from_hex_or_name(junk).is_none(), "{junk:?}");
+    }
 }
 
 #[test]

crates/doc/src/geometry.rs

@@ -51,6 +51,10 @@ pub fn is_closed(n: &Node) -> bool {
     }
 }
 
+/// How much further than `tol` a stroke with nothing filled reaches: a thin line or stroke-only path
+/// is hard to land on with the plain tolerance, so it gets a wider band (5 screen px for the usual 2 px tolerance).
+const STROKE_REACH: f64 = 2.5;
+
 /// Whether `pt` hits `n` itself; in `outline` mode (nothing filled on the canvas) a shape only where
 /// its outline is.
 fn hits_node_itself(doc: &Document, id: NodeId, n: &Node, pt: Point, tol: f64, outline: bool) -> bool {
@@ -62,7 +66,7 @@ fn hits_node_itself(doc: &Document, id: NodeId, n: &Node, pt: Point, tol: f64, o
         NodeKind::Group | NodeKind::BooleanOp { .. } | NodeKind::Page { .. } => false,
         NodeKind::Text(_) | NodeKind::Slice => n.local_rect().inflate(tol_l, tol_l).contains(lp),
         NodeKind::Line => {
-            let half = (n.stroke.weight / 2.0).max(tol_l);
+            let half = (n.stroke.weight / 2.0).max(tol_l * STROKE_REACH);
             lp.x >= -half && lp.x <= n.width + half && lp.y.abs() <= half
         }
         NodeKind::Frame | NodeKind::Component { .. } | NodeKind::ComponentSet { .. } | NodeKind::Instance { .. } | NodeKind::Section { .. } => {
@@ -78,7 +82,9 @@ fn hits_path(n: &Node, path: &BezPath, lp: Point, tol: f64, inside: bool) -> boo
     if inside && (n.fills.iter().any(|f| f.visible) || !n.has_visible_stroke()) {
         return true;
     }
-    let reach = (n.stroke.max_weight() / 2.0).max(tol);
+    // Only a stroke with nothing filled gets the wider band: a filled shape's edge keeps the plain one.
+    let stroke_only = n.has_visible_stroke() && !n.fills.iter().any(|f| f.visible);
+    let reach = (n.stroke.max_weight() / 2.0).max(if stroke_only { tol * STROKE_REACH } else { tol });
     if !path.bounding_box().inflate(reach, reach).contains(lp) {
         return false;
     }

crates/doc/src/lib.rs

@@ -77,17 +77,19 @@ pub enum DocError {
 
 pub type DocResult<T> = Result<T, DocError>;
 
-/// The set of touched node ids, and whether any layer is a mask (worked out when first asked
-/// after a change: hit testing skips its mask checks without one). Never part of equality or
+/// The set of touched node ids, whether any layer is a mask (hit testing skips its mask checks
+/// without one) and the largest background blur radius (renders keep that much overlap between
+/// their bands), both worked out when first asked after a change. Never part of equality or
 /// serialisation.
 #[derive(Clone, Debug, Default)]
-pub struct Dirty(pub std::collections::BTreeSet<NodeId>, std::sync::OnceLock<bool>);
+pub struct Dirty(pub std::collections::BTreeSet<NodeId>, std::sync::OnceLock<bool>, std::sync::OnceLock<f64>);
 
 impl Dirty {
     /// Record node `id` as touched (edited, added or removed).
     fn touch(&mut self, id: NodeId) {
         self.0.insert(id);
         self.1 = std::sync::OnceLock::new();
+        self.2 = std::sync::OnceLock::new();
     }
 }
 
@@ -254,6 +256,11 @@ impl Document {
         *self.dirty.1.get_or_init(|| self.nodes.values().any(|n| n.is_mask))
     }
 
+    /// The largest background blur or glass radius of any layer's effects (0 without any).
+    pub fn max_backdrop_radius(&self) -> f64 {
+        *self.dirty.2.get_or_init(|| self.nodes.values().flat_map(|n| n.effects.iter()).map(Effect::backdrop_radius).fold(0.0, f64::max))
+    }
+
     /// Node ids touched so far (without clearing).
     pub fn dirty(&self) -> &std::collections::BTreeSet<NodeId> {
         &self.dirty.0
@@ -781,6 +788,23 @@ impl Document {
         self.paste_nodes(&src_nodes, &map, id, parent, index)
     }
 
+    /// Deep-copy each of `ids`' subtrees to the end of `parent`, in order, returning the new root
+    /// ids. One id map covers every copy, so references between the copied subtrees (a navigation
+    /// from one copied frame to another) point at the copies.
+    pub fn duplicate_all_into(&mut self, ids: &[NodeId], parent: NodeId) -> DocResult<Vec<NodeId>> {
+        let mut map = BTreeMap::new();
+        let mut trees = Vec::with_capacity(ids.len());
+        for &id in ids {
+            let src_nodes: Vec<Node> = self.subtree(id).into_iter().filter_map(|i| self.node(i).cloned()).collect();
+            for n in &src_nodes {
+                let nid = self.alloc_id();
+                map.insert(n.id, nid);
+            }
+            trees.push((id, src_nodes));
+        }
+        trees.into_iter().map(|(id, src_nodes)| self.paste_nodes(&src_nodes, &map, id, parent, None)).collect()
+    }
+
     /// Insert copies of `nodes` (a subtree rooted at `root`, from this or another document) with ids
     /// remapped by `map`. Interactions, instance references and pattern sources pointing inside the
     /// subtree are remapped too.
@@ -1100,8 +1124,14 @@ impl Document {
     /// mask with the layers above it up to the next mask, or a single layer. An auto layout frame
     /// whose first child paints on top paints the runs in reverse (see [`Node::paint_order`]).
     pub fn paint_runs(&self, n: &Node) -> Vec<std::ops::Range<usize>> {
-        let kids = &n.children;
-        let node = |i: usize| kids.get(i).and_then(|k| self.node(*k));
+        let kids: Vec<Option<&Node>> = n.children.iter().map(|k| self.node(*k)).collect();
+        Self::paint_runs_of(&kids, n.layout.as_ref().is_some_and(|l| l.reverse_z))
+    }
+
+    /// [`Self::paint_runs`] of children already looked up (`None`: not in the document), last run
+    /// first when `reverse_z`.
+    pub fn paint_runs_of(kids: &[Option<&Node>], reverse_z: bool) -> Vec<std::ops::Range<usize>> {
+        let node = |i: usize| kids.get(i).copied().flatten();
         let mut runs = Vec::new();
         let mut i = 0;
         while i < kids.len() {
@@ -1114,7 +1144,7 @@ impl Document {
             runs.push(i..j);
             i = j;
         }
-        if n.layout.as_ref().is_some_and(|l| l.reverse_z) {
+        if reverse_z {
             runs.reverse();
         }
         runs

crates/doc/src/proto_expr.rs

@@ -143,7 +143,7 @@ impl Expr {
             return "…".into();
         }
         match self {
-            Expr::Value(VariableValue::Alias(id)) => vars.get(id).map_or_else(|| "(missing variable)".into(), |v| v.name.clone()),
+            Expr::Value(VariableValue::Alias(id)) => vars.get(id).map_or_else(|| "(missing variable)".into(), |v| var_ref(vars, v)),
             Expr::Value(VariableValue::String(s)) => quote(s),
             // Exact numbers and `#` colours, so the text reads back as the same expression.
             Expr::Value(VariableValue::Number(n)) => format!("{n}"),
@@ -178,6 +178,18 @@ impl Expr {
     }
 }
 
+/// A variable as written in an expression: its bare name when that reads back as this variable,
+/// otherwise `{name}` (or `{id}` when even the braced name wouldn't), so names like `1`, `2x` or
+/// `"q"` don't read back as literals or errors.
+fn var_ref(vars: &Variables, v: &crate::Variable) -> String {
+    let this = Expr::var(v.id.clone());
+    if Expr::parse(&v.name, vars).is_ok_and(|e| e == this) {
+        return v.name.clone();
+    }
+    let braced = !v.name.contains('}') && v.name.trim() == v.name && vars.get(&v.name).is_some_and(|x| x.id == v.id);
+    if braced { format!("{{{}}}", v.name) } else { format!("{{{}}}", v.id) }
+}
+
 /// A collection or mode name as written inside `mode(…)` or `[…]`: as it is, or quoted when it has
 /// spaces at its ends, quotes or brackets.
 fn name_arg(name: &str) -> String {

crates/doc/src/proto_expr_parse_tests.rs

@@ -176,3 +176,22 @@ fn hostile_text_is_bounded() {
         }
     }
 }
+
+#[test]
+fn names_that_look_like_literals_read_back_as_variables() {
+    for name in ["count", "count total", "2x", "1", "-3", ".5", "(x)", "#ff", "\"q\"", "not", "true"] {
+        let mut v = vars();
+        if let Some(var) = v.variables.iter_mut().find(|x| x.id == "n") {
+            var.name = name.into();
+        }
+        for e in [Expr::var("n"), Expr::op(ExprOp::Add, vec![Expr::var("n"), n(1.0)]), Expr::InMode { variable: "n".into(), mode: "dark".into() }] {
+            let shown = e.display(&v);
+            assert_eq!(Expr::parse(&shown, &v), Ok(e.clone()), "{name:?} shown as {shown:?}");
+        }
+    }
+    // Plain names stay bare, and literals still read as literals.
+    let v = vars();
+    assert_eq!(Expr::var("n").display(&v), "n-name");
+    assert_eq!(parse("1"), n(1.0));
+    assert_eq!(parse("\"q\""), Expr::Value(VariableValue::String("q".into())));
+}

crates/doc/src/tests.rs

@@ -168,6 +168,27 @@ fn text_runs_restyle_and_replace() {
     assert_eq!(t.characters, "");
 }
 
+/// A run that reaches past the text (a file can carry one: nothing clamps `runs` on load)
+/// must not overflow the arithmetic that shifts the runs along, and must not leave the
+/// text unwritable.
+#[test]
+fn text_runs_past_the_text_never_overflow() {
+    let style = || TextStyle { font_style: "Bold".into(), ..Default::default() };
+    for end in [usize::MAX, usize::MAX - 1, 1_000_000] {
+        let mut t = TextData::new("hi");
+        t.runs = vec![StyleRun { start: 0, end, style: style() }];
+        // Typing at the caret, and replacing a selection: both shift `end`.
+        t.replace_range(0, 0, "x");
+        assert_eq!(t.characters, "xhi", "end {end}");
+        t.replace_range(0, 3, "yo");
+        assert_eq!(t.characters, "yo", "end {end}");
+        // The text is still writable and the runs are back inside it.
+        t.replace_range(0, 0, "!");
+        assert_eq!(t.characters, "!yo", "end {end}");
+        assert!(t.runs.iter().all(|r| r.start < r.end && r.end <= t.char_count()), "end {end}: {:?}", t.runs);
+    }
+}
+
 #[test]
 fn text_case() {
     assert_eq!(TextCase::Title.apply("hello big world"), "Hello Big World");
@@ -381,3 +402,65 @@ fn custom_easings() {
     assert_eq!(back, Easing::CustomSpring { mass: 2.0, stiffness: 50.0, damping: 5.0 });
     assert_eq!(serde_json::from_value::<Easing>(serde_json::json!("easeInOut")).unwrap(), Easing::EaseInOut);
 }
+
+#[test]
+fn text_style_updates_merge_equal_runs() {
+    let def = TextStyle { font_size: 14.0, ..Default::default() };
+    let mut t = TextData::new("abcd");
+    t.link_text_style(0, 2, &def, "S");
+    t.link_text_style(2, 4, &def, "S");
+    t.restyle(2, 4, |s| s.font_size = 24.0);
+    assert_eq!(t.runs.len(), 2);
+    t.update_text_style("S", &TextStyle { font_size: 24.0, ..def.clone() });
+    let spans = t.spans();
+    assert_eq!(spans.len(), 1);
+    assert_eq!((spans[0].0, spans[0].1), (0, 4));
+    assert_eq!(spans[0].2.font_size, 24.0);
+    assert_eq!(spans[0].2.style_id.as_deref(), Some("S"));
+
+    // Remapping two links to one id merges the runs.
+    let mut t = TextData::new("ab");
+    t.link_text_style(0, 1, &def, "A");
+    t.link_text_style(1, 2, &def, "B");
+    t.map_text_styles(|_| Some("C".into()));
+    assert_eq!(t.spans().len(), 1);
+    assert_eq!(t.style_at(1).style_id.as_deref(), Some("C"));
+
+    // Different values stay separate.
+    let mut t = TextData::new("ab");
+    t.link_text_style(0, 1, &def, "A");
+    t.link_text_style(1, 2, &TextStyle { font_size: 30.0, ..Default::default() }, "B");
+    t.map_text_styles(|_| Some("C".into()));
+    let spans = t.spans();
+    assert_eq!(spans.len(), 2);
+    assert_eq!((spans[0].2.font_size, spans[1].2.font_size), (14.0, 30.0));
+
+    // Unlinking a run equal to the base drops it.
+    let mut t = TextData::new("ab");
+    let base = t.style.clone();
+    t.link_text_style(0, 1, &base, "S");
+    t.map_text_styles(|_| None);
+    assert!(t.runs.is_empty());
+}
+
+#[test]
+fn text_style_empty_range_links_and_unlinks_all() {
+    let def = TextStyle { font_style: "Bold".into(), ..Default::default() };
+    let mut t = TextData::new("abcd");
+    t.link_text_style(2, 2, &def, "S");
+    assert!((0..4).all(|i| t.style_at(i).style_id.as_deref() == Some("S") && t.style_at(i).font_style == "Bold"));
+    t.unlink_text_style(2, 2);
+    assert!((0..4).all(|i| t.style_at(i).style_id.is_none() && t.style_at(i).font_style == "Bold"));
+    // Partial ranges stay partial.
+    t.link_text_style(0, 4, &def, "S");
+    t.unlink_text_style(1, 3);
+    assert_eq!(t.style_at(0).style_id.as_deref(), Some("S"));
+    assert!(t.style_at(1).style_id.is_none() && t.style_at(2).style_id.is_none());
+    assert_eq!(t.style_at(3).style_id.as_deref(), Some("S"));
+    // Empty text changes the base style.
+    let mut e = TextData::new("");
+    e.link_text_style(0, 0, &def, "S");
+    assert_eq!(e.style.style_id.as_deref(), Some("S"));
+    e.unlink_text_style(0, 0);
+    assert!(e.style.style_id.is_none());
+}

crates/doc/src/text.rs

@@ -215,6 +215,10 @@ pub struct ParaList {
     pub list: ListStyle,
     /// Nesting level (0 = outermost; plain paragraphs are always 0).
     pub indent: u8,
+    /// A numbered list that starts counting at this paragraph counts from `start_offset + 1`
+    /// (items that go on counting ignore it; other paragraphs are always 0).
+    #[serde(skip_serializing_if = "crate::node::is_default")]
+    pub start_offset: u32,
 }
 
 /// Character style. In runs, every field is an override; `None` means "inherit the base".
@@ -562,7 +566,7 @@ impl TextData {
         }
     }
 
-    /// Drop empty/out-of-range runs and runs equal to the base style.
+    /// Drop empty/out-of-range runs and runs equal to the base style, and merge touching equal runs.
     pub fn normalize(&mut self) {
         let n = self.char_count();
         let base = self.style.clone();
@@ -571,6 +575,14 @@ impl TextData {
             r.end = r.end.min(n);
         }
         self.runs.sort_by_key(|r| r.start);
+        let mut merged: Vec<StyleRun> = Vec::with_capacity(self.runs.len());
+        for r in std::mem::take(&mut self.runs) {
+            match merged.last_mut() {
+                Some(prev) if prev.end == r.start && prev.style == r.style => prev.end = r.end,
+                _ => merged.push(r),
+            }
+        }
+        self.runs = merged;
     }
 
     /// Replace chars `start..end` with `text`, shifting runs (inserted text takes the style at `start`).
@@ -602,7 +614,9 @@ impl TextData {
                 if p <= start {
                     p
                 } else if p >= end {
-                    p - removed + inserted
+                    // Runs of a file that reach past the text (nothing clamps them on load)
+                    // would otherwise overflow here; `normalize` below drops what is left.
+                    p.saturating_sub(removed).saturating_add(inserted)
                 } else {
                     start + inserted
                 }
@@ -627,13 +641,13 @@ impl TextData {
 
     /// Paragraph `p`'s list settings.
     pub fn para_list(&self, p: usize) -> ParaList {
-        self.paragraphs.get(p).copied().unwrap_or(ParaList { list: self.list, indent: 0 })
+        self.paragraphs.get(p).copied().unwrap_or(ParaList { list: self.list, ..ParaList::default() })
     }
 
     /// Spell out every paragraph's list settings in `paragraphs` (and drop extra entries).
     fn fill_paragraphs(&mut self) {
         let n = self.paragraph_count();
-        let fill = ParaList { list: self.list, indent: 0 };
+        let fill = ParaList { list: self.list, ..ParaList::default() };
         self.paragraphs.resize(n, fill);
     }
 
@@ -647,17 +661,23 @@ impl TextData {
     }
 
     /// Apply `f` to the list settings of the paragraphs chars `start..end` touch (plain
-    /// paragraphs stay at level 0, levels stop at [`MAX_LIST_INDENT`]); one style for all with
-    /// no nesting folds back into `list`.
+    /// paragraphs stay at level 0, only numbered ones keep a start, levels stop at
+    /// [`MAX_LIST_INDENT`]); one style for all with no nesting or start folds back into `list`.
     pub fn set_para_lists(&mut self, start: usize, end: usize, f: impl Fn(&mut ParaList)) {
         let (a, b) = self.para_span(start, end);
         self.fill_paragraphs();
         for pl in self.paragraphs.get_mut(a..=b).unwrap_or(&mut []) {
             f(pl);
-            pl.indent = if pl.list == ListStyle::None { 0 } else { pl.indent.min(MAX_LIST_INDENT) };
+            if pl.list == ListStyle::None {
+                pl.indent = 0;
+            }
+            if pl.list != ListStyle::Numbered {
+                pl.start_offset = 0;
+            }
+            pl.indent = pl.indent.min(MAX_LIST_INDENT);
         }
         if let Some(first) = self.paragraphs.first().copied()
-            && first.indent == 0
+            && first == (ParaList { list: first.list, ..ParaList::default() })
             && self.paragraphs.iter().all(|p| *p == first)
         {
             self.list = first.list;
@@ -665,21 +685,24 @@ impl TextData {
         }
     }
 
-    /// The list settings shared by the paragraphs chars `start..end` touch, or None when they differ.
+    /// The list style and level shared by the paragraphs chars `start..end` touch (the first
+    /// one's settings), or None when they differ. Start numbers don't count.
     pub fn common_para_list(&self, start: usize, end: usize) -> Option<ParaList> {
         let (a, b) = self.para_span(start, end);
         let first = self.para_list(a);
-        (a..=b).all(|p| self.para_list(p) == first).then_some(first)
+        (a..=b).all(|p| self.para_list(p).list == first.list && self.para_list(p).indent == first.indent).then_some(first)
     }
 
     /// Link chars `start..end` (all of them when the range is empty or the whole text) to text
     /// style `id`, defined as `def`.
     pub fn link_text_style(&mut self, start: usize, end: usize, def: &TextStyle, id: &str) {
+        let (start, end) = if start == end { (0, self.char_count()) } else { (start, end) };
         self.restyle(start, end, |s| s.take_text_style(def, id));
     }
 
     /// Unlink chars `start..end` (all when empty or whole) from their text styles; values stay.
     pub fn unlink_text_style(&mut self, start: usize, end: usize) {
+        let (start, end) = if start == end { (0, self.char_count()) } else { (start, end) };
         self.restyle(start, end, |s| s.style_id = None);
     }
 
@@ -770,4 +793,29 @@ mod case_tests {
         assert_eq!(st.variations.keys().collect::<Vec<_>>(), ["wdth"]);
         assert!(valid_axis_tag("wght") && !valid_axis_tag("weight"));
     }
+
+    #[test]
+    fn list_starts_load_from_old_files_and_follow_edits() {
+        use ListStyle::{Bulleted as B, None as P, Numbered as N};
+        // Files written before start numbers load with none, and write the same bytes.
+        let old = r#"{"list":"numbered","indent":1}"#;
+        let pl: ParaList = serde_json::from_str(old).unwrap();
+        assert_eq!(pl, ParaList { list: N, indent: 1, start_offset: 0 });
+        assert_eq!(serde_json::to_string(&pl).unwrap(), old);
+        // One numbered paragraph with a start keeps it (it doesn't fold into `list`).
+        let mut t = TextData { characters: "Next".into(), ..Default::default() };
+        t.set_para_lists(0, 0, |p| *p = ParaList { list: N, indent: 0, start_offset: 1 });
+        assert_eq!(t.para_list(0), ParaList { list: N, indent: 0, start_offset: 1 });
+        // Enter copies it to the new item; different starts don't make the list mixed.
+        t.replace_range(4, 4, "\nMore");
+        assert_eq!(t.para_list(1).start_offset, 1);
+        t.set_para_lists(5, 5, |p| p.start_offset = 0);
+        assert!(t.common_para_list(0, t.char_count()).is_some_and(|p| p.list == N));
+        // Bullets have no number, so no start.
+        t.set_para_lists(0, 0, |p| *p = ParaList { list: B, indent: 1, start_offset: 4 });
+        assert_eq!(t.para_list(0), ParaList { list: B, indent: 1, start_offset: 0 });
+        // A plain paragraph has none.
+        t.set_para_lists(0, 0, |p| p.list = P);
+        assert_eq!(t.para_list(0), ParaList::default());
+    }
 }

crates/doc/src/vector.rs

@@ -468,9 +468,9 @@ impl VectorNetwork {
         start_dir(&self.outward(seg, at_a)?)
     }
 
-    /// Whether any point has a stroke cap or join of its own.
-    pub fn has_point_styles(&self) -> bool {
-        self.vertices.iter().any(|v| v.cap.is_some() || v.join.is_some())
+    /// Whether any point has a stroke cap of its own or a join other than the layer's `layer_join`.
+    pub fn has_point_styles(&self, layer_join: StrokeJoin) -> bool {
+        self.vertices.iter().any(|v| v.cap.is_some() || v.join.is_some_and(|j| j != layer_join))
     }
 
     /// The fill path: every region's loops.

crates/doc/src/vector_faces.rs

@@ -136,8 +136,8 @@ impl VectorNetwork {
         }
         let k = key(&face.loops);
         match (self.regions.iter().position(|r| key(&r.loops) == k), want) {
-            (Some(i), None | Some(false)) => {
-                self.regions.remove(i);
+            (Some(_), None | Some(false)) => {
+                self.regions.retain(|r| key(&r.loops) != k);
                 Some(false)
             }
             (Some(_), Some(true)) => Some(true),
@@ -525,4 +525,21 @@ mod tests {
         let _ = j.paint(Point::new(f64::NAN, 5.0));
         assert!(interior_point(&BezPath::new()).is_none());
     }
+
+    #[test]
+    fn the_bucket_unfills_a_face_with_duplicate_regions_in_one_click() {
+        let c = Point::new(50.0, 50.0);
+        let mut n = square(0.0, 0.0, 100.0);
+        n.regions.push(n.regions[0].clone());
+        assert_eq!(n.paint(c), Some(false));
+        assert!(!n.fill_contains(c));
+        assert_eq!(n.region_at(c), None);
+        assert_eq!(n.paint(c), Some(true));
+        assert!(n.fill_contains(c));
+
+        let mut e = square(0.0, 0.0, 100.0);
+        e.regions.push(e.regions[0].clone());
+        assert_eq!(e.paint_to(c, Some(false)), Some(false));
+        assert!(!e.fill_contains(c));
+    }
 }

crates/doc/src/vector_regions.rs

@@ -18,8 +18,9 @@ impl VectorNetwork {
     /// second; a segment that doesn't touch the point reached so far (a malformed loop) is taken
     /// as stored. Missing segments are skipped.
     pub fn loop_walk(&self, lp: &[usize]) -> Vec<(usize, bool)> {
-        let Some(first) = lp.first().and_then(|i| self.segments.get(*i)) else { return Vec::new() };
-        let forward_first = match lp.get(1).and_then(|i| self.segments.get(*i)) {
+        let mut existing = lp.iter().filter_map(|i| self.segments.get(*i));
+        let Some(first) = existing.next() else { return Vec::new() };
+        let forward_first = match existing.next() {
             Some(second) => first.b == second.a || first.b == second.b,
             None => true,
         };
@@ -102,10 +103,18 @@ impl VectorNetwork {
         (0..self.regions.len()).rev().find(|r| self.region_contains(*r, p))
     }
 
-    /// Every point on region `r`'s loops (holes' too), each once, sorted.
+    /// Every point on region `r`'s loops (holes' too), each once, sorted (segments or points that
+    /// don't exist are left out).
     pub fn region_points(&self, r: usize) -> Vec<usize> {
         let Some(region) = self.regions.get(r) else { return Vec::new() };
-        let mut out: Vec<usize> = region.loops.iter().flatten().filter_map(|i| self.segments.get(*i)).flat_map(|s| [s.a, s.b]).collect();
+        let mut out: Vec<usize> = region
+            .loops
+            .iter()
+            .flatten()
+            .filter_map(|i| self.segments.get(*i))
+            .flat_map(|s| [s.a, s.b])
+            .filter(|v| *v < self.vertices.len())
+            .collect();
         out.sort_unstable();
         out.dedup();
         out

crates/doc/src/vector_regions_tests.rs

@@ -148,6 +148,28 @@ fn a_loop_that_does_not_close_is_closed_implicitly() {
     assert_eq!(n.region_at(p(300.0, 100.0)), None);
 }
 
+#[test]
+fn missing_segments_are_skipped_wherever_they_sit_in_a_loop() {
+    use figcraft_geom::Shape;
+    let mut n = VectorNetwork::default();
+    square(&mut n, 0.0, 0.0, 200.0);
+    n.regions = vec![region(vec![vec![0, 1, 2]], WindingRule::NonZero)];
+    let control = n.region_path(0).unwrap();
+    let control_walk = n.loop_walk(&[0, 1, 2]);
+    for lp in [vec![99, 0, 1, 2], vec![0, 99, 1, 2], vec![99, 98, 0, 1, 2]] {
+        n.regions = vec![region(vec![lp.clone()], WindingRule::NonZero)];
+        assert_eq!(n.loop_walk(&lp), control_walk, "{lp:?}");
+        assert_eq!(n.region_at(p(100.0, 100.0)), Some(0), "{lp:?}");
+        assert!(n.region_contains(0, p(100.0, 100.0)), "{lp:?}");
+        let path = n.region_path(0).unwrap();
+        assert_eq!(path.elements().len(), control.elements().len(), "{lp:?}");
+        assert!((path.area().abs() - control.area().abs()).abs() < 1e-6, "{lp:?}");
+    }
+    n.regions = vec![region(vec![vec![99]], WindingRule::NonZero)];
+    assert!(n.region_path(0).is_none());
+    assert!(!n.region_contains(0, p(100.0, 100.0)));
+}
+
 #[test]
 fn a_regions_points_are_listed_once() {
     let mut n = nested();
@@ -186,6 +208,19 @@ fn empty_and_damaged_networks_have_no_regions_and_never_panic() {
     }
 }
 
+#[test]
+fn region_points_leave_out_segment_ends_that_do_not_exist() {
+    let mut n = VectorNetwork::default();
+    let ring = square(&mut n, 0.0, 0.0, 100.0);
+    n.regions = vec![region(vec![ring], WindingRule::NonZero)];
+    assert_eq!(n.region_points(0), vec![0, 1, 2, 3]);
+    n.segments[3] = Segment::line(3, 9);
+    assert_eq!(n.region_points(0), vec![0, 1, 2, 3]);
+    assert!(n.region_path(0).is_some());
+    n.regions = vec![region(vec![vec![99]], WindingRule::NonZero)];
+    assert!(n.region_points(0).is_empty());
+}
+
 #[test]
 fn the_topology_key_ignores_moved_points_but_not_new_segments() {
     let mut n = nested();

crates/engine/src/al_keys_tests.rs

@@ -74,6 +74,27 @@ fn along_the_flow_skips_hidden_and_absolute_siblings() {
     assert_eq!(kids(&s, col), vec![c1, c0], "Right does nothing in a lone column");
 }
 
+#[test]
+fn single_item_wrapped_lines_move_and_drop_by_line() {
+    let mut s = Session::new();
+    // Full-width items: one per row.
+    let row = al(&mut s, None, "horizontal", 160.0, 200.0);
+    set(&mut s, row, json!({"wrap": true}));
+    let k: Vec<NodeId> = (0..2).map(|_| rect(&mut s, row, 160.0, 20.0)).collect();
+    assert_eq!(s.doc().unwrap().world_bounds(k[1]).unwrap().y0, 30.0, "second row");
+    let slot = crate::drop::auto_layout_slot(s.doc().unwrap(), row, figcraft_geom::Point::new(10.0, 35.0), &[]);
+    assert_eq!(slot, Some((1, Some([-2.0, 30.0, -2.0, 50.0]))));
+    arrow(&mut s, &[k[1]], 0, -1);
+    assert_eq!(kids(&s, row), vec![k[1], k[0]]);
+
+    // Full-height items in a vertical wrap: one per column.
+    let col = al(&mut s, None, "vertical", 200.0, 160.0);
+    set(&mut s, col, json!({"wrap": true}));
+    let c: Vec<NodeId> = (0..3).map(|_| rect(&mut s, col, 20.0, 160.0)).collect();
+    arrow(&mut s, &[c[2]], -1, 0);
+    assert_eq!(kids(&s, col), vec![c[0], c[2], c[1]]);
+}
+
 #[test]
 fn wrapped_rows_move_up_and_down_a_row() {
     let mut s = Session::new();

crates/engine/src/cmd/component.rs

@@ -68,7 +68,7 @@ pub fn specs() -> Vec<CommandSpec> {
             let cmd = "instance.create";
             let c = req_id(cmd, p, "component")?;
             let page = s.page()?;
-            let parent = id(p, "parent").unwrap_or(page);
+            let parent = crate::params::opt_id(cmd, p, "parent")?.unwrap_or(page);
             let doc = s.doc_mut()?;
             let c = main_of(doc, c).ok_or_else(|| bad(cmd, "`component` must be a component or component set"))?;
             let (x, y) = match (num(p, "x"), num(p, "y")) {

crates/engine/src/cmd/create.rs

@@ -167,7 +167,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
     let t = string(p, "type").ok_or_else(|| bad(cmd, "`type` is required"))?;
     let (mut kind, base) = kind_for(&t).ok_or_else(|| bad(cmd, format!("unknown type `{t}`")))?;
     let page = s.page()?;
-    let parent = id(p, "parent").unwrap_or(page);
+    let parent = crate::params::opt_id(cmd, p, "parent")?.unwrap_or(page);
     let doc = s.doc()?;
     let pn = doc.get(parent)?;
     if !pn.kind.is_container() {
@@ -216,7 +216,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
         }
     }
     if let NodeKind::Text(td) = &mut kind {
-        td.characters = string(p, "text").or_else(|| string(p, "characters")).unwrap_or_default();
+        td.characters = super::props::normalize_line_endings(&string(p, "text").or_else(|| string(p, "characters")).unwrap_or_default());
         if w > 0.0 {
             td.auto_resize = TextAutoResize::Height;
         }
@@ -255,7 +255,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
         node.width = tw;
         node.height = th;
     }
-    let index = num(p, "index").map(|i| i.max(0.0) as usize);
+    let index = crate::params::opt_index(cmd, p, "index")?;
     doc.insert(node, parent, index)?;
     if let Some(Value::Object(props)) = get(p, "props") {
         super::props::apply(cmd, doc, nid, props)?;
@@ -340,7 +340,7 @@ pub fn place_image(s: &mut Session, p: &Value) -> Result<Value> {
         _ => ImageScaleMode::Fill,
     };
     let page = s.page()?;
-    let parent = id(p, "parent").unwrap_or(page);
+    let parent = crate::params::opt_id(cmd, p, "parent")?.unwrap_or(page);
     let ds = s.ds_mut()?;
     let doc = ds.doc_mut();
     let (hash, iw, ih) = figcraft_format::add_image(doc, bytes).map_err(|e| bad(cmd, e.to_string()))?;

crates/engine/src/cmd/edit.rs

@@ -25,6 +25,13 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("edit.copy", "Copy", "{ids?}", false, copy),
         spec!("edit.cut", "Cut", "{ids?}", true, cut),
         spec!("edit.paste", "Paste", "{parent?, x?, y? (page coordinates of the pasted top-left)}", true, paste),
+        spec!(
+            "edit.pasteDesignLayers",
+            "Paste design layers",
+            "{html (the clipboard's HTML) | data (base64 of the clipboard's design data, at most 256 MB), parent?, x?, y?}  layers copied from another design app (a .fig canvas in the clipboard's HTML), read like a .fig file (best effort, with `warnings`), pasted as edit.paste pastes",
+            true,
+            paste_design_layers
+        ),
         spec!("edit.pasteOver", "Paste over selection", "{}", true, paste_over),
         spec!("edit.pasteReplace", "Paste to replace", "{ids?}", true, paste_replace),
         spec!("edit.copyProperties", "Copy properties", "{id?}", false, copy_props),
@@ -496,9 +503,27 @@ fn bump_name(n: &str) -> String {
 }
 
 /// The copied form of the selection.
-pub fn copy_to_clipboard(s: &mut Session, ids: &[NodeId]) -> Result<()> {
+pub fn copy_to_clipboard(s: &mut Session, cmd: &str, ids: &[NodeId]) -> Result<()> {
     let ds = s.ds()?;
-    let doc = &ds.doc;
+    // Pages are not layers: they can't be pasted anywhere.
+    let layers: Vec<NodeId> = ids.iter().copied().filter(|i| !ds.doc.node(*i).is_some_and(Node::is_page)).collect();
+    if layers.is_empty() && !ids.is_empty() {
+        return Err(EngineError::Disabled(cmd.into(), "pages can't be copied; use page.duplicate".into()));
+    }
+    let (nodes, images, bounds) = copied(&ds.doc, &layers);
+    let (source, source_path, uid) = (ds.doc.clone(), ds.path.clone(), ds.uid);
+    s.clipboard.source = Some(source);
+    s.clipboard.source_path = source_path;
+    s.clipboard.source_doc = uid;
+    s.clipboard.nodes = nodes;
+    s.clipboard.images = images;
+    s.clipboard.bounds = bounds;
+    Ok(())
+}
+
+type Copied = (Vec<(NodeId, Vec<Node>)>, BTreeMap<String, ImageData>, Option<figcraft_geom::Rect>);
+
+fn copied(doc: &Document, ids: &[NodeId]) -> Copied {
     let ids = z_sorted(doc, &roots(doc, ids));
     let mut nodes = Vec::new();
     let mut images = BTreeMap::new();
@@ -521,28 +546,73 @@ pub fn copy_to_clipboard(s: &mut Session, ids: &[NodeId]) -> Result<()> {
         nodes.push((*i, sub));
     }
     let bounds = doc.bounds_of(&ids);
-    let uid = ds.uid;
-    let source = Some(ds.doc.clone());
-    let source_path = ds.path.clone();
-    s.clipboard.source = source;
-    s.clipboard.source_path = source_path;
-    s.clipboard.nodes = nodes;
-    s.clipboard.images = images;
-    s.clipboard.bounds = bounds;
-    s.clipboard.source_doc = uid;
-    Ok(())
+    (nodes, images, bounds)
+}
+
+/// The markers around the copied layers in the clipboard's HTML, spelt as that format spells them.
+pub const CLIP_OPEN: &str = "(figma)";
+pub const CLIP_CLOSE: &str = "(/figma)";
+/// Largest design data read from the clipboard: the `.fig` import's own canvas cap (256 MB). Its
+/// base64 is checked first, so neither the text nor the decoded bytes can pass it.
+const MAX_CLIP_DATA: usize = 256 * 1024 * 1024;
+const MAX_CLIP_BASE64: usize = MAX_CLIP_DATA.div_ceil(3) * 4;
+
+/// Base64 `text` (whitespace ignored, padding optional) when it fits [`MAX_CLIP_DATA`].
+fn clip_base64(text: &str) -> Option<Vec<u8>> {
+    use base64::Engine as _;
+    if text.bytes().filter(|b| !b.is_ascii_whitespace()).count() > MAX_CLIP_BASE64 {
+        return None;
+    }
+    let b64: String = text.chars().filter(|c| !c.is_ascii_whitespace()).collect();
+    base64::engine::general_purpose::STANDARD.decode(&b64).or_else(|_| base64::engine::general_purpose::STANDARD_NO_PAD.decode(&b64)).ok()
+}
+
+/// Layers copied from another design app travel in the clipboard's HTML as a `.fig` canvas in
+/// base64 between [`CLIP_OPEN`] and [`CLIP_CLOSE`]. This gives those bytes, or `None` when the HTML
+/// holds no readable design data (it may just mention the marker).
+pub fn design_clipboard_buffer(html: &str) -> Option<Vec<u8>> {
+    let start = html.find(CLIP_OPEN)? + CLIP_OPEN.len();
+    let len = html.get(start..)?.find(CLIP_CLOSE)?;
+    let bytes = clip_base64(html.get(start..start + len)?)?;
+    figcraft_format::fig::is_fig(&bytes).then_some(bytes)
+}
+
+fn paste_design_layers(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "edit.pasteDesignLayers";
+    let bytes = match (string(p, "html"), string(p, "data")) {
+        (Some(html), _) => design_clipboard_buffer(&html).ok_or_else(|| bad(CMD, "the HTML holds no copied design layers"))?,
+        (None, Some(d)) => clip_base64(&d).ok_or_else(|| bad(CMD, "`data` is not base64 of at most 256 MB"))?,
+        (None, None) => return Err(bad(CMD, "pass `html` or `data`")),
+    };
+    let other = super::file::load_fig(&bytes, "Pasted layers").ok_or_else(|| bad(CMD, "the data is not copied design layers"))??;
+    let doc = std::sync::Arc::new(other.doc);
+    let tops: Vec<NodeId> = doc.pages.iter().filter_map(|pg| doc.node(*pg)).flat_map(|pg| pg.children.iter().copied()).collect();
+    if tops.is_empty() {
+        return Err(EngineError::Disabled(CMD.into(), "the copied layers came in empty".into()));
+    }
+    let (nodes, images, bounds) = copied(&doc, &tops);
+    let props = s.clipboard.props.take();
+    // No open file has id 0. So paste treats this copy as a copy from a different file.
+    s.clipboard = crate::Clipboard { nodes, images, props, bounds, source_doc: 0, source: Some(doc), source_path: None };
+    let mut out = paste(s, p)?;
+    if !other.issues.is_empty() {
+        out["warnings"] = json!(other.issues);
+    }
+    Ok(out)
 }
 
 fn copy(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("edit.copy", s, p)?;
-    copy_to_clipboard(s, &ids)?;
+    copy_to_clipboard(s, "edit.copy", &ids)?;
     Ok(json!({"copied": s.clipboard.nodes.len()}))
 }
 
 fn cut(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("edit.cut", s, p)?;
-    copy_to_clipboard(s, &ids)?;
-    delete(s, &json!({"ids": ids}))
+    copy_to_clipboard(s, "edit.cut", &ids)?;
+    let doc = s.doc()?;
+    let layers: Vec<NodeId> = ids.into_iter().filter(|i| !doc.node(*i).is_some_and(Node::is_page)).collect();
+    delete(s, &json!({"ids": layers}))
 }
 
 /// Paste the clipboard under `parent` with the copied top-left moved to `at` (page coords).
@@ -1003,7 +1073,8 @@ fn find_replace(s: &mut Session, p: &Value) -> Result<Value> {
     if find.is_empty() {
         return Err(bad("edit.findReplace", "`find` is empty"));
     }
-    let replace = string(p, "replace");
+    // Line breaks stored as the editor stores them (CRLF, CR, U+2028 and U+2029 become LF).
+    let replace = string(p, "replace").map(|r| super::props::normalize_line_endings(&r));
     let names = boolean(p, "layerNames").unwrap_or(false);
     let page = s.page()?;
     let doc = s.doc_mut()?;
@@ -1176,7 +1247,7 @@ fn paint_list(s: &mut Session, p: &Value, fills: bool, add: bool) -> Result<Valu
 fn paint_set(s: &mut Session, p: &Value, fills: bool) -> Result<Value> {
     let cmd = if fills { "fill.set" } else { "stroke.set" };
     let ids = req_targets(cmd, s, p)?;
-    let idx = num(p, "index").map(|x| x.max(0.0) as usize);
+    let idx = opt_index(cmd, p, "index")?;
     let new_paint = match get(p, "paint") {
         Some(v) => Some(paint_of(v).ok_or_else(|| bad(cmd, "invalid paint"))?),
         None => None,

crates/engine/src/cmd/file.rs

@@ -30,7 +30,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "file.open",
             "Open",
-            "{path, variables? (REST: the local variables JSON as an object, JSON text or a path; default `<name>.variables.json` or `variables.json` next to the file)} (.figcraft, .json: FigCraft or REST API file JSON, .fig (best effort), .svg, .png, .jpg …); REST and .fig imports return `warnings`",
+            "{path | data (base64) + name (tells the format; opens as a new unsaved document), variables? (REST: the local variables JSON as an object, JSON text or a path; default `<name>.variables.json` or `variables.json` next to the file)} (.figcraft, .json: FigCraft or REST API file JSON, .fig (best effort), .svg, .png, .jpg …); REST and .fig imports return `warnings`; a file opened anew returns `summary` {name, pages, layers, images} (one that was already open just returns its `index`)",
             false,
             open
         ),
@@ -41,8 +41,20 @@ pub fn specs() -> Vec<CommandSpec> {
             false,
             open_recent
         ),
-        spec!("file.save", "Save", "{path?} (programmatic saves need a path the first time)", false, save),
-        spec!("file.saveAs", "Save as", "{path}", false, save_as),
+        spec!(
+            "file.save",
+            "Save",
+            "{path?} (programmatic saves need a path the first time); a .fig path writes an experimental export copy of the shown document with `warnings`, keeping the native path, unsaved changes and version preview",
+            false,
+            save
+        ),
+        spec!(
+            "file.saveAs",
+            "Save as",
+            "{path} (no extension adds .figcraft); a .fig path writes an experimental export copy of the shown document with `warnings`, keeping the native path, unsaved changes and version preview",
+            false,
+            save_as
+        ),
         spec!(
             "file.export",
             "Export",
@@ -74,7 +86,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "file.import",
             "Import",
-            "{path | data (base64) + name, x?, y?, center? (SVG: centre it on x, y), variables? (REST: the local variables JSON as an object, JSON text or a path)}  SVG becomes an editable frame (shapes, text, gradients, masks, effects; with `warnings` for what it left out), images become image layers, .figcraft, REST API file JSON and .fig pages are appended with their variables and flows (REST and .fig: with `warnings`)",
+            "{path | data (base64) + name, x?, y?, center? (SVG: centre it on x, y), variables? (REST: the local variables JSON as an object, JSON text or a path)}  SVG becomes an editable frame (shapes, text, gradients, masks, effects; with `warnings` for what it left out), images become image layers, .figcraft, REST API file JSON and .fig pages are appended with their variables and flows (REST and .fig: with `warnings`; those return `summary` {name, pages, layers, images} of the file read)",
             true,
             import
         ),
@@ -461,6 +473,11 @@ fn file_stem(path: &str) -> String {
     std::path::Path::new(path).file_stem().and_then(|e| e.to_str()).unwrap_or("Untitled").to_string()
 }
 
+/// The counts the import report shows for a freshly loaded document.
+fn import_summary(doc: &Document) -> Value {
+    json!({"name": doc.name, "pages": doc.pages.len(), "layers": doc.nodes().filter(|n| !n.is_page()).count(), "images": doc.images.len()})
+}
+
 /// Load a document from any supported file (REST API file JSON images come from an `images`
 /// folder next to the file).
 pub fn load(path: &str) -> Result<(Document, Vec<String>)> {
@@ -506,10 +523,8 @@ fn load_with(
             Ok((doc.into(), false))
         }
         _ => {
-            if let Some(r) = figcraft_format::fig::try_import(bytes, &file_stem(name_hint)) {
-                let (mut doc, warnings) = r.map_err(|e| EngineError::Other(e.to_string()))?;
-                link_instances(&mut doc);
-                return Ok((figcraft_format::Loaded { issues: warnings, ..doc.into() }, true));
+            if let Some(r) = load_fig(bytes, &file_stem(name_hint)) {
+                return Ok((r?, true));
             }
             if let Some(r) = figcraft_format::rest::try_import_with(bytes, variables, images) {
                 let (mut doc, warnings) = r.map_err(|e| EngineError::Other(e.to_string()))?;
@@ -525,10 +540,20 @@ fn load_with(
     }
 }
 
+/// Gives `None` when `bytes` are not a `.fig` file. Then other readers can try.
+pub(crate) fn load_fig(bytes: &[u8], name: &str) -> Option<Result<figcraft_format::Loaded>> {
+    let r = figcraft_format::fig::try_import(bytes, name)?;
+    Some(r.map_err(|e| EngineError::Other(e.to_string())).map(|(mut doc, warnings)| {
+        link_instances(&mut doc);
+        figcraft_format::Loaded { issues: warnings, ..doc.into() }
+    }))
+}
+
 /// Link imported instances to their mains (layer sources, overrides found by comparing values),
 /// innermost first so outer instances settle last.
 fn link_instances(doc: &mut Document) {
     crate::style_vars::after_load(doc);
+    super::styles::apply_paint_bindings_on_load(doc);
     let mut insts: Vec<(usize, NodeId)> =
         doc.nodes().filter(|n| matches!(n.kind, NodeKind::Instance { .. })).map(|n| (doc.ancestors(n.id).len(), n.id)).collect();
     insts.sort_by_key(|a| std::cmp::Reverse(a.0));
@@ -653,8 +678,13 @@ fn open_recent(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn open(s: &mut Session, p: &Value) -> Result<Value> {
-    let path = req_string("file.open", p, "path")?;
     let variables = variables_param("file.open", p)?;
+    if string(p, "path").is_none()
+        && let Some(d) = string(p, "data")
+    {
+        return open_data(s, &d, p, variables.as_ref());
+    }
+    let path = req_string("file.open", p, "path")?;
     // Already open: switch to it.
     if let Some(i) = s.docs.iter().position(|d| d.path.as_deref() == Some(path.as_str())) {
         s.active = i;
@@ -672,9 +702,26 @@ fn open(s: &mut Session, p: &Value) -> Result<Value> {
             more => format!("{}: {} problems were repaired or left out while opening it, e.g. {}", file_stem(&path), more.len(), more[0]),
         });
     }
+    let summary = import_summary(&loaded.doc);
     s.docs.push(DocState::new(loaded.doc, native.then_some(path)).with_versions(loaded.versions).with_branches(loaded.branches));
     s.active = s.docs.len() - 1;
-    let mut out = json!({"index": s.active});
+    let mut out = json!({"index": s.active, "summary": summary});
+    out[if warnings { "warnings" } else { "repairs" }] = json!(loaded.issues);
+    Ok(out)
+}
+
+/// [`open`] for a file given as base64 `data` (a file dropped without a path on disk): `name` tells
+/// the format. It opens as a new document with no path, so the first save asks where to put it.
+fn open_data(s: &mut Session, data: &str, p: &Value, variables: Option<&Value>) -> Result<Value> {
+    let name = req_string("file.open", p, "name")?;
+    let data = data.split_once(',').map_or(data, |(_, b)| b);
+    let bytes = base64::engine::general_purpose::STANDARD.decode(data.trim()).map_err(|e| bad("file.open", e.to_string()))?;
+    let (loaded, rest) = load_with(&bytes, &name, variables, &figcraft_format::rest::no_images)?;
+    let warnings = rest || ext(&name) == "svg";
+    let summary = import_summary(&loaded.doc);
+    s.docs.push(DocState::new(loaded.doc, None).with_versions(loaded.versions).with_branches(loaded.branches));
+    s.active = s.docs.len() - 1;
+    let mut out = json!({"index": s.active, "summary": summary});
     out[if warnings { "warnings" } else { "repairs" }] = json!(loaded.issues);
     Ok(out)
 }
@@ -775,8 +822,20 @@ fn color_profile(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"profile": profile.id(), "changed": changed}))
 }
 
-/// Save the file of the active tab (the main file for a branch tab, with its branches).
+/// Native saves act on the current document; a `.fig` copy exports the version shown, and a
+/// pending Save As choice must leave it shown until its destination is known.
+pub(crate) fn save_ends_preview(s: &Session, cmd: &str, p: &Value) -> bool {
+    let path =
+        string(p, "path").or_else(|| if cmd == "file.save" { s.docs.get(crate::branches::file_tab(s)).and_then(|ds| ds.path.clone()) } else { None });
+    path.is_some_and(|path| ext(&path) != "fig")
+}
+
+/// Save the file of the active tab (the main file for a branch tab, with its branches), or export
+/// the active document as an experimental `.fig` copy without changing its native save state.
 fn save_to(s: &mut Session, path: String) -> Result<Value> {
+    if ext(&path) == "fig" {
+        return export_fig(s, &json!({"path": path}));
+    }
     let i = crate::branches::file_tab(s);
     let ds = s.docs.get_mut(i).ok_or(EngineError::NoDocument)?;
     let bytes = file_bytes(ds)?;
@@ -795,6 +854,11 @@ fn save(s: &mut Session, p: &Value) -> Result<Value> {
         return save_to(s, path);
     }
     match s.docs.get(crate::branches::file_tab(s)).ok_or(EngineError::NoDocument)?.path.clone() {
+        // Earlier builds wrote native data under a .fig name: never overwrite that file with an export.
+        Some(path) if ext(&path) == "fig" => {
+            s.request_ui("dialog.saveAs", json!({}));
+            Err(EngineError::Disabled("file.save".into(), "the saved path ends in .fig: choose Save as or pass `path`".into()))
+        }
         Some(path) => save_to(s, path),
         None => {
             s.request_ui("dialog.saveAs", json!({}));
@@ -824,12 +888,21 @@ pub fn export_bytes(doc: &Document, ids: &[NodeId], format: ExportFormat, scale:
 }
 
 /// The page area exporting `ids` with `setting` covers: what they paint (a clipping frame's own
-/// area), or their boxes with "include bounding box" and for slices.
+/// area), or their boxes with "include bounding box" and for slices. Hidden layers paint nothing,
+/// so they take no room next to visible ones (a hidden-only export keeps its own area).
 pub fn export_area(doc: &Document, ids: &[NodeId], setting: &ExportSetting) -> Option<figcraft_geom::Rect> {
+    let any_visible = ids.iter().any(|i| doc.node(*i).is_some_and(|n| n.visible));
     ids.iter()
         .filter_map(|i| {
-            let slice = doc.node(*i).is_some_and(|n| matches!(n.kind, NodeKind::Slice));
-            if setting.include_bounding_box || slice { doc.world_bounds(*i) } else { figcraft_render::export_bounds(doc, *i) }
+            let node = doc.node(*i);
+            let slice = node.is_some_and(|n| matches!(n.kind, NodeKind::Slice));
+            if setting.include_bounding_box || slice {
+                doc.world_bounds(*i)
+            } else if any_visible && node.is_some_and(|n| !n.visible) {
+                None
+            } else {
+                figcraft_render::export_bounds(doc, *i)
+            }
         })
         .reduce(|a, b| a.union(b))
 }
@@ -1206,8 +1279,9 @@ fn import(s: &mut Session, p: &Value) -> Result<Value> {
             };
             let sibling = if variables.is_none() { path.as_deref().and_then(sibling_variables) } else { None };
             let (other, rest) = load_with(&bytes, &name, variables.as_ref().or(sibling.as_ref()), images)?;
+            let summary = import_summary(&other.doc);
             let pages = append_pages(s.doc_mut()?, &other.doc)?;
-            let mut out = json!({"pages": pages});
+            let mut out = json!({"pages": pages, "summary": summary});
             if rest {
                 out["warnings"] = json!(other.issues);
             }
@@ -1243,6 +1317,19 @@ fn append_pages(doc: &mut Document, other: &Document) -> Result<Vec<NodeId>> {
             map.insert(id, doc.alloc_id());
         }
     }
+    // Library copies a .fig import keeps (cached definitions) have no library record to follow:
+    // the layers of its store come along into the store of `doc`. Recorded copies are left to
+    // `merge_store`, which shares them with copies `doc` already has.
+    let cached: Vec<NodeId> = other
+        .library_store()
+        .and_then(|s| other.node(s))
+        .map(|s| s.children.iter().copied().filter(|root| other.libraries.import_of(*root).is_none()).collect())
+        .unwrap_or_default();
+    for root in &cached {
+        for id in other.subtree(*root) {
+            map.insert(id, doc.alloc_id());
+        }
+    }
     let mut new_pages = Vec::new();
     for pg in &other.pages {
         let Some(pn) = other.node(*pg) else { continue };
@@ -1260,6 +1347,13 @@ fn append_pages(doc: &mut Document, other: &Document) -> Result<Vec<NodeId>> {
         }
         new_pages.push(np);
     }
+    if !cached.is_empty() {
+        let store = doc.ensure_library_store();
+        for root in &cached {
+            let nodes: Vec<Node> = other.subtree(*root).into_iter().filter_map(|i| other.node(i).cloned()).collect();
+            doc.paste_nodes(&nodes, &map, *root, store, None)?;
+        }
+    }
     for new in map.values() {
         let src = doc.node(*new).and_then(|n| n.source).and_then(|s| map.get(&s).copied());
         if let (Some(src), Some(n)) = (src, doc.node_mut(*new)) {
@@ -1271,7 +1365,7 @@ fn append_pages(doc: &mut Document, other: &Document) -> Result<Vec<NodeId>> {
 }
 
 fn close(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = num(p, "index").map(|x| x as usize).unwrap_or(s.active);
+    let i = if get(p, "index").is_none() { s.active } else { req_index("file.close", p, "index")? };
     let Some(ds) = s.docs.get(i) else { return Err(bad("file.close", "no such document")) };
     // A branch tab's edits are in its main file already (which then has unsaved changes).
     if ds.branch_of.is_none() && ds.is_dirty() && !boolean(p, "force").unwrap_or(false) {
@@ -1325,6 +1419,70 @@ mod rest_import_tests {
         doc.nodes().find(|n| matches!(n.kind, NodeKind::Instance { .. })).unwrap()
     }
 
+    /// What a .fig import with a cached library component leaves: the main in the hidden store, a
+    /// visible instance of it and a layer linked to the main's layer.
+    fn cached_import() -> Document {
+        let mut doc = Document::new("Cached");
+        let page = doc.first_page().unwrap();
+        let store = doc.ensure_library_store();
+        let main = doc
+            .create(store, NodeKind::Component { description: String::new(), props: Default::default() }, "Cached main", 0.0, 0.0, 20.0, 20.0)
+            .unwrap();
+        let body = doc.create(main, NodeKind::Rectangle, "Body", 0.0, 0.0, 20.0, 20.0).unwrap();
+        let inst =
+            doc.create(page, NodeKind::Instance { component: main, props: Default::default() }, "Cached instance", 0.0, 0.0, 20.0, 20.0).unwrap();
+        let mut copy = doc.node(body).unwrap().clone();
+        copy.id = doc.alloc_id();
+        copy.parent = None;
+        copy.source = Some(body);
+        let copy_id = copy.id;
+        doc.insert(copy, inst, None).unwrap();
+        assert!(doc.is_remote(main) && doc.node(copy_id).unwrap().source == Some(body));
+        doc
+    }
+
+    /// Pasting layers that use a cached main into another document leaves the main behind, as it
+    /// does for other mains that are not published: no link points at a layer of the target.
+    #[test]
+    fn pasting_instances_of_cached_components_leaves_no_dangling_links() {
+        let src = cached_import();
+        let mut doc = Document::new("Target");
+        let page = doc.first_page().unwrap();
+        for i in 0..8 {
+            doc.create(page, NodeKind::Rectangle, &format!("Filler {i}"), 0.0, 0.0, 5.0, 5.0).unwrap();
+        }
+        let inst = src.nodes().find(|n| n.name == "Cached instance").unwrap().id;
+        let ids = src.subtree(inst);
+        let map: std::collections::BTreeMap<NodeId, NodeId> = ids.iter().map(|i| (*i, doc.alloc_id())).collect();
+        let nodes: Vec<Node> = ids.iter().filter_map(|i| src.node(*i).cloned()).collect();
+        doc.paste_nodes(&nodes, &map, inst, page, None).unwrap();
+        crate::library::adopt_pasted(&mut doc, &src, None, &map).unwrap();
+        let pasted = doc.node(map[&inst]).unwrap();
+        let NodeKind::Instance { component, .. } = pasted.kind else { panic!() };
+        assert!(!doc.contains(component), "the main stays behind: {component:?}");
+        assert!(doc.node(pasted.children[0]).unwrap().source.is_none_or(|s| !doc.contains(s)));
+    }
+
+    #[test]
+    fn appending_pages_with_cached_library_components_brings_the_components() {
+        let other = cached_import();
+        let mut doc = Document::new("Target");
+        let page = doc.first_page().unwrap();
+        // Ids of the target that would collide with the other document's store.
+        for i in 0..8 {
+            doc.create(page, NodeKind::Rectangle, &format!("Filler {i}"), 0.0, 0.0, 5.0, 5.0).unwrap();
+        }
+        append_pages(&mut doc, &other).unwrap();
+        assert!(doc.validate().is_empty(), "{:?}", doc.validate());
+        assert!(crate::components::mirror_issues(&doc).is_empty(), "{:?}", crate::components::mirror_issues(&doc));
+        let inst = doc.nodes().find(|n| n.name == "Cached instance").unwrap();
+        let NodeKind::Instance { component, .. } = inst.kind else { panic!() };
+        assert_eq!(doc.node(component).unwrap().name, "Cached main");
+        assert!(doc.is_remote(component), "the main comes along into the store");
+        let layer = doc.node(inst.children[0]).unwrap();
+        assert_eq!(layer.source, doc.node(component).unwrap().children.first().copied());
+    }
+
     #[test]
     fn rest_json_loads_with_linked_instances() {
         let bytes = serde_json::to_vec(&kit()).unwrap();
@@ -1342,6 +1500,25 @@ mod rest_import_tests {
         assert!(thumbnail(&doc).is_some());
     }
 
+    #[test]
+    fn open_takes_data_and_a_name_as_a_new_unsaved_document() {
+        let mut saved = Session::new();
+        saved.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+        let bytes = file_bytes(saved.ds().unwrap()).unwrap();
+        let data = base64::engine::general_purpose::STANDARD.encode(&bytes);
+        let mut s = Session::new();
+        let recent = s.prefs.recent_files.clone();
+        let r = s.execute("file.open", &json!({"data": data, "name": "Dropped.figcraft"})).unwrap();
+        let open = s.docs.len();
+        assert_eq!(r["index"], open - 1, "a document of its own, made active");
+        assert_eq!(s.ds().unwrap().path, None, "no path to save over");
+        assert!(s.doc().unwrap().nodes().any(|n| matches!(n.kind, NodeKind::Rectangle)));
+        assert_eq!(s.prefs.recent_files, recent, "nothing on disk to remember");
+        assert!(s.execute("file.open", &json!({"data": data})).is_err(), "the name tells the format");
+        assert!(s.execute("file.open", &json!({"data": "not base64!", "name": "x.svg"})).is_err());
+        assert_eq!(s.docs.len(), open, "a refused open adds nothing");
+    }
+
     #[test]
     fn open_and_import_rest_json() {
         let dir = std::env::temp_dir().join(format!("figcraft-rest-{}", std::process::id()));

crates/engine/src/cmd/page.rs

@@ -1,5 +1,6 @@
 //! Pages.
 
+use figcraft_doc::proto::Flow;
 use figcraft_doc::*;
 use serde_json::{Value, json};
 
@@ -23,6 +24,15 @@ fn settle(s: &mut Session, cmd: &str) -> crate::Result<()> {
     Ok(())
 }
 
+/// The page a command targets: the explicit `id` (which must be a page) or the open page.
+fn page_target(s: &Session, cmd: &str, p: &Value) -> crate::Result<NodeId> {
+    let Some(target) = id(p, "id") else { return s.page() };
+    if !s.doc()?.pages.contains(&target) {
+        return Err(bad(cmd, format!("{target} is not a page")));
+    }
+    Ok(target)
+}
+
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         spec!("page.add", "Add page", "{name?} (a name starting with a hyphen adds a divider)", true, |s, p| {
@@ -71,13 +81,13 @@ pub fn specs() -> Vec<CommandSpec> {
         }),
         spec!("page.rename", "Rename page", "{id?, name} (an empty page named with a leading hyphen becomes a divider)", true, |s, p| {
             let name = req_string("page.rename", p, "name")?;
-            let id = id(p, "id").unwrap_or(s.page()?);
+            let id = page_target(s, "page.rename", p)?;
             s.doc_mut()?.get_mut(id)?.name = name;
             settle(s, "page.rename")?;
             ok()
         }),
         spec!("page.delete", "Delete page", "{id?}", true, |s, p| {
-            let id = id(p, "id").unwrap_or(s.page()?);
+            let id = page_target(s, "page.delete", p)?;
             s.doc_mut()?.remove(id)?;
             settle(s, "page.delete")?;
             ok()
@@ -87,13 +97,25 @@ pub fn specs() -> Vec<CommandSpec> {
             let doc = s.doc_mut()?;
             let name = format!("Copy of {}", doc.get(src)?.name);
             let np = doc.add_page(&name);
-            if let NodeKind::Page { background, .. } = doc.get(src)?.kind.clone()
-                && let NodeKind::Page { background: b, .. } = &mut doc.get_mut(np)?.kind
+            // One copy with one id map, so navigation between the copied frames points at the copies;
+            // then each layer and its copy (also those in sections), so flows can follow their start frames.
+            let children = doc.get(src)?.children.clone();
+            let copied = doc.duplicate_all_into(&children, np)?;
+            let mut copies = Vec::new();
+            for (c, copy) in children.iter().zip(&copied) {
+                copies.extend(doc.subtree(*c).into_iter().zip(doc.subtree(*copy)));
+            }
+            // The copy keeps the page's colour, flows (pointing at the copied frames), prototype settings and guides.
+            if let NodeKind::Page { background, flows, prototype, guides } = doc.get(src)?.kind.clone()
+                && let NodeKind::Page { background: b, flows: f, prototype: pr, guides: g } = &mut doc.get_mut(np)?.kind
             {
                 *b = background;
-            }
-            for c in doc.get(src)?.children.clone() {
-                doc.duplicate_into(c, np, None)?;
+                *f = flows
+                    .into_iter()
+                    .filter_map(|fl| copies.iter().find(|(old, _)| *old == fl.start).map(|(_, new)| Flow { start: *new, ..fl }))
+                    .collect();
+                *pr = prototype;
+                *g = guides;
             }
             // Keep the new page right after the source.
             if let Some(si) = doc.pages.iter().position(|x| *x == src) {
@@ -117,7 +139,7 @@ pub fn specs() -> Vec<CommandSpec> {
         }),
         spec!("page.setBackground", "Page background", "{id?, color}", true, |s, p| {
             let c = color(p, "color").ok_or_else(|| bad("page.setBackground", "`color` required"))?;
-            let id = id(p, "id").unwrap_or(s.page()?);
+            let id = page_target(s, "page.setBackground", p)?;
             if let NodeKind::Page { background, .. } = &mut s.doc_mut()?.get_mut(id)?.kind {
                 *background = c;
             }
@@ -163,8 +185,11 @@ pub fn specs() -> Vec<CommandSpec> {
             }
             guides.remove(k);
             let ds = s.ds_mut()?;
-            if ds.guide == Some((owner, k)) {
-                ds.guide = None;
+            match ds.guide {
+                Some((o, i)) if o == owner && i == k => ds.guide = None,
+                // A later guide of the same owner moves up one place; keep the selection on it.
+                Some((o, i)) if o == owner && i > k => ds.guide = Some((o, i - 1)),
+                _ => {}
             }
             ok()
         }),

crates/engine/src/cmd/props.rs

@@ -30,6 +30,11 @@ fontVariations / variationSettings ({axis: number}, e.g. {\"wght\": 550, \"wdth\
 arcInner, booleanOperation (a boolean group's operation, or an operand's own; null: the group's), operandOperation (a layer in a boolean \
 group: how it combines with the operands below it; null: the group's), constrainProportions, description, interactions, overflow, pluginData {k: v}";
 
+/// CRLF, bare CR, U+2028 and U+2029 become LF, the only line ending text layout understands (editor insertion does the same).
+pub(crate) fn normalize_line_endings(s: &str) -> String {
+    s.replace("\r\n", "\n").replace(['\r', '\u{2028}', '\u{2029}'], "\n")
+}
+
 /// camelCase object keys → snake_case (accept the inspect/camel forms for serde-backed values).
 pub fn snake(v: &Value) -> Value {
     match v {
@@ -599,7 +604,7 @@ pub fn apply(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Valu
                 let n = doc.get_mut(id)?;
                 let t = text_mut(cmd, n)?;
                 let len = t.char_count();
-                t.replace_range(0, len, &s);
+                t.replace_range(0, len, &normalize_line_endings(&s));
                 n.overrides.insert("characters".into());
             }
             "fontFamily"

crates/engine/src/cmd/structure.rs

@@ -26,10 +26,17 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "object.convertToFrame",
             "Convert to frame",
-            "{ids?} (groups become frames of the same box in place, their layers staying where they are: no fill, not clipping. Frames are left alone; instances, main components and layers inside instances are refused)",
+            "{ids?} (groups become frames of the same box in place, their layers staying where they are: no fill, not clipping; sections become frames that keep their fill and don't clip. Frames are left alone; instances, main components, layers inside instances and sections holding sections are refused)",
             true,
             |s, p| convert(s, p, "object.convertToFrame", true)
         ),
+        spec!(
+            "object.convertToSection",
+            "Convert to section",
+            "{ids?} (frames on the page or in a section become sections in place, keeping their fill and layers; what only a frame has goes: auto layout, clipping, layout grids, guides and scrolling. Sections are left alone; nested frames, instances and main components are refused)",
+            true,
+            convert_to_section
+        ),
         spec!(
             "object.wrapInSection",
             "Wrap in new section",
@@ -199,6 +206,13 @@ fn convert(s: &mut Session, p: &Value, cmd: &'static str, to_frame: bool) -> Res
         let n = doc.get(i)?;
         let refuse = |why: &str| Err(bad(cmd, format!("\"{}\" {why}", n.name)));
         match (&n.kind, to_frame) {
+            // A frame can't hold sections.
+            (NodeKind::Section { .. }, true)
+                if n.children.iter().any(|c| doc.node(*c).is_some_and(|c| matches!(c.kind, NodeKind::Section { .. }))) =>
+            {
+                return refuse("holds sections, which can't go inside a frame: convert those first");
+            }
+            (NodeKind::Section { .. }, true) => todo.push(i),
             (NodeKind::Instance { .. }, _) => return refuse("is an instance: its layers come from its main component (detach it first)"),
             (NodeKind::Component { .. }, _) => return refuse("is a main component, which stays a frame"),
             (NodeKind::Frame | NodeKind::Group, _) if crate::components::owning_instance(doc, i).is_some() => {
@@ -212,12 +226,15 @@ fn convert(s: &mut Session, p: &Value, cmd: &'static str, to_frame: bool) -> Res
     }
     for i in &todo {
         if to_frame {
-            // The group's box as it is; nothing painted or clipped, so the look stays.
+            // The box as it is and nothing clipped, so the look stays: a group has nothing painted, a
+            // section keeps its fill.
             let n = doc.get_mut(*i)?;
+            if matches!(n.kind, NodeKind::Group) {
+                n.fills.clear();
+                n.strokes.clear();
+            }
             n.kind = NodeKind::Frame;
             n.clip = false;
-            n.fills.clear();
-            n.strokes.clear();
             continue;
         }
         let n = doc.get_mut(*i)?;
@@ -242,6 +259,43 @@ fn convert(s: &mut Session, p: &Value, cmd: &'static str, to_frame: bool) -> Res
     Ok(json!({"ids": todo}))
 }
 
+/// Frames on the page or in a section become sections in place (sections only sit there).
+fn convert_to_section(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "object.convertToSection";
+    let ids = req_targets(cmd, s, p)?;
+    let doc = s.doc_mut()?;
+    let mut todo = Vec::new();
+    for i in ids {
+        let n = doc.get(i)?;
+        let refuse = |why: &str| Err(bad(cmd, format!("\"{}\" {why}", n.name)));
+        let on_board = n.parent.and_then(|p| doc.node(p)).is_some_and(|p| p.is_page() || matches!(p.kind, NodeKind::Section { .. }));
+        match &n.kind {
+            NodeKind::Section { .. } => {}
+            NodeKind::Instance { .. } => return refuse("is an instance: its layers come from its main component (detach it first)"),
+            NodeKind::Component { .. } | NodeKind::ComponentSet { .. } => return refuse("is a main component, which stays a frame"),
+            NodeKind::Frame if !on_board => return refuse("is inside a frame or group: only frames on the page or in a section become sections"),
+            NodeKind::Frame => todo.push(i),
+            _ => return refuse("is not a frame"),
+        }
+    }
+    for i in &todo {
+        let n = doc.get_mut(*i)?;
+        n.kind = NodeKind::Section { contents_hidden: false };
+        (n.layout, n.clip, n.overflow) = (None, false, proto::Overflow::None);
+        n.grids.clear();
+        n.guides.clear();
+        n.styles.grid = None;
+        n.bound.retain(|k, _| !k.starts_with("padding") && !matches!(k.as_str(), "gap" | "counterAxisSpacing"));
+        let kids = n.children.clone();
+        for k in kids {
+            // Out of the flow there is nothing to fill or to be absolute against.
+            doc.get_mut(k)?.child_layout.absolute = false;
+        }
+        figcraft_layout::coherent_sizing(doc, *i);
+    }
+    Ok(json!({"ids": todo}))
+}
+
 fn ungroup(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("object.ungroup", s, p)?;
     let doc = s.doc_mut()?;
@@ -309,33 +363,46 @@ fn flatten(s: &mut Session, p: &Value) -> Result<Value> {
     let parent = doc.get(top)?.parent.ok_or_else(|| bad("vector.flatten", "can't flatten a page"))?;
     let index = doc.index_in_parent(top).map(|i| i + 1);
     let pw = doc.world_transform(parent);
-    let mut path = BezPath::new();
-    let mut even = false;
+    let mut net = VectorNetwork::default();
     for i in &ids {
         let Some(n) = doc.node(*i) else { continue };
-        // Booleans flatten to their result; strokes don't get outlined.
-        let Some((mut op, rule)) = (match &n.kind {
-            NodeKind::Group | NodeKind::Frame | NodeKind::Component { .. } | NodeKind::Instance { .. } => figcraft_render::subtree_outline(doc, n, 0),
-            _ => figcraft_render::node_outline(doc, n),
-        }) else {
-            continue;
+        // Vectors keep their own network (open paths and unfilled loops have no fill outline);
+        // booleans flatten to their result; strokes don't get outlined.
+        let mut part = match &n.kind {
+            NodeKind::Vector { network } => network.clone(),
+            _ => {
+                let Some((op, rule)) = (match &n.kind {
+                    NodeKind::Group | NodeKind::Frame | NodeKind::Component { .. } | NodeKind::Instance { .. } => {
+                        figcraft_render::subtree_outline(doc, n, 0)
+                    }
+                    _ => figcraft_render::node_outline(doc, n),
+                }) else {
+                    continue;
+                };
+                let mut part = VectorNetwork::from_path(&op);
+                if rule == figcraft_render::FillRule::EvenOdd {
+                    for r in &mut part.regions {
+                        r.winding = WindingRule::EvenOdd;
+                    }
+                }
+                part
+            }
         };
-        even |= rule == figcraft_render::FillRule::EvenOdd;
         // Into the common parent's space.
-        let w = doc.world_transform(*i);
-        op.apply_affine(pw.inverse() * w);
-        path.extend(op.elements().iter().copied());
+        let all: Vec<usize> = (0..part.vertices.len()).collect();
+        crate::vectoredit::ops::transform_vertices(&mut part, &all, pw.inverse() * doc.world_transform(*i));
+        let (nv, ns) = (net.vertices.len(), net.segments.len());
+        net.vertices.extend(part.vertices);
+        net.segments.extend(part.segments.into_iter().map(|s| Segment { a: s.a + nv, b: s.b + nv, ..s }));
+        net.regions.extend(
+            part.regions.into_iter().map(|r| Region { loops: r.loops.into_iter().map(|l| l.into_iter().map(|s| s + ns).collect()).collect(), ..r }),
+        );
     }
-    if path.elements().is_empty() {
+    let Some(bb) = net.bounds() else {
         return Err(EngineError::Disabled("vector.flatten".into(), "nothing to flatten".into()));
-    }
+    };
     let first = ids.first().and_then(|i| doc.node(*i)).cloned();
-    let bb = path.bounding_box();
-    path.apply_affine(Affine::translate((-bb.x0, -bb.y0)));
-    let mut net = VectorNetwork::from_path(&path);
-    for r in &mut net.regions {
-        r.winding = if even { WindingRule::EvenOdd } else { WindingRule::NonZero };
-    }
+    net.translate(-bb.x0, -bb.y0);
     let vid = doc.alloc_id();
     let name = first.as_ref().map(|f| f.name.clone()).unwrap_or_else(|| "Vector".into());
     let mut v = Node::new(vid, NodeKind::Vector { network: net }, name, bb.width(), bb.height());
@@ -556,6 +623,10 @@ fn offset_path(s: &mut Session, p: &Value) -> Result<Value> {
     for i in req_targets("vector.offset", s, p)? {
         let doc = s.doc_mut()?;
         let n = doc.get(i)?.clone();
+        // A vector can't hold children: leave containers (frames, groups, instances) alone.
+        if !n.children.is_empty() {
+            continue;
+        }
         let Some((path, _)) = figcraft_render::node_outline(doc, &n) else { continue };
         let props = StrokeProps { weight: d.abs() * 2.0, join: StrokeJoin::Round, align: StrokeAlign::Center, ..Default::default() };
         let ring = figcraft_pathops::stroke_center(&path, d.abs() * 2.0, &props);

crates/engine/src/cmd/styles.rs

@@ -112,6 +112,9 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("variable.createCollection", "Create variable collection", "{name, modes? [names]}", true, |s, p| {
             let name = req_string("variable.createCollection", p, "name")?;
             let doc = s.doc_mut()?;
+            if doc.variables.collections.iter().any(|c| c.name == name) {
+                return Err(bad("variable.createCollection", format!("a collection named `{name}` already exists")));
+            }
             let id = doc.new_collection_id();
             let modes: Vec<String> = match get(p, "modes") {
                 Some(Value::Array(a)) => a.iter().filter_map(|m| m.as_str().map(str::to_string)).collect(),
@@ -910,6 +913,24 @@ pub fn apply_bindings(doc: &mut Document) {
 
 /// [`apply_bindings`] for the layers `only` (every bound layer when `None`).
 pub fn apply_bindings_to(doc: &mut Document, only: Option<&std::collections::BTreeSet<NodeId>>) {
+    apply_bindings_matching(doc, only, |_| true);
+}
+
+/// Settle imported paint colours before the document is first shown. Other bindings can affect
+/// layout or component structure, which must be resolved through the normal edit pipeline.
+pub(crate) fn apply_paint_bindings_on_load(doc: &mut Document) {
+    let pending = doc.take_dirty();
+    apply_bindings_matching(doc, None, |field| {
+        super::lists::list_binding(field).is_some_and(|(list, _, prop)| {
+            matches!(list, super::lists::BoundList::Fills | super::lists::BoundList::Strokes)
+                && (prop == "color" || super::lists::stop_binding(prop).is_some())
+        })
+    });
+    doc.take_dirty();
+    doc.mark_dirty(pending);
+}
+
+fn apply_bindings_matching(doc: &mut Document, only: Option<&std::collections::BTreeSet<NodeId>>, include: impl Fn(&str) -> bool) {
     use super::lists::{BoundList, list_binding};
     if doc.variables.variables.is_empty() {
         return;
@@ -929,6 +950,9 @@ pub fn apply_bindings_to(doc: &mut Document, only: Option<&std::collections::BTr
         let mut grid_sets: Vec<(usize, String, f64)> = Vec::new();
         let mut prop_sets: Vec<(String, VariableValue)> = Vec::new();
         for (field, var) in binds {
+            if !include(&field) {
+                continue;
+            }
             let Some(val) = doc.variables.resolve(&var, &modes) else { continue };
             // One list item's value: a paint's colour, an effect's or a layout grid's field.
             if let Some((list, i, prop)) = list_binding(&field) {

crates/engine/src/cmd/text.rs

@@ -332,7 +332,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "text.preview",
             "Preview text change",
-            "{command: style.apply|library.applyStyle|text.setVariations|text.style, params}  shows what the command would do on the canvas without an undo step (a hovered text style or named instance, a dragged axis slider), in place of an earlier preview; text.endPreview or any other command ends it, so running the command for real commits it as one undo step",
+            "{command: style.apply|library.applyStyle|text.setVariations|text.style, params}  shows what the command would do on the canvas without an undo step (a hovered font family or style, text style or named instance, a dragged axis slider), in place of an earlier preview; text.endPreview or any other command ends it, so running the command for real commits it as one undo step",
             false,
             |s, p| {
                 let c = req_string("text.preview", p, "command")?;

crates/engine/src/cmd/variables.rs

@@ -87,7 +87,7 @@ fn update(s: &mut Session, p: &Value) -> Result<Value> {
         }
         None => None,
     };
-    let scopes = match get(p, "scopes") {
+    let scopes = match p.get("scopes") {
         None => None,
         Some(Value::Null) => Some(None),
         Some(Value::Array(a)) => {

crates/engine/src/cmd/view.rs

@@ -138,8 +138,16 @@ fn page_step(s: &mut Session, dir: i64) -> Result<Value> {
     let pages = &ds.doc.pages;
     let i = pages.iter().position(|p| *p == ds.page).unwrap_or(0) as i64;
     let n = pages.len() as i64;
-    let next = (i + dir).clamp(0, n - 1) as usize;
-    let Some(pg) = pages.get(next).copied() else { return ok() };
+    // Dividers never open: step over them, and stay put when only dividers lie ahead.
+    let mut next = i + dir;
+    let pg = loop {
+        let page = usize::try_from(next).ok().and_then(|k| pages.get(k).copied());
+        match page {
+            Some(p) if !ds.doc.is_divider(p) => break p,
+            Some(_) if dir != 0 && next >= 0 && next < n => next += dir,
+            _ => break ds.page,
+        }
+    };
     let ds = s.ds_mut()?;
     ds.page = pg;
     ds.selection.clear();

crates/engine/src/codegen.rs

@@ -113,8 +113,58 @@ pub(crate) fn num(v: f64) -> String {
 }
 
 /// `code` with every pixel length (`12px`) in rem of `root` pixels (`0.75rem`); names that end
-/// in "px" are left alone.
+/// in "px", markup lines (layer text), string literals and comments are left alone.
 pub fn px_to_rem(code: &str, root: f64) -> String {
+    let mut out = String::with_capacity(code.len());
+    let mut in_comment = false;
+    for line in code.split_inclusive('\n') {
+        if !in_comment && line.trim_start().starts_with('<') {
+            out.push_str(line);
+            continue;
+        }
+        // Lengths outside strings and comments convert; `plain` is where that stretch starts.
+        let mut plain = 0;
+        let mut chars = line.char_indices().peekable();
+        while let Some((i, c)) = chars.next() {
+            if in_comment {
+                if c == '*' && chars.peek().is_some_and(|(_, n)| *n == '/') {
+                    chars.next();
+                    out.push_str(line.get(plain..i + 2).unwrap_or(""));
+                    plain = i + 2;
+                    in_comment = false;
+                }
+            } else if c == '/' && chars.peek().is_some_and(|(_, n)| *n == '*') {
+                chars.next();
+                out.push_str(&lengths_to_rem(line.get(plain..i).unwrap_or(""), root));
+                plain = i;
+                in_comment = true;
+            } else if c == '"' {
+                out.push_str(&lengths_to_rem(line.get(plain..i).unwrap_or(""), root));
+                let mut end = line.len();
+                while let Some((j, s)) = chars.next() {
+                    if s == '\\' {
+                        chars.next();
+                    } else if s == '"' {
+                        end = j + 1;
+                        break;
+                    }
+                }
+                out.push_str(line.get(i..end).unwrap_or(""));
+                plain = end;
+            }
+        }
+        let rest = line.get(plain..).unwrap_or("");
+        if in_comment {
+            out.push_str(rest);
+        } else {
+            out.push_str(&lengths_to_rem(rest, root));
+        }
+    }
+    out
+}
+
+/// `code` with every pixel length in rem of `root` pixels; names that end in "px" are left alone.
+fn lengths_to_rem(code: &str, root: f64) -> String {
     let ident = |c: char| c.is_alphanumeric() || c == '_';
     let mut out = String::with_capacity(code.len());
     let mut rest = code;

crates/engine/src/component_codegen.rs

@@ -615,10 +615,10 @@ pub fn definition(doc: &Document, c: &Component, lang: CodeLang) -> String {
     }
 }
 
-/// `data-*` attribute names for variant parameters.
-fn data_attr(p: &Param) -> String {
+/// `data-*` attribute names for variant parameters, unique among them (in order).
+fn data_attrs(variants: &[&Param]) -> Vec<String> {
     let mut used = Vec::new();
-    format!("data-{}", class_name(&p.prop, &mut used))
+    variants.iter().map(|p| format!("data-{}", class_name(&p.prop, &mut used))).collect()
 }
 
 /// `c`'s markup in React or Leptos (two levels in) and its stylesheet (variables as custom
@@ -628,6 +628,7 @@ fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String
     let root_name = c.set.and_then(|s| doc.node(s)).or_else(|| doc.node(c.comp)).map(|n| n.name.clone()).unwrap_or_default();
     let root_class = class_name(&root_name, &mut Vec::new());
     let variants: Vec<&Param> = c.params.iter().filter(|p| matches!(p.kind, ParamKind::Variant(_))).collect();
+    let attr_names = data_attrs(&variants);
     let pass = |root: NodeId| {
         let vctx = Ctx { doc, root, comp: Some(c), base: 2 };
         let mut m = Markup::new(&vctx, lang);
@@ -639,9 +640,10 @@ fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String
     m.root_class = Some(root_class.clone());
     m.root_attrs = variants
         .iter()
-        .map(|p| match lang {
-            CodeLang::Leptos => format!(" {}={{{}.as_str()}}", data_attr(p), rust_ident(&p.ident)),
-            _ => format!(" {}={{{}}}", data_attr(p), p.ident),
+        .zip(&attr_names)
+        .map(|(p, attr)| match lang {
+            CodeLang::Leptos => format!(" {attr}={{{}.as_str()}}", rust_ident(&p.ident)),
+            _ => format!(" {attr}={{{}}}", p.ident),
         })
         .collect();
     m.node(c.comp, None, 2, "");
@@ -653,7 +655,8 @@ fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String
         let pairs = variant_props(&vn.name);
         let attrs: String = variants
             .iter()
-            .filter_map(|p| pairs.get(&p.prop).map(|val| format!("[{}=\"{}\"]", data_attr(p), val.replace(['"', '\\'], ""))))
+            .zip(&attr_names)
+            .filter_map(|(p, attr)| pairs.get(&p.prop).map(|val| format!("[{attr}=\"{}\"]", val.replace(['"', '\\'], ""))))
             .collect();
         for (path, _, decls) in pass(v) {
             let Some((_, class, base)) = m.rules.iter().find(|(p, _, _)| *p == path) else { continue };

crates/engine/src/component_codegen_tests.rs

@@ -314,3 +314,32 @@ fn bound_variables_become_custom_properties() {
     let react = code(&mut s, c, "react");
     assert!(react.contains(":root {\n  --colors-brand-500: #3366FF;\n}"), "{react}");
 }
+
+#[test]
+fn case_colliding_variant_properties_get_distinct_data_attributes() {
+    let mut s = Session::new();
+    let mut variants = Vec::new();
+    for (k, (first, second, fill)) in [("Small", "Big", "#0000FF"), ("Large", "Small", "#FF0000")].iter().enumerate() {
+        let name = format!("Size={first}, size={second}");
+        let f = idv(&ex(
+            &mut s,
+            "frame.create",
+            json!({"x": k as f64 * 150.0, "y": 0, "width": 100, "height": 40, "name": name, "props": {"fill": fill}}),
+        ));
+        variants.push(idv(&ex(&mut s, "component.create", json!({"ids": [f]}))));
+    }
+    let set = idv(&ex(&mut s, "component.combineVariants", json!({"ids": variants})));
+    ex(&mut s, "node.set", json!({"id": set, "props": {"name": "Chip"}}));
+    for lang in ["react", "leptos"] {
+        let v = component_code(&mut s, set, lang);
+        let def = v["definition"].as_str().unwrap_or_default();
+        let root = def.lines().find(|l| l.trim_start().starts_with("<div ")).unwrap_or_default();
+        let attrs: Vec<&str> =
+            root.split_whitespace().filter_map(|w| w.strip_prefix("data-")).map(|w| w.split('=').next().unwrap_or_default()).collect();
+        assert_eq!(attrs.len(), 2, "{lang}: {root}");
+        assert_ne!(attrs[0], attrs[1], "{lang}: distinct attributes in {root}");
+        let sel = format!(".chip[data-{}=\"Large\"][data-{}=\"Small\"]", attrs[0], attrs[1]);
+        assert!(def.contains(&sel), "{lang}: {sel} in:\n{def}");
+        assert!(def.contains("#FF0000"), "{lang}:\n{def}");
+    }
+}

crates/engine/src/components.rs

@@ -472,11 +472,11 @@ fn apply_prop(doc: &Document, n: &mut Node, field: &str, val: &Value) {
             }
         }
         "characters" => {
-            if let (NodeKind::Text(t), Some(sv)) = (&mut n.kind, val.as_str())
+            if let (NodeKind::Text(t), Some(sv)) = (&mut n.kind, val.as_str().map(crate::cmd::props::normalize_line_endings))
                 && t.characters != sv
             {
                 let len = t.char_count();
-                t.replace_range(0, len, sv);
+                t.replace_range(0, len, &sv);
             }
         }
         "mainComponent" => {
@@ -1710,6 +1710,165 @@ pub fn refused_override(before: &Document, after: &Document, id: NodeId) -> Opti
     None
 }
 
+/// Bounded source and parent lookups while a rebase reads an unchanged document.
+struct RebaseSources<'a> {
+    doc: &'a Document,
+    chains: BTreeMap<NodeId, Option<Vec<NodeId>>>,
+    parents: BTreeMap<(NodeId, NodeId), Option<bool>>,
+    main_changes: BTreeMap<NodeId, bool>,
+}
+
+impl<'a> RebaseSources<'a> {
+    const PARENTS: usize = 512;
+    const CACHE: usize = 8192;
+
+    fn new(doc: &'a Document) -> Self {
+        Self { doc, chains: BTreeMap::new(), parents: BTreeMap::new(), main_changes: BTreeMap::new() }
+    }
+
+    fn chain(&mut self, source: NodeId) -> Option<Vec<NodeId>> {
+        if let Some(chain) = self.chains.get(&source) {
+            return chain.clone();
+        }
+        let read = || {
+            let mut chain = Vec::new();
+            let mut seen = BTreeSet::new();
+            let mut current = Some(source);
+            for _ in 0..MAX_DEPTH {
+                let Some(id) = current else { return Some(chain) };
+                if !seen.insert(id) {
+                    return None;
+                }
+                let n = self.doc.node(id)?;
+                chain.push(id);
+                current = n.source;
+            }
+            current.is_none().then_some(chain)
+        };
+        let chain = read();
+        if self.chains.len() < Self::CACHE {
+            self.chains.insert(source, chain.clone());
+        }
+        chain
+    }
+
+    /// Validate the complete parent chain, even if `main` was found before a cycle.
+    fn in_main(&mut self, id: NodeId, main: NodeId) -> Option<bool> {
+        if let Some(found) = self.parents.get(&(id, main)) {
+            return *found;
+        }
+        let read = || {
+            let mut current = Some(id);
+            let mut seen = BTreeSet::new();
+            let mut found = false;
+            for _ in 0..Self::PARENTS {
+                let Some(id) = current else { return Some(found) };
+                if !seen.insert(id) {
+                    return None;
+                }
+                found |= id == main;
+                current = self.doc.node(id)?.parent;
+            }
+            current.is_none().then_some(found)
+        };
+        let found = read();
+        if self.parents.len() < Self::CACHE {
+            self.parents.insert((id, main), found);
+        }
+        found
+    }
+
+    fn member(&mut self, source: NodeId, main: NodeId, target: NodeId) -> Option<NodeId> {
+        let chain = self.chain(source)?;
+        if chain.contains(&target) {
+            return None;
+        }
+        let mut member = None;
+        for id in chain {
+            if self.in_main(id, main)? && id != main && member.is_none() {
+                member = Some(id);
+            }
+        }
+        member
+    }
+
+    /// Nearest enclosing instances and their current mains. Slots with own content end scope.
+    fn owners(&self, id: NodeId) -> Option<Vec<(NodeId, NodeId)>> {
+        let mut owners = Vec::new();
+        let mut current = self.doc.node(id)?.parent;
+        let mut seen = BTreeSet::from([id]);
+        for _ in 0..Self::PARENTS {
+            let Some(id) = current else { return Some(owners) };
+            if !seen.insert(id) {
+                return None;
+            }
+            let n = self.doc.node(id)?;
+            if holds_content(n) {
+                return Some(owners);
+            }
+            if let NodeKind::Instance { component, .. } = &n.kind {
+                owners.push((id, *component));
+            }
+            current = n.parent;
+        }
+        current.is_none().then_some(owners)
+    }
+
+    fn contextual(&mut self, source: NodeId, owners: &[(NodeId, NodeId)]) -> bool {
+        owners.iter().any(|(_, main)| self.in_main(source, *main) == Some(true) && source != *main)
+    }
+
+    /// A contextual child belongs to the same placed slot as its enclosing instance.
+    fn valid(&mut self, source: NodeId, target: NodeId, owners: &[(NodeId, NodeId)]) -> bool {
+        let Some((owner, main)) = owners.first() else { return false };
+        if self.member(source, *main, target).is_none() {
+            return false;
+        }
+        if self.in_main(source, *main) == Some(true) {
+            return true;
+        }
+        let Some(source_owner) = self.doc.node(*owner).and_then(|n| n.source) else { return false };
+        matches!(self.doc.node(source_owner).map(|n| &n.kind), Some(NodeKind::Instance { component, .. }) if component == main)
+            && self.owners(source).and_then(|owners| owners.first().copied()).is_some_and(|(id, _)| id == source_owner)
+    }
+
+    fn placed(&mut self, id: NodeId, owners: &[(NodeId, NodeId)]) -> Option<NodeId> {
+        let source = self.doc.node(id)?.source?;
+        if !matches!(self.doc.node(source)?.kind, NodeKind::Instance { .. } | NodeKind::Frame)
+            || !self.valid(source, id, owners)
+            || !self.contextual(source, owners)
+        {
+            return None;
+        }
+        Some(source)
+    }
+
+    fn beneath_swap(&mut self, owners: &[(NodeId, NodeId)], stop: NodeId) -> bool {
+        for (index, (id, main)) in owners.iter().enumerate() {
+            if *id == stop {
+                break;
+            }
+            let changed = if let Some(changed) = self.main_changes.get(id) {
+                *changed
+            } else {
+                let changed = self.placed(*id, &owners[index + 1..]).is_some_and(|source| match self.doc.node(source).map(|n| &n.kind) {
+                    Some(NodeKind::Instance { component, .. }) => component != main,
+                    Some(NodeKind::Frame) => true,
+                    _ => false,
+                });
+                if self.main_changes.len() < Self::CACHE {
+                    self.main_changes.insert(*id, changed);
+                }
+                changed
+            };
+            if changed {
+                return true;
+            }
+        }
+        false
+    }
+}
+
 /// Re-derive `source` links and overrides of instance `inst` against its own main by comparing
 /// values (after detaching an outer instance, restoring a main, or copying a nested instance out):
 /// the look is kept exactly. Values a component property sets aren't overrides.
@@ -1722,22 +1881,28 @@ pub fn rebase_instance(doc: &mut Document, inst: NodeId) {
         diff_groups(a, b).into_iter().filter(|g| !matches!(*g, "size" | "position")).map(str::to_string).collect()
     };
     let mut updates = Vec::new();
+    let mut sources = RebaseSources::new(doc);
+    let root_owners = sources.owners(inst).unwrap_or_default();
+    let placed_source = sources.placed(inst, &root_owners);
+    let mut contexts = vec![(inst, component)];
+    contexts.extend_from_slice(&root_owners);
     for (id, path) in &mine {
         let Some(n) = doc.node(*id) else { continue };
-        // Follow the source chain into the main first (exact), then fall back to the name path.
-        let mut main = None;
-        let mut cur = n.source;
-        for _ in 0..MAX_DEPTH {
-            let Some(c) = cur else { break };
-            if c != component && doc.contains(c) && doc.is_ancestor(component, c) {
-                main = Some(c);
-                break;
-            }
-            cur = doc.node(c).and_then(|x| x.source);
+        let owners = sources.owners(*id).unwrap_or_default();
+        let nearest_main = owners.first().map(|(_, main)| *main);
+        let valid_source = n.source.filter(|source| sources.valid(*source, *id, &owners));
+        let mut main = valid_source.and_then(|source| sources.member(source, component, *id));
+        // A swapped or Frame-to-Instance subtree is compared to its current main by the inner
+        // rebase. An outer name path must not rebind those children to the old expanded copies.
+        if main.is_none() && valid_source.is_some() && sources.beneath_swap(&owners, inst) {
+            updates.push((*id, valid_source, n.overrides.clone()));
+            continue;
         }
-        let main = main.or_else(|| theirs.get(path).copied());
+        main = main
+            .or_else(|| theirs.get(path).copied().filter(|source| nearest_main.is_some_and(|scope| sources.member(*source, scope, *id).is_some())));
+        let source = valid_source.filter(|source| sources.contextual(*source, &contexts)).filter(|_| main.is_some()).or(main);
         let mut overrides: BTreeSet<String> = n.overrides.iter().filter(|g| !matches!(g.as_str(), "component" | "props")).cloned().collect();
-        if let Some(m) = main.and_then(|m| doc.node(m)) {
+        if let Some(m) = source.and_then(|source| doc.node(source)) {
             let mut bound: Vec<&str> = m.prop_refs.keys().map(|f| field_group(f)).collect();
             bound.extend(variable_groups(n, m));
             overrides.extend(value_groups(m, n).into_iter().filter(|g| !bound.contains(&g.as_str())));
@@ -1745,36 +1910,51 @@ pub fn rebase_instance(doc: &mut Document, inst: NodeId) {
                 overrides.insert("component".into());
             }
         }
-        updates.push((*id, main, overrides));
+        updates.push((*id, source, overrides));
     }
-    for (id, main, overrides) in updates {
-        if let Some(n) = doc.node_mut(id) {
-            n.source = main;
-            n.overrides = if main.is_some() { overrides } else { BTreeSet::new() };
-        }
-    }
-    let root_groups = match (doc.node(component), doc.node(inst)) {
+    // A placed nested root compares to its actual slot. A detached root compares to its own main.
+    let root_base = placed_source.or_else(|| {
+        let chain = sources.chain(component)?;
+        (!chain.contains(&inst) && sources.in_main(component, inst) == Some(false)).then_some(component)
+    });
+    let root_groups = match (root_base.and_then(|source| doc.node(source)), doc.node(inst)) {
         (Some(m), Some(n)) => {
             let from_variables = variable_groups(n, m);
             let mut groups: Vec<String> = value_groups(m, n)
                 .into_iter()
                 .filter(|g| !matches!(g.as_str(), "name" | "exports" | "interactions") && !from_variables.contains(&g.as_str()))
                 .collect();
-            // A layer name of its own (a nested instance renamed in its old main) stays.
-            if n.name != default_instance_name(doc, component) {
+            let named = if placed_source.is_some() { n.name != m.name } else { n.name != default_instance_name(doc, component) };
+            if named {
                 groups.push("name".into());
             }
+            if placed_source.is_some()
+                && matches!((&m.kind, &n.kind), (NodeKind::Instance { component: a, .. }, NodeKind::Instance { component: b, .. }) if a != b)
+            {
+                groups.push("component".into());
+            }
             groups
         }
         _ => Vec::new(),
     };
+    drop(sources);
+    for (id, main, overrides) in updates {
+        if let Some(n) = doc.node_mut(id) {
+            n.source = main;
+            n.overrides = if main.is_some() { overrides } else { BTreeSet::new() };
+        }
+    }
     if let Some(n) = doc.node_mut(inst) {
-        n.source = Some(component);
+        n.source = root_base;
         n.overrides.retain(|g| !matches!(g.as_str(), "component" | "props" | "position"));
         n.overrides.extend(root_groups);
     }
 }
 
+#[cfg(test)]
+#[path = "components_rebase_source_tests.rs"]
+mod rebase_source_tests;
+
 /// A set's default variant: the one in its top-left corner (nearest to it, then the top-most, then
 /// the left-most).
 pub fn default_variant(doc: &Document, set: NodeId) -> Option<NodeId> {

crates/engine/src/components_rebase_source_tests.rs

@@ -0,0 +1,244 @@
+//! Contextual import sources survive rebasing; detached and swapped subtrees use their current mains.
+
+use super::*;
+
+fn add(doc: &mut Document, parent: NodeId, kind: NodeKind, name: &str) -> NodeId {
+    doc.create(parent, kind, name, 0.0, 0.0, 20.0, 20.0).unwrap()
+}
+
+fn component(doc: &mut Document, parent: NodeId, name: &str) -> NodeId {
+    add(doc, parent, NodeKind::Component { description: String::new(), props: BTreeMap::new() }, name)
+}
+
+fn mirror(doc: &mut Document, source: NodeId, parent: NodeId) -> NodeId {
+    let mut n = doc.node(source).unwrap().clone();
+    let children = std::mem::take(&mut n.children);
+    n.id = doc.alloc_id();
+    n.parent = None;
+    n.source = Some(source);
+    let id = n.id;
+    doc.insert(n, parent, None).unwrap();
+    for child in children {
+        mirror(doc, child, id);
+    }
+    id
+}
+
+fn instance(doc: &mut Document, main: NodeId, parent: NodeId, name: &str) -> NodeId {
+    let mut n = doc.node(main).unwrap().clone();
+    let children = std::mem::take(&mut n.children);
+    n.id = doc.alloc_id();
+    n.kind = NodeKind::Instance { component: main, props: BTreeMap::new() };
+    n.name = name.into();
+    n.parent = None;
+    n.source = None;
+    let id = n.id;
+    doc.insert(n, parent, None).unwrap();
+    for child in children {
+        mirror(doc, child, id);
+    }
+    id
+}
+
+struct Scene {
+    doc: Document,
+    inner: NodeId,
+    base: NodeId,
+    slot: NodeId,
+    context: NodeId,
+    root: NodeId,
+    nested: NodeId,
+    child: NodeId,
+}
+
+fn scene() -> Scene {
+    let mut doc = Document::new("Source context");
+    let page = doc.first_page().unwrap();
+    let inner = component(&mut doc, page, "Inner");
+    let base = add(&mut doc, inner, NodeKind::Rectangle, "Body");
+    doc.node_mut(base).unwrap().transform = Affine::translate((2.0, 0.0));
+    let outer = component(&mut doc, page, "Outer");
+    let slot = instance(&mut doc, inner, outer, "Nested");
+    doc.node_mut(slot).unwrap().source = Some(inner);
+    let context = doc.node(slot).unwrap().children[0];
+    doc.node_mut(context).unwrap().transform = Affine::translate((3.0, 0.0));
+    doc.node_mut(context).unwrap().opacity = 0.3;
+    let root = instance(&mut doc, outer, page, "Outer copy");
+    let nested = doc.node(root).unwrap().children[0];
+    let child = doc.node(nested).unwrap().children[0];
+    doc.node_mut(child).unwrap().transform = Affine::translate((2.0, 0.0));
+    doc.node_mut(child).unwrap().opacity = 0.2;
+    Scene { doc, inner, base, slot, context, root, nested, child }
+}
+
+fn both(s: &mut Scene) {
+    rebase_instance(&mut s.doc, s.nested);
+    rebase_instance(&mut s.doc, s.root);
+}
+
+#[test]
+fn rebase_default_only_sources_promote_to_the_actual_outer_context() {
+    let mut s = scene();
+    s.doc.node_mut(s.nested).unwrap().source = None;
+    s.doc.node_mut(s.child).unwrap().source = None;
+    both(&mut s);
+    assert_eq!(s.doc.node(s.nested).unwrap().source, Some(s.slot));
+    assert_eq!(s.doc.node(s.child).unwrap().source, Some(s.context));
+}
+
+#[test]
+fn rebase_rejects_a_context_source_from_another_nested_slot() {
+    let mut s = scene();
+    let outer = s.doc.node(s.slot).unwrap().parent.unwrap();
+    let sibling = instance(&mut s.doc, s.inner, outer, "Other nested slot");
+    s.doc.node_mut(sibling).unwrap().source = Some(s.inner);
+    let sibling_child = s.doc.node(sibling).unwrap().children[0];
+    mirror(&mut s.doc, sibling, s.root);
+    s.doc.node_mut(s.child).unwrap().source = Some(sibling_child);
+    both(&mut s);
+    assert_eq!(s.doc.node(s.nested).unwrap().source, Some(s.slot));
+    assert_eq!(s.doc.node(s.child).unwrap().source, Some(s.context));
+    assert_eq!(s.doc.node(sibling_child).unwrap().transform.translation().x, 2.0);
+    assert_eq!(s.doc.node(s.context).unwrap().transform.translation().x, 3.0);
+}
+
+#[test]
+fn rebase_does_not_mark_inherited_context_values_as_local_overrides() {
+    let mut s = scene();
+    s.doc.node_mut(s.child).unwrap().opacity = 0.3;
+    both(&mut s);
+    assert_eq!(s.doc.node(s.child).unwrap().source, Some(s.context));
+    assert!(!s.doc.node(s.child).unwrap().overrides.contains("opacity"));
+}
+
+#[test]
+fn rebase_preserves_multilevel_context_without_shortening_source_chains() {
+    let mut doc = Document::new("Nested source contexts");
+    let page = doc.first_page().unwrap();
+    let inner = component(&mut doc, page, "Inner");
+    let base = add(&mut doc, inner, NodeKind::Rectangle, "Body");
+    doc.node_mut(base).unwrap().transform = Affine::translate((2.0, 0.0));
+    let wrapper = component(&mut doc, page, "Wrapper");
+    let default_slot = instance(&mut doc, inner, wrapper, "Nested");
+    doc.node_mut(default_slot).unwrap().source = Some(inner);
+    let outer = component(&mut doc, page, "Outer");
+    let wrapper_slot = instance(&mut doc, wrapper, outer, "Wrapper slot");
+    doc.node_mut(wrapper_slot).unwrap().source = Some(wrapper);
+    let source_slot = doc.node(wrapper_slot).unwrap().children[0];
+    let context = doc.node(source_slot).unwrap().children[0];
+    doc.node_mut(context).unwrap().transform = Affine::translate((3.0, 0.0));
+    let root = instance(&mut doc, outer, page, "Outer copy");
+    let wrapper_copy = doc.node(root).unwrap().children[0];
+    let nested = doc.node(wrapper_copy).unwrap().children[0];
+    let child = doc.node(nested).unwrap().children[0];
+    doc.node_mut(nested).unwrap().name = "Renamed nested".into();
+    doc.node_mut(child).unwrap().transform = Affine::translate((2.0, 0.0));
+    for id in [nested, wrapper_copy, root] {
+        rebase_instance(&mut doc, id);
+        assert_eq!(doc.node(nested).unwrap().source, Some(source_slot));
+        assert_eq!(doc.node(child).unwrap().source, Some(context));
+    }
+    assert_eq!(doc.node(context).unwrap().source, Some(doc.node(default_slot).unwrap().children[0]));
+    assert_eq!(doc.node(context).unwrap().transform.translation().x, 3.0);
+    assert_eq!(doc.node(child).unwrap().transform.translation().x, 2.0);
+}
+
+#[test]
+fn rebase_preserves_placed_frame_to_instance_and_current_main_children() {
+    let mut doc = Document::new("Typed nested source");
+    let page = doc.first_page().unwrap();
+    let inner = component(&mut doc, page, "Inner");
+    let body = add(&mut doc, inner, NodeKind::Rectangle, "Body");
+    let outer = component(&mut doc, page, "Outer");
+    let slot = add(&mut doc, outer, NodeKind::Frame, "Empty slot");
+    let root = instance(&mut doc, outer, page, "Outer copy");
+    let nested = doc.node(root).unwrap().children[0];
+    doc.node_mut(nested).unwrap().kind = NodeKind::Instance { component: inner, props: BTreeMap::new() };
+    let child = mirror(&mut doc, body, nested);
+    rebase_instance(&mut doc, nested);
+    rebase_instance(&mut doc, root);
+    assert_eq!(doc.node(nested).unwrap().source, Some(slot));
+    assert_eq!(doc.node(child).unwrap().source, Some(body));
+    assert!(matches!(doc.node(nested).unwrap().kind, NodeKind::Instance { component, .. } if component == inner));
+}
+
+#[test]
+fn rebase_keeps_current_main_sources_and_component_delta_beneath_swap() {
+    let mut s = scene();
+    let page = s.doc.first_page().unwrap();
+    let replacement = component(&mut s.doc, page, "Replacement");
+    let body = add(&mut s.doc, replacement, NodeKind::Rectangle, "Body");
+    s.doc.node_mut(body).unwrap().transform = Affine::translate((7.0, 0.0));
+    s.doc.node_mut(s.nested).unwrap().kind = NodeKind::Instance { component: replacement, props: BTreeMap::new() };
+    s.doc.remove(s.child).unwrap();
+    s.child = mirror(&mut s.doc, body, s.nested);
+    s.doc.node_mut(s.child).unwrap().transform = Affine::translate((8.0, 0.0));
+    s.doc.node_mut(s.nested).unwrap().name = "Renamed swap".into();
+    rebase_instance(&mut s.doc, s.nested);
+    assert_eq!(s.doc.node(s.nested).unwrap().source, Some(s.slot));
+    assert!(s.doc.node(s.nested).unwrap().overrides.contains("component"));
+    rebase_instance(&mut s.doc, s.root);
+    assert_eq!(s.doc.node(s.nested).unwrap().source, Some(s.slot));
+    assert_eq!(s.doc.node(s.child).unwrap().source, Some(body));
+    assert!(s.doc.node(s.nested).unwrap().overrides.contains("component"));
+    assert_eq!(s.doc.node(s.child).unwrap().transform.translation().x, 8.0);
+}
+
+#[test]
+fn rebase_detached_nested_uses_own_main_and_keeps_inherited_geometry() {
+    let mut s = scene();
+    let page = s.doc.first_page().unwrap();
+    let detached = mirror(&mut s.doc, s.nested, page);
+    let child = s.doc.node(detached).unwrap().children[0];
+    // The old source references still exist, but their Outer context is absent here.
+    s.doc.node_mut(detached).unwrap().source = Some(s.slot);
+    s.doc.node_mut(child).unwrap().source = Some(s.context);
+    s.doc.node_mut(child).unwrap().transform = Affine::translate((3.0, 0.0));
+    rebase_instance(&mut s.doc, detached);
+    assert_eq!(s.doc.node(detached).unwrap().source, Some(s.inner));
+    assert_eq!(s.doc.node(child).unwrap().source, Some(s.base));
+    assert_eq!(s.doc.node(child).unwrap().transform.translation().x, 3.0);
+    assert_eq!(s.doc.node(s.base).unwrap().transform.translation().x, 2.0);
+}
+
+#[test]
+fn rebase_does_not_preserve_existing_foreign_or_stale_sources() {
+    let mut s = scene();
+    let page = s.doc.first_page().unwrap();
+    let foreign = component(&mut s.doc, page, "Foreign");
+    let foreign_body = add(&mut s.doc, foreign, NodeKind::Rectangle, "Body");
+    s.doc.node_mut(s.child).unwrap().source = Some(foreign_body);
+    both(&mut s);
+    assert_ne!(s.doc.node(s.child).unwrap().source, Some(foreign_body));
+    assert_eq!(s.doc.node(s.child).unwrap().source, Some(s.context));
+    let mut s = scene();
+    let page = s.doc.first_page().unwrap();
+    let replacement = component(&mut s.doc, page, "Replacement");
+    let body = add(&mut s.doc, replacement, NodeKind::Rectangle, "Body");
+    s.doc.node_mut(s.nested).unwrap().kind = NodeKind::Instance { component: replacement, props: BTreeMap::new() };
+    s.doc.node_mut(s.child).unwrap().source = Some(s.context);
+    both(&mut s);
+    assert_ne!(s.doc.node(s.child).unwrap().source, Some(s.context), "the old default-main child is stale after a swap");
+    assert!(s.doc.node(s.child).unwrap().source.is_none() || s.doc.node(s.child).unwrap().source == Some(body));
+}
+
+#[test]
+fn rebase_rejects_source_and_parent_cycles_with_bounded_lookups() {
+    let mut s = scene();
+    s.doc.node_mut(s.base).unwrap().source = Some(s.context);
+    both(&mut s);
+    assert_eq!(s.doc.node(s.child).unwrap().source, None);
+    let mut s = scene();
+    s.doc.node_mut(s.context).unwrap().parent = Some(s.context);
+    both(&mut s);
+    assert_ne!(s.doc.node(s.child).unwrap().source, Some(s.context));
+    let mut s = scene();
+    s.doc.node_mut(s.nested).unwrap().parent = Some(s.child);
+    s.doc.node_mut(s.child).unwrap().parent = Some(s.nested);
+    let sources = RebaseSources::new(&s.doc);
+    assert!(sources.owners(s.child).is_none());
+    let mut s = scene();
+    s.doc.node_mut(s.root).unwrap().kind = NodeKind::Instance { component: s.root, props: BTreeMap::new() };
+    rebase_instance(&mut s.doc, s.root);
+    assert_ne!(s.doc.node(s.root).unwrap().source, Some(s.root));
+}

crates/engine/src/convert_container_tests.rs

@@ -1,5 +1,5 @@
-//! Frames and groups converted into each other in place: the layers stay where they are on the
-//! page, what only a frame has goes with it, what can't convert is refused, one undo step.
+//! Frames, groups and sections converted into each other in place: the layers stay where they are on
+//! the page, what only a frame has goes with it, what can't convert is refused, one undo step.
 
 use serde_json::{Value, json};
 
@@ -136,7 +136,7 @@ fn what_cannot_convert_is_refused_and_nothing_changes() {
 #[test]
 fn junk_parameters_are_refused_not_fatal() {
     let junk = [json!(null), json!(true), json!(-1), json!(1e308), json!("x"), json!([[1]]), json!({"a": 1}), json!([0, 999_999, "7"])];
-    for cmd in ["object.convertToGroup", "object.convertToFrame"] {
+    for cmd in ["object.convertToGroup", "object.convertToFrame", "object.convertToSection"] {
         for j in &junk {
             let mut s = Session::new();
             let f = id(ex(&mut s, "frame.create", json!({"x": 0, "y": 0, "width": 50, "height": 50})));
@@ -148,3 +148,49 @@ fn junk_parameters_are_refused_not_fatal() {
         }
     }
 }
+
+#[test]
+fn a_frame_on_the_page_becomes_a_section_and_back() {
+    let mut s = Session::new();
+    let f = id(ex(&mut s, "frame.create", json!({"x": 100, "y": 50, "width": 300, "height": 200, "name": "Flow", "props": {"fill": "#FFEEDD"}})));
+    let (a, b) = (rect(&mut s, f, 20.0, 30.0), rect(&mut s, f, 400.0, 90.0));
+    ex(&mut s, "layout.add", json!({"ids": [f], "direction": "horizontal"}));
+    ex(&mut s, "node.set", json!({"id": f, "props": {"width": 300, "height": 200}}));
+    let before = [page_box(&s, a), page_box(&s, b), page_box(&s, f)];
+    assert_eq!(ex(&mut s, "object.convertToSection", json!({"ids": [f]}))["ids"], json!([f]));
+    let n = s.doc().unwrap().node(f).unwrap().clone();
+    assert!(matches!(n.kind, NodeKind::Section { contents_hidden: false }));
+    assert_eq!((n.name.as_str(), n.children.clone(), n.fills.len()), ("Flow", vec![a, b], 1), "same name, layers and fill");
+    assert!(n.layout.is_none() && !n.clip, "no auto layout or clipping on a section");
+    assert_eq!([page_box(&s, a), page_box(&s, b), page_box(&s, f)], before, "nothing moves");
+    // And back: a frame that keeps the fill and doesn't clip, so the look stays.
+    assert_eq!(ex(&mut s, "object.convertToFrame", json!({"ids": [f]}))["ids"], json!([f]));
+    let n = s.doc().unwrap().node(f).unwrap().clone();
+    assert!(matches!(n.kind, NodeKind::Frame) && n.fills.len() == 1 && !n.clip);
+    assert_eq!([page_box(&s, a), page_box(&s, b), page_box(&s, f)], before);
+    // Each conversion is one undo step.
+    ex(&mut s, "edit.undo", json!({}));
+    assert!(matches!(kind(&s, f), NodeKind::Section { .. }));
+    ex(&mut s, "edit.undo", json!({}));
+    assert!(matches!(kind(&s, f), NodeKind::Frame));
+    assert!(s.doc().unwrap().node(f).unwrap().layout.is_some(), "the frame's auto layout is back");
+}
+
+#[test]
+fn only_frames_on_the_page_or_in_a_section_become_sections() {
+    let mut s = Session::new();
+    let outer = id(ex(&mut s, "frame.create", json!({"x": 0, "y": 0, "width": 300, "height": 300})));
+    let inner = id(ex(&mut s, "frame.create", json!({"parent": outer, "x": 10, "y": 10, "width": 100, "height": 100})));
+    let err = s.execute("object.convertToSection", &json!({"ids": [inner]})).unwrap_err().to_string();
+    assert!(err.contains("inside a frame"), "{err}");
+    let r = rect(&mut s, outer, 150.0, 150.0);
+    assert!(s.execute("object.convertToSection", &json!({"ids": [r]})).is_err(), "a rectangle isn't a frame");
+    // A frame inside a section converts; a section holding a section can't become a frame.
+    let sec = id(ex(&mut s, "node.create", json!({"type": "section", "x": 500, "y": 0, "width": 400, "height": 400})));
+    let in_sec = id(ex(&mut s, "frame.create", json!({"parent": sec, "x": 20, "y": 20, "width": 100, "height": 100})));
+    ex(&mut s, "object.convertToSection", json!({"ids": [in_sec]}));
+    assert!(matches!(kind(&s, in_sec), NodeKind::Section { .. }));
+    let err = s.execute("object.convertToFrame", &json!({"ids": [sec]})).unwrap_err().to_string();
+    assert!(err.contains("holds sections"), "{err}");
+    assert!(matches!(kind(&s, sec), NodeKind::Section { .. }), "nothing changed");
+}

crates/engine/src/cursor_tests.rs

@@ -219,6 +219,24 @@ fn an_edit_an_instance_refuses_shows_not_allowed_and_is_undone() {
     assert_eq!(s.doc().unwrap().world_bounds(inner).unwrap(), before, "the move was undone");
 }
 
+#[test]
+fn a_pen_click_that_wobbles_a_pixel_is_still_a_click() {
+    let mut s = Session::new();
+    s.set_tool(ToolId::Pen);
+    // A real click: the mouse moves a pixel or two between press and release.
+    s.pointer(&ev(PointerKind::Down, (100.0, 100.0), NONE)).unwrap();
+    s.pointer(&ev(PointerKind::Move, (102.0, 101.0), NONE)).unwrap();
+    s.pointer(&ev(PointerKind::Up, (102.0, 101.0), NONE)).unwrap();
+    let out = s.tool.pen.as_ref().and_then(|p| p.points.first()).map(|(_, _, o)| *o);
+    assert_eq!(out.map(|o| o.hypot()), Some(0.0), "no handle pulled out");
+    assert!(s.tool.overlay.pen_handles.is_empty());
+    // Past the slop it is a drag: the handle follows the pointer from where it was pressed.
+    s.pointer(&ev(PointerKind::Down, (200.0, 100.0), NONE)).unwrap();
+    s.pointer(&ev(PointerKind::Move, (204.0, 100.0), NONE)).unwrap();
+    let out = s.tool.pen.as_ref().and_then(|p| p.points.last()).map(|(_, _, o)| (o.x, o.y));
+    assert_eq!(out, Some((4.0, 0.0)));
+}
+
 #[test]
 fn the_pen_shows_what_a_click_would_do() {
     // The Pen tool drawing a new path: three points, then over each of them.

crates/engine/src/design_paste_tests.rs

@@ -0,0 +1,108 @@
+//! Paste of layers copied from another design app: the clipboard's design data (a `.fig` canvas in
+//! its HTML) read through the `.fig` import and pasted as Paste pastes our own layers.
+
+use base64::Engine as _;
+use serde_json::json;
+
+use super::*;
+use crate::cmd::edit::{CLIP_CLOSE, CLIP_OPEN, design_clipboard_buffer};
+
+const B64: base64::engine::GeneralPurpose = base64::engine::general_purpose::STANDARD;
+
+fn id(v: &Value) -> NodeId {
+    params::id_of(&v["id"]).unwrap()
+}
+
+fn copied_file() -> Vec<u8> {
+    let mut s = Session::new();
+    let frame = id(&s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 200, "height": 100, "name": "Card"})).unwrap());
+    s.execute("node.create", &json!({"type": "rectangle", "x": 10, "y": 10, "width": 40, "height": 20, "parent": frame, "name": "Badge"})).unwrap();
+    s.execute("node.create", &json!({"type": "ellipse", "x": 300, "y": 0, "width": 50, "height": 50, "name": "Dot"})).unwrap();
+    let r = s.execute("file.export", &json!({"format": "fig"})).unwrap();
+    B64.decode(r["data"].as_str().unwrap()).unwrap()
+}
+
+fn clipboard_html(buffer: &[u8]) -> String {
+    let mut wrapped = B64.encode(buffer);
+    wrapped.insert(8, '\n');
+    format!(r#"<meta charset="utf-8"><span data-buffer="<!--{CLIP_OPEN}{wrapped}{CLIP_CLOSE}-->"></span>"#)
+}
+
+fn names(s: &Session, ids: &[NodeId]) -> Vec<String> {
+    let doc = s.doc().unwrap();
+    ids.iter().map(|i| doc.node(*i).unwrap().name.clone()).collect()
+}
+
+#[test]
+fn buffer_is_found_in_the_html() {
+    let file = copied_file();
+    assert_eq!(design_clipboard_buffer(&clipboard_html(&file)), Some(file));
+    assert_eq!(design_clipboard_buffer("<p>plain</p>"), None);
+    assert_eq!(design_clipboard_buffer(&format!("{CLIP_OPEN}not base64!{CLIP_CLOSE}")), None);
+    assert_eq!(design_clipboard_buffer(&format!("{CLIP_OPEN}{}{CLIP_CLOSE}", B64.encode(b"hello"))), None);
+    assert_eq!(design_clipboard_buffer(&format!("{CLIP_OPEN}ZmlnLQ")), None);
+    // Web text that only mentions the markers holds no design data.
+    assert_eq!(design_clipboard_buffer(&format!("<p>see {CLIP_OPEN} and {CLIP_CLOSE} in the docs</p>")), None);
+}
+
+#[test]
+fn oversized_design_data_is_refused_before_decoding() {
+    // Just past the cap (256 MB of data, as base64), made of valid base64 characters.
+    let big = "A".repeat((256 * 1024 * 1024usize).div_ceil(3) * 4 + 4);
+    assert_eq!(design_clipboard_buffer(&format!("{CLIP_OPEN}{big}{CLIP_CLOSE}")), None);
+    let mut s = Session::new();
+    let e = s.execute("edit.pasteDesignLayers", &json!({ "data": big })).unwrap_err();
+    assert!(e.to_string().contains("256 MB"), "{e}");
+    assert!(s.clipboard.nodes.is_empty());
+}
+
+#[test]
+fn layers_paste_into_the_page_and_undo() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let r = s.execute("edit.pasteDesignLayers", &json!({"html": clipboard_html(&copied_file())})).unwrap();
+    let ids: Vec<NodeId> = r["ids"].as_array().unwrap().iter().map(|v| params::id_of(v).unwrap()).collect();
+    assert_eq!(names(&s, &ids), ["Card", "Dot"]);
+    assert_eq!(s.selection(), ids);
+    let doc = s.doc().unwrap();
+    assert!(ids.iter().all(|i| doc.node(*i).unwrap().parent == Some(page)));
+    let card = doc.node(ids[0]).unwrap();
+    assert_eq!(names(&s, &card.children), ["Badge"]);
+    assert_eq!((card.width, card.height), (200.0, 100.0));
+    assert!(s.undo().unwrap());
+    assert!(ids.iter().all(|i| !s.doc().unwrap().contains(*i)));
+}
+
+#[test]
+fn a_second_paste_repeats_the_copied_layers() {
+    let mut s = Session::new();
+    // `data` may be wrapped and unpadded, like the HTML's base64.
+    let mut data = B64.encode(copied_file()).trim_end_matches('=').to_string();
+    data.insert(8, '\n');
+    s.execute("edit.pasteDesignLayers", &json!({ "data": data })).unwrap();
+    let r = s.execute("edit.paste", &json!({})).unwrap();
+    let ids: Vec<NodeId> = r["ids"].as_array().unwrap().iter().map(|v| params::id_of(v).unwrap()).collect();
+    assert_eq!(names(&s, &ids), ["Card", "Dot"]);
+}
+
+#[test]
+fn pastes_into_the_selected_frame() {
+    let mut s = Session::new();
+    let host = id(&s.execute("frame.create", &json!({"x": 1000, "y": 0, "width": 800, "height": 600})).unwrap());
+    s.execute("select.set", &json!({"ids": [host]})).unwrap();
+    let r = s.execute("edit.pasteDesignLayers", &json!({"html": clipboard_html(&copied_file())})).unwrap();
+    let first = params::id_of(&r["ids"][0]).unwrap();
+    assert_eq!(s.doc().unwrap().node(first).unwrap().parent, Some(host));
+}
+
+#[test]
+fn other_content_is_refused_without_changes() {
+    let mut s = Session::new();
+    let before = s.doc().unwrap().nodes().count();
+    assert!(s.execute("edit.pasteDesignLayers", &json!({})).is_err());
+    assert!(s.execute("edit.pasteDesignLayers", &json!({"html": "<b>hi</b>"})).is_err());
+    assert!(s.execute("edit.pasteDesignLayers", &json!({"data": B64.encode(b"PK not a zip")})).is_err());
+    assert!(s.execute("edit.pasteDesignLayers", &json!({"data": B64.encode(b"fig-kiwi\x00\x00\x00\x00junk")})).is_err());
+    assert_eq!(s.doc().unwrap().nodes().count(), before);
+    assert!(s.clipboard.nodes.is_empty());
+}

crates/engine/src/devfocus_tests.rs

@@ -93,3 +93,29 @@ fn only_the_focused_frame_is_hit_and_escape_leaves() {
     click(&mut s, 350.0, 100.0);
     assert_eq!(s.selection(), vec![b], "everything is hit again");
 }
+
+#[test]
+fn nested_frames_stay_out_of_the_ready_list_and_its_navigation() {
+    let mut s = Session::new();
+    let screen = frame(&mut s, 0.0, "Screen");
+    let card = idv(&ex(&mut s, "frame.create", json!({"parent": screen, "width": 100, "height": 50, "name": "Card"})));
+    // A status a nested frame already stores (an older file, or set through node.set) is ignored.
+    ex(&mut s, "node.set", json!({"id": card, "props": {"devStatus": "readyForDev"}}));
+    assert_eq!(ex(&mut s, "inspect.readyForDev", json!({"status": "any"}))["items"], json!([]));
+    assert!(s.execute("dev.focus", &json!({"direction": "next"})).is_err(), "nothing is ready");
+    ex(&mut s, "node.set", json!({"id": screen, "props": {"devStatus": "readyForDev"}}));
+    let ids = |v: serde_json::Value| -> Vec<serde_json::Value> {
+        v["items"].as_array().map(|a| a.iter().map(|i| i["id"].clone()).collect()).unwrap_or_default()
+    };
+    assert_eq!(ids(ex(&mut s, "inspect.readyForDev", json!({}))), vec![json!(screen)]);
+    ex(&mut s, "dev.focus", json!({"id": screen}));
+    for direction in ["next", "previous"] {
+        let v = ex(&mut s, "dev.focus", json!({"direction": direction}));
+        assert_eq!((v["id"].clone(), v["count"].clone()), (json!(screen), json!(1)), "{direction} wraps to the only ready frame");
+    }
+    // A frame directly inside a section still counts.
+    let sec = idv(&ex(&mut s, "node.create", json!({"type": "section", "x": 1000, "y": 0, "width": 400, "height": 300})));
+    let in_sec = idv(&ex(&mut s, "frame.create", json!({"parent": sec, "width": 100, "height": 100, "name": "In section"})));
+    ex(&mut s, "node.set", json!({"ids": [sec, in_sec], "props": {"devStatus": "readyForDev"}}));
+    assert_eq!(ids(ex(&mut s, "inspect.readyForDev", json!({}))), vec![json!(screen), json!(sec), json!(in_sec)]);
+}

crates/engine/src/devinspect.rs

@@ -231,7 +231,7 @@ pub fn has_status(doc: &Document, id: NodeId) -> bool {
 }
 
 /// The layers with handoff status `status` (`None`: any status) on `page` (`None`: every page),
-/// in page and layer order (bounded).
+/// in page and layer order (bounded). Only layers that can carry a status are listed.
 pub fn dev_items(doc: &Document, status: Option<DevStatus>, page: Option<NodeId>) -> Vec<DevItem> {
     let mut out = Vec::new();
     let mut visited = 0usize;
@@ -243,7 +243,7 @@ pub fn dev_items(doc: &Document, status: Option<DevStatus>, page: Option<NodeId>
                 return out;
             }
             let Some(n) = doc.node(id) else { continue };
-            if !n.dev_status.is_none() && status.is_none_or(|s| s == n.dev_status) {
+            if !n.dev_status.is_none() && status.is_none_or(|s| s == n.dev_status) && has_status(doc, id) {
                 out.push(DevItem { id, name: n.name.clone(), page: pg, status: n.dev_status });
             }
             stack.extend(n.children.iter().rev().copied());

crates/engine/src/drop.rs

@@ -61,12 +61,15 @@ pub fn flip(r: figcraft_geom::Rect, vertical: bool) -> figcraft_geom::Rect {
 
 /// The visual rows (columns when `vertical`) of a wrapping layout's placed children `kids`, each
 /// child as (its index in `kids`, its page bounds [`flip`]ped so the flow runs along x). Children
-/// wrap in flow order, so a new row starts where a child sits before the one before.
+/// wrap in flow order, so a new row starts where a child sits before the one before, or where it
+/// does not follow the one before along the flow but sits past it across (one child per line).
 pub fn wrap_rows(doc: &Document, kids: &[NodeId], vertical: bool) -> Vec<Vec<(usize, figcraft_geom::Rect)>> {
     let mut rows: Vec<Vec<(usize, figcraft_geom::Rect)>> = Vec::new();
     for (i, b) in kids.iter().enumerate().filter_map(|(i, c)| doc.world_bounds(*c).map(|b| (i, flip(b, vertical)))) {
         match rows.last_mut() {
-            Some(row) if row.last().is_some_and(|(_, prev)| b.x0 >= prev.x0 - 0.5) => row.push((i, b)),
+            Some(row) if row.last().is_some_and(|(_, prev)| b.x0 >= prev.x0 - 0.5 && !(b.x0 < prev.x1 - 0.5 && b.y0 >= prev.y1 - 0.5)) => {
+                row.push((i, b))
+            }
             _ => rows.push(vec![(i, b)]),
         }
     }

crates/engine/src/duplicate_spacing_tests.rs

@@ -157,3 +157,49 @@ fn an_alt_drag_into_auto_layout_sets_no_step() {
     cmd_d(&mut s);
     assert_eq!(s.doc().unwrap().node(f).unwrap().children.len(), n + 1, "Duplicate still adds one to the flow");
 }
+
+/// Drag `from` by `by` with no modifier: moving the selection, not copying it.
+fn drag_move(s: &mut Session, from: (f64, f64), by: (f64, f64)) {
+    let ev = |kind, (x, y): (f64, f64)| PointerEvent::at(kind, x, y, 1.0);
+    s.pointer(&ev(PointerKind::Down, from)).unwrap();
+    for k in 1..=4 {
+        let t = f64::from(k) / 4.0;
+        s.pointer(&ev(PointerKind::Move, (from.0 + by.0 * t, from.1 + by.1 * t))).unwrap();
+    }
+    s.pointer(&ev(PointerKind::Up, (from.0 + by.0, from.1 + by.1))).unwrap();
+}
+
+/// The reported path (#567): Cmd+D, drag the copy with the mouse, Cmd+D again. The other tests
+/// here set the copy's position with `node.set` or Alt-drag it; dragging is how it is usually done,
+/// and the step is measured from where the copy ended up, whichever way it got there.
+#[test]
+fn duplicate_repeats_the_step_set_by_dragging_the_copy() {
+    let mut s = Session::new();
+    let a = rect(&mut s, 0.0, 0.0);
+    ex(&mut s, "select.set", json!({"ids": [a]}));
+    let c1 = cmd_d(&mut s);
+    assert_eq!(at(&s, c1), (0.0, 0.0), "the first copy lands in place");
+
+    drag_move(&mut s, (50.0, 50.0), (150.0, 20.0));
+    assert_eq!(at(&s, c1), (150.0, 20.0), "the drag moved the copy, it did not make another one");
+    assert_eq!(s.selection(), vec![c1], "and left it selected");
+    assert_eq!(at(&s, a), (0.0, 0.0), "the original stays");
+
+    let c2 = cmd_d(&mut s);
+    assert_eq!(at(&s, c2), (300.0, 40.0), "the next one as far again");
+    let c3 = cmd_d(&mut s);
+    assert_eq!(at(&s, c3), (450.0, 60.0), "and again");
+}
+
+/// And a step set with the arrow keys, which is how a small offset is usually made exact.
+#[test]
+fn duplicate_repeats_a_nudged_step() {
+    let mut s = Session::new();
+    let a = rect(&mut s, 0.0, 0.0);
+    ex(&mut s, "select.set", json!({"ids": [a]}));
+    let c1 = cmd_d(&mut s);
+    ex(&mut s, "transform.nudge", json!({"dx": 40, "dy": 0}));
+    assert_eq!(at(&s, c1), (40.0, 0.0));
+    let c2 = cmd_d(&mut s);
+    assert_eq!(at(&s, c2), (80.0, 0.0), "the nudge is the step");
+}

crates/engine/src/fig_import_tests.rs

@@ -50,3 +50,43 @@ fn local_samples_match_their_exports() {
         }
     }
 }
+
+/// Layers of an instance copy keep their link to the layer they stand for when the file is
+/// opened, also after they were renamed in the copy (a name is no identity), and the override
+/// that a rename is stays an override.
+#[test]
+fn opened_fig_links_instance_layers_by_identity_not_by_name() {
+    use base64::Engine as _;
+    let mut s = Session::new();
+    let make = |s: &mut Session, cmd: &str, p: serde_json::Value| s.execute(cmd, &p).unwrap()["id"].as_u64().map(figcraft_doc::NodeId).unwrap();
+    let body = make(&mut s, "frame.create", json!({"x": 0, "y": 0, "width": 40, "height": 20, "name": "Inner"}));
+    let label = make(&mut s, "text.create", json!({"text": "Label", "x": 2, "y": 2, "parent": body, "props": {"name": "Label"}}));
+    let inner = make(&mut s, "component.create", json!({"ids": [body]}));
+    let frame = make(&mut s, "frame.create", json!({"x": 100, "y": 0, "width": 200, "height": 60, "name": "Outer"}));
+    let outer = make(&mut s, "component.create", json!({"ids": [frame]}));
+    let slot = make(&mut s, "instance.create", json!({"component": inner, "x": 0, "y": 0, "parent": outer}));
+    s.execute("node.set", &json!({"id": slot, "props": {"name": "Slot"}})).unwrap();
+    let copy = make(&mut s, "instance.create", json!({"component": outer, "x": 0, "y": 200}));
+    let copy_slot = s.doc().unwrap().node(copy).unwrap().children[0];
+    let copy_label = s.doc().unwrap().node(copy_slot).unwrap().children[0];
+    s.execute("node.set", &json!({"id": copy_slot, "props": {"name": "Renamed slot"}})).unwrap();
+    s.execute("node.set", &json!({"id": copy_label, "props": {"name": "Renamed label"}})).unwrap();
+    let _ = label;
+
+    let exported = s.execute("file.export", &json!({"format": "fig"})).unwrap();
+    let path = std::env::temp_dir().join(format!("figcraft-slots-{}.fig", std::process::id()));
+    std::fs::write(&path, base64::engine::general_purpose::STANDARD.decode(exported["data"].as_str().unwrap()).unwrap()).unwrap();
+    let mut opened = Session::new();
+    let result = opened.execute("file.open", &json!({"path": path.to_string_lossy()}));
+    let _ = std::fs::remove_file(&path);
+    result.unwrap();
+    let doc = opened.doc().unwrap();
+    let outer = doc.nodes().find(|n| n.name == "Outer" && matches!(n.kind, NodeKind::Component { .. })).unwrap();
+    let copy = doc.nodes().find(|n| n.name == "Outer" && matches!(n.kind, NodeKind::Instance { .. })).unwrap();
+    let slot = doc.node(copy.children[0]).unwrap();
+    let label = doc.node(slot.children[0]).unwrap();
+    assert_eq!((slot.name.as_str(), label.name.as_str()), ("Renamed slot", "Renamed label"));
+    assert_eq!(slot.source, Some(outer.children[0]));
+    assert_eq!(label.source, Some(doc.node(outer.children[0]).unwrap().children[0]));
+    assert!(slot.overrides.contains("name") && label.overrides.contains("name"));
+}

crates/engine/src/finite_geometry_tests.rs

@@ -0,0 +1,40 @@
+//! Commands never leave a layer with a non-finite position or size: such a file saves but can't be
+//! reopened (JSON writes NaN and infinity as null).
+
+use serde_json::json;
+
+use crate::Session;
+
+fn rect(s: &mut Session) -> crate::NodeId {
+    let r = s.execute("node.create", &json!({"type": "rectangle", "x": 0, "y": 10, "width": 100, "height": 50})).unwrap();
+    crate::params::id_of(&r["id"]).unwrap()
+}
+
+fn assert_roundtrips(s: &Session) {
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    assert!(figcraft_format::load_bytes(&bytes).is_ok(), "the saved file reopens");
+}
+
+#[test]
+fn huge_moves_are_refused_and_the_file_still_reopens() {
+    let mut s = Session::new();
+    let r = rect(&mut s);
+    s.execute("transform.move", &json!({"ids": [r], "dx": 1e308, "dy": 0})).ok();
+    let second = s.execute("transform.move", &json!({"ids": [r], "dx": 1e308, "dy": 1e308}));
+    assert!(second.is_err(), "a move past the f64 range is refused");
+    let n = s.doc().unwrap().node(r).unwrap();
+    assert!(n.transform.as_coeffs().iter().all(|c| c.is_finite()), "{:?}", n.transform);
+    assert_roundtrips(&s);
+}
+
+#[test]
+fn huge_scale_is_refused_and_the_file_still_reopens() {
+    let mut s = Session::new();
+    let r = rect(&mut s);
+    s.execute("transform.scale", &json!({"ids": [r], "factor": 1e300})).ok();
+    let second = s.execute("transform.scale", &json!({"ids": [r], "factor": 1e300}));
+    assert!(second.is_err(), "a size past the f64 range is refused");
+    let n = s.doc().unwrap().node(r).unwrap();
+    assert!(n.width.is_finite() && n.height.is_finite(), "{} x {}", n.width, n.height);
+    assert_roundtrips(&s);
+}

crates/engine/src/html_codegen_tests.rs

@@ -77,3 +77,43 @@ fn leptos_wraps_the_markup_in_a_component_with_text_as_string_literals() {
     let out = s.execute("inspect.code", &json!({"id": card, "language": "leptos", "unit": "rem"})).unwrap();
     assert!(out["code"].as_str().unwrap().contains("width: 12.5rem;"), "{}", out["code"]);
 }
+
+fn web_code(s: &mut Session, id: figcraft_doc::NodeId, language: &str, unit: &str) -> String {
+    let out = s.execute("inspect.code", &json!({"id": id, "language": language, "unit": unit})).unwrap();
+    out["code"].as_str().unwrap().to_string()
+}
+
+#[test]
+fn rem_preserves_text_in_web_markup() {
+    let mut s = Session::new();
+    let frame = id(s.execute("frame.create", &json!({"width": 200, "height": 100, "name": "Card"})).unwrap());
+    s.execute("text.create", &json!({"text": "Tile 24px", "parent": frame, "name": "Label"})).unwrap();
+    let mut changed = Vec::new();
+    for language in ["html", "react", "leptos"] {
+        let px = web_code(&mut s, frame, language, "px");
+        let rem = web_code(&mut s, frame, language, "rem");
+        assert!(px.contains("Tile 24px"), "{language}: px control: {px}");
+        assert!(rem.contains("width: 12.5rem;"), "{language}: width: {rem}");
+        assert!(rem.contains("font-size: 0.75rem;"), "{language}: font: {rem}");
+        if !rem.contains("Tile 24px") {
+            changed.push(language);
+        }
+    }
+    assert!(changed.is_empty(), "text rewritten in {changed:?}");
+}
+
+#[test]
+fn rem_preserves_text_property_default() {
+    let mut s = Session::new();
+    let frame = id(s.execute("frame.create", &json!({"width": 100, "height": 40, "name": "Chip"})).unwrap());
+    let label = id(s.execute("text.create", &json!({"text": "24px", "parent": frame, "name": "Label"})).unwrap());
+    let component = id(s.execute("component.create", &json!({"ids": [frame]})).unwrap());
+    s.execute("component.addProperty", &json!({"id": component, "name": "Label", "type": "text", "default": "24px", "layer": label})).unwrap();
+    for unit in ["px", "rem"] {
+        let code = web_code(&mut s, component, "react", unit);
+        assert!(code.contains("label = \"24px\""), "{unit}: changed default: {code}");
+        if unit == "rem" {
+            assert!(code.contains("width: 6.25rem;"), "rem still converts lengths: {code}");
+        }
+    }
+}

crates/engine/src/huge_stroke_tests.rs

@@ -0,0 +1,28 @@
+//! An absurd stroke weight must not take the renderer down with it: saving (thumbnail) and exporting still work.
+
+use serde_json::{Value, json};
+
+use crate::Session;
+use crate::params::id_of;
+use figcraft_doc::NodeId;
+
+fn id(v: Value) -> NodeId {
+    id_of(&v["id"]).unwrap()
+}
+
+#[test]
+fn huge_stroke_weight_with_round_caps_still_saves_and_exports() {
+    for weight in [1e6, 1e7, 1e10, 1e30] {
+        let mut s = Session::new();
+        let f = id(s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 100, "height": 100})).unwrap());
+        let v = id(s.execute("vector.create", &json!({"parent": f, "path": "M0 0.8333 L7.5 6.25 L15 0.8333"})).unwrap());
+        s.execute("node.set", &json!({"id": v, "props": {"stroke": "#ff0000", "strokeWeight": weight, "strokeCap": "round", "strokeJoin": "round"}}))
+            .unwrap();
+        let path = std::env::temp_dir().join(format!("figcraft-huge-stroke-{}-{weight}.figcraft", std::process::id()));
+        let saved = s.execute("file.saveAs", &json!({"path": path.to_string_lossy()}));
+        let _ = std::fs::remove_file(&path);
+        assert!(saved.is_ok(), "saveAs at weight {weight}: {:?}", saved.err());
+        let exported = s.execute("file.export", &json!({"ids": [f], "format": "png"}));
+        assert!(exported.is_ok(), "export at weight {weight}: {:?}", exported.err());
+    }
+}

crates/engine/src/id_params_behaviour_tests.rs

@@ -0,0 +1,161 @@
+//! Layer ids in params: naming something that isn't a layer is a mistake, and says so, rather than
+//! quietly meaning "none".
+//!
+//! `node.create`'s `parent` was `id(p, "parent").unwrap_or(page)`, so any value that isn't an id —
+//! a `{"$step": n}` nothing had resolved, a name, a negative number — became "no parent" and the
+//! layer landed on the page while the call reported success. The same shape sat on `image.place`
+//! and `instance.create`'s parents, on `index`, and on the `ids` of every command that targets
+//! layers (an entry that wasn't an id was dropped and the rest ran).
+
+use crate::params::id_of;
+use crate::{EngineError, Session};
+use figcraft_doc::*;
+use serde_json::{Value, json};
+
+/// The page's children, by name (bottom first).
+fn top(s: &Session) -> Vec<String> {
+    let doc = s.doc().unwrap();
+    let page = s.page().unwrap();
+    doc.node(page).unwrap().children.iter().filter_map(|c| doc.node(*c).map(|n| n.name.clone())).collect()
+}
+
+/// The message of a failure, or `None` when the call went through.
+fn failed(r: std::result::Result<Value, EngineError>) -> Option<String> {
+    match r {
+        Ok(_) => None,
+        Err(e) => Some(e.to_string()),
+    }
+}
+
+fn rect(parent: Value) -> Value {
+    json!({"type": "rectangle", "name": "child", "parent": parent, "x": 0, "y": 0, "width": 10, "height": 10})
+}
+
+fn card(s: &mut Session) -> NodeId {
+    let v = s.execute("node.create", &json!({"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 100, "height": 100})).unwrap();
+    id_of(&v["id"]).unwrap()
+}
+
+#[test]
+fn a_parent_that_is_not_an_id_is_refused_rather_than_becoming_the_page() {
+    let mut s = Session::new();
+    let card = card(&mut s);
+    for parent in [json!({"$step": 0}), json!("Card"), json!(-1), json!(true)] {
+        let msg = failed(s.execute("node.create", &rect(parent.clone()))).unwrap_or_else(|| panic!("{parent} must be refused"));
+        assert!(msg.contains("`parent` must be a node id"), "{parent}: {msg}");
+    }
+    assert_eq!(top(&s), ["Card"], "nothing landed on the page");
+    let doc = s.doc().unwrap();
+    assert!(doc.node(card).unwrap().children.is_empty(), "nor inside the frame");
+}
+
+#[test]
+fn leaving_the_parent_out_or_null_still_means_the_page() {
+    let mut s = Session::new();
+    let card = card(&mut s);
+    for parent in [None, Some(json!(null))] {
+        let mut p = rect(json!(0));
+        match parent {
+            None => _ = p.as_object_mut().unwrap().remove("parent"),
+            Some(v) => p["parent"] = v,
+        }
+        s.execute("node.create", &p).unwrap();
+    }
+    assert_eq!(top(&s), ["Card", "child", "child"]);
+    let doc = s.doc().unwrap();
+    assert!(doc.node(card).unwrap().children.is_empty());
+}
+
+#[test]
+fn a_parent_id_that_names_nothing_is_still_reported() {
+    let mut s = Session::new();
+    card(&mut s);
+    let msg = failed(s.execute("node.create", &rect(json!(99999)))).unwrap_or_else(|| panic!("a missing layer must fail"));
+    assert!(msg.contains("no such node 99999"), "{msg}");
+}
+
+#[test]
+fn an_index_that_is_not_a_whole_non_negative_number_is_refused() {
+    let mut s = Session::new();
+    let card = card(&mut s);
+    // (A boolean is a number to `f64_of` — `true` reads as 1 — as for `x`, `width` and every
+    // other number, so it is deliberately not in this list.)
+    for index in [json!("last"), json!(1.5), json!(-1), json!(-0.5), json!(1e12)] {
+        let mut p = rect(json!(card));
+        p["index"] = index.clone();
+        let msg = failed(s.execute("node.create", &p)).unwrap_or_else(|| panic!("index {index} must be refused"));
+        assert!(msg.contains("`index`"), "{index}: {msg}");
+    }
+    let doc = s.doc().unwrap();
+    assert!(doc.node(card).unwrap().children.is_empty(), "nothing was inserted");
+}
+
+#[test]
+fn a_whole_index_still_inserts_where_it_says() {
+    let mut s = Session::new();
+    let card = card(&mut s);
+    for name in ["a", "b"] {
+        s.execute("node.create", &json!({"type": "rectangle", "name": name, "parent": card, "x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+    }
+    s.execute("node.create", &json!({"type": "rectangle", "name": "mid", "parent": card, "index": 1, "x": 0, "y": 0, "width": 10, "height": 10}))
+        .unwrap();
+    let doc = s.doc().unwrap();
+    let names: Vec<&str> = doc.node(card).unwrap().children.iter().filter_map(|c| doc.node(*c).map(|n| n.name.as_str())).collect();
+    assert_eq!(names, ["a", "mid", "b"]);
+}
+
+#[test]
+fn ids_entries_that_are_not_ids_are_refused_instead_of_being_dropped() {
+    let mut s = Session::new();
+    let card = card(&mut s);
+    // The junk used to be dropped and the rest applied, so `["nope", card]` renamed the frame.
+    for ids in [json!(["nope"]), json!(["nope", card]), json!([{"$step": 0}, card]), json!([null])] {
+        let msg =
+            failed(s.execute("node.set", &json!({"ids": ids, "props": {"name": "renamed"}}))).unwrap_or_else(|| panic!("{ids} must be refused"));
+        assert!(msg.contains("`ids`"), "{ids}: {msg}");
+    }
+    let doc = s.doc().unwrap();
+    assert_eq!(doc.node(card).unwrap().name, "Card", "nothing was renamed");
+}
+
+#[test]
+fn an_ids_that_is_not_an_array_is_refused_but_null_means_the_selection() {
+    let mut s = Session::new();
+    let card = card(&mut s);
+    let msg =
+        failed(s.execute("node.set", &json!({"ids": "nope", "props": {"name": "renamed"}}))).unwrap_or_else(|| panic!("a non-array ids must fail"));
+    assert!(msg.contains("`ids` must be an array"), "{msg}");
+    // An explicit null says the same as leaving it out: the selection.
+    s.execute("select.set", &json!({"ids": [card]})).unwrap();
+    s.execute("node.set", &json!({"ids": null, "props": {"name": "Selected"}})).unwrap();
+    assert_eq!(s.doc().unwrap().node(card).unwrap().name, "Selected");
+}
+
+#[test]
+fn a_single_id_that_is_not_an_id_is_refused() {
+    let mut s = Session::new();
+    card(&mut s);
+    let msg =
+        failed(s.execute("node.set", &json!({"id": {"$step": 0}, "props": {"name": "renamed"}}))).unwrap_or_else(|| panic!("a bad id must fail"));
+    assert!(msg.contains("`id` must be a node id"), "{msg}");
+}
+
+#[test]
+fn an_image_and_an_instance_parent_are_checked_the_same_way() {
+    let mut s = Session::new();
+    card(&mut s);
+    let img = failed(s.execute("image.place", &json!({"data": "aGk=", "parent": {"$step": 0}})));
+    assert!(img.unwrap_or_default().contains("`parent` must be a node id"), "image.place");
+    let inst = failed(s.execute("instance.create", &json!({"component": 99999, "parent": {"$step": 0}})));
+    assert!(inst.is_some(), "instance.create refuses both a bad component and a bad parent");
+}
+
+#[test]
+fn a_huge_bad_value_is_cut_short_in_the_error() {
+    let mut s = Session::new();
+    card(&mut s);
+    let junk = "é".repeat(10_000);
+    let msg = failed(s.execute("node.set", &json!({"ids": junk, "props": {"name": "renamed"}}))).unwrap_or_else(|| panic!("must fail"));
+    assert!(msg.contains("`ids` must be an array") && msg.ends_with("…)"), "{msg}");
+    assert!(msg.chars().count() < 200, "{} chars", msg.chars().count());
+}

crates/engine/src/import_journal_tests.rs

@@ -0,0 +1,51 @@
+//! Imported file bytes already live in the document: the command log keeps no second copy.
+
+use base64::Engine as _;
+use serde_json::{Value, json};
+
+use crate::Session;
+
+const SVG: &str = r##"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><rect width="40" height="20" fill="#3366cc"/></svg>"##;
+
+fn payload() -> String {
+    base64::engine::general_purpose::STANDARD.encode(SVG)
+}
+
+fn holds_payload(journal: &[(String, Value)]) -> bool {
+    let payload = payload();
+    journal.iter().any(|(_, params)| params.to_string().contains(&payload))
+}
+
+#[test]
+fn byte_imports_keep_no_payload_in_the_journal() {
+    let mut s = Session::new();
+    let before = s.doc().unwrap().node_count();
+    s.execute("file.import", &json!({"data": payload(), "name": "pasted.svg"})).unwrap();
+    assert!(!holds_payload(&s.journal), "the journal must not retain the Base64 file");
+    // Not journaling is no change to the edit itself: still one undo step.
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.doc().unwrap().node_count(), before);
+}
+
+#[test]
+fn batch_wrappers_do_not_retain_import_payloads() {
+    let mut s = Session::new();
+    let nested =
+        json!({"command": "command.batch", "params": {"commands": [{"command": "file.import", "params": {"data": payload(), "name": "a.svg"}}]}});
+    s.execute("command.batch", &json!({"commands": [nested]})).unwrap();
+    assert!(!holds_payload(&s.journal));
+}
+
+#[test]
+fn path_imports_and_ordinary_edits_are_still_journaled() {
+    let dir = std::env::temp_dir().join(format!("figcraft-import-journal-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("kit.svg");
+    std::fs::write(&path, SVG).unwrap();
+    let mut s = Session::new();
+    s.execute("file.import", &json!({"path": path.to_string_lossy()})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+    let ids: Vec<_> = s.journal.iter().map(|(id, _)| id.as_str()).collect();
+    assert_eq!(ids, ["file.import", "shape.rectangle"]);
+    std::fs::remove_dir_all(&dir).ok();
+}

crates/engine/src/inspect.rs

@@ -191,7 +191,7 @@ pub fn node_json(doc: &Document, id: NodeId, depth: usize) -> Value {
                 o.insert("textDecorationSkipInk".into(), json!(l.skip_ink));
                 o.insert("textDecorationColor".into(), l.color.map_or(json!("auto"), |c| json!(format!("#{}", c.to_hex()))));
             }
-            // Lists: one style for the layer, or each paragraph's type and nesting level.
+            // Lists: one style for the layer, or each paragraph's type, nesting level and start.
             if t.paragraphs.is_empty() {
                 if t.list != figcraft_doc::ListStyle::None {
                     o.insert("listStyle".into(), json!(t.list));
@@ -199,6 +199,9 @@ pub fn node_json(doc: &Document, id: NodeId, depth: usize) -> Value {
             } else {
                 o.insert("lineTypes".into(), t.paragraphs.iter().map(|p| json!(p.list)).collect());
                 o.insert("lineIndentations".into(), t.paragraphs.iter().map(|p| json!(p.indent)).collect());
+                if t.paragraphs.iter().any(|p| p.start_offset > 0) {
+                    o.insert("listStartOffsets".into(), t.paragraphs.iter().map(|p| json!(p.start_offset)).collect());
+                }
             }
             if t.list_spacing != 0.0 {
                 o.insert("listSpacing".into(), json!(t.list_spacing));

crates/engine/src/lib.rs

@@ -357,8 +357,8 @@ pub struct DocState {
     versions_changed: bool,
     /// A version shown in place of the document (read-only).
     pub preview: Option<VersionPreview>,
-    /// The document under a live text preview (a hovered text style or font instance, a dragged
-    /// axis slider): `doc` shows the preview until [`textpreview::end`] puts this back.
+    /// The document under a live text preview (a hovered font family or style, text style or
+    /// font instance, a dragged axis slider): `doc` shows the preview until [`textpreview::end`] puts this back.
     pub text_preview: Option<Arc<Document>>,
     /// The document as of the last version saved or restored (none yet): autosaves, restores and
     /// merges only add a checkpoint for changes since.
@@ -390,7 +390,8 @@ pub struct VersionPreview {
 /// Why edits are refused while a version is shown.
 pub const PREVIEW_READ_ONLY: &str = "you're viewing an earlier version: restore it or go back to the current version to edit";
 
-/// Commands that first end a version preview: they act on the document itself.
+/// Commands that first end a version preview: they act on the document itself. Saving does so
+/// only with a native destination; export copies and pending format choices keep the preview.
 const ENDS_PREVIEW: &[&str] = &["file.save", "file.saveAs", "file.close", "file.revert", "file.saveVersion", "file.duplicate", "version.restore"];
 
 static NEXT_UID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
@@ -401,6 +402,8 @@ impl DocState {
             doc.repair();
         }
         doc.link_layer_text_styles();
+        cmd::styles::apply_paint_bindings_on_load(&mut doc);
+        // Initial import settlement belongs to the saved baseline, not the user's first edit.
         let page = doc.current_page.filter(|p| doc.pages.contains(p)).or_else(|| doc.first_page()).unwrap_or(NodeId(0));
         let doc = Arc::new(doc);
         let mut st = Self {
@@ -606,6 +609,9 @@ pub struct Prefs {
     /// The widths of the main window's left and right panels (the interface keeps them within its
     /// limits; other windows have their own while they are open).
     pub panel_widths: (f32, f32),
+    /// The height asked for the main window's pages list, dragged at its lower edge (`None`: a
+    /// share of the panel; the interface keeps it within its limits).
+    pub pages_height: Option<f32>,
     /// The interface language: a language code ("en", "es", "pt-BR") or "system" (the OS or browser
     /// language). Languages without a catalog show English.
     pub language: String,
@@ -652,8 +658,16 @@ pub struct Prefs {
     pub home_sort: String,
     /// Which way: `"desc"` (newest first, Z to A) or `"asc"`.
     pub home_order: String,
+    /// Recently run actions (the Actions palette's Recents), newest first, at most
+    /// [`MAX_RECENT_ACTIONS`]. Entries are `command:<id>`, `plugin:<plugin>/<command>` or
+    /// `widget:<plugin>`.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub recent_actions: Vec<String>,
 }
 
+/// Recently run actions kept for the Actions palette (newest first).
+pub const MAX_RECENT_ACTIONS: usize = 5;
+
 impl Default for Prefs {
     fn default() -> Self {
         Self {
@@ -666,6 +680,7 @@ impl Default for Prefs {
             show_dimensions: true,
             theme: "system".into(),
             panel_widths: (240.0, 240.0),
+            pages_height: None,
             language: "system".into(),
             user_name: cmd::comment::DEFAULT_AUTHOR.into(),
             reduce_motion: false,
@@ -681,6 +696,7 @@ impl Default for Prefs {
             home_views: BTreeMap::new(),
             home_sort: "modified".into(),
             home_order: "desc".into(),
+            recent_actions: Vec::new(),
         }
     }
 }
@@ -721,7 +737,8 @@ pub struct Session {
     /// dark page colour while it is dark (added pages take the current page's). Headless sessions (CLI, MCP, exports) have no
     /// theme, so what scripts make is the same everywhere.
     pub ui_dark: Option<bool>,
-    /// Command log (id + params) for actions/automation.
+    /// Command log (id + params) for actions/automation. File imports that carry the file bytes
+    /// (`file.import` with `data`) are not logged, so the log never holds a copy of a pasted file.
     pub journal: Vec<(String, Value)>,
     /// Recently used colours.
     pub recent_colors: Vec<figcraft_color::Color>,
@@ -746,6 +763,19 @@ impl Default for Session {
     }
 }
 
+/// Whether a command, or a batch wrapping one, imports a file passed as Base64 `data`.
+fn command_carries_import_bytes(id: &str, params: &Value) -> bool {
+    match id {
+        "file.import" => params::get(params, "data").is_some(),
+        "command.batch" => params.get("commands").and_then(Value::as_array).is_some_and(|commands| {
+            commands.iter().any(|c| {
+                c.get("command").and_then(Value::as_str).zip(c.get("params")).is_some_and(|(id, params)| command_carries_import_bytes(id, params))
+            })
+        }),
+        _ => false,
+    }
+}
+
 impl Session {
     /// A session with one new document.
     pub fn new() -> Self {
@@ -870,6 +900,7 @@ impl Session {
         // Every other command acts on the document itself, not on a live text preview.
         textpreview::end(self);
         if ENDS_PREVIEW.contains(&id)
+            && (!matches!(id, "file.save" | "file.saveAs") || cmd::file::save_ends_preview(self, id, params))
             && let Ok(ds) = self.ds_mut()
         {
             ds.end_preview();
@@ -878,16 +909,21 @@ impl Session {
         let result = guard::run(id, || (spec.run)(self, params))
             .and_then(|v| self.check_instance_structure(id, &before).map(|()| v))
             .and_then(|v| self.check_preview(id, &before).map(|()| v))
-            .and_then(|v| self.check_live_access(id, &before).map(|()| v));
+            .and_then(|v| self.check_live_access(id, &before).map(|()| v))
+            .and_then(|v| self.check_finite_geometry(id, &before).map(|()| v));
         match &result {
             Ok(_) => {
                 self.after_command(spec, before);
                 if spec.history && id != "edit.repeat" {
                     self.last_command = Some((id.to_string(), params.clone()));
                 }
-                self.journal.push((id.to_string(), params.clone()));
-                if self.journal.len() > 5000 {
-                    self.journal.drain(..1000);
+                // Imported bytes already live in the document: a Base64 copy in the log would stay
+                // for the whole session.
+                if !command_carries_import_bytes(id, params) {
+                    self.journal.push((id.to_string(), params.clone()));
+                    if self.journal.len() > 5000 {
+                        self.journal.drain(..1000);
+                    }
                 }
             }
             Err(_) => {
@@ -916,6 +952,22 @@ impl Session {
         Err(EngineError::Disabled(id.to_string(), PREVIEW_READ_ONLY.into()))
     }
 
+    /// A layer's position and size stay finite: infinity and NaN are written as `null`, so a file
+    /// holding them saves but can't be reopened. Refuse such an edit (it is rolled back).
+    fn check_finite_geometry(&self, id: &str, before: &Option<(Arc<Document>, Vec<NodeId>, NodeId, u64)>) -> Result<()> {
+        let Some((bdoc, _, _, uid)) = before else { return Ok(()) };
+        let Some(ds) = self.docs.iter().find(|d| d.uid == *uid) else { return Ok(()) };
+        if Arc::ptr_eq(&ds.doc, bdoc) {
+            return Ok(());
+        }
+        let broken = |n: &Node| !(n.transform.as_coeffs().iter().all(|c| c.is_finite()) && n.width.is_finite() && n.height.is_finite());
+        let untouched = |n: &Node| bdoc.node_arc(n.id).zip(ds.doc.node_arc(n.id)).is_some_and(|(a, b)| Arc::ptr_eq(a, b));
+        match ds.doc.nodes().find(|n| broken(n) && !untouched(n)) {
+            Some(n) => Err(bad(id, format!("\"{}\" would get a position or size beyond the number range", n.name))),
+            None => Ok(()),
+        }
+    }
+
     /// A live session's document you may only view (or that is on its way to a server) is
     /// read-only: refuse an edit (it is rolled back).
     fn check_live_access(&self, id: &str, before: &Option<(Arc<Document>, Vec<NodeId>, NodeId, u64)>) -> Result<()> {
@@ -1135,13 +1187,22 @@ impl Session {
         self.grouped(label, |s| {
             let mut results: Vec<Value> = Vec::with_capacity(cmds.len());
             for (step, (id, p)) in cmds.iter().enumerate() {
-                let p = if id == "command.batch" { p.clone() } else { resolve_step_refs(p, &results, step, 0)? };
-                results.push(s.execute(id, &p)?);
+                let v = s.batch_step(&results, step, id, p)?;
+                results.push(v);
             }
             Ok(results)
         })
     }
 
+    /// One step of a batch: `{"$step": n}` in `params` resolves against `results` (the results of
+    /// the steps before it), then the command runs. [`Session::batch`] runs a list of these as one
+    /// undo step; a caller with its own list — the CLI's script runner — uses this so its steps
+    /// resolve `$step` the same way, inside its own [`Session::grouped`].
+    pub fn batch_step(&mut self, results: &[Value], step: usize, cmd: &str, params: &Value) -> Result<Value> {
+        let p = if cmd == "command.batch" { params.clone() } else { resolve_step_refs(params, results, step, 0)? };
+        self.execute(cmd, &p)
+    }
+
     /// Run `f` as one undo step called `label`: the commands it executes push no steps of their
     /// own, and when it fails the documents stay at their group-start state.
     pub fn grouped<T>(&mut self, label: &str, f: impl FnOnce(&mut Self) -> Result<T>) -> Result<T> {
@@ -1236,8 +1297,8 @@ pub fn changed_nodes(doc: &Document, before: &Document) -> Vec<NodeId> {
 pub fn normalize(doc: &mut Document, before: &Document) {
     // Only what was touched since the last normalisation (edited, added or removed).
     let mut touched: BTreeSet<NodeId> = doc.take_dirty();
-    // A variable edit changes no layer directly, but bound layers must follow it.
-    if touched.is_empty() && doc.variables == before.variables {
+    // A variable or style edit changes no layer directly, but bound and linked layers must follow it.
+    if touched.is_empty() && doc.variables == before.variables && doc.styles == before.styles {
         return;
     }
     let m = measure::TextMeasure;
@@ -1500,6 +1561,8 @@ mod cursor_tests;
 #[cfg(test)]
 mod dark_page_text_tests;
 #[cfg(test)]
+mod design_paste_tests;
+#[cfg(test)]
 mod dev_resources_tests;
 #[cfg(test)]
 mod devcompare_tests;
@@ -1528,6 +1591,8 @@ mod fig_export_tests;
 #[cfg(test)]
 mod fig_import_tests;
 #[cfg(test)]
+mod finite_geometry_tests;
+#[cfg(test)]
 mod frame_guides_tests;
 #[cfg(test)]
 mod frame_label_tests;
@@ -1548,8 +1613,14 @@ mod history_behaviour_tests;
 #[cfg(test)]
 mod html_codegen_tests;
 #[cfg(test)]
+mod huge_stroke_tests;
+#[cfg(test)]
+mod id_params_behaviour_tests;
+#[cfg(test)]
 mod import_export_tests;
 #[cfg(test)]
+mod import_journal_tests;
+#[cfg(test)]
 mod inspect_behaviour_tests;
 #[cfg(test)]
 mod interaction_rollback_tests;
@@ -1558,8 +1629,12 @@ mod invite_links_tests;
 #[cfg(test)]
 mod keymap_tests;
 #[cfg(test)]
+mod library_range_styles_tests;
+#[cfg(test)]
 mod library_variables_tests;
 #[cfg(test)]
+mod line_endings_tests;
+#[cfg(test)]
 mod live_access_tests;
 #[cfg(test)]
 mod live_docs_tests;
@@ -1586,6 +1661,14 @@ mod open_issues_tests;
 #[cfg(test)]
 mod outline_options_tests;
 #[cfg(test)]
+mod page_clipboard_tests;
+#[cfg(test)]
+mod page_copy_navigation_tests;
+#[cfg(test)]
+mod page_target_tests;
+#[cfg(test)]
+mod paint_index_tests;
+#[cfg(test)]
 mod paint_reorder_tests;
 #[cfg(test)]
 mod paint_tests;
@@ -1634,6 +1717,8 @@ mod rotated_select_tests;
 #[cfg(test)]
 mod rotation_origin_tests;
 #[cfg(test)]
+mod save_format_tests;
+#[cfg(test)]
 mod scale_tool_tests;
 #[cfg(test)]
 mod section_contents_tests;
@@ -1702,6 +1787,8 @@ mod vector_behaviour_tests;
 #[cfg(test)]
 mod vector_multi_behaviour_tests;
 #[cfg(test)]
+mod vector_offset_tests;
+#[cfg(test)]
 mod version_preview_tests;
 #[cfg(test)]
 mod version_tests;

crates/engine/src/library.rs

@@ -134,9 +134,12 @@ pub fn closure(doc: &Document, roots: &[NodeId]) -> Vec<NodeId> {
     out
 }
 
-/// The style ids a layer links to (fill, stroke, effect, grid, text).
+/// The style ids a layer links to (fill, stroke, effect, grid, text, and text styles on
+/// character ranges).
 pub(crate) fn style_links(n: &Node) -> impl Iterator<Item = &String> {
-    [&n.styles.fill, &n.styles.stroke, &n.styles.effect, &n.styles.grid, &n.styles.text].into_iter().flatten()
+    let chars =
+        n.kind.text().into_iter().flat_map(|t| std::iter::once(&t.style).chain(t.runs.iter().map(|r| &r.style))).filter_map(|s| s.style_id.as_ref());
+    [&n.styles.fill, &n.styles.stroke, &n.styles.effect, &n.styles.grid, &n.styles.text].into_iter().flatten().chain(chars)
 }
 
 /// Style ids the layers under `roots` link to.
@@ -446,9 +449,27 @@ struct Stamp {
 #[derive(Clone, Debug)]
 struct Entry {
     stamp: Option<Stamp>,
+    /// When the file was read: a stamp only proves the file unchanged once its modification time
+    /// is safely older than that, since file systems keep the time in coarse ticks.
+    read_at: Option<std::time::SystemTime>,
     result: std::result::Result<Arc<PublishedLibrary>, String>,
 }
 
+/// How far a file's modification time must lie before its read for the stamp to be trusted.
+const RACY_STAMP: std::time::Duration = std::time::Duration::from_secs(2);
+
+impl Entry {
+    /// A file stamped in the future (clock skew, unpacked archives) never settles: it is re-read on
+    /// every load until the clock passes it.
+    fn still_valid(&self, now: &Stamp) -> bool {
+        let settled = match (now.modified, self.read_at) {
+            (Some(modified), Some(read_at)) => modified.checked_add(RACY_STAMP).is_some_and(|t| t < read_at),
+            _ => false,
+        };
+        settled && self.stamp.as_ref() == Some(now)
+    }
+}
+
 /// Library files read by a session, by path (re-read when they change on disk).
 #[derive(Clone, Debug, Default)]
 pub struct Cache {
@@ -478,10 +499,11 @@ impl Cache {
             return Err(EngineError::Other(format!("{path} is too large to use as a library (the limit is {} MB)", max_bytes / 1024 / 1024)));
         }
         if let (Some(e), Ok(st)) = (self.entries.get(path), &stamp)
-            && e.stamp.as_ref() == Some(st)
+            && e.still_valid(st)
         {
             return e.result.clone().map_err(EngineError::Other);
         }
+        let read_at = now();
         let result = match &stamp {
             Ok(_) => read_file(path).map(Arc::new),
             Err(e) => Err(e.clone()),
@@ -489,7 +511,7 @@ impl Cache {
         if self.entries.len() >= MAX_CACHED && !self.entries.contains_key(path) {
             self.entries.clear();
         }
-        self.entries.insert(path.to_string(), Entry { stamp: stamp.ok(), result: result.clone() });
+        self.entries.insert(path.to_string(), Entry { stamp: stamp.ok(), read_at, result: result.clone() });
         result.map_err(EngineError::Other)
     }
 
@@ -503,10 +525,20 @@ impl Cache {
         if self.entries.len() >= MAX_CACHED && !self.entries.contains_key(path) {
             self.entries.clear();
         }
-        self.entries.insert(path.to_string(), Entry { stamp: None, result });
+        self.entries.insert(path.to_string(), Entry { stamp: None, read_at: None, result });
     }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
+fn now() -> Option<std::time::SystemTime> {
+    Some(std::time::SystemTime::now())
+}
+
+#[cfg(target_arch = "wasm32")]
+fn now() -> Option<std::time::SystemTime> {
+    None
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn stat(path: &str) -> std::result::Result<Stamp, String> {
     let m = std::fs::metadata(path).map_err(|e| format!("{path}: {e}"))?;
@@ -582,11 +614,15 @@ fn local_key(lid: &str, key: &str, taken: impl Fn(&str) -> bool) -> String {
 }
 
 /// Copy library styles `keys` into `doc` as linked remote styles (with `update`, copies older than
-/// the library's are refreshed). Returns library style id → local id.
+/// the library's are refreshed). The variables a written copy binds are imported too and its
+/// bindings point at their copies (never at this file's variables of the same ids). Returns library
+/// style id → local id.
 pub fn import_styles(doc: &mut Document, lib: &PublishedLibrary, keys: &BTreeSet<String>, update: bool) -> BTreeMap<String, String> {
     let lid = lib.manifest.id.clone();
     let mut out = BTreeMap::new();
     let mut hashes = BTreeSet::new();
+    // Local ids of the copies written now, with the library style they copy.
+    let mut written: Vec<(String, &Style)> = Vec::new();
     for key in keys {
         let Some(style) = lib.doc.styles.iter().find(|s| s.id == *key) else { continue };
         let version = lib.manifest.style(key).map_or(lib.manifest.version, |s| s.version);
@@ -598,6 +634,7 @@ pub fn import_styles(doc: &mut Document, lib: &PublishedLibrary, keys: &BTreeSet
                 {
                     *slot = Style { id: r.local.clone(), ..style.clone() };
                     set_record(&mut doc.libraries_mut().styles, ImportedStyle { version, ..r.clone() });
+                    written.push((r.local.clone(), style));
                 }
                 r.local
             }
@@ -605,6 +642,7 @@ pub fn import_styles(doc: &mut Document, lib: &PublishedLibrary, keys: &BTreeSet
                 let local = local_key(&lid, key, |l| doc.styles.iter().any(|s| s.id == l));
                 doc.styles.push(Style { id: local.clone(), ..style.clone() });
                 set_record(&mut doc.libraries_mut().styles, ImportedStyle { library: lid.clone(), key: key.clone(), local: local.clone(), version });
+                written.push((local.clone(), style));
                 local
             }
         };
@@ -613,6 +651,17 @@ pub fn import_styles(doc: &mut Document, lib: &PublishedLibrary, keys: &BTreeSet
         }
         out.insert(key.clone(), local);
     }
+    let bound: BTreeSet<VariableId> = written.iter().flat_map(|(_, s)| s.bound.values().cloned()).collect();
+    if !bound.is_empty() {
+        let vars = import_variables(doc, lib, &bound, &BTreeSet::new(), update);
+        for (local, _) in &written {
+            if let Some(slot) = doc.styles.iter_mut().find(|s| s.id == *local) {
+                // Bindings to variables the library lacks are dropped (the published value stays).
+                slot.bound =
+                    std::mem::take(&mut slot.bound).into_iter().filter_map(|(f, v)| vars.variables.get(&v).map(|l| (f, l.clone()))).collect();
+            }
+        }
+    }
     copy_images(doc, &lib.doc, &hashes);
     out
 }
@@ -1201,9 +1250,16 @@ pub fn check_read_only(cmd: &str, before: &Document, after: &Document) -> std::r
     if !variables_unchanged(before, after) {
         return Err(READ_ONLY.into());
     }
-    let Some(store) = after.library_store().or_else(|| before.library_store()) else { return Ok(()) };
-    let touched = |d: &Document, id: NodeId| d.contains(id) && d.page_of(id) == Some(store);
-    if after.dirty().iter().any(|id| touched(before, *id) || touched(after, *id)) {
+    let changed_remote = |id| {
+        if !before.is_remote(id) && !after.is_remote(id) {
+            return false;
+        }
+        match (before.node_arc(id), after.node_arc(id)) {
+            (Some(old), Some(new)) => !Arc::ptr_eq(old, new),
+            _ => true,
+        }
+    };
+    if after.dirty().iter().any(|id| changed_remote(*id)) {
         return Err(READ_ONLY.into());
     }
     Ok(())

crates/engine/src/library_range_styles_tests.rs

@@ -0,0 +1,66 @@
+//! Text styles linked on character ranges travel with components (publish and place).
+
+use crate::Session;
+use figcraft_doc::NodeId;
+use serde_json::{Value, json};
+
+fn run(s: &mut Session, command: &str, params: Value) -> Value {
+    s.execute(command, &params).unwrap_or_else(|e| panic!("{command}: {e}"))
+}
+
+fn node(value: Value) -> NodeId {
+    NodeId(value["id"].as_u64().unwrap())
+}
+
+/// A component with "Hello" (chars 0..2 linked to a range style) and "World" (whole-layer style).
+fn fixture() -> (Session, NodeId, String, String) {
+    let mut s = Session::new();
+    let frame = node(run(&mut s, "frame.create", json!({"name":"Card", "width":100, "height":40})));
+    let text = node(run(&mut s, "text.create", json!({"parent":frame, "text":"Hello"})));
+    let range = run(&mut s, "style.create", json!({"type":"text", "name":"Emphasis", "value":{"fontSize":32}}))["id"].as_str().unwrap().to_owned();
+    run(&mut s, "style.apply", json!({"id":text, "style":range, "start":0, "end":2}));
+    let whole_text = node(run(&mut s, "text.create", json!({"parent":frame, "text":"World"})));
+    let whole = run(&mut s, "style.create", json!({"type":"text", "name":"Whole", "value":{"fontSize":24}}))["id"].as_str().unwrap().to_owned();
+    run(&mut s, "style.apply", json!({"id":whole_text, "style":whole}));
+    let component = node(run(&mut s, "component.create", json!({"ids":[frame]})));
+    let source = s.doc().unwrap().node(text).unwrap();
+    let chars = source.kind.text().unwrap();
+    assert!(source.styles.text.is_none());
+    assert_eq!(chars.style_at(0).style_id.as_deref(), Some(range.as_str()));
+    assert_eq!(chars.style_at(2).style_id, None);
+    (s, component, range, whole)
+}
+
+#[test]
+fn component_publish_keeps_range_text_style() {
+    let (mut s, component, range, whole) = fixture();
+    run(&mut s, "library.publish", json!({"include":[component]}));
+    let snapshot = &s.doc().unwrap().published.as_ref().unwrap().doc;
+    assert!(snapshot.style(&whole).is_some());
+    assert!(snapshot.style(&range).is_some(), "character-range style missing from snapshot");
+}
+
+#[test]
+fn component_place_imports_range_text_style() {
+    let (mut source, component, range, whole) = fixture();
+    let publication = run(&mut source, "library.publish", json!({}));
+    let library = source.doc().unwrap().published.as_ref().unwrap().clone();
+    assert!(library.doc.style(&range).is_some());
+    let mut target = Session::new();
+    let path = "figcraft://library.test/range-styles";
+    target.libraries.insert(path, Ok(library));
+    run(&mut target, "library.add", json!({"path":path}));
+    let instance = node(run(&mut target, "library.place", json!({"library":publication["id"], "component":component})));
+    let doc = target.doc().unwrap();
+    let children = &doc.node(instance).unwrap().children;
+    let ranged = doc.node(children[0]).unwrap().kind.text().unwrap();
+    let full = doc.node(children[1]).unwrap().kind.text().unwrap();
+    let whole_record = doc.libraries.styles.iter().find(|r| r.key == whole).unwrap();
+    assert_eq!(full.style_at(0).style_id.as_deref(), Some(whole_record.local.as_str()));
+    assert_eq!(ranged.style_at(0).font_size, 32.0);
+    assert!(ranged.style_at(2).style_id.is_none());
+    let record = doc.libraries.styles.iter().find(|r| r.key == range);
+    assert!(record.is_some(), "character-range style missing after placement");
+    assert_eq!(ranged.style_at(0).style_id.as_deref(), record.map(|r| r.local.as_str()));
+    assert!(doc.style(ranged.style_at(0).style_id.as_deref().unwrap()).is_some());
+}

crates/engine/src/library_tests.rs

@@ -45,6 +45,38 @@ fn path_str(p: &std::path::Path) -> String {
     p.to_string_lossy().into_owned()
 }
 
+fn dirty_library_document() -> (Document, NodeId) {
+    let mut doc = Document::new("Dirty library cache");
+    let store = doc.ensure_library_store();
+    let remote = doc.alloc_id();
+    doc.insert(Node::new(remote, NodeKind::Frame, "Remote", 10.0, 10.0), store, None).unwrap();
+    (doc, remote)
+}
+
+/// An imported cache is dirty until the first edit; that alone is no edit of the library copies.
+#[test]
+fn read_only_allows_unchanged_predirty_remote_nodes() {
+    let (before, remote) = dirty_library_document();
+    assert!(before.dirty().contains(&remote));
+
+    let mut after = before.clone();
+    after.add_page("Unrelated page");
+    assert!(after.dirty().contains(&remote), "the imported remote node remains in the pending dirty set");
+    check_read_only("page.add", &before, &after).unwrap();
+
+    let mut edited = before.clone();
+    edited.get_mut(remote).unwrap().opacity = 0.5;
+    assert_eq!(check_read_only("node.set", &before, &edited), Err(READ_ONLY.into()));
+
+    let mut moved = before.clone();
+    moved.reparent(remote, before.first_page().unwrap(), None).unwrap();
+    assert_eq!(check_read_only("node.reparent", &before, &moved), Err(READ_ONLY.into()));
+
+    let mut deleted = before.clone();
+    deleted.remove(remote).unwrap();
+    assert_eq!(check_read_only("edit.delete", &before, &deleted), Err(READ_ONLY.into()));
+}
+
 /// The library file's layers.
 struct Kit {
     button: NodeId,
@@ -179,8 +211,16 @@ fn add_place_and_update_keep_overrides() {
         NodeKind::Instance { component, .. } => component,
         _ => panic!("not an instance"),
     };
+    let unchanged = s.doc().unwrap().clone();
     let e = s.execute("node.set", &json!({"id": remote_button, "props": {"fill": "#ff0000"}})).unwrap_err();
     assert!(e.to_string().contains("can't be edited"), "{e}");
+    assert_eq!(s.doc().unwrap(), &unchanged, "a refused remote edit rolls back");
+    for (cmd, args) in
+        [("node.reparent", json!({"ids": [remote_button], "parent": s.page().unwrap()})), ("edit.delete", json!({"ids": [remote_button]}))]
+    {
+        assert!(s.execute(cmd, &args).is_err(), "{cmd} must preserve read-only copies");
+        assert_eq!(s.doc().unwrap(), &unchanged, "refused {cmd} rolls back");
+    }
     let style = s.doc().unwrap().styles[0].id.clone();
     assert!(s.execute("style.update", &json!({"style": style, "name": "Mine"})).is_err());
     assert!(s.execute("style.delete", &json!({"style": style})).is_err());
@@ -281,10 +321,16 @@ fn library_styles_apply_and_import_with_pages() {
     let copy = doc.nodes().find(|n| n.name == node(&s, inst).name && matches!(n.kind, NodeKind::Instance { .. }) && !doc.is_remote(n.id)).unwrap();
     let NodeKind::Instance { component, .. } = copy.kind else { panic!("not an instance") };
     assert!(doc.is_remote(component));
+    let store_roots = |s: &Session| {
+        let doc = s.doc().unwrap();
+        doc.library_store().and_then(|id| doc.node(id)).map_or(0, |n| n.children.len())
+    };
+    assert_eq!(store_roots(&t), 2, "recorded copies are not copied twice");
     // A second import shares the copies it already has.
     ex(&mut t, "file.import", json!({"path": path}));
     healthy(&t);
     assert_eq!(t.doc().unwrap().libraries.components.len(), 2);
+    assert_eq!(store_roots(&t), 2);
     let _ = std::fs::remove_dir_all(&d);
 }
 
@@ -399,3 +445,21 @@ fn library_survives_saving_with_versions() {
     healthy(&user);
     let _ = std::fs::remove_dir_all(&d);
 }
+
+#[test]
+fn a_file_stamp_from_the_moment_it_was_read_does_not_prove_it_unchanged() {
+    use std::time::{Duration, SystemTime};
+    let read_at = SystemTime::now();
+    let entry = |modified: SystemTime| Entry {
+        stamp: Some(Stamp { len: 10, modified: Some(modified) }),
+        read_at: Some(read_at),
+        result: Err("unused".into()),
+    };
+    // Written in the same coarse tick as the read: a same-length rewrite would keep this stamp.
+    let fresh = entry(read_at);
+    assert!(!fresh.still_valid(&Stamp { len: 10, modified: Some(read_at) }));
+    // Written well before the read: an unchanged stamp means an unchanged file.
+    let old = read_at - Duration::from_secs(10);
+    assert!(entry(old).still_valid(&Stamp { len: 10, modified: Some(old) }));
+    assert!(!entry(old).still_valid(&Stamp { len: 11, modified: Some(old) }));
+}

crates/engine/src/library_variables_tests.rs

@@ -314,3 +314,33 @@ fn library_variable_commands_fail_cleanly() {
     }
     assert!(s.doc().unwrap().libraries.is_empty());
 }
+
+#[test]
+fn library_style_bindings_ignore_unrelated_local_variables() {
+    let d = dir("style-bound");
+    let path = path_str(&d.join("lib.figcraft"));
+    let mut lib = Session::new();
+    ex(&mut lib, "variable.createCollection", json!({"name": "Tokens"}));
+    let var = ex(&mut lib, "variable.create", json!({"collection": "Tokens", "name": "Brand", "type": "color", "value": "#0000ff"}))["id"].clone();
+    let style = ex(&mut lib, "style.create", json!({"type": "paint", "name": "Brand", "value": "#0000ff"}))["id"].clone();
+    ex(&mut lib, "style.bind", json!({"style": style, "field": "fill", "variable": var}));
+    let lid = publish_to(&mut lib, &path);
+
+    let mut s = Session::new();
+    ex(&mut s, "variable.createCollection", json!({"name": "Local"}));
+    let local = ex(&mut s, "variable.create", json!({"collection": "Local", "name": "Unrelated", "type": "color", "value": "#ff0000"}))["id"].clone();
+    assert_eq!(local, var, "the ids must collide for this test");
+    let r = idv(&ex(&mut s, "shape.rectangle", json!({"width": 40, "height": 40})));
+    ex(&mut s, "library.add", json!({"path": path}));
+    ex(&mut s, "library.applyStyle", json!({"library": lid, "style": "Brand", "id": r}));
+    assert_eq!(fill(&s, r), "0000FF");
+    healthy(&s);
+
+    // An updated style follows the library's variable, not the local one.
+    ex(&mut lib, "variable.set", json!({"variable": "Brand", "value": "#00ffff"}));
+    republish(&mut lib);
+    ex(&mut s, "library.acceptUpdates", json!({}));
+    assert_eq!(fill(&s, r), "00FFFF");
+    healthy(&s);
+    let _ = std::fs::remove_dir_all(&d);
+}

crates/engine/src/line_endings_tests.rs

@@ -0,0 +1,56 @@
+//! Text set by a command stores every line ending as LF, like editor insertion does, so layout
+//! sees two lines and no stray glyph for CRLF, bare CR, U+2028 or U+2029.
+
+use serde_json::json;
+
+use crate::Session;
+use crate::components::tests::{card, chars, copy_of, ex, idv};
+use crate::params::id_of;
+
+const INPUTS: [&str; 5] = ["a\nb", "a\r\nb", "a\rb", "a\u{2028}b", "a\u{2029}b"];
+
+#[test]
+fn text_set_normalizes_line_endings() {
+    let mut s = Session::new();
+    let created = s.execute("text.create", &json!({"text": "", "x": 0, "y": 0})).unwrap();
+    let id = id_of(&created["id"]).unwrap();
+    for input in INPUTS {
+        s.execute("text.set", &json!({"id": id, "characters": input})).unwrap();
+        let t = s.doc().unwrap().node(id).unwrap().kind.text().unwrap().clone();
+        assert_eq!(t.characters, "a\nb", "text.set {input:?}");
+    }
+}
+
+#[test]
+fn text_create_normalizes_line_endings() {
+    let mut s = Session::new();
+    for input in INPUTS {
+        let created = s.execute("text.create", &json!({"text": input, "x": 0, "y": 0})).unwrap();
+        let id = id_of(&created["id"]).unwrap();
+        let t = s.doc().unwrap().node(id).unwrap().kind.text().unwrap().clone();
+        assert_eq!(t.characters, "a\nb", "text.create {input:?}");
+    }
+}
+
+#[test]
+fn find_replace_normalizes_line_endings() {
+    for input in INPUTS {
+        let mut s = Session::new();
+        let id = idv(&ex(&mut s, "text.create", json!({"text": "x", "x": 0, "y": 0})));
+        ex(&mut s, "edit.findReplace", json!({"find": "x", "replace": input}));
+        assert_eq!(chars(&s, id), "a\nb", "edit.findReplace {input:?}");
+    }
+}
+
+#[test]
+fn text_property_values_normalize_line_endings() {
+    let mut s = Session::new();
+    let (c, _bg, title, _dot) = card(&mut s);
+    ex(&mut s, "component.addProperty", json!({"id": c, "name": "Title", "type": "text", "layer": title}));
+    let i = idv(&ex(&mut s, "instance.create", json!({"component": c, "x": 300, "y": 0})));
+    let copy = copy_of(&s, i, title);
+    for input in INPUTS {
+        ex(&mut s, "instance.setProperties", json!({"ids": [i], "properties": {"Title": input}}));
+        assert_eq!(chars(&s, copy), "a\nb", "instance.setProperties {input:?}");
+    }
+}

crates/engine/src/open_issues_tests.rs

@@ -49,3 +49,16 @@ fn an_intact_file_opens_without_a_message() {
     assert!(s.message.is_none());
     let _ = std::fs::remove_dir_all(path.parent().unwrap());
 }
+
+#[test]
+fn file_close_rejects_a_bad_index_instead_of_closing_another_document() {
+    let mut s = Session::new();
+    s.execute("file.new", &json!({})).unwrap();
+    s.execute("file.new", &json!({})).unwrap();
+    let docs = s.docs.len();
+    for index in [json!(-1), json!(1.5), json!(99)] {
+        let r = s.execute("file.close", &json!({"index": index, "force": true}));
+        assert!(r.is_err(), "index {index} must be rejected, got {r:?}");
+        assert_eq!(s.docs.len(), docs, "index {index} closed a document");
+    }
+}

crates/engine/src/page_clipboard_tests.rs

@@ -0,0 +1,36 @@
+//! `edit.copy` / `edit.cut` skip pages (they aren't layers and can't be pasted), and refuse a
+//! selection of only pages under their own command id.
+
+use serde_json::json;
+
+use crate::{EngineError, Session};
+
+#[test]
+fn copy_and_cut_ignore_pages_so_paste_keeps_the_document_valid() {
+    for cmd in ["edit.copy", "edit.cut"] {
+        let mut s = Session::new();
+        let page = s.page().unwrap();
+        s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+        match s.execute(cmd, &json!({"ids": [page.0]})) {
+            Err(EngineError::Disabled(id, _)) => assert_eq!(id, cmd),
+            r => panic!("{cmd} on a page: {r:?}"),
+        }
+        let _ = s.execute("edit.paste", &json!({}));
+        let doc = s.doc().unwrap();
+        assert!(doc.validate().is_empty(), "{cmd}: {:?}", doc.validate());
+        assert!(doc.node(page).is_some(), "{cmd} removed the page");
+    }
+}
+
+#[test]
+fn cut_of_a_page_and_a_layer_moves_only_the_layer() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let r = s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+    let rect = crate::params::id_of(&r["id"]).unwrap();
+    s.execute("edit.cut", &json!({"ids": [page.0, rect.0]})).unwrap();
+    assert!(s.doc().unwrap().node(page).is_some());
+    assert!(s.doc().unwrap().node(rect).is_none());
+    s.execute("edit.paste", &json!({})).unwrap();
+    assert!(s.doc().unwrap().validate().is_empty());
+}

crates/engine/src/page_copy_navigation_tests.rs

@@ -0,0 +1,48 @@
+//! Duplicating a page copies its prototype connections: navigation between two frames that are both
+//! on the page leads between the copies, while a destination outside the copied contents is kept.
+
+use figcraft_doc::NodeId;
+use serde_json::{Value, json};
+
+use crate::Session;
+use crate::params::id_of;
+
+fn ex(s: &mut Session, cmd: &str, p: Value) -> Value {
+    s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
+}
+
+fn frame(s: &mut Session, x: f64) -> NodeId {
+    id_of(&ex(s, "frame.create", json!({"x": x, "y": 0, "width": 100, "height": 100}))["id"]).unwrap()
+}
+
+fn dest(s: &Session, id: NodeId) -> NodeId {
+    s.doc().unwrap().node(id).unwrap().interactions[0].actions[0].dest().unwrap()
+}
+
+#[test]
+fn page_copy_navigation_uses_the_copied_destination() {
+    let mut s = Session::new();
+    let first = frame(&mut s, 0.0);
+    let second = frame(&mut s, 200.0);
+    ex(&mut s, "proto.interaction.add", json!({"id": first, "action": {"type": "navigate", "dest": second}}));
+    let copy = id_of(&ex(&mut s, "page.duplicate", json!({}))["id"]).unwrap();
+    let children = s.doc().unwrap().node(copy).unwrap().children.clone();
+    assert_eq!(children.len(), 2);
+    assert_eq!(dest(&s, children[0]), children[1]);
+    let visited = Default::default();
+    assert_eq!(crate::proto_run::navigate_target(s.doc().unwrap(), dest(&s, children[0]), &visited), Some(children[1]));
+    assert_eq!(dest(&s, first), second, "the original keeps its destination");
+}
+
+#[test]
+fn frame_copy_keeps_an_outside_destination() {
+    let mut s = Session::new();
+    let first = frame(&mut s, 0.0);
+    let second = frame(&mut s, 200.0);
+    ex(&mut s, "proto.interaction.add", json!({"id": first, "action": {"type": "navigate", "dest": second}}));
+    ex(&mut s, "select.set", json!({"ids": [first]}));
+    ex(&mut s, "edit.duplicate", json!({}));
+    let copy = s.selection()[0];
+    assert_ne!(copy, first);
+    assert_eq!(dest(&s, copy), second);
+}

crates/engine/src/page_target_tests.rs

@@ -0,0 +1,63 @@
+//! Page commands act on pages: a layer id (a rectangle, a frame) is refused before anything about
+//! the layer changes, as `page.select` already does.
+
+use figcraft_doc::{NodeId, NodeKind};
+use serde_json::{Value, json};
+
+use crate::Session;
+
+fn ex(s: &mut Session, cmd: &str, p: Value) -> Value {
+    s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
+}
+
+fn id_of(v: &Value) -> NodeId {
+    NodeId(v["id"].as_u64().unwrap())
+}
+
+fn name(s: &Session, id: NodeId) -> String {
+    s.doc().unwrap().get(id).unwrap().name.clone()
+}
+
+#[test]
+fn page_commands_reject_a_rectangle() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let r = id_of(&ex(&mut s, "shape.rectangle", json!({"x": 0, "y": 0, "width": 10, "height": 10})));
+    let before = name(&s, r);
+    assert!(s.execute("page.select", &json!({"id": r})).is_err());
+    assert!(s.execute("page.rename", &json!({"id": r, "name": "Not a page"})).is_err(), "rename refuses a layer");
+    assert_eq!(name(&s, r), before, "the layer keeps its name");
+    assert!(s.execute("page.setBackground", &json!({"id": r, "color": "#123456"})).is_err(), "background refuses a layer");
+    assert!(s.execute("page.delete", &json!({"id": r})).is_err(), "delete refuses a layer");
+    assert!(s.doc().unwrap().contains(r), "the layer is still there");
+    assert!(s.doc().unwrap().contains(page));
+}
+
+#[test]
+fn page_delete_keeps_a_frame_and_its_child() {
+    let mut s = Session::new();
+    let f = id_of(&ex(&mut s, "frame.create", json!({"x": 0, "y": 0, "width": 100, "height": 100})));
+    let c = id_of(&ex(&mut s, "shape.rectangle", json!({"x": 5, "y": 5, "width": 10, "height": 10, "parent": f})));
+    assert_eq!(s.doc().unwrap().get(c).unwrap().parent, Some(f));
+    assert!(s.execute("page.delete", &json!({"id": f})).is_err());
+    assert!(s.doc().unwrap().contains(f) && s.doc().unwrap().contains(c), "the frame and its child remain");
+    assert!(s.execute("page.rename", &json!({"id": f, "name": "Not a page"})).is_err());
+    assert_ne!(name(&s, f), "Not a page");
+}
+
+#[test]
+fn page_commands_still_work_on_pages() {
+    let mut s = Session::new();
+    let first = s.page().unwrap();
+    let second = id_of(&ex(&mut s, "page.add", json!({})));
+    ex(&mut s, "page.rename", json!({"id": second, "name": "Flows"}));
+    assert_eq!(name(&s, second), "Flows");
+    ex(&mut s, "page.setBackground", json!({"id": second, "color": "#123456"}));
+    match s.doc().unwrap().get(second).unwrap().kind {
+        NodeKind::Page { background, .. } => assert_eq!(background.to_css_hex().to_uppercase(), "#123456"),
+        _ => panic!("not a page"),
+    }
+    ex(&mut s, "page.delete", json!({"id": second}));
+    assert!(!s.doc().unwrap().contains(second));
+    assert!(s.execute("page.delete", &json!({"id": first})).is_err(), "the last ordinary page stays");
+}

crates/engine/src/paint_index_tests.rs

@@ -0,0 +1,39 @@
+//! `fill.set` / `stroke.set` reject a negative, fractional or non-finite `index` instead of
+//! clamping or truncating it onto another paint (like `fill.remove` / `stroke.remove`).
+
+use figcraft_doc::NodeId;
+use serde_json::{Value, json};
+
+use crate::Session;
+
+fn ex(s: &mut Session, cmd: &str, p: Value) -> Value {
+    s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd} {p}: {e}"))
+}
+
+fn paints(s: &Session, id: NodeId) -> String {
+    let n = s.doc().unwrap().node(id).unwrap();
+    format!("{:?} {:?}", n.fills, n.strokes)
+}
+
+#[test]
+fn paint_set_rejects_bad_index_and_leaves_the_paints_alone() {
+    let mut s = Session::new();
+    let r = NodeId(ex(&mut s, "shape.rectangle", json!({"x": 0, "y": 0, "width": 10, "height": 10}))["id"].as_u64().unwrap());
+    for add in ["fill.add", "stroke.add"] {
+        for c in ["#0000FF", "#FFFF00"] {
+            ex(&mut s, add, json!({"ids": [r], "color": c}));
+        }
+    }
+    let before = paints(&s, r);
+    for cmd in ["fill.set", "stroke.set"] {
+        for bad in [json!(-1), json!(0.5), json!(1.9), json!("-1"), json!("1.5"), json!("NaN"), json!("inf"), json!("abc")] {
+            let res = s.execute(cmd, &json!({"ids": [r], "index": bad, "color": "#FF0000"}));
+            assert!(res.is_err(), "{cmd} index {bad} was accepted: {res:?}");
+            assert_eq!(paints(&s, r), before, "{cmd} index {bad} changed the document");
+        }
+        ex(&mut s, cmd, json!({"ids": [r], "index": 1, "color": "#FF0000"}));
+        assert_ne!(paints(&s, r), before, "{cmd} with a valid index still edits");
+        ex(&mut s, "edit.undo", json!({}));
+        assert_eq!(paints(&s, r), before);
+    }
+}

crates/engine/src/panels_behaviour_tests.rs

@@ -425,3 +425,25 @@ fn duplicating_a_layer_named_past_the_counter_does_not_overflow() {
     assert_eq!(name(&s, dup), "Layer 18446744073709551615 2");
     assert!(s.doc().unwrap().validate().is_empty(), "the document still checks out");
 }
+
+#[test]
+fn page_navigation_skips_dividers() {
+    // A trailing divider: Next page stays on the ordinary page.
+    let mut s = Session::new();
+    let first = s.page().unwrap();
+    let div = id(&ex(&mut s, "page.add", json!({"name": "-"})));
+    assert!(s.execute("page.select", &json!({"id": div})).is_err(), "a divider isn't a page to open");
+    let r = ex(&mut s, "view.nextPage", json!({}));
+    assert_eq!(s.page().unwrap(), first, "Next page doesn't open a trailing divider");
+    assert_eq!(id_of(&r["page"]), Some(first), "the result names the current page");
+    // A middle divider: Previous page crosses it, Next page crosses it back.
+    let later = id(&ex(&mut s, "page.add", json!({"name": "Later"})));
+    assert_eq!(s.page().unwrap(), later);
+    let r = ex(&mut s, "view.prevPage", json!({}));
+    assert_eq!(s.page().unwrap(), first, "Previous page crosses a divider");
+    assert_eq!(id_of(&r["page"]), Some(first));
+    ex(&mut s, "view.nextPage", json!({}));
+    assert_eq!(s.page().unwrap(), later, "Next page crosses a divider");
+    ex(&mut s, "view.nextPage", json!({}));
+    assert_eq!(s.page().unwrap(), later, "Next page stops on the last page");
+}

crates/engine/src/params.rs

@@ -88,6 +88,36 @@ pub fn req_id(cmd: &str, p: &Value, key: &str) -> Result<NodeId> {
     id(p, key).ok_or_else(|| bad(cmd, format!("`{key}` must be a node id")))
 }
 
+/// The offending value for an error message, cut to a few dozen characters so a huge param
+/// doesn't end up in the error whole.
+fn shown(v: &Value) -> String {
+    const MAX: usize = 40;
+    let text = v.to_string();
+    match text.char_indices().nth(MAX) {
+        Some((cut, _)) => format!("{}…", &text[..cut]),
+        None => text,
+    }
+}
+
+/// `key` when it is there: a layer id, or an error naming it. Missing and `null` mean "none", so a
+/// command can tell "no parent given" (use the page) from "a parent was given that isn't an id" —
+/// which is a mistake, not the default. Without this, `{"$step": 0}` reaching a param that isn't
+/// resolved yet silently becomes "no parent" and the layer lands on the page.
+pub fn opt_id(cmd: &str, p: &Value, key: &str) -> Result<Option<NodeId>> {
+    match get(p, key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => id_of(v).map(Some).ok_or_else(|| bad(cmd, format!("`{key}` must be a node id (got {})", shown(v)))),
+    }
+}
+
+/// `key` when it is there: a whole, non-negative number, or an error. Missing means "none".
+pub fn opt_index(cmd: &str, p: &Value, key: &str) -> Result<Option<usize>> {
+    match get(p, key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(_) => req_index(cmd, p, key).map(Some),
+    }
+}
+
 /// `ids` (array), `id` (single), or the current selection.
 pub fn targets(s: &Session, p: &Value) -> Vec<NodeId> {
     if let Some(Value::Array(a)) = get(p, "ids") {
@@ -99,8 +129,25 @@ pub fn targets(s: &Session, p: &Value) -> Vec<NodeId> {
     s.selection()
 }
 
-/// Like [`targets`] but an empty result is an error.
+/// Like [`targets`] but an unparseable `ids` entry, an unparseable `id`, or an empty result is an
+/// error: naming something that isn't a layer is a mistake, not an empty selection. An explicit
+/// `null` says the same as leaving the key out.
 pub fn req_targets(cmd: &str, s: &Session, p: &Value) -> Result<Vec<NodeId>> {
+    match get(p, "ids") {
+        Some(Value::Array(a)) => {
+            if let Some(v) = a.iter().find(|v| id_of(v).is_none()) {
+                return Err(bad(cmd, format!("`ids`: every entry must be a node id (got {})", shown(v))));
+            }
+        }
+        Some(Value::Null) | None => {
+            if let Some(v) = get(p, "id").filter(|v| !v.is_null())
+                && id_of(v).is_none()
+            {
+                return Err(bad(cmd, format!("`id` must be a node id (got {})", shown(v))));
+            }
+        }
+        Some(v) => return Err(bad(cmd, format!("`ids` must be an array (got {})", shown(v)))),
+    }
     let t = targets(s, p);
     if t.is_empty() {
         return Err(EngineError::Disabled(cmd.to_string(), "nothing is selected (pass `ids`)".into()));

crates/engine/src/plugins.rs

@@ -111,6 +111,10 @@ const DENIED: &[&str] = &[
     "edit.redo",
     "edit.repeat",
     "command.batch",
+    // Network sessions, online files and their recovery copies on disk.
+    "collab.",
+    // Opens files in new windows.
+    "window.",
     "view.theme",
 ];
 /// Read-only exceptions to [`DENIED`].
@@ -128,6 +132,17 @@ fn refusal(m: &Manifest, command: &str, params: &Value) -> Option<String> {
     if command == "image.place" && get(params, "path").is_some() {
         return Some("plugins can't read files: pass the image as `data`".into());
     }
+    // `path` here is a file on disk (elsewhere it is a vector path or an action's place).
+    if matches!(command, "variable.export" | "codeConnect.export" | "component.playground") && get(params, "path").is_some() {
+        return Some("plugins can't write files: leave out `path` to get the result back".into());
+    }
+    if command == "codeConnect.import" && get(params, "path").is_some() {
+        return Some("plugins can't read files: pass the connections as `json`".into());
+    }
+    // Variables JSON may be given as a path: only objects and JSON text for plugins.
+    if command == "variable.import" && get(params, "variables").and_then(Value::as_str).is_some_and(|t| !t.trim_start().starts_with('{')) {
+        return Some("plugins can't read files: pass the variables JSON itself".into());
+    }
     if !m.permissions.allows(command) {
         return Some(format!("`{command}` isn't in the commands {} asked permission for", m.name));
     }

crates/engine/src/plugins_tests.rs

@@ -169,6 +169,13 @@ fn files_dialogs_history_and_plugins_are_off_limits() {
         ("plugin.remove", json!({"id": "org.test.deny"})),
         ("edit.undo", json!({})),
         ("command.batch", json!({"commands": [{"command": "file.saveAs", "params": {"path": target}}]})),
+        ("variable.export", json!({"format": "css", "path": target})),
+        ("codeConnect.export", json!({"path": target})),
+        ("codeConnect.import", json!({"path": "/etc/passwd"})),
+        ("component.playground", json!({"id": a, "path": target})),
+        ("variable.import", json!({"variables": "/etc/passwd"})),
+        ("collab.recoverFile", json!({"path": "copy.figcraft", "file": "x", "session": 1, "client": 1, "seq": 0})),
+        ("window.new", json!({"path": "C:/Windows/win.ini"})),
         ("doc.switch", json!({"index": 0})),
         ("pref.keepTool", json!({})),
         // Without a name it would open inline renaming in the layers panel: a UI request.

crates/engine/src/save_format_tests.rs

@@ -0,0 +1,366 @@
+//! Save As can write an experimental `.fig` copy without replacing native save state.
+
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use figcraft_format::Version;
+use serde_json::{Value, json};
+
+use crate::{DocState, EngineError, Session};
+
+struct SaveFiles {
+    dir: PathBuf,
+    files: Vec<PathBuf>,
+}
+
+impl SaveFiles {
+    fn new() -> Self {
+        let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let dir = std::env::temp_dir().join(format!("figcraft-save-formats-{}-{stamp}", std::process::id()));
+        std::fs::create_dir(&dir).unwrap();
+        Self { dir, files: Vec::new() }
+    }
+
+    fn path(&mut self, name: &str) -> PathBuf {
+        let path = self.dir.join(name);
+        self.files.push(path.clone());
+        path
+    }
+}
+
+impl Drop for SaveFiles {
+    fn drop(&mut self) {
+        for path in &self.files {
+            let _ = std::fs::remove_file(path);
+            let _ = std::fs::remove_dir(path);
+        }
+        let _ = std::fs::remove_dir(&self.dir);
+    }
+}
+
+fn rect(s: &mut Session, name: &str) {
+    s.execute("shape.rectangle", &json!({"name": name, "x": 10, "y": 20, "width": 30, "height": 40})).unwrap();
+}
+
+fn assert_versions_unchanged(after: &[Version], before: &[Version]) {
+    assert_eq!(after.len(), before.len());
+    for (after, before) in after.iter().zip(before) {
+        assert_eq!(
+            (&after.id, &after.name, &after.description, after.time, after.auto),
+            (&before.id, &before.name, &before.description, before.time, before.auto)
+        );
+        assert_eq!(*after.document().unwrap(), *before.document().unwrap());
+    }
+}
+
+fn assert_save_state_unchanged(s: &Session, before: &DocState, recent: &[String]) {
+    let after = s.ds().unwrap();
+    assert_eq!(after.path, before.path);
+    assert_eq!(after.is_dirty(), before.is_dirty());
+    assert_eq!(after.versions_changed, before.versions_changed);
+    assert!(Arc::ptr_eq(&after.doc, &before.doc));
+    assert!(Arc::ptr_eq(&after.saved_doc, &before.saved_doc));
+    assert_eq!(
+        after.preview.as_ref().map(|p| (&p.id, &p.name, p.time, &p.selection, p.page)),
+        before.preview.as_ref().map(|p| (&p.id, &p.name, p.time, &p.selection, p.page))
+    );
+    if let (Some(after), Some(before)) = (&after.preview, &before.preview) {
+        assert!(Arc::ptr_eq(&after.doc, &before.doc));
+    }
+    assert_eq!((&after.selection, after.page), (&before.selection, before.page));
+    assert_versions_unchanged(&after.versions, &before.versions);
+    assert_eq!(after.branches.len(), before.branches.len());
+    for (after, before) in after.branches.iter().zip(&before.branches) {
+        assert_eq!(
+            (&after.id, &after.name, after.time, after.client, after.state),
+            (&before.id, &before.name, before.time, before.client, before.state)
+        );
+        assert_eq!(*after.base, *before.base);
+        assert_eq!(*after.head, *before.head);
+        assert_versions_unchanged(&after.versions, &before.versions);
+    }
+    for (after, before) in [(&after.history.undo, &before.history.undo), (&after.history.redo, &before.history.redo)] {
+        assert_eq!(after.len(), before.len());
+        for (after, before) in after.iter().zip(before) {
+            assert_eq!((&after.label, &after.selection, after.page), (&before.label, &before.selection, before.page));
+            assert!(Arc::ptr_eq(&after.doc, &before.doc));
+        }
+    }
+    assert_eq!(s.prefs.recent_files, recent);
+}
+
+fn read_fig(path: &std::path::Path, result: &Value) -> figcraft_doc::Document {
+    let bytes = std::fs::read(path).unwrap();
+    assert_eq!(result["format"], "fig");
+    assert_eq!(result["bytes"], bytes.len());
+    assert!(result["warnings"].is_array());
+    assert!(figcraft_format::load_bytes(&bytes).is_err(), "a .fig copy must not contain native FigCraft data");
+    figcraft_format::fig::import(&bytes, "Copy").unwrap().0
+}
+
+#[test]
+fn fig_save_as_keeps_native_path_dirty_state_and_history() {
+    let mut files = SaveFiles::new();
+    let native = files.path("design.figcraft");
+    let copy = files.path("copy.fig");
+    let mut s = Session::new();
+    rect(&mut s, "Saved rectangle");
+    s.execute("file.saveAs", &json!({"path": native.to_string_lossy()})).unwrap();
+    let saved = std::fs::read(&native).unwrap();
+    rect(&mut s, "New rectangle");
+    s.execute("comment.add", &json!({"x": 0, "y": 0, "text": "Copy warning"})).unwrap();
+    s.execute("file.saveVersion", &json!({"name": "Before copy"})).unwrap();
+    rect(&mut s, "Undone rectangle");
+    s.undo().unwrap();
+    let before = s.ds().unwrap().clone();
+    let recent = s.prefs.recent_files.clone();
+    assert!(before.is_dirty());
+    assert!(!before.history.redo.is_empty());
+
+    let result = s.execute("file.saveAs", &json!({"path": copy.to_string_lossy()})).unwrap();
+    let imported = read_fig(&copy, &result);
+    assert!(imported.nodes().any(|n| n.name == "New rectangle"));
+    assert!(!imported.nodes().any(|n| n.name == "Undone rectangle"));
+    assert!(result["warnings"].as_array().unwrap().iter().any(|w| w == "comments were left out"));
+    assert_save_state_unchanged(&s, &before, &recent);
+    assert_eq!(std::fs::read(&native).unwrap(), saved);
+
+    s.execute("file.save", &json!({})).unwrap();
+    assert!(!s.ds().unwrap().is_dirty());
+    assert_eq!(s.ds().unwrap().path.as_deref(), native.to_str());
+    let persisted = figcraft_format::load_bytes_with_versions(&std::fs::read(&native).unwrap()).unwrap();
+    assert!(persisted.doc.nodes().any(|n| n.name == "New rectangle"));
+    assert_eq!(persisted.versions[0].name, "Before copy");
+    assert_eq!(std::fs::read(&copy).unwrap().len(), result["bytes"].as_u64().unwrap() as usize);
+}
+
+#[test]
+fn unsaved_fig_copy_remains_unsaved() {
+    let mut files = SaveFiles::new();
+    let copy = files.path("unsaved.fig");
+    let mut s = Session::new();
+    rect(&mut s, "Unsaved rectangle");
+    let before = s.ds().unwrap().clone();
+    let recent = s.prefs.recent_files.clone();
+    let result = s.execute("file.saveAs", &json!({"path": copy.to_string_lossy()})).unwrap();
+    assert!(read_fig(&copy, &result).nodes().any(|n| n.name == "Unsaved rectangle"));
+    assert_save_state_unchanged(&s, &before, &recent);
+    assert!(matches!(s.execute("file.save", &json!({})), Err(EngineError::Disabled(..))));
+    assert_eq!(s.ui_requests.last().unwrap().kind, "dialog.saveAs");
+}
+
+#[test]
+fn empty_document_fig_copy_keeps_clean_state() {
+    let mut files = SaveFiles::new();
+    let copy = files.path("empty.fig");
+    let mut s = Session::new();
+    let before = s.ds().unwrap().clone();
+    assert!(!before.is_dirty());
+    let result = s.execute("file.saveAs", &json!({"path": copy.to_string_lossy()})).unwrap();
+    let imported = read_fig(&copy, &result);
+    assert_eq!(imported.pages.len(), 1);
+    assert_eq!(imported.node_count(), 1);
+    assert_save_state_unchanged(&s, &before, &[]);
+}
+
+#[test]
+fn fig_save_commands_accept_uppercase_extension() {
+    let mut files = SaveFiles::new();
+    for (index, command) in ["file.save", "file.saveAs"].into_iter().enumerate() {
+        let copy = files.path(&format!("copy-{index}.FIG"));
+        let mut s = Session::new();
+        rect(&mut s, command);
+        let before = s.ds().unwrap().clone();
+        let result = s.execute(command, &json!({"path": copy.to_string_lossy()})).unwrap();
+        assert!(read_fig(&copy, &result).nodes().any(|n| n.name == command));
+        assert_save_state_unchanged(&s, &before, &[]);
+    }
+}
+
+#[test]
+fn fig_copy_from_branch_exports_active_document_without_saving_main() {
+    let mut files = SaveFiles::new();
+    let native = files.path("main.figcraft");
+    let copy = files.path("branch.fig");
+    let mut s = Session::new();
+    rect(&mut s, "Main rectangle");
+    s.execute("file.save", &json!({"path": native.to_string_lossy()})).unwrap();
+    let saved = std::fs::read(&native).unwrap();
+    s.execute("branch.create", &json!({"name": "Explore"})).unwrap();
+    rect(&mut s, "Branch rectangle");
+    s.execute("file.saveVersion", &json!({"name": "Branch version"})).unwrap();
+    // Branch edits normally sync to main before commands; capture that state before exporting.
+    s.execute("branch.list", &json!({})).unwrap();
+    let branch = s.ds().unwrap().clone();
+    let main = s.docs[0].clone();
+    let recent = s.prefs.recent_files.clone();
+
+    let result = s.execute("file.saveAs", &json!({"path": copy.to_string_lossy()})).unwrap();
+    assert!(read_fig(&copy, &result).nodes().any(|n| n.name == "Branch rectangle"));
+    assert_save_state_unchanged(&s, &branch, &recent);
+    assert_eq!(s.docs[0].path, main.path);
+    assert_eq!(s.docs[0].is_dirty(), main.is_dirty());
+    assert!(Arc::ptr_eq(&s.docs[0].saved_doc, &main.saved_doc));
+    assert!(Arc::ptr_eq(&s.docs[0].doc, &main.doc));
+    assert_eq!(std::fs::read(&native).unwrap(), saved);
+
+    s.execute("file.save", &json!({})).unwrap();
+    let persisted = figcraft_format::load_bytes_with_versions(&std::fs::read(&native).unwrap()).unwrap();
+    assert!(!persisted.doc.nodes().any(|n| n.name == "Branch rectangle"));
+    assert!(persisted.branches[0].head.nodes().any(|n| n.name == "Branch rectangle"));
+    assert_eq!(persisted.branches[0].versions[0].name, "Branch version");
+    assert!(!s.ds().unwrap().is_dirty());
+    assert!(!s.docs[0].is_dirty());
+}
+
+#[test]
+fn fig_copy_write_failure_keeps_save_state() {
+    let mut files = SaveFiles::new();
+    let blocked = files.path("blocked.fig");
+    std::fs::create_dir(&blocked).unwrap();
+    let missing = files.path("missing/copy.fig");
+    let mut s = Session::new();
+    rect(&mut s, "Kept rectangle");
+    s.execute("file.saveVersion", &json!({"name": "Kept version"})).unwrap();
+    rect(&mut s, "Later rectangle");
+    s.execute("version.preview", &json!({"index": 0})).unwrap();
+    let before = s.ds().unwrap().clone();
+    for command in ["file.save", "file.saveAs"] {
+        for path in [&blocked, &missing] {
+            assert!(s.execute(command, &json!({"path": path.to_string_lossy()})).is_err());
+            assert_save_state_unchanged(&s, &before, &[]);
+            assert!(!PathBuf::from(format!("{}.tmp-figcraft", path.display())).exists());
+        }
+    }
+}
+
+#[test]
+fn save_as_without_extension_stays_native() {
+    let mut files = SaveFiles::new();
+    let requested = files.dir.join("native");
+    let native = files.path("native.figcraft");
+    let mut s = Session::new();
+    rect(&mut s, "Native rectangle");
+    let result = s.execute("file.saveAs", &json!({"path": requested.to_string_lossy()})).unwrap();
+    assert_eq!(result["path"], native.to_string_lossy().as_ref());
+    assert_eq!(s.ds().unwrap().path.as_deref(), native.to_str());
+    assert!(!s.ds().unwrap().is_dirty());
+    assert!(!requested.exists());
+    let loaded = figcraft_format::load_bytes(&std::fs::read(native).unwrap()).unwrap();
+    assert!(loaded.0.nodes().any(|n| n.name == "Native rectangle"));
+}
+
+#[test]
+fn fig_copy_of_version_preview_keeps_visible_version_and_save_state() {
+    let mut files = SaveFiles::new();
+    for (index, command) in ["file.save", "file.saveAs"].into_iter().enumerate() {
+        let native = files.path(&format!("current-{index}.figcraft"));
+        let copy = files.path(&format!("version-{index}.FIG"));
+        let mut s = Session::new();
+        rect(&mut s, "A");
+        s.execute("file.saveVersion", &json!({"name": "A only"})).unwrap();
+        s.execute("file.save", &json!({"path": native.to_string_lossy()})).unwrap();
+        let saved = std::fs::read(&native).unwrap();
+        rect(&mut s, "B");
+        s.execute("version.preview", &json!({"index": 0})).unwrap();
+        let before = s.ds().unwrap().clone();
+        let recent = s.prefs.recent_files.clone();
+        assert!(before.preview.is_some());
+        assert!(before.is_dirty());
+
+        let result = s.execute(command, &json!({"path": copy.to_string_lossy()})).unwrap();
+        let imported = read_fig(&copy, &result);
+        assert!(imported.nodes().any(|n| n.name == "A"));
+        assert!(!imported.nodes().any(|n| n.name == "B"), "the copy must export the version shown");
+        assert_save_state_unchanged(&s, &before, &recent);
+        assert_eq!(std::fs::read(&native).unwrap(), saved);
+        s.execute("version.exitPreview", &json!({})).unwrap();
+        assert!(s.doc().unwrap().nodes().any(|n| n.name == "B"));
+    }
+}
+
+#[test]
+fn pending_save_choice_keeps_version_preview() {
+    let mut files = SaveFiles::new();
+    for (index, (command, native_path)) in [("file.saveAs", false), ("file.saveAs", true), ("file.save", false)].into_iter().enumerate() {
+        let mut s = Session::new();
+        rect(&mut s, "A");
+        s.execute("file.saveVersion", &json!({"name": "A only"})).unwrap();
+        if native_path {
+            let native = files.path(&format!("saved-{index}.figcraft"));
+            s.execute("file.save", &json!({"path": native.to_string_lossy()})).unwrap();
+        }
+        rect(&mut s, "B");
+        s.execute("version.preview", &json!({"index": 0})).unwrap();
+        let before = s.ds().unwrap().clone();
+        let recent = s.prefs.recent_files.clone();
+        assert!(matches!(s.execute(command, &json!({})), Err(EngineError::Disabled(..))));
+        assert_eq!(s.ui_requests.last().unwrap().kind, "dialog.saveAs");
+        assert_save_state_unchanged(&s, &before, &recent);
+    }
+}
+
+#[test]
+fn native_save_from_version_preview_writes_current_document() {
+    let mut files = SaveFiles::new();
+    for (index, (command, explicit)) in [("file.save", false), ("file.save", true), ("file.saveAs", true)].into_iter().enumerate() {
+        let native = files.path(&format!("native-version-{index}.figcraft"));
+        let mut s = Session::new();
+        rect(&mut s, "A");
+        s.execute("file.saveVersion", &json!({"name": "A only"})).unwrap();
+        s.execute("file.save", &json!({"path": native.to_string_lossy()})).unwrap();
+        rect(&mut s, "B");
+        s.execute("version.preview", &json!({"index": 0})).unwrap();
+        let undo = s.ds().unwrap().history.undo.len();
+        let params = if explicit { json!({"path": native.to_string_lossy()}) } else { json!({}) };
+        s.execute(command, &params).unwrap();
+        assert!(s.ds().unwrap().preview.is_none());
+        assert!(!s.ds().unwrap().is_dirty());
+        assert_eq!(s.ds().unwrap().history.undo.len(), undo);
+        assert_eq!(s.ds().unwrap().path.as_deref(), native.to_str());
+        let loaded = figcraft_format::load_bytes_with_versions(&std::fs::read(&native).unwrap()).unwrap();
+        assert!(loaded.doc.nodes().any(|n| n.name == "A"));
+        assert!(loaded.doc.nodes().any(|n| n.name == "B"));
+        assert!(!loaded.versions[0].document().unwrap().nodes().any(|n| n.name == "B"));
+    }
+}
+
+#[test]
+fn implicit_save_protects_legacy_fig_destination() {
+    let mut files = SaveFiles::new();
+    for (index, command) in ["file.save", "file.saveAs"].into_iter().enumerate() {
+        let legacy = files.path(&format!("legacy-{index}.FIG"));
+        let native = files.path(&format!("corrected-{index}.figcraft"));
+        let mut s = Session::new();
+        rect(&mut s, "A");
+        s.execute("file.saveVersion", &json!({"name": "A only"})).unwrap();
+        // Earlier builds could write native data under .fig; keep those bytes safe on plain Save.
+        let sentinel = crate::cmd::file::file_bytes(s.ds().unwrap()).unwrap();
+        std::fs::write(&legacy, &sentinel).unwrap();
+        s.ds_mut().unwrap().path = Some(legacy.to_string_lossy().into_owned());
+        s.ds_mut().unwrap().mark_saved();
+        rect(&mut s, "B");
+        s.execute("version.preview", &json!({"index": 0})).unwrap();
+        let before = s.ds().unwrap().clone();
+        let recent = s.prefs.recent_files.clone();
+
+        assert!(matches!(s.execute("file.save", &json!({})), Err(EngineError::Disabled(..))));
+        assert_eq!(s.ui_requests.last().unwrap().kind, "dialog.saveAs");
+        assert_save_state_unchanged(&s, &before, &recent);
+        assert_eq!(std::fs::read(&legacy).unwrap(), sentinel);
+
+        s.execute(command, &json!({"path": native.to_string_lossy()})).unwrap();
+        assert!(s.ds().unwrap().preview.is_none());
+        assert!(!s.ds().unwrap().is_dirty());
+        assert_eq!(s.ds().unwrap().path.as_deref(), native.to_str());
+        let loaded = figcraft_format::load_bytes_with_versions(&std::fs::read(&native).unwrap()).unwrap();
+        assert!(loaded.doc.nodes().any(|n| n.name == "A"));
+        assert!(loaded.doc.nodes().any(|n| n.name == "B"));
+        assert_eq!(loaded.versions[0].name, "A only");
+        rect(&mut s, "C");
+        s.execute("file.save", &json!({})).unwrap();
+        let loaded = figcraft_format::load_bytes(&std::fs::read(&native).unwrap()).unwrap();
+        assert!(loaded.0.nodes().any(|n| n.name == "C"));
+        assert_eq!(std::fs::read(&legacy).unwrap(), sentinel);
+    }
+}

crates/engine/src/selection_behaviour_tests.rs

@@ -275,3 +275,92 @@ fn locked_layers_selected_in_the_layers_panel_stay_put() {
     ex(&mut s, "object.toggleLock", json!({"ids": [k.g], "locked": true}));
     assert_eq!(handle_at(s.doc().unwrap(), &[k.a], Point::new(60.0, 60.0), 1.0), None);
 }
+
+#[test]
+fn shift_drag_moves_the_selection() {
+    let mut s = Session::new();
+    let k = scene(&mut s);
+    let at = |s: &Session, i: NodeId| s.doc().unwrap().world_bounds(i).unwrap().origin();
+    let home = (Point::new(500.0, 0.0), Point::new(600.0, 0.0));
+    // (selection before, Shift-drag to (from r at 520,20), selection after, where r and empty end up, derivation)
+    let rows: Vec<(Vec<NodeId>, (f64, f64), Vec<NodeId>, (Point, Point), &str)> = vec![
+        (
+            vec![k.r],
+            (560.0, 22.0),
+            vec![k.r],
+            (Point::new(540.0, 0.0), Point::new(600.0, 0.0)),
+            "Shift-drag on the selected layer moves it along one axis and keeps it selected",
+        ),
+        (
+            vec![k.r, k.empty],
+            (560.0, 22.0),
+            vec![k.r, k.empty],
+            (Point::new(540.0, 0.0), Point::new(640.0, 0.0)),
+            "Shift-drag on one of several selected layers moves them all",
+        ),
+        (
+            vec![k.empty],
+            (560.0, 22.0),
+            vec![k.r, k.empty],
+            (Point::new(540.0, 0.0), Point::new(640.0, 0.0)),
+            "Shift-drag on an unselected layer adds it and moves the selection",
+        ),
+        (vec![k.r, k.empty], (521.0, 21.0), vec![k.empty], home, "a Shift-press that wobbles under the drag threshold is a click: the layer leaves"),
+    ];
+    for (before, to, after, end, why) in rows {
+        ex(&mut s, "select.set", json!({"ids": before}));
+        drag(&mut s, (520.0, 20.0), to, SHIFT);
+        assert_eq!(sorted(s.selection()), sorted(after), "{why}");
+        assert_eq!((at(&s, k.r), at(&s, k.empty)), end, "{why}");
+        if end != home {
+            assert!(s.undo().unwrap(), "{why}: one undo step");
+            assert_eq!((at(&s, k.r), at(&s, k.empty)), home, "{why}: undone");
+        }
+    }
+    // Shift let go before the button: still a Shift-click.
+    ex(&mut s, "select.set", json!({"ids": [k.r, k.empty]}));
+    s.pointer(&ev(PointerKind::Down, 520.0, 20.0, SHIFT)).unwrap();
+    s.pointer(&ev(PointerKind::Up, 520.0, 20.0, NONE)).unwrap();
+    assert_eq!(s.selection(), vec![k.empty], "Shift let go before the button still takes the layer out");
+}
+
+#[test]
+fn alt_shift_drag_on_a_selected_layer_duplicates_it() {
+    let mut s = Session::new();
+    let k = scene(&mut s);
+    let layers = |s: &Session| s.doc().unwrap().node(s.page().unwrap()).unwrap().children.len();
+    let n = layers(&s);
+    let alt_shift = |kind, x, y| {
+        let mut e = ev(kind, x, y, SHIFT);
+        e.alt = true;
+        e
+    };
+    ex(&mut s, "select.set", json!({"ids": [k.r]}));
+    s.pointer(&alt_shift(PointerKind::Down, 520.0, 20.0)).unwrap();
+    s.pointer(&alt_shift(PointerKind::Up, 520.0, 20.0)).unwrap();
+    assert_eq!(s.selection(), Vec::<NodeId>::new(), "an Alt+Shift-click is a Shift-click: the layer leaves the selection");
+    assert_eq!(layers(&s), n, "and nothing is copied");
+    ex(&mut s, "select.set", json!({"ids": [k.r]}));
+    s.pointer(&alt_shift(PointerKind::Down, 520.0, 20.0)).unwrap();
+    s.pointer(&alt_shift(PointerKind::Move, 560.0, 22.0)).unwrap();
+    s.pointer(&alt_shift(PointerKind::Up, 560.0, 22.0)).unwrap();
+    let sel = s.selection();
+    assert_eq!(layers(&s), n + 1, "an Alt+Shift-drag copies the layer");
+    assert!(sel.len() == 1 && sel[0] != k.r, "the copy is selected");
+    let doc = s.doc().unwrap();
+    assert_eq!(doc.world_bounds(sel[0]).unwrap().origin(), Point::new(540.0, 0.0), "the copy moves along one axis");
+    assert_eq!(doc.world_bounds(k.r).unwrap().origin(), Point::new(500.0, 0.0), "the original stays");
+}
+
+#[test]
+fn shift_click_takes_a_layer_out_where_nothing_can_move() {
+    let mut s = Session::new();
+    let k = scene(&mut s);
+    // A version being viewed is read-only: the press can't start a move.
+    let v = ex(&mut s, "file.saveVersion", json!({"name": "v"}));
+    ex(&mut s, "version.preview", json!({"id": v["id"]}));
+    ex(&mut s, "select.set", json!({"ids": [k.r, k.empty]}));
+    assert!(s.pointer(&ev(PointerKind::Down, 520.0, 20.0, SHIFT)).is_err(), "a version being viewed can't be edited");
+    s.pointer(&ev(PointerKind::Up, 520.0, 20.0, SHIFT)).unwrap();
+    assert_eq!(s.selection(), vec![k.empty], "Shift-click still takes the layer out");
+}

crates/engine/src/shapebuilder.rs

@@ -322,7 +322,7 @@ fn apply(s: &mut Session, cmd: &str, p: &Value, merge: bool) -> Result<Value> {
     let whole_shape =
         touched.len() == 1 && a.regions.iter().enumerate().all(|(i, r)| pick.contains(&i) || !r.sources.iter().any(|x| touched.contains(x)));
     if merge && whole_shape {
-        return Ok(json!({"id": null, "changed": [], "removed": [], "regions": pick}));
+        return Ok(json!({"id": null, "changed": [], "removed": [], "outlines": [], "regions": pick}));
     }
     let doc = s.doc_mut()?;
     let created = if merge {

crates/engine/src/shapes_behaviour_tests.rs

@@ -396,6 +396,30 @@ fn boolean_results_and_the_look_they_take() {
     assert!(path.area().abs() < 1e-6, "no overlap, nothing to show");
 }
 
+#[test]
+fn flatten_keeps_open_paths() {
+    // #377: open paths have no fill outline, so two pen paths flattened to "nothing to flatten"
+    // and next to a closed shape they disappeared.
+    let mut s = Session::new();
+    let a = create(&mut s, "vector.create", json!({"points": [[0, 0], [100, 50], [200, 0]]}));
+    let b = create(&mut s, "vector.create", json!({"points": [[0, 100], [100, 150], [200, 100]]}));
+    let tri = create(&mut s, "vector.create", json!({"points": [[300, 0], [400, 0], [400, 100]], "closed": true}));
+    let v = create(&mut s, "vector.flatten", json!({"ids": [a, b, tri]}));
+    let NodeKind::Vector { network } = node(&s, v).kind else { panic!("flatten makes one vector") };
+    assert_eq!((network.vertices.len(), network.segments.len()), (9, 7), "both open paths and the triangle");
+    assert_eq!(network.regions.len(), 1, "only the triangle is filled");
+    let bb = s.doc().unwrap().world_bounds(v).unwrap();
+    assert_eq!((bb.x0, bb.y0, bb.x1, bb.y1), (0.0, 0.0, 400.0, 150.0), "nothing moves");
+
+    // Joining two open paths goes the same way.
+    let mut s = Session::new();
+    let a = create(&mut s, "vector.create", json!({"points": [[0, 0], [100, 0]]}));
+    let b = create(&mut s, "vector.create", json!({"points": [[0, 50], [100, 50]]}));
+    let v = create(&mut s, "vector.join", json!({"ids": [a, b]}));
+    let NodeKind::Vector { network } = node(&s, v).kind else { panic!("join makes one vector") };
+    assert_eq!(network.segments.len(), 2);
+}
+
 #[test]
 fn flatten_and_outline_stroke() {
     // Flatten: one vector layer from the selection, in one step; Alt+Shift+F does it.

crates/engine/src/synthetic.rs

@@ -66,7 +66,8 @@ pub fn large_document(layers: usize) -> DocResult<(Document, NodeId)> {
             made += 4;
         }
         // A card group (5 layers).
-        if budget(made) >= 5 {
+        // The card and the instances leave one layer for the grid, which starts with a rectangle.
+        if budget(made) > 5 {
             let card = doc.create(screen, NodeKind::Group, "Card", 12.0, 52.0, 160.0, 64.0)?;
             // Children are in the group's space; normalising fits the group around them.
             let cbg = doc.create(card, NodeKind::Rectangle, "Card background", 0.0, 0.0, 160.0, 64.0)?;
@@ -78,7 +79,7 @@ pub fn large_document(layers: usize) -> DocResult<(Document, NodeId)> {
         }
         // Three button instances (3 layers each).
         for k in 0..3 {
-            if budget(made) < 3 {
+            if budget(made) < 3 + 1 {
                 break;
             }
             crate::components::create_instance(&mut doc, button, screen, 12.0 + k as f64 * 108.0, SCREEN_H - 44.0)?;
@@ -89,12 +90,14 @@ pub fn large_document(layers: usize) -> DocResult<(Document, NodeId)> {
         for k in 0..rest {
             let (gx, gy) = (184.0 + (k % 8) as f64 * 21.0, 52.0 + (k / 8) as f64 * 34.0);
             let hue = ((s * PER_SCREEN + k) % 360) as f32 / 360.0;
-            let id = match k % 5 {
+            // The grid starts with a rectangle so even the smallest workload has one.
+            let kind = (k + 2) % 5;
+            let id = match kind {
                 0 => doc.create(screen, text(&format!("Item {k}")), "Text", gx, gy, 20.0, 14.0)?,
                 1 | 3 => doc.create(screen, ellipse(), "Ellipse", gx, gy, 18.0, 18.0)?,
                 _ => doc.create(screen, NodeKind::Rectangle, "Rectangle", gx, gy, 18.0, 18.0)?,
             };
-            if k % 5 != 0 {
+            if kind != 0 {
                 fill(&mut doc, id, Color::new(hue, 0.5, 1.0 - hue, 1.0));
                 if let Some(n) = doc.node_mut(id) {
                     n.corners.radii = [3.0; 4];
@@ -124,4 +127,16 @@ mod tests {
             assert!(doc.page_content_bounds(page).is_some());
         }
     }
+
+    #[test]
+    fn small_documents_hold_the_benchmark_targets() {
+        for n in [10, 11, 12, 13, 14, 15] {
+            let (doc, page) = super::large_document(n).unwrap();
+            let nodes: Vec<_> = doc.subtree(page).into_iter().filter_map(|id| doc.node(id)).collect();
+            let has = |f: &dyn Fn(&figcraft_doc::Node) -> bool| nodes.iter().any(|node| f(node));
+            assert!(has(&|x| matches!(x.kind, figcraft_doc::NodeKind::Rectangle) && x.name == "Rectangle"), "{n}: no rectangle");
+            assert!(has(&|x| x.name == "Title"), "{n}: no title");
+            assert!(has(&|x| matches!(x.kind, figcraft_doc::NodeKind::Component { .. })), "{n}: no component");
+        }
+    }
 }

crates/engine/src/text_style_picker_tests.rs

@@ -212,6 +212,31 @@ fn previews_while_editing_keep_the_edit() {
     assert!(links(&s, t).iter().all(Option::is_none));
 }
 
+#[test]
+fn previews_show_a_hovered_font_family() {
+    let mut s = new_session();
+    let t = text(&mut s, "Preview me");
+    s.ds_mut().unwrap().mark_saved();
+    let before = s.doc().unwrap().clone();
+    let undo = s.ds().unwrap().history.undo.len();
+    // Hovering a font family shows it on the canvas: no undo step, not dirty.
+    s.execute("text.preview", &json!({"command": "text.style", "params": {"ids": [t], "fontFamily": "Arial"}})).unwrap();
+    assert_eq!(data(&s, t).style_at(0).font_family, "Arial");
+    assert_eq!(s.ds().unwrap().history.undo.len(), undo);
+    assert!(!s.ds().unwrap().is_dirty());
+    // Moving to another family replaces the preview, from the document itself.
+    s.execute("text.preview", &json!({"command": "text.style", "params": {"ids": [t], "fontFamily": "Georgia"}})).unwrap();
+    assert_eq!(data(&s, t).style_at(0).font_family, "Georgia");
+    // Closing without picking puts the document back as it was.
+    assert_eq!(s.execute("text.endPreview", &json!({})).unwrap()["ended"], json!(true));
+    assert_eq!(*s.doc().unwrap(), before);
+    // Clicking commits it as one undo step.
+    s.execute("text.style", &json!({"ids": [t], "fontFamily": "Georgia"})).unwrap();
+    assert_eq!(data(&s, t).style_at(0).font_family, "Georgia");
+    assert_eq!(s.ds().unwrap().history.undo.len(), undo + 1);
+    assert!(s.ds().unwrap().text_preview.is_none());
+}
+
 #[test]
 fn previews_refuse_what_they_cant_show() {
     let mut s = new_session();

crates/engine/src/text_tail_tests.rs

@@ -57,6 +57,24 @@ fn list_buttons_act_on_the_selected_paragraphs() {
     assert_eq!(data(&s, t).list, P, "toggled off");
 }
 
+#[test]
+fn a_list_with_a_start_number_toggles_off() {
+    // An imported list that starts at 2 has the start on its first item only; it is still one
+    // numbered list, so the button turns it back to plain (#686).
+    let mut s = Session::new();
+    let t = text(&mut s, "two\nthree\nfour");
+    if let figcraft_doc::NodeKind::Text(td) = &mut s.doc_mut().unwrap().get_mut(t).unwrap().kind {
+        let n = |start_offset| ParaList { list: N, indent: 0, start_offset };
+        td.paragraphs = vec![n(1), n(0), n(0)];
+    }
+    let j = crate::inspect::node_json(s.doc().unwrap(), t, 0);
+    assert_eq!(j["listStartOffsets"], json!([1, 0, 0]), "inspect reports the start");
+    s.execute("text.numberList", &json!({"ids": [t]})).unwrap();
+    assert_eq!(lists(&s, t), [(P, 0); 3]);
+    assert_eq!(data(&s, t).para_list(0).start_offset, 0, "a plain paragraph has no start");
+    assert!(crate::inspect::node_json(s.doc().unwrap(), t, 0).get("listStartOffsets").is_none());
+}
+
 #[test]
 fn typed_list_starts() {
     // Typing "- " or "* " at the start of a paragraph starts a bulleted list, "1. " a numbered one
@@ -117,7 +135,7 @@ fn list_keys_at_list_items() {
     for (chars, before, caret, k, shift, after, want, why) in cases {
         let mut s = Session::new();
         let t = text(&mut s, chars);
-        let ps: Vec<ParaList> = before.iter().map(|(list, indent)| ParaList { list: *list, indent: *indent }).collect();
+        let ps: Vec<ParaList> = before.iter().map(|(list, indent)| ParaList { list: *list, indent: *indent, start_offset: 0 }).collect();
         if let figcraft_doc::NodeKind::Text(td) = &mut s.doc_mut().unwrap().get_mut(t).unwrap().kind {
             td.paragraphs = ps;
         }
@@ -141,7 +159,7 @@ fn paragraph_lists_follow_edits() {
     // A paragraph's list stays with it as text is typed, pasted and deleted: new paragraphs copy
     // the one they split from; joined paragraphs keep the first one's.
     let mut t = TextData::new("ab\ncd\nef");
-    t.paragraphs = vec![ParaList { list: B, indent: 1 }, ParaList::default(), ParaList { list: N, indent: 0 }];
+    t.paragraphs = vec![ParaList { list: B, indent: 1, start_offset: 0 }, ParaList::default(), ParaList { list: N, indent: 0, start_offset: 0 }];
     let get = |t: &TextData| (0..t.paragraph_count()).map(|p| (t.para_list(p).list, t.para_list(p).indent)).collect::<Vec<_>>();
     t.replace_range(1, 1, "x\ny");
     assert_eq!(get(&t), [(B, 1), (B, 1), (P, 0), (N, 0)], "a pasted newline: a new item like it");
@@ -156,7 +174,7 @@ fn paragraph_lists_follow_edits() {
         (seed >> 33) as usize % n.max(1)
     };
     let mut t = TextData::new("a\nb\nc\nd");
-    t.paragraphs = vec![ParaList { list: B, indent: 2 }; 4];
+    t.paragraphs = vec![ParaList { list: B, indent: 2, start_offset: 0 }; 4];
     for _ in 0..500 {
         let n = t.char_count();
         let (a, b) = (rnd(n + 2), rnd(n + 2));

crates/engine/src/textedit.rs

@@ -38,16 +38,17 @@ pub fn end(s: &mut Session) -> Result<()> {
         let _ = doc.remove(te.id);
         s.ds_mut()?.selection.clear();
     }
-    s.commit_interaction()?;
     if empty && te.created {
-        // Nothing to undo for a text box that was never filled.
+        // Nothing to undo for a text box that was never filled. The gesture snapshot was taken
+        // after the layer was added, so it still holds it: re-base it on the document without the
+        // layer, and committing then records no step (and leaves the redo stack alone).
         let ds = s.ds_mut()?;
-        if let Some(last) = ds.history.undo.last()
-            && *last.doc == *ds.doc
-        {
-            ds.history.undo.pop();
+        let doc = ds.doc.clone();
+        if let Some(it) = ds.interaction.as_mut() {
+            it.doc = doc;
         }
     }
+    s.commit_interaction()?;
     let ds = s.ds_mut()?;
     ds.revision += 1;
     Ok(())
@@ -82,12 +83,7 @@ fn edit(s: &mut Session, f: impl FnOnce(&mut TextData, &mut TextEdit)) -> Result
 /// Type (or paste) `text` replacing the selection. Line endings are normalised and other control
 /// characters dropped, so pasted plain text from any platform lands cleanly.
 pub fn insert(s: &mut Session, text: &str) -> Result<()> {
-    let text: String = text
-        .replace("\r\n", "\n")
-        .replace(['\r', '\u{2028}', '\u{2029}'], "\n")
-        .chars()
-        .filter(|c| !c.is_control() || matches!(c, '\n' | '\t'))
-        .collect();
+    let text: String = crate::cmd::props::normalize_line_endings(text).chars().filter(|c| !c.is_control() || matches!(c, '\n' | '\t')).collect();
     if text.is_empty() {
         return Ok(());
     }
@@ -146,9 +142,15 @@ fn list_key(s: &mut Session, key: &str, shift: bool) -> Result<bool> {
 }
 
 /// Cmd/Ctrl+] and Cmd/Ctrl+[ while editing: the selected list items a level deeper or out, like
-/// Tab and Shift+Tab. Returns whether anything changed (text that isn't a list stays as it is).
+/// Tab and Shift+Tab. Returns whether anything changed (text that isn't a list and items already
+/// at the deepest level stay as they are).
 pub fn list_indent(s: &mut Session, out: bool) -> Result<bool> {
-    list_key(s, "Tab", out)
+    let Some(id) = s.ds()?.text_edit.as_ref().map(|te| te.id) else { return Ok(false) };
+    let before = text_of(s, id)?;
+    if !list_key(s, "Tab", out)? {
+        return Ok(false);
+    }
+    Ok(text_of(s, id)? != before)
 }
 
 /// The kind of word char `i` belongs to: 0 for spaces and punctuation, else its script, so a word

crates/engine/src/textpreview.rs

@@ -1,6 +1,6 @@
 //! Live text previews: what a text command would do, shown on the canvas without an undo step —
-//! while the pointer is over a text style in the style browser or a font's named instance, or
-//! while a variable font axis slider is dragged. The document under the preview is kept and comes
+//! while the pointer is over a font family or style, a text style in the style browser or a
+//! font's named instance, or while a variable font axis slider is dragged. The document under the preview is kept and comes
 //! back when the preview ends ([`end`], `text.endPreview`). Every other command ends it first, so
 //! committing (running the command for real) applies to the document itself as one undo step, and
 //! Escape just ends the preview.

crates/engine/src/theme_pages_tests.rs

@@ -182,3 +182,49 @@ fn text_drawn_on_a_dark_page_is_white_and_on_a_light_page_black() {
     let made = id_of(&ex(&mut s, "text.create", json!({"text": "Hi", "x": 0, "y": 300}))["id"]).unwrap();
     assert_eq!(s.doc().unwrap().node(made).unwrap().fills, vec![Paint::solid(Color::WHITE)]);
 }
+
+#[test]
+fn a_copy_of_a_page_keeps_its_flows_prototype_settings_and_guides() {
+    let mut s = Session::new();
+    ex(&mut s, "frame.create", json!({"x": 0, "y": 0, "width": 100, "height": 100}));
+    let start = ex(&mut s, "frame.create", json!({"x": 200, "y": 0, "width": 100, "height": 100}))["id"].clone();
+    ex(&mut s, "proto.flow.add", json!({"start": start, "name": "Checkout"}));
+    ex(&mut s, "proto.settings", json!({"device": "iPhone 16", "responsive": true}));
+    ex(&mut s, "guide.add", json!({"vertical": true, "offset": 25}));
+    ex(&mut s, "select.none", json!({}));
+    let source = s.page().unwrap();
+    let copy = id_of(&ex(&mut s, "page.duplicate", json!({}))["id"]).unwrap();
+    let frames = s.doc().unwrap().node(copy).unwrap().children.clone();
+    let state = |s: &Session, id: NodeId| match &s.doc().unwrap().node(id).unwrap().kind {
+        NodeKind::Page { flows, prototype, guides, .. } => (flows.clone(), prototype.clone(), guides.clone()),
+        _ => panic!("expected a page"),
+    };
+    let (flows, prototype, guides) = state(&s, copy);
+    let (src_flows, src_prototype, src_guides) = state(&s, source);
+    assert_eq!(flows.len(), 1);
+    assert_eq!(flows[0].name, "Checkout");
+    assert_eq!(flows[0].start, frames[1], "the flow starts at the copied frame");
+    assert_eq!(src_flows[0].start, id_of(&start).unwrap(), "the source keeps its own");
+    assert_eq!(prototype, src_prototype);
+    assert_eq!(prototype.device, "iPhone 16");
+    assert!(prototype.responsive);
+    assert_eq!(guides, src_guides);
+    assert_eq!(guides.len(), 1);
+    assert_eq!(ex(&mut s, "proto.present", json!({}))["start"].as_u64(), Some(frames[1].0));
+}
+
+#[test]
+fn a_copy_of_a_page_keeps_a_flow_that_starts_in_a_section() {
+    let mut s = Session::new();
+    let start = id_of(&ex(&mut s, "frame.create", json!({"x": 0, "y": 0, "width": 100, "height": 100}))["id"]).unwrap();
+    ex(&mut s, "object.wrapInSection", json!({"ids": [start]}));
+    ex(&mut s, "proto.flow.add", json!({"start": start, "name": "Onboarding"}));
+    let copy = id_of(&ex(&mut s, "page.duplicate", json!({}))["id"]).unwrap();
+    let doc = s.doc().unwrap();
+    let section = doc.node(copy).unwrap().children[0];
+    let frame = doc.node(section).unwrap().children[0];
+    match &doc.node(copy).unwrap().kind {
+        NodeKind::Page { flows, .. } => assert_eq!(flows.iter().map(|f| (f.name.as_str(), f.start)).collect::<Vec<_>>(), vec![("Onboarding", frame)]),
+        _ => panic!("expected a page"),
+    }
+}

crates/engine/src/tools.rs

@@ -344,6 +344,9 @@ pub(crate) enum Gesture {
         targets: Targets,
         duplicate: bool,
         moved: bool,
+        /// A Shift-press on this selected layer: it leaves the selection on release, unless the
+        /// press became a drag.
+        deselect: Option<NodeId>,
     },
     Resize {
         start: Point,
@@ -1194,15 +1197,15 @@ impl Session {
             Some(target) => {
                 // Clicking inside the current selection's box keeps it (drag them all).
                 let in_sel_box = sel.len() > 1 && doc.bounds_of(&sel).is_some_and(|b| b.contains(ev.p())) && !ev.shift;
+                // Shift on a selected layer takes it out on release if the press doesn't become a
+                // drag; a drag moves the selection with it. Where no drag can start, it goes now.
+                let deselect = (ev.shift && sel.contains(&target)).then_some(target);
+                let without_target = || sel.iter().copied().filter(|x| *x != target).collect::<Vec<_>>();
                 let new_sel = if in_sel_box && (sel.contains(&target) || sel.iter().any(|s| doc.is_ancestor(*s, target))) {
                     sel.clone()
-                } else if ev.shift {
+                } else if ev.shift && deselect.is_none() {
                     let mut s2 = sel.clone();
-                    if let Some(pos) = s2.iter().position(|x| *x == target) {
-                        s2.remove(pos);
-                    } else {
-                        s2.push(target);
-                    }
+                    s2.push(target);
                     s2
                 } else if sel.contains(&target) {
                     sel.clone()
@@ -1210,12 +1213,12 @@ impl Session {
                     vec![target]
                 };
                 self.set_selection(new_sel.clone());
-                if new_sel.is_empty() || doc.node(target).is_some_and(|n| n.locked) {
-                    return Ok(());
-                }
                 // Locked layers selected in the layers panel stay put.
                 let ids: Vec<NodeId> = roots(&doc, &new_sel).into_iter().filter(|i| !locked_in(&doc, *i)).collect();
-                if ids.is_empty() {
+                if new_sel.is_empty() || doc.node(target).is_some_and(|n| n.locked) || ids.is_empty() {
+                    if deselect.is_some() {
+                        self.set_selection(without_target());
+                    }
                     return Ok(());
                 }
                 let mut targets = Targets::gather(&doc, page, &ids);
@@ -1225,8 +1228,13 @@ impl Session {
                 {
                     targets.add_box(b);
                 }
-                self.begin_interaction(if ev.alt { "Duplicate" } else { "Move" })?;
-                self.tool.gesture = Gesture::Move { start: ev.p(), ids, targets, duplicate: ev.alt, moved: false };
+                if let Err(e) = self.begin_interaction(if ev.alt { "Duplicate" } else { "Move" }) {
+                    if deselect.is_some() {
+                        self.set_selection(without_target());
+                    }
+                    return Err(e);
+                }
+                self.tool.gesture = Gesture::Move { start: ev.p(), ids, targets, duplicate: ev.alt, moved: false, deselect };
                 self.tool.overlay.cursor = if ev.alt { Cursor::Copy } else { Cursor::Default };
             }
             None => {
@@ -1456,7 +1464,8 @@ impl Session {
             }
             Gesture::Vector(_) | Gesture::ShapeBuild { .. } | Gesture::Origin => Ok(()),
             Gesture::PenDrag { anchor } => {
-                let out = ev.p() - *anchor;
+                // A click's wobble pulls out no handle.
+                let out = if within_slop(ev, *anchor) { Vec2::ZERO } else { ev.p() - *anchor };
                 if let Some(pen) = self.tool.pen.as_mut()
                     && let Some(last) = pen.points.last_mut()
                 {
@@ -1734,7 +1743,7 @@ impl Session {
         self.tool.overlay.drop_cell = None;
         let drop_target = self.tool.overlay.drop_target.take();
         match g {
-            Gesture::Move { ids, moved, duplicate, start, .. } => {
+            Gesture::Move { ids, moved, duplicate, start, deselect, .. } => {
                 if moved {
                     // A free move lands in the frame under the pointer (or the page) where it was
                     // dropped; layers in an auto layout frame already sit in their slot.
@@ -1776,7 +1785,11 @@ impl Session {
                     }
                 } else {
                     self.cancel_interaction()?;
-                    if !(ev.shift || ev.cmd || duplicate) {
+                    if let Some(d) = deselect {
+                        let sel = self.selection().into_iter().filter(|x| *x != d).collect();
+                        self.set_selection(sel);
+                    }
+                    if deselect.is_none() && !(ev.shift || ev.cmd || duplicate) {
                         self.widget_click(start, ev.tol() * 2.0)?;
                     }
                 }
@@ -1856,9 +1869,10 @@ impl Session {
             self.widget_click(ev.p(), ev.tol() * 2.0)?;
             return Ok(());
         }
-        // The second press began a move or a resize: a double-click isn't one.
-        if matches!(self.tool.gesture, Gesture::Move { .. } | Gesture::Resize { .. }) {
+        // The second press began a move, a resize, a shape or a marquee: a double-click isn't one.
+        if matches!(self.tool.gesture, Gesture::Move { .. } | Gesture::Resize { .. } | Gesture::Draw { .. } | Gesture::Marquee { .. }) {
             self.tool.gesture = Gesture::None;
+            self.tool.overlay.marquee = None;
             self.cancel_interaction()?;
         }
         let Some(leaf) = self.hit(&doc, page, ev.p(), ev.tol() * 2.0) else { return Ok(()) };

crates/engine/src/variable_tests.rs

@@ -5,6 +5,79 @@ use serde_json::json;
 use crate::Session;
 use crate::params::id_of;
 
+fn stale_bound_color_document() -> (figcraft_doc::Document, figcraft_doc::NodeId) {
+    let mut s = Session::new();
+    let id = id_of(&s.execute("shape.rectangle", &json!({"x": 4000, "y": 4000, "width": 23, "height": 17})).unwrap()["id"]).unwrap();
+    let page = s.doc().unwrap().first_page().unwrap();
+    s.execute("variable.createCollection", &json!({"name": "Theme", "modes": ["Light", "Dark"]})).unwrap();
+    s.execute("variable.create", &json!({"collection": "Theme", "name": "surface", "type": "color", "value": "#FFFFFF"})).unwrap();
+    s.execute("variable.create", &json!({"collection": "Theme", "name": "size", "type": "number", "value": 23})).unwrap();
+    s.execute("variable.set", &json!({"variable": "surface", "mode": "Dark", "value": "#202124"})).unwrap();
+    s.execute("variable.set", &json!({"variable": "size", "mode": "Dark", "value": 99})).unwrap();
+    s.execute("variable.bind", &json!({"ids": [id], "field": "fill", "variable": "surface"})).unwrap();
+    s.execute("variable.bind", &json!({"ids": [id], "field": "width", "variable": "size"})).unwrap();
+    s.execute("variable.setMode", &json!({"collection": "Theme", "mode": "Dark"})).unwrap();
+    let mut doc = s.doc().unwrap().clone();
+    let node = doc.get_mut(id).unwrap();
+    node.name = "load-binding-sentinel".into();
+    node.fills = vec![figcraft_color::Paint::solid(figcraft_color::Color::WHITE)];
+    node.width = 5.0;
+    node.source = Some(page);
+    node.overrides.insert("sentinel".into());
+    doc.take_dirty();
+    (doc, id)
+}
+
+fn assert_dark_bound_color(doc: &figcraft_doc::Document, transform: figcraft_doc::geom::Affine) -> figcraft_doc::NodeId {
+    let node = doc.nodes().find(|n| n.name == "load-binding-sentinel").unwrap();
+    assert_eq!(node.fills.first().and_then(|p| p.solid_color()).map(|c| c.to_hex()), Some("202124".into()));
+    assert_eq!((node.transform, node.width, node.height), (transform, 5.0, 17.0));
+    assert!(node.bound.contains_key("fills/0/color") || node.bound.contains_key("fill"));
+    node.id
+}
+
+#[test]
+fn initial_color_bindings_settle_in_constructor_and_loaders() {
+    let (stale, _id) = stale_bound_color_document();
+    let name_transform = stale.nodes().find(|n| n.name == "load-binding-sentinel").unwrap().transform;
+
+    let mut state = Session::with_document(stale.clone());
+    let id = assert_dark_bound_color(state.doc().unwrap(), name_transform);
+    assert_eq!(state.doc().unwrap().node(id).unwrap().source, stale.first_page());
+    assert!(state.doc().unwrap().node(id).unwrap().overrides.contains("sentinel"));
+    assert!(!state.ds().unwrap().is_dirty());
+    assert!(state.doc().unwrap().dirty().is_empty());
+    assert_eq!(state.undo_depth(), (0, 0));
+    state.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 2, "height": 2})).unwrap();
+    assert_dark_bound_color(state.doc().unwrap(), name_transform);
+
+    let native = figcraft_format::save_bytes(&stale, None).unwrap();
+    let (loaded, _) = crate::cmd::file::load_bytes(&native, "bindings.figcraft").unwrap();
+    // A native file settles when it opens as a document, not in the loader.
+    let opened = Session::with_document(loaded);
+    let loaded = opened.doc().unwrap();
+    let loaded_id = assert_dark_bound_color(loaded, name_transform);
+    assert_eq!(loaded_id, id);
+    assert_eq!(loaded.node(id).unwrap().source, stale.first_page());
+    assert!(loaded.node(id).unwrap().overrides.contains("sentinel"));
+    assert!(loaded.dirty().is_empty());
+
+    let (fig, _) = figcraft_format::fig::export(&stale, None).unwrap();
+    let (loaded, _) = crate::cmd::file::load_bytes(&fig, "bindings.fig").unwrap();
+    assert_dark_bound_color(&loaded, name_transform);
+}
+
+#[test]
+fn initial_paint_settlement_preserves_existing_dirty_nodes() {
+    let (mut doc, _) = stale_bound_color_document();
+    let page = doc.first_page().unwrap();
+    doc.mark_dirty([page]);
+
+    crate::cmd::styles::apply_paint_bindings_on_load(&mut doc);
+
+    assert_eq!(doc.dirty().iter().copied().collect::<Vec<_>>(), [page]);
+}
+
 #[test]
 fn bound_layers_follow_variable_values_and_unbind() {
     let mut s = Session::new();

crates/engine/src/variables_editor_tests.rs

@@ -114,3 +114,14 @@ fn field_scopes_by_property_and_layer() {
     assert_eq!(scope(f, "paddingHorizontal"), Some("GAP"));
     assert_eq!(scope(f, "visible"), None);
 }
+
+#[test]
+fn create_collection_refuses_a_taken_name() {
+    let mut s = Session::new();
+    ex(&mut s, "variable.createCollection", json!({"name": "Theme"}));
+    let before = s.doc().unwrap().variables.collections.len();
+    assert!(s.execute("variable.createCollection", &json!({"name": "Theme"})).is_err());
+    assert_eq!(s.doc().unwrap().variables.collections.len(), before);
+    ex(&mut s, "variable.createCollection", json!({"name": "Theme 2"}));
+    assert_eq!(s.doc().unwrap().variables.collections.len(), before + 1);
+}

crates/engine/src/vector_behaviour_tests.rs

@@ -133,6 +133,50 @@ fn entering_and_leaving_vector_edit_mode() {
     assert!(matches!(s.doc().unwrap().node(id).unwrap().kind, NodeKind::Rectangle), "converting is one undo step");
 }
 
+#[test]
+fn thin_strokes_are_easy_to_enter_and_bend() {
+    use crate::tools::ToolId;
+    // A diagonal line from (100, 100) to (200, 50); `off` steps away from its middle, square to it.
+    let at = |off: f64| (150.0 + off * 50.0 / 125f64.sqrt() / 10.0, 75.0 + off * 100.0 / 125f64.sqrt() / 10.0);
+    // (layer, screen px off the stroke, in edit mode after a double-click, derivation)
+    let rows: Vec<(&str, f64, bool, &str)> = vec![
+        ("line", 0.0, true, "double-clicking a selected line edits it as a vector"),
+        ("line", 4.0, true, "a 1 px line reaches a few pixels, so a double-click near it still lands (#646)"),
+        ("line", 8.0, false, "a double-click well away from it does not"),
+        ("path", 4.0, true, "a stroke-only path reaches as far as a line does"),
+        ("path", 8.0, false, "and no further"),
+    ];
+    for (layer, off, after, why) in rows {
+        let mut s = Session::new();
+        let id = if layer == "line" {
+            s.set_tool(ToolId::Line);
+            drag(&mut s, (100.0, 100.0), (200.0, 50.0), NONE);
+            *s.selection().first().unwrap()
+        } else {
+            let id = id_of(&ex(&mut s, "vector.create", json!({"points": [[100, 100], [200, 50]], "closed": false}))["id"]).unwrap();
+            // Styled like a pen stroke: 1 px, no fill.
+            ex(&mut s, "node.set", json!({"ids": [id], "props": {"fills": [], "strokes": ["#000000"], "strokeWeight": 1}}));
+            s.set_selection(vec![id]);
+            id
+        };
+        assert!(!s.doc().unwrap().node(id).unwrap().fills.iter().any(|f| f.visible), "{why}: the {layer} only has a stroke");
+        let p = at(off);
+        click(&mut s, p, NONE);
+        s.pointer(&ev(PointerKind::Down, p, NONE)).unwrap();
+        s.pointer(&ev(PointerKind::DoubleClick, p, NONE)).unwrap();
+        s.pointer(&ev(PointerKind::Up, p, NONE)).unwrap();
+        assert_eq!(editing(&s).is_some(), after, "{why}");
+        if after {
+            // Cmd/Ctrl then bends it through the pointer.
+            drag(&mut s, at(0.0), (170.0, 115.0), Mods { cmd: true, ..NONE });
+            let w = s.doc().unwrap().world_transform(id);
+            let n = net(&s, id);
+            assert!(!n.segments[0].is_straight(), "{why}: Cmd/Ctrl bends it");
+            assert!((w * n.cubic(0).unwrap().eval(0.5) - Point::new(170.0, 115.0)).hypot() < 1.0, "{why}: through the pointer");
+        }
+    }
+}
+
 #[test]
 fn the_pen_follows_the_documented_rules() {
     let mut s = Session::new();