Merge fix/794

Collect the folders whose lock is held, wait 100 ms once and retry only those,
instead of up to 100 ms per held folder. Recovery::start takes its folder without
waiting again (a held name already falls through to another). Windows doesn't
pass the lock to child processes, so the wait and its test are Unix-only; the
test holds the lock 10 ms against the 100 ms wait.

.github/workflows/ci.yml

@@ -29,6 +29,7 @@ concurrency:
 
 jobs:
   test:
+    timeout-minutes: 35
     name: test (ubuntu-latest)
     runs-on: ubuntu-latest
     steps:
@@ -69,6 +70,7 @@ jobs:
         run: cargo run --locked -q -p xtask -- assets
 
   wasm:
+    timeout-minutes: 30
     name: wasm32 check
     runs-on: ubuntu-latest
     steps:

.github/workflows/freebsd.yml

@@ -1,13 +1,12 @@
 # Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
-# (GitHub has no FreeBSD runners).
-# It then runs packaging/freebsd/package.sh, the script the release job runs, and checks the
-# tarball, so a broken FreeBSD package fails here before it can fail a release. Nothing is
-# uploaded and no secrets are used.
+# (GitHub has no FreeBSD runners). It then runs packaging/freebsd/package.sh, the script
+# the release job runs, and checks the tarball, so a broken FreeBSD package fails here
+# before it can fail a release. Nothing is uploaded and no secrets are used.
 name: FreeBSD
 
-# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every push
-# or dependency change: a drifted dependency still shows up within a day, and always before a
-# release ships. PRs that change the FreeBSD packaging itself still run it.
+# The VM build takes one to several hours, so it runs nightly on main rather than on every push
+# or dependency change: a drifted dependency still shows up within a day. PRs that change the
+# FreeBSD packaging itself still run it.
 on:
   schedule:
     - cron: "17 2 * * *"
@@ -29,35 +28,8 @@ permissions:
 
 jobs:
   freebsd:
-    name: FreeBSD 14 (build + test + package)
-    runs-on: ubuntu-latest
-    timeout-minutes: 300
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build, test and package in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Nothing to bring back; copying the target dir out of the VM fails on large builds.
-          copyback: false
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2
-            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-          run: |
-            set -e
-            . "$HOME/.cargo/env"
-            # The checkout is synced in under another owner; let tests that call git read it.
-            git config --global --add safe.directory "*"
-            rustc --version
-            CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
-            # The release package, as release.yml builds it. Free the debug build's disk first.
-            rm -rf target/debug
-            CARGO_BUILD_JOBS=4 bash packaging/freebsd/package.sh
-            tar -tzf dist/release/figcraft-*-freebsd-x86_64.tar.gz >"$HOME/freebsd-contents.txt"
-            for f in '/bin/figcraft$' '/share/applications/ai\.storyteller\.figcraft\.desktop$' '/share/doc/figcraft/LICENSE-MIT$'; do
-              grep -E "$f" "$HOME/freebsd-contents.txt"
-            done
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
+    with:
+      run-package-check: true
+      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104

.github/workflows/nix.yml

@@ -0,0 +1,23 @@
+# Evaluates the Nix flake (no build, about a minute): `nix build` / `nix develop` stop at evaluation
+# when Cargo.lock gains something nix/package.nix can't vendor, and nothing else would notice.
+name: Nix
+
+on:
+  push:
+    branches: [main]
+    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+  pull_request:
+    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  nix:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/nix.yml@main

.github/workflows/packaging-lint.yml

@@ -19,57 +19,7 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
-    env:
-      ACTIONLINT_VERSION: 1.7.12
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends shellcheck desktop-file-utils appstream libxml2-utils python3-yaml
-          curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
-            | tar -xz -C "$RUNNER_TEMP" actionlint
-      - name: actionlint
-        run: |
-          "$RUNNER_TEMP/actionlint" -color
-      - name: shellcheck
-        run: shellcheck packaging/*.sh packaging/*/*.sh packaging/linux/AppRun
-      - name: Server install script (Caddyfile handling)
-        run: bash packaging/server/install-test.sh
-      - name: AppImage AppRun desktop integration
-        run: bash packaging/linux/apprun-test.sh
-      - name: PowerShell
-        shell: pwsh
-        run: |
-          foreach ($f in Get-ChildItem packaging/windows/*.ps1) {
-            $errors = $null
-            [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors) | Out-Null
-            if ($errors) { $errors | ForEach-Object { Write-Output "::error file=$($f.Name)::$_" }; exit 1 }
-            Write-Output "ok $($f.Name)"
-          }
-          ./packaging/windows/check-icons.ps1
-      - name: FreeBSD package layout (dry run, no build)
-        run: bash packaging/freebsd/package.sh --dry-run
-      - name: No template leftovers from other apps in package metadata
-        run: |
-          if grep -rniE 'photoshop|psd|photocraft|vectorcraft|illustrator|adobe|figma' packaging/ .github/ --exclude=packaging-lint.yml; then
-            echo "::error::package metadata mentions another product (see above)"
-            exit 1
-          fi
-      - name: XML, desktop entry, AppStream, Flatpak manifest
-        run: |
-          xmllint --noout packaging/windows/figcraft.wxs packaging/windows/figcraft.en-us.wxl packaging/macos/*.plist* packaging/linux/*.xml*
-          desktop-file-validate packaging/linux/ai.storyteller.figcraft.desktop
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.figcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.figcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.figcraft.metainfo.xml"
-          python3 - <<'EOF'
-          import yaml
-          src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.figcraft.yml"))
-          bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.figcraft.bundle.yml"))
-          for m in (src, bundle):
-              assert m["id"] == "ai.storyteller.figcraft" and m["command"] == "figcraft", m["id"]
-          for key in ("runtime", "runtime-version", "sdk", "finish-args"):
-              assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}"
-          print("Flatpak manifests ok")
-          EOF
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
+    with:
+      extra-checks-script: packaging/check-app-specific.sh

.github/workflows/release.yml

@@ -1,11 +1,3 @@
-# Release pipeline: every push to `release` builds signed installers for every platform and
-# creates or updates the draft GitHub Release "FigCraft v<version>". See docs/releasing.md.
-#
-# Only the jobs that read secrets (macOS and Windows signing, and the draft release) run in the
-# `release` environment (restricted to the `release` branch), which holds the signing secrets; the
-# rest build on any branch, so `gh workflow run release.yml --ref <branch>` is a real dry run.
-# Every secret is optional: missing ones produce unsigned artifacts and a warning, never a failed
-# build. Playbook: storytold/craftrules release/playbook.md.
 name: Release
 
 on:
@@ -19,534 +11,34 @@ on:
         default: ""
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: release-${{ github.ref }}
-  # Never cancel a run mid-notarization or mid-upload; a newer push waits its turn.
   cancel-in-progress: false
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-  RUST_BACKTRACE: 1
-  FIGCRAFT_BUILD_SHA: ${{ github.sha }}
-  INPUT_VERSION: ${{ inputs.version }}
-  # craft-fonts (https://github.com/storytold/craft-fonts): shared font assets every release
-  # embeds (Inter and the Latin presentation fonts from fonts/latin-manifest.txt; the web build
-  # embeds Inter only, see crates/text/build.rs). An optional build input for everyone else.
-  # crates/text/build.rs needs fonts/latin-manifest.txt, so the pin must include it. Bump
-  # deliberately; every build job checks out this commit.
-  CRAFT_FONTS_REF: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
-
 jobs:
-  version:
-    name: version
-    runs-on: ubuntu-latest
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    outputs:
-      version: ${{ steps.v.outputs.version }}
-      date: ${{ steps.v.outputs.date }}
-      prerelease: ${{ steps.v.outputs.prerelease }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: v
-        name: Resolve version
-        run: |
-          . packaging/env.sh
-          v="${INPUT_VERSION#v}"
-          v="${v:-$VERSION}"
-          if ! printf '%s' "$v" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'; then
-            echo "::error::'$v' is not a version like 1.2.3 or 1.2.3-rc.1"
-            exit 1
-          fi
-          case "$v" in *-*) pre=true ;; *) pre=false ;; esac
-          {
-            echo "version=$v"
-            echo "date=$(date -u +%Y-%m-%d)"
-            echo "prerelease=$pre"
-          } >>"$GITHUB_OUTPUT"
-          echo "### FigCraft v$v (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
-
-  macos:
-    name: macOS universal
-    needs: version
-    runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
-    environment: release
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-macos-universal
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Import signing certificate
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: packaging/macos/import-cert.sh
-      - name: Build, sign, notarize
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/macos/package.sh --arch universal
-      # Unpacks the CLI zip and checks the binary users get: Developer ID, hardened runtime,
-      # timestamp, and Gatekeeper's notarization lookup (codesign --verify, spctl). Also the DMG's
-      # stapled ticket. Strict when the signing secrets are present, warnings otherwise.
-      - name: Verify signatures and notarization
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: packaging/macos/verify.sh --arch universal
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-macos
-          path: dist/release/*
-          if-no-files-found: error
-      - name: Remove temporary keychain
-        if: always()
-        run: |
-          if [ -n "${MACOS_KEYCHAIN:-}" ]; then security delete-keychain "$MACOS_KEYCHAIN" || true; fi
-
-  windows:
-    name: Windows ${{ matrix.arch }}
-    needs: version
-    runs-on: windows-latest
-    environment: release
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x64, target: x86_64-pc-windows-msvc }
-          - { arch: x86, target: i686-pc-windows-msvc }
-          # Windows on ARM: cross-compiled on the x64 runner, so signing and WiX run as above.
-          # .github/workflows/windows-arm64.yml installs and runs it on ARM64 hardware.
-          - { arch: arm64, target: aarch64-pc-windows-msvc }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-windows-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        shell: bash
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Install WiX
-        shell: pwsh
-        run: |
-          dotnet tool install --global wix --version 5.0.2
-          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
-      - name: Build, sign, package
-        shell: pwsh
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
-          AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
-          AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-windows-${{ matrix.arch }}
-          path: dist/release/*
-          if-no-files-found: error
-
-  linux:
-    name: Linux ${{ matrix.arch }}
-    needs: version
-    # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
-    # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-22.04, deb: amd64 }
-          - { arch: aarch64, runner: ubuntu-22.04-arm, deb: arm64 }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      NFPM_VERSION: 2.47.0
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - name: Install build and packaging tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
-            desktop-file-utils appstream python3-yaml zsync
-          curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
-            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
-          sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-linux-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Build and package (AppImage, deb, rpm, tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/linux/package.sh
-      - name: Check the packages
-        run: |
-          dpkg-deb --info dist/release/*.deb
-          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/figcraft$|metainfo|applications'
-          ldd target/release/figcraft
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.figcraft.yml')); assert m['id'] == 'ai.storyteller.figcraft'"
-          for appimage in dist/release/*.AppImage; do
-            chmod +x "$appimage"
-            APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
-            # Update information is embedded, and the .zsync for delta updates sits beside it.
-            "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|'
-            test -s "$appimage.zsync"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/release/*
-          if-no-files-found: error
-
-  server:
-    name: Server Linux ${{ matrix.arch }}
-    needs: version
-    # The headless collaboration server (docs/server.md): figcraft-server-<v>-linux-<arch>.tar.gz
-    # with the binary, licences, docs/server.md and the deployment examples. Same runners as the
-    # app, so the same glibc floor; no craft-fonts (the server draws no text).
-    # shortcut: Linux only (where servers run); add macOS/Windows archives, signed like figcraft-cli,
-    # when people host there.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-22.04 }
-          - { arch: aarch64, runner: ubuntu-22.04-arm }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-server-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Build and package (tar.gz)
-        run: packaging/server/package.sh
-      - name: Check the archive
-        run: |
-          tar -tzf "dist/release/figcraft-server-$FIGCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz" | tee "$RUNNER_TEMP/server-contents.txt"
-          for f in '/figcraft-server$' '/figcraft-server\.service$' '/Caddyfile$' '/nginx\.conf$' '/install\.sh$' '/figcraft-backup\.timer$' '/server\.md$' '/LICENSE-MIT$'; do
-            grep -E "$f" "$RUNNER_TEMP/server-contents.txt"
-          done
-          ldd target/release/figcraft-server
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-server-linux-${{ matrix.arch }}
-          path: dist/release/*.tar.gz
-          if-no-files-found: error
-
-  flatpak:
-    name: Flatpak ${{ matrix.arch }}
-    needs: [version, linux]
-    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
-    # build here. 24.04 for a newer flatpak-builder (1.4) than 22.04 ships.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-24.04 }
-          - { arch: aarch64, runner: ubuntu-24.04-arm }
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/linux
-      - name: Install flatpak-builder
-        run: |
-          sudo apt-get update
-          # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's
-          # `appstreamcli compose`, which renders the scalable icon and fails without it.
-          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
-          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      - name: Build the Flatpak bundle
-        run: packaging/linux/flatpak-bundle.sh "dist/linux/figcraft-$FIGCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-flatpak-${{ matrix.arch }}
-          path: dist/release/*.flatpak
-          if-no-files-found: error
-
-  freebsd:
-    name: FreeBSD x86_64
-    needs: version
-    # GitHub has no FreeBSD runners: build in a FreeBSD 14.3 VM, the same image and packages as
-    # .github/workflows/freebsd.yml. A private repo's ubuntu-latest has 2 vCPUs and 7 GB, too small
-    # for this VM (QEMU "cannot set up guest memory"), so it runs on the org's 16-core larger runner.
-    runs-on: github-ubuntu-16core
-    timeout-minutes: 180
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - name: Build and package in a FreeBSD VM (tar.gz)
-        # vmactions/freebsd-vm v1.5.9, pinned by commit (it runs our build).
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Passed into the VM by name; never templated into the script below.
-          envs: "FIGCRAFT_VERSION FIGCRAFT_BUILD_DATE FIGCRAFT_BUILD_SHA INPUT_VERSION"
-          # The FreeBSD CI packages, plus bash for the packaging script.
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-          run: |
-            set -e
-            . "$HOME/.cargo/env"
-            git config --global --add safe.directory "$PWD"
-            # Build outside the checkout so only dist/ is copied back out of the VM (copying the
-            # target dir back fails on large builds). 4 jobs: more runs the VM out of memory.
-            export CARGO_TARGET_DIR=/var/tmp/figcraft-target CARGO_BUILD_JOBS=4
-            if [ -n "$INPUT_VERSION" ]; then cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"; fi
-            # craft-fonts was checked out next to the sources and synced into the VM with them.
-            export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
-            bash packaging/freebsd/package.sh
-            tar -tzf dist/release/figcraft-*-freebsd-x86_64.tar.gz >"$HOME/freebsd-contents.txt"
-            for f in '/bin/figcraft$' '/share/applications/ai\.storyteller\.figcraft\.desktop$' '/share/doc/figcraft/LICENSE-MIT$'; do
-              grep -E "$f" "$HOME/freebsd-contents.txt"
-            done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-freebsd-x86_64
-          path: dist/release/*
-          if-no-files-found: error
-
-  web:
-    name: Web (wasm)
-    needs: version
-    runs-on: ubuntu-latest
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      TRUNK_VERSION: 0.21.14
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-web
-      - name: Install trunk
-        run: |
-          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
-            | tar -xz -C "$HOME/.cargo/bin" trunk
-          trunk --version
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      # The wasm32 build embeds only Inter from craft-fonts (crates/text/build.rs): browsers have
-      # no system fonts to fall back on, and the rest would push the wasm towards
-      # packaging/web/package.sh's 24 MiB gate.
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - name: Build and zip
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/web/package.sh
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-web
-          path: dist/release/*
-          if-no-files-found: error
-
-  linux-riscv64:
-    name: Linux riscv64
-    needs: version
-    # Cross-compiled on x86_64 (no hosted RISC-V runners) against the runner's own Ubuntu release
-    # from ports.ubuntu.com, so the binaries need that release's glibc (24.04: 2.39). 22.04's
-    # riscv64 ports lag its amd64 updates, which breaks the multiarch install. tar.gz only; the
-    # CLI is smoke-tested under QEMU.
-    runs-on: ubuntu-24.04
-    # No `environment: release`: this job reads no secrets, so a branch dry run can run it.
-    env:
-      FIGCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      FIGCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check out craft-fonts (embedded fonts)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: riscv64gc-unknown-linux-gnu
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-linux-riscv64
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo run --locked -q -p xtask -- version set "$FIGCRAFT_VERSION"
-      - name: Install cross-compilation dependencies
-        run: |
-          . /etc/os-release
-          sudo dpkg --add-architecture riscv64
-          # Pin the existing (archive.ubuntu.com) sources to amd64; riscv64 comes from ports.
-          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
-            sudo sed -i '/^Types: deb/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
-          fi
-          if [ -f /etc/apt/sources.list ]; then
-            sudo sed -i 's/^deb /deb [arch=amd64] /g' /etc/apt/sources.list
-            sudo sed -i 's/^deb-src /deb-src [arch=amd64] /g' /etc/apt/sources.list
-          fi
-          for suite in "$VERSION_CODENAME" "$VERSION_CODENAME-updates" "$VERSION_CODENAME-security"; do
-            echo "deb [arch=riscv64] http://ports.ubuntu.com/ubuntu-ports $suite main universe restricted multiverse"
-          done | sudo tee /etc/apt/sources.list.d/riscv64.list
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            gcc-riscv64-linux-gnu binutils-riscv64-linux-gnu libc6-dev-riscv64-cross libc6-dev:riscv64 qemu-user \
-            libxkbcommon-dev:riscv64 libwayland-dev:riscv64 libx11-dev:riscv64 libxrandr-dev:riscv64 \
-            libxi-dev:riscv64 libgl1-mesa-dev:riscv64
-      - name: Build and package (tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-          CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_LINKER: riscv64-linux-gnu-gcc
-          PKG_CONFIG_SYSROOT_DIR: /
-          PKG_CONFIG_PATH: /usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
-          PKG_CONFIG_ALLOW_CROSS: "1"
-          CROSS_ARCH: riscv64
-          CROSS_TARGET: riscv64gc-unknown-linux-gnu
-          CROSS_COMPILE: riscv64-linux-gnu-
-          EMULATOR: qemu-riscv64
-          QEMU_LD_PREFIX: /usr/riscv64-linux-gnu
-        run: packaging/linux/package.sh --formats tar
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-linux-riscv64
-          path: dist/release/*.tar.gz
-          if-no-files-found: error
-
   release:
-    name: Draft GitHub Release
-    needs: [version, macos, windows, linux, linux-riscv64, flatpak, freebsd, web, server]
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: write
-    env:
-      VERSION: ${{ needs.version.outputs.version }}
-      PRERELEASE: ${{ needs.version.outputs.prerelease }}
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      GH_REPO: ${{ github.repository }}
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: release-*
-          path: artifacts
-          merge-multiple: true
-      - name: Checksums
-        working-directory: artifacts
-        run: |
-          sha256sum -- * | tee SHA256SUMS.txt
-      - name: Create or update the draft release
-        working-directory: artifacts
-        run: |
-          tag="v$VERSION"
-          title="FigCraft v$VERSION"
-          pre=()
-          if [ "$PRERELEASE" = true ]; then pre=(--prerelease); fi
-          if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
-            if [ "$draft" != "true" ]; then
-              echo "::error::Release $tag is already published. Bump the version (cargo run -p xtask -- version set X.Y.Z) before pushing to release."
-              exit 1
-            fi
-            echo "Updating draft $tag: replacing its assets"
-            gh release view "$tag" --json assets --jq '.assets[].name' | while read -r asset; do
-              gh release delete-asset "$tag" "$asset" --yes
-            done
-            gh release edit "$tag" --draft --title "$title" --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
-            gh release upload "$tag" --clobber -- *
-          else
-            echo "Creating draft $tag"
-            gh release create "$tag" --draft --title "$title" --target "$GITHUB_SHA" --generate-notes "${pre[@]}" -- *
-          fi
-          {
-            echo "Draft release **$title** at \`${GITHUB_SHA::9}\`:"
-            echo
-            sed 's/^/    /' SHA256SUMS.txt
-          } >>"$GITHUB_STEP_SUMMARY"
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
+    with:
+      app-name: figcraft
+      app-title: FigCraft
+      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+      has-server: true
+      version: ${{ inputs.version }}
+    secrets:
+      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+      KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
+      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
+      AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}

.github/workflows/windows-arm64.yml

@@ -24,77 +24,10 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-
 jobs:
-  package:
-    name: package (cross-compiled on x64)
-    runs-on: windows-latest
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
-        with:
-          targets: aarch64-pc-windows-msvc
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-        with:
-          key: windows-arm64-package
-      - name: Install WiX
-        shell: pwsh
-        run: |
-          dotnet tool install --global wix --version 5.0.2
-          wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2
-      - name: Build and package (unsigned)
-        shell: pwsh
-        env:
-          DIST: ${{ github.workspace }}\dist\arm64
-        run: ./packaging/windows/package.ps1 -Arch arm64
-      - uses: actions/upload-artifact@v4
-        with:
-          name: figcraft-windows-arm64
-          path: dist/arm64/*
-          if-no-files-found: error
-          retention-days: 7
-
-  install:
-    name: install and run on ARM64
-    needs: package
-    runs-on: windows-11-arm
-    timeout-minutes: 30
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: figcraft-windows-arm64
-          path: dist
-      - name: Install the MSI, check it, run it, uninstall it
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $msi = (Get-ChildItem dist/*.msi | Select-Object -First 1).FullName
-          $p = Start-Process msiexec.exe -ArgumentList '/i', "`"$msi`"", '/qn', '/l*v', 'install.log' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { Get-Content install.log -Tail 60; throw "msiexec /i exited $($p.ExitCode)" }
-          $dir = Join-Path $env:ProgramFiles 'FigCraft'
-          # figcraft-cli.exe ships once apps/figcraft-cli exists; check it when installed.
-          foreach ($exe in 'figcraft.exe', 'figcraft-cli.exe') {
-            $path = Join-Path $dir $exe
-            if (-not (Test-Path $path)) {
-              if ($exe -eq 'figcraft-cli.exe') { Write-Output "skip $exe (not in this build)"; continue }
-              throw "$exe not installed in $dir"
-            }
-            $bytes = [System.IO.File]::ReadAllBytes($path)
-            $machine = [BitConverter]::ToUInt16($bytes, [BitConverter]::ToInt32($bytes, 0x3C) + 4)
-            if ($machine -ne 0xAA64) { throw "$exe is for machine 0x$('{0:X}' -f $machine), not ARM64" }
-            Write-Output "ok $path (ARM64)"
-          }
-          # The installed binary runs natively on ARM64 (the CLI when present, else the app's --version).
-          $cli = Join-Path $dir 'figcraft-cli.exe'
-          if (-not (Test-Path $cli)) { $cli = Join-Path $dir 'figcraft.exe' }
-          $out = & $cli --version 2>&1 | Out-String
-          if ($LASTEXITCODE -ne 0) { Write-Output $out; throw "$cli --version exited $LASTEXITCODE" }
-          Write-Output "ok $(Split-Path -Leaf $cli) --version: $($out.Trim())"
-          $p = Start-Process msiexec.exe -ArgumentList '/x', "`"$msi`"", '/qn' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { throw "msiexec /x exited $($p.ExitCode)" }
-          if (Test-Path (Join-Path $dir 'figcraft.exe')) { throw 'uninstall left figcraft.exe behind' }
-          Write-Output 'ok uninstalled'
+  windows-arm64:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
+    with:
+      app-name: figcraft
+      app-dir: FigCraft

Cargo.lock

@@ -259,6 +259,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "windows-sys 0.60.2",
+ "wl-clipboard-rs",
  "x11rb",
 ]
 
@@ -855,6 +856,11 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-docpath"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -1407,7 +1413,7 @@ checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
 
 [[package]]
 name = "figcraft"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "arboard",
  "eframe",
@@ -1418,19 +1424,23 @@ dependencies = [
  "figcraft-format",
  "figcraft-text",
  "figcraft-ui-egui",
+ "fmv-macos-events",
  "image",
  "log",
+ "raw-window-handle",
  "rfd",
  "serde_json",
  "wat",
+ "wayland-client",
  "webbrowser",
  "windows",
+ "winit",
  "winresource",
 ]
 
 [[package]]
 name = "figcraft-cli"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-doc",
  "figcraft-engine",
@@ -1444,7 +1454,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-collab"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "base64 0.22.1",
  "figcraft-color",
@@ -1459,7 +1469,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-collab-net"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "base64 0.22.1",
  "figcraft-collab",
@@ -1482,7 +1492,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-color"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "kurbo",
  "serde",
@@ -1491,7 +1501,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-doc"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-color",
  "figcraft-geom",
@@ -1503,9 +1513,10 @@ dependencies = [
 
 [[package]]
 name = "figcraft-engine"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "base64 0.22.1",
+ "craft-docpath",
  "figcraft-collab",
  "figcraft-color",
  "figcraft-doc",
@@ -1530,7 +1541,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-format"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-doc",
  "figcraft-pathops",
@@ -1545,7 +1556,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-geom"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "kurbo",
  "serde",
@@ -1553,7 +1564,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-layout"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-doc",
  "figcraft-geom",
@@ -1561,7 +1572,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-mcp"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "base64 0.22.1",
  "figcraft-collab-net",
@@ -1577,7 +1588,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-pathops"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-doc",
  "figcraft-geom",
@@ -1586,7 +1597,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-pdf"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-color",
  "figcraft-doc",
@@ -1598,12 +1609,12 @@ dependencies = [
  "krilla",
  "log",
  "thiserror 2.0.21",
- "tiny-skia",
+ "tiny-skia 0.12.0",
 ]
 
 [[package]]
 name = "figcraft-plugin"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-color",
  "serde",
@@ -1616,7 +1627,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-render"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "crc32fast",
  "figcraft-color",
@@ -1629,12 +1640,12 @@ dependencies = [
  "moxcms",
  "png",
  "rayon",
- "tiny-skia",
+ "tiny-skia 0.12.0",
 ]
 
 [[package]]
 name = "figcraft-server"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "crc32fast",
  "ctrlc",
@@ -1658,7 +1669,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-svg"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "base64 0.22.1",
  "figcraft-color",
@@ -1674,12 +1685,13 @@ dependencies = [
 
 [[package]]
 name = "figcraft-text"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-doc",
  "figcraft-geom",
  "harfrust 0.13.3",
  "log",
+ "png",
  "skrifa 0.47.0",
  "unicode-bidi",
  "unicode-segmentation",
@@ -1687,7 +1699,7 @@ dependencies = [
 
 [[package]]
 name = "figcraft-ui-egui"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "base64 0.22.1",
  "egui",
@@ -1707,17 +1719,19 @@ dependencies = [
  "serde_json",
  "toml",
  "wat",
+ "web-time",
 ]
 
 [[package]]
 name = "figcraft-web"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "eframe",
  "egui",
  "figcraft-collab-net",
  "figcraft-engine",
  "figcraft-ui-egui",
+ "js-sys",
  "log",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -1730,6 +1744,12 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -1750,6 +1770,17 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "fmv-macos-events"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90642cf66dde7f205dc8b42dfe57b47d0f3a29f571b832742883ef512e23fe55"
+dependencies = [
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -2548,7 +2579,7 @@ dependencies = [
  "skrifa 0.42.1",
  "smallvec",
  "subsetter",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
  "xmp-writer",
  "yoke",
  "zune-jpeg",
@@ -2805,6 +2836,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -3189,6 +3229,16 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3249,6 +3299,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
 [[package]]
 name = "phf"
 version = "0.13.1"
@@ -3966,6 +4027,17 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sctk-adwaita"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec"
+dependencies = [
+ "log",
+ "smithay-client-toolkit 0.19.2",
+ "tiny-skia 0.11.4",
+]
+
 [[package]]
 name = "self_cell"
 version = "1.3.0"
@@ -4425,6 +4497,20 @@ dependencies = [
  "zune-jpeg",
 ]
 
+[[package]]
+name = "tiny-skia"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "tiny-skia-path 0.11.4",
+]
+
 [[package]]
 name = "tiny-skia"
 version = "0.12.0"
@@ -4437,7 +4523,18 @@ dependencies = [
  "cfg-if",
  "log",
  "png",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
+]
+
+[[package]]
+name = "tiny-skia-path"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+dependencies = [
+ "arrayref",
+ "bytemuck",
+ "strict-num",
 ]
 
 [[package]]
@@ -4559,6 +4656,17 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
 [[package]]
 name = "ttf-parser"
 version = "0.25.1"
@@ -4715,7 +4823,7 @@ dependencies = [
  "skrifa 0.44.0",
  "strict-num",
  "svgtypes",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
  "unicode-bidi",
  "unicode-script",
  "unicode-vo",
@@ -5668,6 +5776,7 @@ dependencies = [
  "raw-window-handle",
  "redox_syscall 0.4.1",
  "rustix 0.38.44",
+ "sctk-adwaita",
  "smithay-client-toolkit 0.19.2",
  "smol_str",
  "tracing",
@@ -5711,6 +5820,24 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"
@@ -5807,7 +5934,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.6.0"
+version = "0.7.0"
 dependencies = [
  "figcraft-engine",
  "serde_json",

Cargo.toml

@@ -6,7 +6,7 @@ exclude = ["plugins"]
 # default-members = ["crates/*", "apps/figcraft", "apps/figcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.6.0"
+version = "0.7.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -32,6 +32,9 @@ figcraft-mcp = { path = "crates/mcp" }
 figcraft-collab-net = { path = "crates/collab-net" }
 figcraft-plugin = { path = "crates/plugin" }
 
+# Which paths stored in a document may be followed (craft-libs).
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
+
 # foundation
 kurbo = { version = "0.13", features = ["serde"] }
 thiserror = "2"

NOTICE

@@ -20,3 +20,34 @@ licence texts.
 Rust crate dependencies keep their own licenses (MIT, Apache-2.0, BSD, ISC, Zlib, OFL for egui's
 default fonts, CDLA-Permissive-2.0 for the root certificate list webpki-roots compiles in, and
 similar permissive licenses); see each crate's metadata.
+
+Linux Wayland window decorations
+-------------------------------
+sctk-adwaita 0.10.1 (https://github.com/PolyMeilex/sctk-adwaita,
+commit d5f343c45c04d4a026db57f76760819b7325db00) is used by winit on Linux
+for vector window controls. Its title-font features are disabled: no Cantarell
+font is embedded by this dependency and no font file is added to this repo.
+
+sctk-adwaita's MIT licence:
+
+MIT License
+
+Copyright (c) 2022 Bartłomiej Maryńczak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -227,8 +227,8 @@ The desktop app also offers a loopback-only control channel (`figcraft --control
 - **Its own renderer:** tiny-skia on every core for the canvas and exports, with layer blending, effects and masks; booleans from linesweeper, geometry from kurbo, text from skrifa and HarfRust.
 - **Runs in the browser:** the whole engine and UI compile to WebAssembly.
 - **Accessible:** screen readers get names, roles, values and states for the tools, layer rows, fields, dropdowns, tabs and menus (AccessKit on desktop), F6 moves the keyboard between the toolbar, layers, canvas and properties (Tab within them, Escape back to the canvas), the system's reduce-motion setting is honoured, and panel text meets WCAG AA contrast in both themes.
-- **Languages:** English and Spanish (a draft waiting for a native speaker's review), picked in Preferences or taken from the system or browser and switched live; adding a language is one catalog file ([`docs/translating.md`](docs/translating.md)).
-- **Plugins:** sandboxed WebAssembly plugins (a metered, pure-Rust interpreter with a memory cap and no file or network access, in the browser too) that act through the same commands, each run one undo step, within the permissions their manifest asks for. A Rust SDK and two example plugins are in [`plugins/`](plugins); see [`docs/plugins.md`](docs/plugins.md).
+- **Languages:** English, Russian and Turkish (reviewed by native speakers), and Spanish, French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Czech and Indonesian drafts, picked in Preferences or taken from the system or browser and switched live; adding a language is one catalog file ([`docs/translating.md`](docs/translating.md)).
+- **Plugins:** sandboxed WebAssembly plugins (a metered, pure-Rust interpreter with a memory cap and no file or network access, in the browser too) that act through the same commands, each run one undo step, within the permissions their manifest asks for. A Rust SDK and three example plugins are in [`plugins/`](plugins); see [`docs/plugins.md`](docs/plugins.md).
 - **Live sessions (preview):** share the open file from the app (Share ▸ Start sharing: online through a server, or on your local network), give the others the short join code it shows (or the invite link), and edit it together: everyone's changes sync live, with cursors, selections, avatars and follow, and undo takes back only your own changes. Others join from the desktop app (invite links open it) or from the browser build. See [`docs/collab-protocol.md`](docs/collab-protocol.md).
 - **A server of your own (preview):** `figcraft-server` keeps a team's files, publishes them from the app (File ▸ Publish to server…, or Share ▸ Online with your server in Preferences) and hands out share links and join codes that let people edit or only view; files survive restarts and apps reconnect where they were. No accounts yet: links are the access. Releases ship it for Linux, and the desktop app joins over `wss://`; [hosting it on a rented Linux server](docs/server.md#deploy-on-a-linux-server) takes a systemd unit and Caddy or nginx (or Docker). See [`docs/server.md`](docs/server.md).
 - **Never crashes:** no `unwrap`, `expect` or `panic` in shipped code, enforced by clippy; commands run behind a guard so a bug fails one action, not your session.

ROADMAP.md

@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading (#207), SVG import budgets (#190), Leptos code (#223), full screen (#227), server snapshots readable again (#188), owner-only preferences (#200), ruzstd 0.9.1 (#182), layer cycle repair (#205), batch rollback, Direct3D 12 on Windows, plugin metering (#192); vector edit mode regions: hover hatch, selection and drag; SVG/PDF exports refuse over-depth documents (#208); bounded MCP/control framing, connections and queues (#201); plugin log limits (#191); live-session revert guard (#198); attached MCP no longer replays after a lost reply (#194); repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; starter templates, a Templates tab and Getting started tips on the home screen; your online files; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; Windows QA pass with eight fixes; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (community batch #753: Selection colors, smart-selection spacing, a Present tab; language table re-measured from the catalogs; community fixes from #524 up (55 PRs: `.fig` import fidelity, paste from other apps, the Actions palette, editor fixes, server limits) and a boolean-op crash guard; number variables in the text content picker (#629); frames and sections convert into each other (#719); bounded canvas pan overscan; community fixes from #478 up and a control-channel fix (#589); bounded canvas pan overscan; Typography spacing icons support scrubbing (#373); font scans skip named pipes; system theme on first run; recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading (#207), SVG import budgets (#190), Leptos code (#223), full screen (#227), server snapshots readable again (#188), owner-only preferences (#200), ruzstd 0.9.1 (#182), layer cycle repair (#205), batch rollback, Direct3D 12 on Windows, plugin metering (#192); vector edit mode regions: hover hatch, selection and drag; SVG/PDF exports refuse over-depth documents (#208); bounded MCP/control framing, connections and queues (#201); plugin log limits (#191); live-session revert guard (#198); attached MCP no longer replays after a lost reply (#194); repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; starter templates, a Templates tab and Getting started tips on the home screen; your online files; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; Windows QA pass with eight fixes; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -13,7 +13,7 @@ start with [`docs/gaps.md`](docs/gaps.md).
 
 | | Value | Kind |
 |---|---|---|
-| Menu/command breadth | **100%** (211 / 211) | measured, [`docs/parity-checklist.md`](docs/parity-checklist.md) (`cargo xtask parity`) |
+| Menu/command breadth | **100%** (212 / 212) | measured, [`docs/parity-checklist.md`](docs/parity-checklist.md) (`cargo xtask parity`) |
 | Feature breadth | **~85%** (core editor ~94%) | estimated, [`docs/target-app-parity.md`](docs/target-app-parity.md) |
 | Ready for real work | **~53%** | estimated, same doc (written dimension weights and scores) |
 | Essentials user | **~59%** | estimated: core features 77.8% × 0.92 launch/stability × 0.94 discoverability × 0.88 opening files people send ([method](docs/target-app-parity.md#essentials-user)) |
@@ -99,25 +99,25 @@ native speakers' reviews of the six language drafts need people.
 | Language | Code | Strings | Status |
 |---|---|---|---|
 | English | en | 100% | full |
-| Simplified Chinese | zh-Hans | 100% | draft (needs native review) |
-| Spanish | es, es-419 | 100% (es-419: an overlay of 98 entries) | draft (needs native review) |
+| Simplified Chinese | zh-Hans | 95% | draft (needs native review) |
+| Spanish | es, es-419 | 100% (es-419: an overlay of 101 entries) | draft (needs native review) |
 | Hindi | hi | 0% | none |
 | Arabic | ar | 0% | none |
-| French | fr | 100% | draft (needs native review) |
-| Portuguese (Brazil) | pt-BR | 100% | draft (needs native review) |
-| Indonesian | id | 0% | none |
-| Japanese | ja | 100% | draft (needs native review) |
-| German | de | 100% | draft (needs native review) |
-| Korean | ko | 100% | draft (needs native review) |
+| French | fr | 95% | draft (needs native review) |
+| Portuguese (Brazil) | pt-BR | 95% | draft (needs native review) |
+| Indonesian | id | 99% | draft (needs native review) |
+| Japanese | ja | 99% | draft (needs native review) |
+| German | de | 96% | draft (needs native review) |
+| Korean | ko | 95% | draft (needs native review) |
 | Vietnamese | vi | 0% | none |
 
-No other languages. Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
+Percentages measured 2026-10-17 over 2,272 entries (strings added since a draft show English). Also shipped: Russian (`ru`, 99%, reviewed by VanTan), Swedish (`sv`, 99.6%, command labels since 2026-10-17; native review welcome), Turkish (`tr`, 99%) and Czech (`cs`, 99%, draft). Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
 (Brazil); FigCraft has the localization layer, English and Spanish (Spain and Latin America),
-French, German, Brazilian Portuguese, Japanese, Korean and Simplified Chinese drafts (Preferences ▸
+French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese and Indonesian drafts (Preferences ▸
 Language; Traditional Chinese has no catalog; CJK UI
 text uses an installed CJK font, loaded only when needed; adding a language:
 [`docs/translating.md`](docs/translating.md)). Document text in any script (bidi, Arabic shaping,
-IME) already works. Detail: [`docs/localization-parity.md`](docs/localization-parity.md).
+IME) already works (macOS IME composition fixed for #747, not yet checked on a Mac). Detail: [`docs/localization-parity.md`](docs/localization-parity.md).
 
 ## Upcoming
 
@@ -131,6 +131,10 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 ## Progress log
 
+- **2026-10-17** · Control channel while the window is minimised (M8, #720): a minimised or covered window answers every request that acts on the app's state (edits, `ui.inspect`, `ui.pointer`, `ui.key`, `ui.type`, `ui.set`, `app.quit`…) without drawing, and what needs a drawn frame (`ui.screenshot`, `ui.input`, `window.new`) is an error at once; before, those waited up to 60 s and held up every later request on the connection (an attached agent's `inspect_ui` or window screenshot stalled until the window came back). Measured on Windows 11, minimised: requests ~100 ms each (eframe wakes a minimised window at most ten times a second; ~2 ms on screen), a window screenshot fails in ~100 ms instead of 60 s, idle CPU 0. Numbers unchanged.
+- **2026-10-17** · Number variables on text content (M3, #629): the Typography section's variable picker also lists number variables for a text layer's content, as the engine already accepted (the text shows the number, e.g. 42.5, and follows the variable). Other text fields keep their own types. Numbers unchanged.
+- **2026-10-17** · Frames and sections convert into each other (M1, #719): `object.convertToSection` turns a frame on the page or in a section into a section in place (same box, name, fill and layers, which stay where they are; what only a frame has goes: auto layout, clipping, layout grids, guides, scrolling), and `object.convertToFrame` now also turns a section into a frame that keeps its fill and doesn't clip, so the look stays. Nested frames, instances, main components and sections holding sections are refused with the reason; one undo step each. Both are in the canvas context menu (Convert to section / Convert to frame) and in Spanish. Numbers unchanged.
+- **2026-10-14** · Corner handles win over the corner-radius handles (M1, #292): a press on the inner half of a corner handle's square picked the radius handle 10 px in, so the drag neither resized nor (dragging outward) rounded anything. Inside the drawn square the corner now resizes both sides (in ratio with Shift or the link); further in the radius handle still answers. Regression test in the transform behaviour suite. Numbers unchanged.
 - **2026-10-14** · Home screen recent files as cards (M7): each card shows the picture its file carries on its first page's colour, the file's icon, name and "Edited ... ago"; sort by name, creation or last change either way; a table view; a click selects, a double-click or Enter opens, arrow keys move; Open, Show in folder and Remove from recents on right-click. Numbers unchanged.
 - **2026-10-13** · Vector edit mode regions (M4): with the Move tool, the filled area under the pointer is hatched with "/" lines in the selection colour, clipped by the area's own fill rule so holes stay clear; the hatch goes near points (3.5 px) and segments (2 px), and its spacing follows octave folding (8 px at every power-of-two zoom), fixed to the shape. A click selects the area with its points (they move with it but keep the unselected look), Shift adds or removes one, a press on a selected area drags the whole selection as one undo step, and a click on an empty spot clears the areas and stays in edit mode. `vector.edit.select {regions}` and `vector.edit.state` (`regions`, `regionVertices`, `regionHover`); `vector_regions_tests` and `regions_tests`. Numbers unchanged.
 - **2026-10-14** · SVG/PDF export depth (M0.9, #208): visible descendants deeper than 256 levels below an exported root are refused before bounds or drawing, including masks and raster fallbacks. SVG has a checked API; the engine and CLI report the limit and suggest selecting an inner layer. Existing destination files survive refusal. Boundary, inner-root, hidden-subtree, multi-root/page and command/CLI regressions cover the change. Numbers unchanged.
@@ -312,6 +316,17 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-17 | minor | Community batch #753 (10 PRs): Selection colors for mixed selections (#403); smart-selection spacing fields and canvas handles (#402); a Present tab with device and scale controls (#537); adding auto layout to an empty frame keeps its size (#369); `node.set` applies auto layout keys to frames only and warns about font styles a family lacks (#603); canvas images on whole device pixels (#359); Adwaita window controls on Wayland without server decorations (#592, not run on GNOME or KDE by the maintainers); the keyboard shortcuts panel closes on the home screen (#548); macOS paste modifiers in tests (#750); credits column tests (#347). `cargo xtask parity` re-run: 212 / 212 menu items (100%; the catalog gained View ▸ Full screen with #227 on 2026-10-14), 561 commands. Language table re-measured from the catalogs (2,272 entries): the drafts read 95–99% (strings added since 2026-10-12 show English), Indonesian has a draft (99%; it read none), and Russian, Swedish (its command labels from #599), Turkish and Czech are listed with their counts. Per-area parity rows for the day's landings in `docs/gaps.md`, `target-app-parity.md` and the area docs. Numbers unchanged |
+| 2026-10-17 | minor | Control channel while the window is minimised (M8, #720): a minimised or covered window answers every request that acts on the app's state (edits, `ui.inspect`, `ui.pointer`, `ui.key`, `ui.type`, `ui.set`, `app.quit`…) without drawing, and what needs a drawn frame (`ui.screenshot`, `ui.input`, `window.new`) is an error at once; before, those waited up to 60 s and held up every later request on the connection (an attached agent's `inspect_ui` or window screenshot stalled until the window came back). Measured on Windows 11, minimised: requests ~100 ms each (eframe wakes a minimised window at most ten times a second; ~2 ms on screen), a window screenshot fails in ~100 ms instead of 60 s, idle CPU 0. Numbers unchanged. |
+| 2026-10-17 | minor | Community fixes from #524 up (batches #727, #728, #733, #735, #736 and #729; 55 PRs) and a crash guard. `.fig` import: explicit instance identity, overrides by key, text style precedence, grid track sizes, slot content, connector labels, skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, text on a path, image adjustments and embedded images; large files open within budgets from the file's own size; an import report after opening; imported bytes stay out of the command journal. Files and paste: save a copy as `.fig`; Cmd/Ctrl+V pastes images copied in other apps and layers copied from another design app (`edit.pasteDesignLayers`); paste over and paste properties; clipboard reads on Linux and the BSDs time out after 2 s. Editor: live font preview on hover; Shift+I and Resources open Assets; Shift-drag moves the selection; thin strokes take a nearby double-click; dropped points merge; Flatten keeps open paths; the Actions palette gets tabs, ranked search, a keyboard highlight and recents; the colour picker opens on a new fill or stroke; text strokes follow their alignment; selection highlights after line breaks; a draggable pages/layers divider; variant properties reorder by drag; submenus keep their hover with a safe triangle; menu actions that need a value ask for it; File ▸ Rename edits the name in place. Engine: bad paint indexes, non-finite geometry and pages in copy/cut are refused; a param naming a layer says so when it isn't one; a CLI script is one undo step and resolves `$step`. Server and collaboration: message limits follow `max_file_mb` (client capped at 1 GiB); a damaged generation field no longer drops flushed edits; the web build joins a session from a `#join=` link. Also Swedish command labels, Nix CI through the shared workflow, paint bounds once per render, and a guard that turns a panic inside the boolean-op library into bad input (the stroke draws unclipped). Numbers unchanged. |
+| 2026-10-17 | minor | Number variables on text content (M3, #629): the Typography section's variable picker also lists number variables for a text layer's content, as the engine already accepted (the text shows the number, e.g. 42.5, and follows the variable). Other text fields keep their own types. Numbers unchanged. |
+| 2026-10-17 | minor | Frames and sections convert into each other (M1, #719): `object.convertToSection` turns a frame on the page or in a section into a section in place (same box, name, fill and layers, which stay where they are; what only a frame has goes: auto layout, clipping, layout grids, guides, scrolling), and `object.convertToFrame` now also turns a section into a frame that keeps its fill and doesn't clip, so the look stays. Nested frames, instances, main components and sections holding sections are refused with the reason; one undo step each. Both are in the canvas context menu (Convert to section / Convert to frame) and in Spanish. Numbers unchanged. |
+| 2026-10-16 | minor | Community fixes from #478 up (batches #591, #598, #602; 69 PRs) and a control-channel fix: a line that isn't JSON now ends a `--control` connection, so a web page can't drive the app through a browser request (#589). Highlights: page copies keep navigation, flows, prototype settings and guides; Find and Replace keeps line endings and case-insensitive matches; text hyperlinks survive import and export; recent colours record only what was picked; MCP screenshots respect `maxSize`; Swedish catalog (UI strings), Czech plurals; bounded canvas overscan while panning; Korean fallback at the run's weight; many vector-edit, guide, page and .fig round-trip fixes. Numbers unchanged |
+| 2026-10-15 | minor | Drop files anywhere to open them (M7): dragging files over the window shows a "Drop to open" (home) or "Drop to import" (canvas) overlay. On the home screen each supported file opens as a document of its own and other files are turned away with a toast; on the canvas the files import at the drop point. Both wait behind a small card that is on screen before a large file blocks the window. A canvas import stays with the document and page that received the drop even if the tab or page changes meanwhile, and is cancelled with a message if that document or page is gone. Numbers unchanged. |
+| 2026-10-15 | minor | M7: system font discovery skips entries observed as non-regular files before opening them, avoiding the reproduced named-pipe stall. Regular-file symlinks remain supported; directory depth, font limits and priorities are unchanged. Numbers unchanged. |
+| 2026-10-15 | minor | Canvas retains a bounded margin while panning so newly exposed strips can reuse the previous render. Numbers unchanged. |
+| 2026-10-15 | minor | Typography spacing icons scrub with the shared number-field gesture, modifier rates and one Undo step per drag (#373). Units and selected-character targeting are preserved. Numbers unchanged. |
+| 2026-10-14 | minor | System theme on first run (M7): preferences without a theme default to System; the first frame reads the OS appearance directly, including when returning from a manual theme. Saved Light/Dark choices stay explicit; unavailable OS appearance falls back to Light. Numbers unchanged. |
 | 2026-10-14 | minor | Home screen recent files as cards (M7): each card shows the picture its file carries on its first page's colour, the file's icon, name and "Edited ... ago"; sort by name, creation or last change either way; a table view; a click selects, a double-click or Enter opens, arrow keys move; Open, Show in folder and Remove from recents on right-click. Numbers unchanged. |
 | 2026-10-14 | minor | Lost images reported on loading (#207): a `.figcraft` file whose image member is damaged, too large or missing no longer loads in silence; each lost image (up to 20, then a count) is listed in `repairs` on `file.open` with its hash and the reason, and the app shows it as a toast. Saving still writes the file without the lost images. Numbers unchanged |
 | 2026-10-14 | minor | SVG import budgets (#190): gzipped SVG is unpacked by FigCraft within 64 MiB before parsing (it was unpacked without a limit), so the nesting check sees the real document; SVG documents embedded in `<image>` data URIs share one 32 MiB budget and at most 4 levels, and one past a budget is left out. Linked files stay unread. Numbers unchanged |

apps/figcraft-cli/src/args.rs

@@ -1,5 +1,6 @@
 //! Minimal std-only argument parsing: positionals, `--key value` / `--key=value` / `-o value`
-//! options, and boolean `--flag`s. Unknown options are usage errors.
+//! options (given again: the last counts, or all with [`Args::values`]), and boolean `--flag`s.
+//! Unknown options are usage errors.
 
 use std::collections::BTreeMap;
 
@@ -8,7 +9,7 @@ use crate::{CliError, CliResult};
 #[derive(Debug, Default)]
 pub struct Args {
     pub positional: Vec<String>,
-    values: BTreeMap<String, String>,
+    values: BTreeMap<String, Vec<String>>,
     flags: Vec<String>,
 }
 
@@ -34,7 +35,7 @@ impl Args {
                     Some(v) => v,
                     None => it.next().cloned().ok_or_else(|| CliError::Usage(format!("`{arg}` needs a value")))?,
                 };
-                a.values.insert(name.to_string(), v);
+                a.values.entry(name.to_string()).or_default().push(v);
             } else if flags.contains(&name) && inline.is_none() {
                 a.flags.push(name.to_string());
             } else {
@@ -45,7 +46,12 @@ impl Args {
     }
 
     pub fn value(&self, k: &str) -> Option<String> {
-        self.values.get(k).cloned()
+        self.values.get(k).and_then(|v| v.last()).cloned()
+    }
+
+    /// Every value of an option that may be given more than once, in order.
+    pub fn values(&self, k: &str) -> &[String] {
+        self.values.get(k).map_or(&[], Vec::as_slice)
     }
 
     pub fn flag(&self, k: &str) -> bool {
@@ -62,9 +68,9 @@ impl Args {
     /// PDF print options: `--bleed LENGTH` (points, or "3mm", "0.125in"), `--crop-marks`,
     /// `--bleed-marks`, `--cmyk`.
     pub fn print(&self) -> CliResult<figcraft_doc::PrintSettings> {
-        let bleed = match self.values.get("bleed") {
+        let bleed = match self.value("bleed") {
             None => 0.0,
-            Some(s) => figcraft_doc::PrintSettings::parse_length(s)
+            Some(s) => figcraft_doc::PrintSettings::parse_length(&s)
                 .filter(|b| *b <= figcraft_doc::PrintSettings::MAX_BLEED)
                 .ok_or_else(|| CliError::Usage(format!("--bleed takes points or a length like 3mm or 0.125in (up to 2in), got `{s}`")))?,
         };
@@ -72,7 +78,7 @@ impl Args {
     }
 
     pub fn scale(&self) -> CliResult<f64> {
-        match self.values.get("scale") {
+        match self.value("scale") {
             None => Ok(1.0),
             Some(s) => s
                 .trim_end_matches('x')
@@ -85,7 +91,7 @@ impl Args {
 
     /// A comma-separated list of whole numbers (`--layers 1000,10_000`).
     pub fn usizes(&self, k: &str, default: &[usize]) -> CliResult<Vec<usize>> {
-        match self.values.get(k) {
+        match self.value(k) {
             None => Ok(default.to_vec()),
             Some(s) => s
                 .split(',')
@@ -110,6 +116,10 @@ mod tests {
         assert_eq!(a.value("o").as_deref(), Some("out"));
         assert_eq!(a.scale().unwrap(), 2.0);
         assert!(a.flag("json"));
+        let a = Args::parse(&v(&["--root", "a", "--root=b"]), &["root"], &[]).unwrap();
+        assert_eq!(a.values("root"), ["a", "b"]);
+        assert_eq!(a.value("root").as_deref(), Some("b"));
+        assert!(a.values("none").is_empty());
     }
 
     #[test]

apps/figcraft-cli/src/files.rs

@@ -38,7 +38,7 @@ fn write(path: &str, bytes: &[u8]) -> CliResult<()> {
 
 fn page_named(doc: &Document, name: Option<&str>) -> CliResult<NodeId> {
     match name {
-        None => doc.first_page().ok_or_else(|| CliError::Failed("the document has no pages".into())),
+        None => doc.first_open_page().or_else(|| doc.first_page()).ok_or_else(|| CliError::Failed("the document has no pages".into())),
         Some(n) => doc
             .pages
             .iter()
@@ -155,6 +155,7 @@ pub fn info(path: &str, as_json: bool) -> CliResult<ExitCode> {
             Some(json!({"id": p, "name": pn.name, "nodes": nodes, "topLevel": pn.children.len(), "frames": frames}))
         })
         .collect();
+    let missing = figcraft_engine::fonts::missing(&doc);
     let v = json!({
         "file": path,
         "name": doc.name,
@@ -164,6 +165,7 @@ pub fn info(path: &str, as_json: bool) -> CliResult<ExitCode> {
         "variables": doc.variables.variables.len(),
         "images": doc.images.len(),
         "notes": notes,
+        "missingFonts": missing.iter().map(|m| json!({"family": m.family, "layers": m.layers})).collect::<Vec<_>>(),
     });
     if as_json {
         println!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
@@ -187,6 +189,10 @@ pub fn info(path: &str, as_json: bool) -> CliResult<ExitCode> {
             println!("  {} {} \"{}\" {}×{}", f["id"], f["type"].as_str().unwrap_or(""), f["name"].as_str().unwrap_or(""), f["width"], f["height"]);
         }
     }
+    for m in &missing {
+        let layers = if m.layers == 1 { "text layer" } else { "text layers" };
+        println!("missing font \"{}\": {} {layers} (drawn in a fallback font)", m.family, m.layers);
+    }
     Ok(ExitCode::SUCCESS)
 }
 
@@ -333,17 +339,32 @@ pub fn run_script(script: &str, input: Option<&str>, out: Option<&str>) -> CliRe
         }
         None => Session::new(),
     };
-    for (i, (cmd, params)) in steps.iter().enumerate() {
-        let r = s.execute(cmd, params);
-        s.ui_requests.clear();
-        match r {
-            Ok(v) => println!("{}", json!({"step": i, "command": cmd, "ok": true, "result": v})),
-            Err(e) => {
-                println!("{}", json!({"step": i, "command": cmd, "ok": false, "error": e.to_string()}));
-                eprintln!("error: step {i} ({cmd}) failed: {e}");
-                return Ok(ExitCode::from(1));
-            }
+    // One undo step and all-or-nothing, the way the same commands behave through `command.batch`
+    // (MCP, the control channel, plugins): `{"$step": n}` resolves against the steps before it, and
+    // a step that fails takes the whole script back instead of leaving the earlier steps applied.
+    // The result lines are held back until the script is through, so none of them reports work that
+    // was rolled back.
+    let mut results: Vec<Value> = Vec::with_capacity(steps.len());
+    let mut failed_at = 0;
+    let outcome = s.grouped(&format!("run {script}"), |s| {
+        for (i, (cmd, params)) in steps.iter().enumerate() {
+            failed_at = i;
+            let v = s.batch_step(&results, i, cmd, params)?;
+            s.ui_requests.clear();
+            results.push(v);
         }
+        Ok(())
+    });
+    if let Err(e) = outcome {
+        let cmd = steps.get(failed_at).map_or("", |(cmd, _)| cmd.as_str());
+        let i = failed_at;
+        println!("{}", json!({"step": i, "command": cmd, "ok": false, "error": e.to_string(), "rolledBack": true}));
+        eprintln!("error: step {i} ({cmd}) failed: {e}");
+        eprintln!("the script's document changes were rolled back");
+        return Ok(ExitCode::from(1));
+    }
+    for (i, ((cmd, _), v)) in steps.iter().zip(&results).enumerate() {
+        println!("{}", json!({"step": i, "command": cmd, "ok": true, "result": v}));
     }
     if let Some(out) = out {
         let ds = s.ds().map_err(|e| CliError::Failed(e.to_string()))?;
@@ -380,6 +401,22 @@ mod tests {
         assert_eq!(sanitize(""), "layer");
     }
 
+    #[test]
+    fn default_page_skips_leading_divider() {
+        let mut doc = Document::new("divider");
+        let page = doc.first_page().unwrap();
+        doc.create(page, figcraft_doc::NodeKind::Frame, "First", 0.0, 0.0, 40.0, 30.0).unwrap();
+        let divider = doc.add_page("- Divider");
+        doc.pages.retain(|p| *p != divider);
+        doc.pages.insert(0, divider);
+        assert!(doc.is_divider(divider));
+        assert_eq!(page_named(&doc, None).unwrap(), page);
+        assert_eq!(page_named(&doc, Some("- Divider")).unwrap(), divider);
+        let pm = render_page(&doc, page_named(&doc, None).unwrap(), 1.0).unwrap();
+        assert_eq!((pm.width(), pm.height()), (40, 30));
+        assert!(render_page(&doc, divider, 1.0).is_err());
+    }
+
     #[test]
     fn export_depth_errors_preserve_conversion_destinations() {
         let mut doc = Document::new("export depth");
@@ -406,4 +443,62 @@ mod tests {
         assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 2);
         std::fs::remove_dir_all(dir).unwrap();
     }
+
+    fn temp_dir(tag: &str) -> std::path::PathBuf {
+        let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let dir = std::env::temp_dir().join(format!("figcraft-cli-{tag}-{}-{stamp}", std::process::id()));
+        std::fs::create_dir(&dir).unwrap();
+        dir
+    }
+
+    /// A script resolves `{"$step": n}` like the same commands through `command.batch`. Each step
+    /// used to run on its own, so the reference reached `parent` unresolved, `node.create` read it
+    /// as "no parent" and the layer landed on the page — with every step reporting success.
+    #[test]
+    fn a_script_puts_a_layer_in_a_layer_an_earlier_step_made() {
+        let dir = temp_dir("run-step");
+        let script = dir.join("script.json");
+        std::fs::write(
+            &script,
+            r#"[
+                {"command": "node.create", "params": {"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 200, "height": 100}},
+                {"command": "node.create", "params": {"type": "rectangle", "name": "child", "parent": {"$step": 0}, "x": 10, "y": 10, "width": 20, "height": 20}}
+            ]"#,
+        )
+        .unwrap();
+        let out = dir.join("out.figcraft");
+        run_script(script.to_str().unwrap(), None, Some(out.to_str().unwrap())).unwrap();
+
+        let mut s = Session::empty();
+        s.execute("file.open", &json!({"path": out.to_str().unwrap()})).unwrap();
+        let doc = s.doc().unwrap();
+        let page = s.page().unwrap();
+        let top = doc.node(page).unwrap().children.clone();
+        assert_eq!(top.len(), 1, "only the frame is top level, not the rectangle too");
+        assert_eq!(doc.node(top[0]).unwrap().name, "Card");
+        let inner = doc.node(top[0]).unwrap().children.clone();
+        assert_eq!(inner.len(), 1, "the rectangle went inside the frame");
+        assert_eq!(doc.node(inner[0]).unwrap().name, "child");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    /// A step that fails takes the whole script back: nothing is written, and the failure says so.
+    #[test]
+    fn a_failed_step_leaves_no_output() {
+        let dir = temp_dir("run-rollback");
+        let script = dir.join("script.json");
+        std::fs::write(
+            &script,
+            r#"[
+                {"command": "node.create", "params": {"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 200, "height": 100}},
+                {"command": "node.set", "params": {"ids": [99999], "props": {"name": "nope"}}}
+            ]"#,
+        )
+        .unwrap();
+        let out = dir.join("out.figcraft");
+        // The failure is the script's, not the call's: the CLI reports it and exits non-zero.
+        run_script(script.to_str().unwrap(), None, Some(out.to_str().unwrap())).unwrap();
+        assert!(!out.exists(), "a script that failed writes nothing");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
 }

apps/figcraft-cli/src/main.rs

@@ -23,7 +23,7 @@ USAGE:
   figcraft-cli render <file> -o <out.png> [--scale N] [--page NAME]
   figcraft-cli run <script.json|script.jsonl> [--in <file>] [--out <file>]
   figcraft-cli commands [--json] [--filter TEXT]
-  figcraft-cli mcp [--attach PORT]
+  figcraft-cli mcp [--attach PORT] [--automation-read-root DIR]... [--automation-write-root DIR]...
   figcraft-cli plugin publish <folder> --server ws://host:port/[?key=KEY]
   figcraft-cli perf [--layers N[,N...]] [--instances N[,N...]]
   figcraft-cli help | --help | --version
@@ -42,6 +42,10 @@ crop and bleed marks, CMYK colour). `run` executes a JSON array (or JSON lines)
 `plugin publish` sends a plugin folder (figcraft-plugin.json, its module, an optional assets/ folder)
 to a figcraft-server's plugin directory as a new version; the server's key comes from the address or
 the FIGCRAFT_SERVER_KEY environment variable (which keeps it out of the shell history).
+`mcp --automation-read-root DIR` / `--automation-write-root DIR` (each may be repeated; the folders
+must exist) confine the files the agent's commands touch: reads only inside a read or write root,
+writes only inside a write root, everything else refused. A running app confines itself: start it
+with `figcraft --control PORT` and the same flags (`--attach` refuses them).
 See docs/cli.md and docs/mcp.md.";
 
 fn main() -> ExitCode {
@@ -133,11 +137,23 @@ fn run(argv: &[String]) -> CliResult<ExitCode> {
             Ok(ExitCode::SUCCESS)
         }
         "mcp" => {
-            let a = Args::parse(rest, &["attach"], &[])?;
+            let a = Args::parse(rest, &["attach", "automation-read-root", "automation-write-root"], &[])?;
             if !a.positional.is_empty() {
                 return Err(CliError::Usage("mcp takes no positional arguments".into()));
             }
-            mcp(a.value("attach").as_deref())
+            let (read, write) = (a.values("automation-read-root"), a.values("automation-write-root"));
+            let roots = match (read.is_empty() && write.is_empty(), a.value("attach")) {
+                (true, _) => None,
+                // The app runs the commands: only its own roots can confine them.
+                (false, Some(_)) => {
+                    return Err(CliError::Usage(
+                        "--attach can't take automation roots: start the app with them instead (`figcraft --control PORT --automation-read-root DIR ...`)"
+                            .into(),
+                    ));
+                }
+                (false, None) => Some(figcraft_engine::file_access::Roots::new(read, write).map_err(CliError::Failed)?),
+            };
+            mcp(a.value("attach").as_deref(), roots)
         }
         "plugin" => {
             let a = Args::parse(rest, &["server"], &[])?;
@@ -205,7 +221,7 @@ fn publish_plugin(folder: &str, server: &str) -> CliResult<ExitCode> {
     Ok(ExitCode::SUCCESS)
 }
 
-fn mcp(attach: Option<&str>) -> CliResult<ExitCode> {
+fn mcp(attach: Option<&str>, roots: Option<figcraft_engine::file_access::Roots>) -> CliResult<ExitCode> {
     let backend: Box<dyn figcraft_mcp::Backend> = match attach {
         Some(p) => {
             let addr = if p.contains(':') {
@@ -220,7 +236,10 @@ fn mcp(attach: Option<&str>) -> CliResult<ExitCode> {
         None => Box::new(figcraft_mcp::Headless::new()),
     };
     eprintln!("figcraft MCP server ({}) on stdio", backend.describe());
-    let mut server = figcraft_mcp::Server::new(backend);
+    if let Some(r) = &roots {
+        eprintln!("file access confined to {}", r.to_json());
+    }
+    let mut server = figcraft_mcp::Server::new(backend).with_roots(roots);
     let stdin = std::io::stdin();
     let stdout = std::io::stdout();
     server.serve(stdin.lock(), stdout.lock()).map_err(|e| format!("stdio: {e}"))?;

apps/figcraft-cli/src/perf.rs

@@ -438,44 +438,66 @@ fn measure_components(table: &mut Table, col: usize, instances: usize) -> CliRes
         mean(3, |i| exec(&mut s, "node.set", json!({"ids": labels, "props": {"fontSize": 13 + (i % 2) * 2}}))),
     );
     let doc = s.doc().map_err(failed)?.clone();
-    let (card, _) = instance_with(&doc, &inst, ds.card, &["Footer button", "Icon", "Glyph"]).ok_or_else(|| failed("no card"))?;
-    table.put(
-        col,
-        "switch a card's variant (nested overrides kept)",
-        mean(5, |i| {
-            exec(&mut s, "instance.setProperties", json!({"ids": [card], "properties": {"Size": if i % 2 == 0 { "Large" } else { "Small" }}}))
-        }),
-    );
-    let (nav, _) = instance_with(&doc, &inst, ds.nav, &["Profile"]).ok_or_else(|| failed("no nav"))?;
-    table.put(col, "reset all changes on a nav", timed(&mut s, "component.resetInstance", json!({"ids": [nav]}), true));
-    table.put(col, "detach a nav", timed(&mut s, "component.detach", json!({"ids": [nav]}), true));
-    let (button, bglyph) = instance_with(&doc, &inst, ds.button, &["Icon", "Glyph"]).ok_or_else(|| failed("no button"))?;
-    table.put(col, "push a button's changes to its main", timed(&mut s, "component.pushChanges", json!({"id": button}), true));
-    // A button glyph the drop really lands on: screens can overlap (text sizes differ without
-    // fonts), so ask the hit test the swap uses.
-    let now = s.doc().map_err(failed)?.clone();
-    let page = s.page().map_err(failed)?;
-    let b = std::iter::once(bglyph)
-        .chain(inst.iter().filter_map(|i| {
-            let NodeKind::Instance { component, .. } = &now.node(*i)?.kind else { return None };
-            (figcraft_engine::components::variant_set(&now, *component) == Some(ds.button)).then(|| find_path(&now, *i, &["Icon", "Glyph"]))?
-        }))
-        .filter_map(|g| now.world_bounds(g))
-        .find(|b| figcraft_engine::drop::swap_target(&now, page, b.center(), None, None).is_some())
-        .ok_or_else(|| failed("no button glyph to drop on"))?;
-    let other = ds.icons.get(5).copied().unwrap_or(icon0);
-    table.put(
-        col,
-        "Alt-drop swap onto an instance",
-        timed(&mut s, "instance.swapAt", json!({"component": other, "x": b.center().x, "y": b.center().y}), true),
-    );
-    exec(&mut s, "edit.copy", json!({"ids": [nav]}));
-    table.put(col, "copy + paste a nav", timed(&mut s, "edit.paste", json!({}), true));
+    // Small workloads may not contain every instance type; the rows needing a missing one stay empty.
+    if let Some((card, _)) = instance_with(&doc, &inst, ds.card, &["Footer button", "Icon", "Glyph"]) {
+        table.put(
+            col,
+            "switch a card's variant (nested overrides kept)",
+            mean(5, |i| {
+                exec(&mut s, "instance.setProperties", json!({"ids": [card], "properties": {"Size": if i % 2 == 0 { "Large" } else { "Small" }}}))
+            }),
+        );
+    } else {
+        table.put(col, "switch a card's variant (nested overrides kept)", f64::NAN);
+    }
+    let nav = instance_with(&doc, &inst, ds.nav, &["Profile"]).map(|(nav, _)| nav);
+    if let Some(nav) = nav {
+        table.put(col, "reset all changes on a nav", timed(&mut s, "component.resetInstance", json!({"ids": [nav]}), true));
+        table.put(col, "detach a nav", timed(&mut s, "component.detach", json!({"ids": [nav]}), true));
+    } else {
+        table.put(col, "reset all changes on a nav", f64::NAN);
+        table.put(col, "detach a nav", f64::NAN);
+    }
+    if let Some((button, bglyph)) = instance_with(&doc, &inst, ds.button, &["Icon", "Glyph"]) {
+        table.put(col, "push a button's changes to its main", timed(&mut s, "component.pushChanges", json!({"id": button}), true));
+        // A button glyph the drop really lands on: screens can overlap (text sizes differ without
+        // fonts), so ask the hit test the swap uses.
+        let now = s.doc().map_err(failed)?.clone();
+        let page = s.page().map_err(failed)?;
+        let drop_at = std::iter::once(bglyph)
+            .chain(inst.iter().filter_map(|i| {
+                let NodeKind::Instance { component, .. } = &now.node(*i)?.kind else { return None };
+                (figcraft_engine::components::variant_set(&now, *component) == Some(ds.button)).then(|| find_path(&now, *i, &["Icon", "Glyph"]))?
+            }))
+            .filter_map(|g| now.world_bounds(g))
+            .find(|b| figcraft_engine::drop::swap_target(&now, page, b.center(), None, None).is_some());
+        let other = ds.icons.get(5).copied().unwrap_or(icon0);
+        table.put(
+            col,
+            "Alt-drop swap onto an instance",
+            match drop_at {
+                Some(b) => timed(&mut s, "instance.swapAt", json!({"component": other, "x": b.center().x, "y": b.center().y}), true),
+                None => f64::NAN,
+            },
+        );
+    } else {
+        table.put(col, "push a button's changes to its main", f64::NAN);
+        table.put(col, "Alt-drop swap onto an instance", f64::NAN);
+    }
+    if let Some(nav) = nav {
+        exec(&mut s, "edit.copy", json!({"ids": [nav]}));
+        table.put(col, "copy + paste a nav", timed(&mut s, "edit.paste", json!({}), true));
+    } else {
+        table.put(col, "copy + paste a nav", f64::NAN);
+    }
     table.put(col, "undo (deep main edit)", mean(10, |_| _ = s.undo()));
     table.put(col, "redo", mean(10, |_| _ = s.redo()));
 
     // As a library: publish it, use it from another file, publish a change, accept the update.
-    let dir = std::env::temp_dir().join(format!("figcraft-perf-{}", std::process::id()));
+    // One directory per run, so concurrent runs in a process don't delete each other's files.
+    static RUNS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    let run = RUNS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let dir = std::env::temp_dir().join(format!("figcraft-perf-{}-{run}", std::process::id()));
     std::fs::create_dir_all(&dir).map_err(failed)?;
     let path = dir.join("design-system.figcraft").to_string_lossy().into_owned();
     let (lib_doc, lib_ds) = design_system_document(&spec).map_err(failed)?;
@@ -533,6 +555,14 @@ mod tests {
         assert!(t.rows.iter().all(|r| r.1.len() == 1 && r.1[0].is_finite()), "{:?}", t.rows);
     }
 
+    #[test]
+    fn measures_components_with_a_single_instance() {
+        let mut t = super::Table { rows: Vec::new() };
+        super::measure_components(&mut t, 0, 1).unwrap();
+        assert!(t.rows.iter().all(|r| r.1.len() == 1), "{:?}", t.rows);
+        assert!(t.rows.iter().any(|r| r.0.starts_with("build design system") && r.1[0].is_finite()), "{:?}", t.rows);
+    }
+
     #[test]
     fn measures_a_small_document() {
         let mut t = super::Table { rows: Vec::new() };

apps/figcraft-cli/tests/cli.rs

@@ -25,6 +25,9 @@ fn bad_arguments_exit_2_without_panicking() {
         &["render", "a", "-o"],
         &["perf", "--shapes", "lots"],
         &["mcp", "--attach", "notaport"],
+        // An attached app confines itself: roots go to `figcraft --control`.
+        &["mcp", "--attach", "7979", "--automation-read-root", "."],
+        &["mcp", "--automation-write-root"],
         &["convert", "a"],
     ] {
         let out = bin().args(args).output().unwrap();
@@ -78,6 +81,27 @@ fn run_export_info_convert() {
     std::fs::remove_dir_all(&d).ok();
 }
 
+#[test]
+fn run_takes_the_documented_gradient_shorthand() {
+    // #252: only MCP used to accept it; `run` said "`fills` must be paints or colours".
+    let d = tmp("gradient");
+    let script = d.join("s.json");
+    std::fs::write(
+        &script,
+        r##"[{"command":"shape.rectangle","params":{"x":0,"y":0,"width":200,"height":100}},
+            {"command":"node.set","params":{"ids":[2],"fills":[{"type":"linearGradient","stops":["#ff0000","#0000ff"],"from":[0,0.5],"to":[1,0.5]}]}}]"##,
+    )
+    .unwrap();
+    let file = d.join("g.figcraft");
+    let out = bin().arg("run").arg(&script).arg("--out").arg(&file).output().unwrap();
+    assert!(out.status.success(), "{}{}", String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+    let json = d.join("g.json");
+    assert!(bin().arg("convert").arg(&file).arg(&json).status().unwrap().success());
+    let doc = std::fs::read_to_string(&json).unwrap();
+    assert!(doc.contains("\"kind\":\"linear\"") || doc.contains("\"kind\": \"linear\""), "{doc}");
+    std::fs::remove_dir_all(&d).ok();
+}
+
 #[test]
 fn mcp_over_stdio() {
     let mut child = bin().arg("mcp").stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::null()).spawn().unwrap();
@@ -99,6 +123,49 @@ fn mcp_over_stdio() {
     assert_eq!(lines[2]["result"]["isError"], false);
 }
 
+#[test]
+fn mcp_over_stdio_confined_to_automation_roots() {
+    let d = tmp("roots");
+    for sub in ["in", "out", "outside"] {
+        std::fs::create_dir_all(d.join(sub)).unwrap();
+    }
+    let p = |rel: &str| d.join(rel).to_string_lossy().into_owned();
+    // A root that isn't a folder stops the server before it serves.
+    let out = bin().args(["mcp", "--automation-read-root", &p("missing")]).output().unwrap();
+    assert_eq!(out.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&out.stderr).contains("--automation-read-root"));
+    let mut child = bin()
+        .args(["mcp", "--automation-read-root", &p("in"), "--automation-write-root", &p("out")])
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap();
+    {
+        let stdin = child.stdin.as_mut().unwrap();
+        let call = |id: u32, tool: &str, args: serde_json::Value| {
+            serde_json::json!({"jsonrpc": "2.0", "id": id, "method": "tools/call", "params": {"name": tool, "arguments": args}}).to_string()
+        };
+        writeln!(stdin, r#"{{"jsonrpc":"2.0","id":1,"method":"initialize","params":{{"protocolVersion":"2025-06-18"}}}}"#).unwrap();
+        writeln!(stdin, "{}", call(2, "create_node", serde_json::json!({"type": "ellipse"}))).unwrap();
+        writeln!(stdin, "{}", call(3, "save_file", serde_json::json!({"path": p("outside/a.figcraft")}))).unwrap();
+        writeln!(stdin, "{}", call(4, "save_file", serde_json::json!({"path": p("out/a.figcraft")}))).unwrap();
+        writeln!(stdin, "{}", call(5, "open_file", serde_json::json!({"path": p("outside/a.figcraft")}))).unwrap();
+        writeln!(stdin, "{}", call(6, "open_file", serde_json::json!({"path": p("out/a.figcraft")}))).unwrap();
+    }
+    drop(child.stdin.take());
+    let out = child.wait_with_output().unwrap();
+    assert!(out.status.success());
+    let lines: Vec<serde_json::Value> = String::from_utf8_lossy(&out.stdout).lines().map(|l| serde_json::from_str(l).unwrap()).collect();
+    assert_eq!(lines.len(), 6);
+    assert!(lines[0]["result"]["instructions"].as_str().unwrap().contains("only these folders may be read"));
+    let error = |i: usize| lines[i]["result"]["isError"] == true;
+    assert!(!error(1) && error(2) && !error(3) && error(4) && !error(5), "{lines:?}");
+    assert!(lines[2]["result"]["content"][0]["text"].as_str().unwrap().contains("automation path rejected"));
+    assert!(d.join("out/a.figcraft").is_file() && !d.join("outside/a.figcraft").exists());
+    let _ = std::fs::remove_dir_all(&d);
+}
+
 #[test]
 fn commands_json_lists_everything() {
     let out = bin().args(["commands", "--json"]).output().unwrap();

apps/figcraft-cli/tests/fonts.rs

@@ -45,3 +45,25 @@ fn headless_runs_resolve_installed_families_unless_opted_out() {
     assert_eq!(run_one("face", face.clone(), &[], false)["family"], json!(installed), "text uses the installed family");
     assert_ne!(run_one("face", face, &["--no-system-fonts"], false)["family"], json!(installed), "opted out, it falls back");
 }
+
+#[test]
+fn info_lists_the_fonts_a_file_uses_that_are_missing() {
+    let d = std::env::temp_dir().join(format!("figcraft-cli-missing-{}", std::process::id()));
+    std::fs::create_dir_all(&d).unwrap();
+    let (script, file) = (d.join("make.json"), d.join("doc.figcraft"));
+    let text =
+        |family: &str| json!({"command": "text.create", "params": {"text": "Hamburgefonstiv", "x": 0, "y": 0, "props": {"fontFamily": family}}});
+    std::fs::write(&script, json!([text("FigCraft Missing CLI"), text("FigCraft Missing CLI")]).to_string()).unwrap();
+    let cli = || Command::new(env!("CARGO_BIN_EXE_figcraft-cli"));
+    let made = cli().arg("run").arg(&script).arg("--out").arg(&file).output().unwrap();
+    assert!(made.status.success(), "{}", String::from_utf8_lossy(&made.stderr));
+
+    let out = cli().arg("info").arg(&file).arg("--json").output().unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    let v: Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(v["missingFonts"], json!([{"family": "FigCraft Missing CLI", "layers": 2}]));
+
+    let out = cli().arg("info").arg(&file).output().unwrap();
+    let shown = String::from_utf8_lossy(&out.stdout);
+    assert!(shown.contains("missing font \"FigCraft Missing CLI\": 2 text layers"), "{shown}");
+}

apps/figcraft-server/src/config.rs

@@ -135,9 +135,23 @@ impl Config {
     /// abuse contact, or one whose clients would all count as its proxy).
     pub fn warnings(&self) -> Vec<String> {
         let mut out = Vec::new();
+        let client_max = NetLimits::default().max_server_message >> 20;
+        if usize::try_from(self.file_mb()).is_ok_and(|mb| mb >= client_max) {
+            out.push(format!(
+                "max_file_mb is {}: the app opens files of up to {} MiB, so a file that large can't be opened",
+                self.file_mb(),
+                client_max - 1
+            ));
+        }
         if !self.open_publish {
             return out;
         }
+        if self.file_mb() > 64 {
+            out.push(format!(
+                "open_publish is on with max_file_mb = {}: anyone may send messages that large, and the memory set aside for reading and queueing them grows to eight times it; keep it at 64 or less on a public server",
+                self.file_mb()
+            ));
+        }
         if self.operator_contact.trim().is_empty() {
             out.push("open_publish is on but operator_contact is empty: people can't reach you about abuse; set it (and terms_url)".into());
         }
@@ -168,7 +182,7 @@ impl Config {
             return Err("`idle_days` must be from 0 to 3650".into());
         }
         let terms = self.terms_url.trim();
-        if !terms.is_empty() && !(terms.starts_with("https://") || terms.starts_with("http://")) || terms.contains(char::is_whitespace) {
+        if !(terms.is_empty() || terms.starts_with("https://") || terms.starts_with("http://")) || terms.contains(char::is_whitespace) {
             return Err("`terms_url` must be a web address (https://…)".into());
         }
         if self.operator_contact.chars().count() > 120 || self.operator_contact.chars().any(char::is_control) || terms.len() > 500 {
@@ -253,8 +267,9 @@ impl Config {
         }
     }
 
-    /// Largest message a client may send when open to the public: a whole file (or plugin bundle)
-    /// and a margin, not the core's 64 MiB.
+    /// Largest message a client may send: a whole file (or plugin bundle) and a margin. Open to the
+    /// public this is also the cap (strangers' files stay small); a private server never goes below
+    /// the core's 64 MiB, and a `max_file_mb` above it raises the cap with it.
     fn open_message(&self) -> usize {
         usize::try_from(self.file_mb().max(self.max_plugin_mb).saturating_add(1).saturating_mul(1 << 20)).unwrap_or(usize::MAX)
     }
@@ -265,9 +280,9 @@ impl Config {
     fn core(&self) -> figcraft_collab::Limits {
         let base = figcraft_collab::Limits { max_peers: self.max_people, ..figcraft_collab::Limits::default() };
         if !self.open_publish {
-            return base;
+            return figcraft_collab::Limits { max_message_bytes: base.max_message_bytes.max(self.open_message()), ..base };
         }
-        let max = self.open_message().min(base.max_message_bytes);
+        let max = self.open_message();
         let file = usize::try_from(self.file_mb().saturating_mul(1 << 20)).unwrap_or(usize::MAX);
         figcraft_collab::Limits { max_message_bytes: max, max_log_bytes: (file / 4).max(256 << 10), ..base }
     }
@@ -279,21 +294,24 @@ impl Config {
     pub fn net(&self) -> NetLimits {
         let base = NetLimits { max_connections: self.max_connections, trusted_proxy: self.proxy().ok().flatten(), ..NetLimits::default() };
         if !self.open_publish {
-            return base;
+            let max = base.max_client_message.max(self.open_message());
+            return NetLimits { max_client_message: max, max_queued_bytes: base.max_queued_bytes.max(max.saturating_add(1 << 20)), ..base };
         }
-        let max = self.open_message().min(base.max_client_message);
+        let max = self.open_message();
         // Shared budgets: one block of addresses (an IPv4 address, an IPv6 /48) gets at most an
-        // eighth of each, and its biggest consumers are dropped first.
-        let (queued, reading) = (256usize << 20, 192usize << 20);
+        // eighth of each, and its biggest consumers are dropped first. Each still fits one whole
+        // message, or a file as large as `max_file_mb` could never arrive.
+        let one = max.saturating_add(1 << 20);
+        let (queued, reading) = ((256usize << 20).max(one.saturating_mul(8)), (192usize << 20).max(one.saturating_mul(8)));
         NetLimits {
             max_per_address: self.max_connections_per_ip,
             max_client_message: max,
-            max_queued_bytes: max.saturating_add(1 << 20),
+            max_queued_bytes: one,
             max_queued_block: queued / 8,
             max_queued_total: queued,
-            max_reading_block: max.saturating_add(1 << 20).min(reading / 8),
+            max_reading_block: one.min(reading / 8),
             max_reading_total: reading,
-            max_in_flight: 128 << 20,
+            max_in_flight: (128usize << 20).max(one),
             reserve_for_sessions: self.max_connections / 8,
             request_idle: std::time::Duration::from_secs(20),
             ..base

apps/figcraft-server/src/disk.rs

@@ -8,8 +8,10 @@
 //!   length (u32 LE), CRC-32 (u32 LE), one [`Journal`] entry in the wire encoding.
 //!
 //! Compaction writes the next generation's snapshot, then an empty log of that generation. A log
-//! whose generation isn't the snapshot's is from before a compaction that was cut short: what it
-//! holds is in the snapshot already. A log ends at its first damaged record (a write cut short).
+//! whose generation isn't the snapshot's is usually from before a compaction that was cut short
+//! (what it holds is in the snapshot already), but no checksum covers either generation, so the
+//! store replays such a log anyway and reports any change the snapshot lacked. A log ends at its
+//! first damaged record (a write cut short).
 
 use std::fs::{self, File};
 use std::io::{self, Read, Write};

apps/figcraft-server/src/hardening_tests.rs

@@ -800,3 +800,41 @@ fn the_server_forgets_addresses_whose_connections_are_gone() {
     assert!(server.blocks_remembered() <= 2, "{} blocks remembered", server.blocks_remembered());
     server.stop();
 }
+
+#[test]
+fn a_library_publish_that_fails_keeps_serving_the_old_version() {
+    let dir = TempDir::new("libfail");
+    let mut store = Store::open(dir.path(), config(dir.path()).store()).unwrap();
+    let (file, ..) = store.publish("Library", &snapshot("Library")).unwrap();
+    // Version 1, then a changed library as version 2.
+    let mut s = Session::new();
+    let f = s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 50, "height": 20, "name": "Button"})).unwrap()["id"].as_u64().unwrap();
+    let c = s.execute("component.create", &json!({"ids": [f]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("library.publish", &json!({})).unwrap();
+    let v1 = figcraft_engine::library_server::archive(&s.doc().unwrap().published.clone().unwrap()).unwrap();
+    s.execute("node.set", &json!({"id": c, "props": {"fill": "#00ff00"}})).unwrap();
+    s.execute("library.publish", &json!({})).unwrap();
+    let v2 = figcraft_engine::library_server::archive(&s.doc().unwrap().published.clone().unwrap()).unwrap();
+    assert_eq!(store.publish_library(&file.id, &v1).unwrap(), 1);
+    let files = dir.path().join(crate::store::FILES).join(&file.id);
+    // The description can't be written: a directory sits where its temporary file goes.
+    let tmp = crate::disk::temp_of(&files.join(crate::disk::META));
+    std::fs::create_dir(&tmp).unwrap();
+    assert!(store.publish_library(&file.id, &v2).is_err());
+    let fetch = |s: &mut Store| s.library(ip("198.51.100.1"), &file.id, Access::View, LibraryReq::Fetch { have: None, usage: None });
+    let served = |reply: LibraryReply| match reply {
+        LibraryReply::Library { version, archive } => (version, archive),
+        other => panic!("{other:?}"),
+    };
+    assert_eq!(served(fetch(&mut store)), (1, v1.clone()), "version 1, with its own bytes");
+    // A crash right after the archive was written leaves it on disk, the description unchanged.
+    std::fs::write(files.join(crate::store::library_name(2)), &v2).unwrap();
+    drop(store);
+    std::fs::remove_dir(&tmp).unwrap();
+    let mut store = Store::open(dir.path(), config(dir.path()).store()).unwrap();
+    assert_eq!(served(fetch(&mut store)), (1, v1), "still version 1 after a restart");
+    // Publishing again works, and serves the new version.
+    assert_eq!(store.publish_library(&file.id, &v2).unwrap(), 2);
+    assert_eq!(served(fetch(&mut store)), (2, v2));
+    assert!(!files.join(crate::store::library_name(1)).exists(), "the old version is deleted");
+}

apps/figcraft-server/src/public_tests.rs

@@ -413,7 +413,7 @@ fn open_mode_has_safe_defaults_and_warns_the_operator() {
     assert_eq!(open.net().request_idle, Duration::from_secs(20), "idle one-shot requests go quickly");
     assert_eq!(open.net().reserve_for_sessions, 512 / 8);
     assert_eq!(open.net().max_client_message, 17 << 20);
-    assert_eq!(private.net().max_client_message, NetLimits::default().max_client_message, "unchanged when private");
+    assert_eq!(private.net().max_client_message, 65 << 20, "private: a 64 MiB file and a margin");
     let w = open.warnings().join("\n");
     assert!(w.contains("operator_contact is empty") && w.contains("trusted_proxy"), "{w}");
     let set = Config { operator_contact: "[email protected]".into(), trusted_proxy: Some("127.0.0.1".into()), max_file_mb: Some(8), ..open };
@@ -493,3 +493,34 @@ fn open_connections_never_reach_what_needs_the_key() {
     assert!(!format!("{info:?}").contains(&k));
     server.stop();
 }
+
+#[test]
+fn files_above_64_mib_fit_every_limit() {
+    // `max_file_mb` may go up to 4096: every cap a whole file's message meets on its way in must
+    // follow it, or the upload is dropped by the transport before the server can say why.
+    for open_publish in [false, true] {
+        let cfg = Config { open_publish, max_file_mb: Some(256), public_url: Some("wss://figcraft.example.com/".into()), ..Config::default() };
+        let (net, core, file) = (cfg.net(), cfg.store().core, 256usize << 20);
+        assert!(net.max_client_message > file, "open={open_publish}: {}", net.max_client_message);
+        assert!(net.max_queued_bytes > file && net.max_reading_block > file && net.max_in_flight > file, "open={open_publish}: {net:?}");
+        assert!(net.max_reading_total >= net.max_reading_block && net.max_queued_total >= net.max_queued_block);
+        assert!(core.max_message_bytes > file, "open={open_publish}: {}", core.max_message_bytes);
+    }
+    // A client takes such a file too, but caps what any server may make it buffer at 1 GiB.
+    assert_eq!(NetLimits::default().max_server_message, 1 << 30);
+}
+
+#[test]
+fn large_files_warn_the_operator() {
+    let public_url = Some("wss://figcraft.example.com/".into());
+    let warns = |open_publish, mb| {
+        Config { open_publish, max_file_mb: Some(mb), public_url: public_url.clone(), ..Config::default() }.warnings().join(
+            "
+",
+        )
+    };
+    assert!(!warns(true, 64).contains("max_file_mb"), "{}", warns(true, 64));
+    assert!(warns(true, 65).contains("open_publish is on with max_file_mb = 65"), "{}", warns(true, 65));
+    assert!(!warns(false, 1023).contains("max_file_mb"), "{}", warns(false, 1023));
+    assert!(warns(false, 1024).contains("can't be opened"), "{}", warns(false, 1024));
+}

apps/figcraft-server/src/store.rs

@@ -10,7 +10,8 @@
 //!                                and a join code's hash and wrapped token (see `codes`)
 //! <data>/files/<id>/snapshot.bin the session state at the last compaction
 //! <data>/files/<id>/log.bin      what changed since (see `disk`)
-//! <data>/files/<id>/library.bin  its team library, when one was published (a `.figcraft` archive)
+//! <data>/files/<id>/library-<version>.bin  its team library, when one was published (a `.figcraft`
+//!                                archive; `library.bin` from servers before versioned names)
 //! <data>/files/<id>/usage.json   how other files use that library, as their apps report it
 //! <data>/plugins/                the plugin directory (see `directory`)
 //! <data>/blocked.json            addresses the operator blocked
@@ -179,7 +180,7 @@ impl Meta {
     }
 }
 
-/// What a file's team library is (`library.bin` holds it).
+/// What a file's team library is ([`library_file`] holds it).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 struct LibraryMeta {
     id: String,
@@ -265,6 +266,9 @@ pub struct Store {
     next_sweep: u64,
     /// Compactions so far (tests count them).
     compactions: u64,
+    /// Open files closed by a compaction cut short (their snapshot replaced, their log not):
+    /// reported at the next flush, so nothing appended after it is confirmed.
+    cut_short: Vec<String>,
     /// The free space last seen on the data directory's disk, and when.
     free: Option<(Instant, Option<u64>)>,
     _lock: File,
@@ -343,14 +347,14 @@ impl Store {
         let key = load_key(root)?;
         let dir = root.join(FILES);
         fs::create_dir_all(&dir).map_err(|e| format!("can't create {}: {e}", dir.display()))?;
-        let (directory, problems) = Directory::open(root, cfg.directory);
+        let (directory, startup_problems) = Directory::open(root, cfg.directory);
         let abuse = Abuse::new(cfg.hosting.abuse);
         let mut store = Store {
             root: root.to_path_buf(),
             cfg,
             key,
             files: BTreeMap::new(),
-            problems,
+            problems: Vec::new(),
             directory,
             abuse,
             served: figcraft_collab_net::net::Bucket::new(LIBRARY_RATE, LIBRARY_BURST),
@@ -360,9 +364,13 @@ impl Store {
             gone_codes: VecDeque::new(),
             next_sweep: 0,
             compactions: 0,
+            cut_short: Vec::new(),
             free: None,
             _lock: lock,
         };
+        for problem in startup_problems {
+            store.note(problem);
+        }
         store.scan(&dir);
         store.blocked = store.read_list::<String>(BLOCKED).iter().filter_map(|s| s.parse().ok()).map(ip_key).collect();
         store.reports = store.read_list(REPORTS);
@@ -380,7 +388,7 @@ impl Store {
         match disk::read_capped(&path, 16 << 20).and_then(|b| serde_json::from_slice(&b).map_err(|e| format!("{name} is damaged ({e})"))) {
             Ok(list) => list,
             Err(e) => {
-                self.problems.push(e);
+                self.note(e);
                 Vec::new()
             }
         }
@@ -389,7 +397,7 @@ impl Store {
     fn scan(&mut self, dir: &Path) {
         let entries = match fs::read_dir(dir) {
             Ok(e) => e,
-            Err(e) => return self.problems.push(format!("can't list {}: {e}", dir.display())),
+            Err(e) => return self.note(format!("can't list {}: {e}", dir.display())),
         };
         let mut ids: Vec<(String, PathBuf)> = entries.flatten().map(|e| (e.file_name().to_string_lossy().into_owned(), e.path())).collect();
         ids.sort();
@@ -398,18 +406,18 @@ impl Store {
                 continue;
             }
             if !valid_id(&id) {
-                self.problems.push(format!("skipped {}: not a file folder of this server", path.display()));
+                self.note(format!("skipped {}: not a file folder of this server", path.display()));
                 continue;
             }
             if self.files.len() >= self.cfg.max_files {
-                self.problems.push(format!("skipped file {id}: over the {}-file cap", self.cfg.max_files));
+                self.note(format!("skipped file {id}: over the {}-file cap", self.cfg.max_files));
                 continue;
             }
             match self.check(&path) {
                 Ok(entry) => {
                     self.files.insert(id, entry);
                 }
-                Err(why) => self.problems.push(format!("skipped file {id}: {why}")),
+                Err(why) => self.note(format!("skipped file {id}: {why}")),
             }
         }
     }
@@ -432,7 +440,7 @@ impl Store {
             && let Ok(log) = disk::read_log(&bytes)
             && log.generation != generation
         {
-            log::info!("file at {}: its log predates the last compaction; it is ignored", path.display());
+            log::info!("file at {}: its log isn't of its snapshot's generation; it is replayed over it when the file opens", path.display());
         }
         let bytes = [SNAPSHOT, LOG].iter().filter_map(|n| fs::metadata(path.join(n)).ok()).map(|m| m.len()).sum();
         Ok(Entry { meta, links, log: None, bytes, forced: 0 })
@@ -919,11 +927,12 @@ impl Store {
     /// A file's team library for `ip`, unless its version is `have`; within what one address and
     /// everyone may download (the size is known before anything is read).
     fn fetch_library(&mut self, ip: IpAddr, file: &str, have: Option<u64>) -> Result<LibraryReply, String> {
-        let (path, max) = (self.dir(file).join(LIBRARY), self.cfg.max_file_bytes);
+        let (dir, max) = (self.dir(file), self.cfg.max_file_bytes);
         let Some(lib) = self.entry(file)?.meta.library.clone() else { return Ok(LibraryReply::Empty) };
         if have == Some(lib.version) {
             return Ok(LibraryReply::Unchanged { version: lib.version });
         }
+        let path = library_file(&dir, lib.version);
         let size = fs::metadata(&path).map_or(0, |m| m.len());
         let now = Instant::now();
         if !self.abuse.allow(ip, Action::Download(usize::try_from(size).unwrap_or(usize::MAX)), now) || !self.served.take_n(now, size as f64) {
@@ -965,14 +974,24 @@ impl Store {
                 return Err(format!("version {} is on the server already: publish again to follow it", old.version));
             }
         }
-        // The archive first: a description never names a version whose library isn't there (a
-        // failed description write leaves the older number, which the next publish follows).
-        disk::write_atomic(&dir.join(LIBRARY), archive).map_err(|e| format!("couldn't keep the library: {e}"))?;
+        // Each version has a file of its own, written before the description names it: a failed
+        // description write or a crash in between leaves the previous version served whole, never
+        // the new bytes under the old number.
+        let path = dir.join(library_name(m.version));
+        disk::write_atomic(&path, archive).map_err(|e| format!("couldn't keep the library: {e}"))?;
         let before = entry.meta.library.replace(LibraryMeta { id: m.id.clone(), name: m.name.clone(), version: m.version });
         if let Err(e) = write_json(&dir.join(META), &entry.meta) {
+            // Never served (the description doesn't name it); the next publish of it replaces it.
+            if let Err(r) = fs::remove_file(&path) {
+                log::warn!("file {file}: an unpublished library version couldn't be deleted: {r}");
+            }
             entry.meta.library = before;
             return Err(format!("couldn't keep the library: {e}"));
         }
+        // The previous version isn't served any more.
+        if let Some(Err(e)) = before.map(|old| fs::remove_file(library_file(&dir, old.version))) {
+            log::warn!("file {file}: the previous library version couldn't be deleted: {e}");
+        }
         log::info!("file {file}: published library version {} ({} bytes)", m.version, archive.len());
         Ok(m.version)
     }
@@ -1107,8 +1126,32 @@ impl Store {
                     fresh_log = true;
                 }
             }
-            // From before a compaction that was cut short: the snapshot has it all.
-            Ok(_) => {}
+            // From before a compaction that was cut short, the snapshot has it all; or a generation
+            // field damaged, which no checksum covers. Replaying tells them apart without trusting
+            // it: entries the snapshot holds are skipped, so only edits it lacks change anything.
+            Ok(log) => {
+                let before = server.seq();
+                let mut stopped = None;
+                for entry in log.entries {
+                    if let Err(e) = server.replay(entry) {
+                        stopped = Some(e);
+                        break;
+                    }
+                }
+                let (snap, found, recovered) = (generation, log.generation, server.seq().saturating_sub(before));
+                if recovered > 0 {
+                    issues.push(format!(
+                        "file {file}: its log's generation ({found}) doesn't match its snapshot's ({snap}), but it held \
+                         {recovered} changes the snapshot didn't; they were recovered"
+                    ));
+                }
+                if let Some(e) = stopped {
+                    issues.push(format!(
+                        "file {file}: its log's generation ({found}) doesn't match its snapshot's ({snap}) and it stops \
+                         making sense after {recovered} newer changes ({e}); the rest was dropped"
+                    ));
+                }
+            }
             Err(why) => issues.push(format!("file {file}: {why}; starting a new log")),
         }
         for i in issues {
@@ -1124,7 +1167,7 @@ impl Store {
                 Log { generation, file: f, pending: Vec::new(), entries: kept, bytes, dirty: kept > 0 }
             }
             // A new snapshot and log of the next generation, so appends start clean.
-            _ => self.rewrite(file, generation + 1, &server)?,
+            _ => self.rewrite(file, generation + 1, &server).map_err(|e| e.why)?,
         };
         self.entry(file)?.log = Some(log);
         Ok(server)
@@ -1137,21 +1180,24 @@ impl Store {
     }
 
     /// Write `server`'s state as snapshot `generation` and start an empty log of it.
-    fn rewrite(&mut self, file: &str, generation: u64, server: &Server) -> Result<Log, String> {
+    fn rewrite(&mut self, file: &str, generation: u64, server: &Server) -> Result<Log, RewriteError> {
         let dir = self.dir(file);
-        let state = server.state().map_err(|e| e.to_string())?;
-        let bytes = disk::encode_snapshot(generation, &state)?;
+        let kept = |why: String| RewriteError { why, snapshot_replaced: false };
+        let state = server.state().map_err(|e| kept(e.to_string()))?;
+        let bytes = disk::encode_snapshot(generation, &state).map_err(kept)?;
         // Never replace a readable snapshot with one that can't be opened again: the old snapshot
         // and log still hold everything.
         if bytes.len() as u64 > self.snapshot_cap() {
-            return Err(format!("the snapshot would be {} MiB, more than can be opened again", bytes.len() >> 20));
+            return Err(kept(format!("the snapshot would be {} MiB, more than can be opened again", bytes.len() >> 20)));
         }
         if bytes.len() as u64 > self.cfg.max_file_bytes {
             log::warn!("file {file} is {} MiB, over the {} MiB cap (kept anyway)", bytes.len() >> 20, self.cfg.max_file_bytes >> 20);
         }
-        disk::write_atomic(&dir.join(SNAPSHOT), &bytes).map_err(|e| format!("couldn't write the snapshot: {e}"))?;
-        disk::write_atomic(&dir.join(LOG), &disk::log_header(generation)).map_err(|e| format!("couldn't start the log: {e}"))?;
-        let f = OpenOptions::new().append(true).open(dir.join(LOG)).map_err(|e| format!("couldn't open the log: {e}"))?;
+        disk::write_atomic(&dir.join(SNAPSHOT), &bytes).map_err(|e| kept(format!("couldn't write the snapshot: {e}")))?;
+        // From here the old log no longer goes with the snapshot on disk.
+        let replaced = |why: String| RewriteError { why, snapshot_replaced: true };
+        disk::write_atomic(&dir.join(LOG), &disk::log_header(generation)).map_err(|e| replaced(format!("couldn't start the log: {e}")))?;
+        let f = OpenOptions::new().append(true).open(dir.join(LOG)).map_err(|e| replaced(format!("couldn't open the log: {e}")))?;
         if let Ok(e) = self.entry(file) {
             e.bytes = (bytes.len() + LOG_HEADER) as u64;
             e.meta.seq = server.seq();
@@ -1204,8 +1250,19 @@ impl Store {
                 }
                 log::debug!("compacted file {file}");
             }
+            // The new snapshot holds everything, but a restart would drop whatever is appended to
+            // the old log now (its generation no longer matches): the file closes, the hub hears
+            // it at the next flush, and it opens again from the new snapshot.
+            Err(RewriteError { why, snapshot_replaced: true }) => {
+                self.note(format!("file {file}: compaction was cut short ({why}); it was closed"));
+                log::error!("file {file}: compaction was cut short: {why}");
+                if let Some(e) = self.files.get_mut(file) {
+                    e.log = None;
+                }
+                self.cut_short.push(file.to_string());
+            }
             // The old snapshot and log still hold everything: carry on appending.
-            Err(e) => log::error!("file {file}: compaction failed: {e}"),
+            Err(RewriteError { why, .. }) => log::error!("file {file}: compaction failed: {why}"),
         }
     }
 
@@ -1213,7 +1270,7 @@ impl Store {
     /// Those are closed here (their pending records dropped: nobody was told of them) and open
     /// again from what is on disk.
     fn flush_all(&mut self) -> Vec<String> {
-        let mut failed = Vec::new();
+        let mut failed = std::mem::take(&mut self.cut_short);
         for (id, e) in &mut self.files {
             if let Some(log) = e.log.as_mut() {
                 match flush_log(id, log) {
@@ -1229,6 +1286,13 @@ impl Store {
     }
 }
 
+/// Why a snapshot and log couldn't be rewritten, and whether the snapshot on disk was replaced
+/// before it failed (then the old log no longer goes with it).
+struct RewriteError {
+    why: String,
+    snapshot_replaced: bool,
+}
+
 /// Write and sync a log's pending records: the bytes written, or `Err` when that failed (the log
 /// can't be trusted to hold them).
 fn flush_log(id: &str, log: &mut Log) -> Result<u64, ()> {
@@ -1249,6 +1313,18 @@ fn flush_log(id: &str, log: &mut Log) -> Result<u64, ()> {
     }
 }
 
+/// The name of the file holding version `version` of a file's team library.
+pub fn library_name(version: u64) -> String {
+    format!("library-{version}.bin")
+}
+
+/// Where version `version` of the team library in `dir` is: its own file, or `library.bin` for a
+/// version published before each version had one.
+fn library_file(dir: &Path, version: u64) -> PathBuf {
+    let path = dir.join(library_name(version));
+    if path.exists() { path } else { dir.join(LIBRARY) }
+}
+
 fn write_json<T: Serialize + ?Sized>(path: &Path, value: &T) -> Result<(), String> {
     let text = serde_json::to_vec_pretty(value).map_err(|e| e.to_string())?;
     disk::write_atomic(path, &text).map_err(|e| e.to_string())
@@ -1316,6 +1392,8 @@ impl Backend for Store {
         if dirty {
             self.compact(file, server);
         }
+        // It closes anyway, everything in its snapshot: a compaction cut short needs no report.
+        self.cut_short.retain(|f| f != file);
         if let Some(e) = self.files.get_mut(file) {
             e.log = None;
         }
@@ -1438,6 +1516,8 @@ impl Backend for Store {
             Admin::Blocked => AdminReply::Blocked(self.blocked()).into(),
             Admin::Code { file, token } => self.set_code(&file, &token).map_or_else(failed, |code| AdminReply::Code { code }.into()),
             Admin::Owned { files } => self.owned(&files).into(),
+            // The hub removes people itself (it knows who is connected); it never asks the store.
+            Admin::RemovePeer { .. } => failed("removing someone from a file is done by the server's hub".into()),
             Admin::Remove { file } => {
                 if !self.files.contains_key(&file) {
                     return failed("this file isn't on the server (it may have been removed)".into());

apps/figcraft-server/src/store_tests.rs

@@ -269,3 +269,47 @@ fn random_bytes_never_panic_the_readers() {
         let _ = disk::read_log(&bytes);
     }
 }
+
+/// The first page's name in `server`'s document.
+fn page_name(server: &Server) -> String {
+    let d = server.replica().document();
+    d.node(d.first_page().unwrap()).unwrap().name.clone()
+}
+
+#[test]
+fn edits_confirmed_after_a_compaction_cut_short_survive_a_restart() {
+    let dir = TempDir::new("cutshort");
+    let c = StoreConfig { compact_after: 3, ..cfg(dir.path()) };
+    let folder = dir.path().join(FILES);
+    let mut store = Store::open(dir.path(), c.clone()).unwrap();
+    let (id, _, _) = publish(&mut store, "Busy");
+    let mut server = store.open(&id).unwrap();
+    let mut a = join(&mut server, Access::Edit);
+    store.changed(&id, &mut server);
+    // The next compaction writes its snapshot, then can't start its log.
+    let blocker = disk::temp_of(&folder.join(&id).join(LOG));
+    fs::create_dir(&blocker).unwrap();
+    // What the hub would confirm: every change whose flush didn't report the file.
+    let mut confirmed = String::new();
+    let mut failed = false;
+    let names = ["P0", "P1", "P2", "After 1", "After 2"];
+    for name in names {
+        rename(&mut server, &mut a, name);
+        store.changed(&id, &mut server);
+        if store.flush().contains(&id) {
+            failed = true;
+            break;
+        }
+        confirmed = name.to_string();
+    }
+    assert!(failed, "the hub hears the file can't be kept; confirmed {confirmed:?}");
+    // A crash, then the disk recovers.
+    drop(store);
+    fs::remove_dir(&blocker).unwrap();
+    let mut store = Store::open(dir.path(), c).unwrap();
+    let restored = store.open(&id).unwrap();
+    // Every confirmed change is there (the snapshot may also hold the one that was cut short).
+    let at = |n: &str| names.iter().position(|x| *x == n);
+    let name = page_name(&restored);
+    assert!(at(&name) >= at(&confirmed), "restored {name:?}, confirmed {confirmed:?}");
+}

apps/figcraft-server/tests/header_recovery.rs

@@ -0,0 +1,139 @@
+//! A generation field damaged after an abrupt stop must not make the server drop a log that still
+//! holds confirmed edits (#408): the log is replayed over the snapshot, which only the changes the
+//! snapshot lacks survive, and the damage is reported. A genuine leftover of a compaction cut short
+//! still restores silently.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use figcraft_collab::message::{Access, ClientMsg};
+use figcraft_collab::{Client, Outgoing, Replica, Server};
+use figcraft_collab_net::hub::Backend;
+use figcraft_doc::Document;
+use figcraft_server::config::Config;
+use figcraft_server::disk::{self, LOG, SNAPSHOT};
+use figcraft_server::store::{FILES, Store};
+use std::fs;
+use std::path::{Path, PathBuf};
+
+struct Fixture(PathBuf);
+
+impl Fixture {
+    fn new() -> Self {
+        let path = std::env::temp_dir().join(format!("figcraft-header-recovery-{}", figcraft_collab_net::token::file_id().unwrap()));
+        fs::create_dir(&path).unwrap();
+        Self(path)
+    }
+}
+
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+fn page_name(server: &Server) -> String {
+    let doc = server.document();
+    doc.node(doc.first_page().unwrap()).unwrap().name.clone()
+}
+
+/// A published file whose first page was renamed "Kept", flushed to its log (not compacted), then
+/// the store dropped without stopping (an abrupt stop). Returns the file id and the final state.
+fn renamed_and_stopped(data: &Path) -> (String, Server) {
+    let mut store = Store::open(data, Config::default().store()).unwrap();
+    let snapshot = Replica::new(Document::new("Fixture")).snapshot().unwrap();
+    let (info, _, _) = store.publish("Fixture", &snapshot).unwrap();
+    let id = info.id;
+    let mut server = store.open(&id).unwrap();
+    let ClientMsg::Hello(hello) = Client::hello("f", "", "Editor", "#FF8800") else { panic!("not a hello") };
+    let (_, messages) = server.join_as(hello, Access::Edit).unwrap();
+    let Some(Outgoing::To(_, welcome)) = messages.into_iter().next() else { panic!("no welcome") };
+    let mut client = Client::join(welcome).unwrap();
+    store.changed(&id, &mut server);
+    let mut edited = client.document().clone();
+    let page = edited.first_page().unwrap();
+    edited.node_mut(page).unwrap().name = "Kept".into();
+    let change = client.edit(&edited).unwrap().unwrap();
+    assert!(!server.receive(client.id(), change).is_empty());
+    store.changed(&id, &mut server);
+    assert!(store.flush().is_empty(), "the edit must reach disk");
+    assert_eq!(page_name(&server), "Kept");
+    let dir = data.join(FILES).join(&id);
+    assert!(!disk::read_log(&fs::read(dir.join(LOG)).unwrap()).unwrap().entries.is_empty());
+    assert_eq!(disk::decode_snapshot(&fs::read(dir.join(SNAPSHOT)).unwrap()).unwrap().1.seq, 0, "the rename is only in the log");
+    drop(store);
+    (id, server)
+}
+
+/// Reopen the data directory: the file's first page name and the problems reported.
+fn reopen(data: &Path, id: &str) -> (String, Vec<String>) {
+    let mut store = Store::open(data, Config::default().store()).unwrap();
+    let server = store.open(id).unwrap();
+    (page_name(&server), store.problems().to_vec())
+}
+
+fn flip(path: &Path, at: usize) {
+    let mut bytes = fs::read(path).unwrap();
+    bytes[at] ^= 1;
+    fs::write(path, bytes).unwrap();
+}
+
+/// The generation field's first byte in both headers (after the magic and the format byte).
+const GENERATION_AT: usize = 5;
+
+#[test]
+fn an_intact_log_restores_its_edits_without_a_report() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept");
+    assert!(problems.is_empty(), "{problems:?}");
+}
+
+#[test]
+fn a_damaged_log_generation_keeps_the_edits_and_is_reported() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    let log = fixture.0.join(FILES).join(&id).join(LOG);
+    flip(&log, GENERATION_AT);
+    // The records themselves still read: only the header's generation changed.
+    let read = disk::read_log(&fs::read(&log).unwrap()).unwrap();
+    assert!(read.damaged.is_none() && !read.entries.is_empty());
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept", "the flushed rename must survive");
+    assert!(problems.iter().any(|p| p.contains(&id) && p.contains("generation")), "{problems:?}");
+    // And it stays: the recovered edit is now in the file's snapshot.
+    assert_eq!(reopen(&fixture.0, &id).0, "Kept");
+}
+
+#[test]
+fn a_damaged_snapshot_generation_keeps_the_edits_and_is_reported() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    let snapshot = fixture.0.join(FILES).join(&id).join(SNAPSHOT);
+    flip(&snapshot, GENERATION_AT);
+    assert!(disk::check_snapshot(&fs::read(&snapshot).unwrap()).is_ok(), "the generation is outside the checksum");
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept", "the flushed rename must survive");
+    assert!(problems.iter().any(|p| p.contains(&id) && p.contains("generation")), "{problems:?}");
+    assert_eq!(reopen(&fixture.0, &id).0, "Kept");
+}
+
+#[test]
+fn a_damaged_log_format_is_still_reported() {
+    let fixture = Fixture::new();
+    let (id, _) = renamed_and_stopped(&fixture.0);
+    flip(&fixture.0.join(FILES).join(&id).join(LOG), 4);
+    let (_, problems) = reopen(&fixture.0, &id);
+    assert!(problems.iter().any(|p| p.contains(&id) && p.contains("format")), "{problems:?}");
+}
+
+#[test]
+fn a_log_left_by_a_compaction_cut_short_restores_without_a_report() {
+    let fixture = Fixture::new();
+    let (id, server) = renamed_and_stopped(&fixture.0);
+    // The next snapshot was written (it holds the rename); the old log wasn't replaced yet.
+    let bytes = disk::encode_snapshot(2, &server.state().unwrap()).unwrap();
+    fs::write(fixture.0.join(FILES).join(&id).join(SNAPSHOT), bytes).unwrap();
+    let (name, problems) = reopen(&fixture.0, &id);
+    assert_eq!(name, "Kept");
+    assert!(problems.is_empty(), "a leftover log is expected, not damage: {problems:?}");
+}

apps/figcraft-server/tests/problem_retention.rs

@@ -0,0 +1,40 @@
+use figcraft_server::config::Config;
+use figcraft_server::store::{FILES, Store};
+
+#[test]
+fn startup_problem_retention() {
+    let root = std::env::temp_dir().join(format!("figcraft-problem-cap-{}", std::process::id()));
+    assert!(!root.exists());
+    let result = (|| -> Result<(), String> {
+        for count in [3u32, 200, 201] {
+            let data = root.join(count.to_string());
+            for i in 0..count {
+                std::fs::create_dir_all(data.join(FILES).join(format!("{i:016x}"))).map_err(|e| e.to_string())?;
+            }
+            let cfg = Config { open_publish: true, data: data.clone(), ..Config::default() };
+            cfg.check()?;
+            let store = Store::open(&data, cfg.store())?;
+            let expected = (count as usize).min(200);
+            let problems = store.problems().to_vec();
+            let no_loaded_files = store.is_empty();
+            drop(store);
+            if !problems.iter().all(|p| p.contains("meta.json")) || !no_loaded_files {
+                return Err("unexpected diagnostic or loaded file".into());
+            }
+            if problems.len() != expected {
+                return Err(format!("expected {expected} retained problems, got {}", problems.len()));
+            }
+            // The latest problems stay, in scan order: the first folder's is the one dropped.
+            let first_kept = count as usize - expected;
+            for (n, p) in problems.iter().enumerate() {
+                let id = format!("{:016x}", first_kept + n);
+                if !p.contains(&id) {
+                    return Err(format!("problem {n} should be about {id}: {p}"));
+                }
+            }
+        }
+        Ok(())
+    })();
+    std::fs::remove_dir_all(&root).unwrap();
+    assert!(result.is_ok(), "{}", result.unwrap_err());
+}

apps/figcraft-web/Cargo.toml

@@ -24,5 +24,6 @@ log = { workspace = true }
 # `wgpu` pulls egui-wgpu's defaults: WebGPU plus the WebGL2 fallback.
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 wasm-bindgen = "0.2"
+js-sys = "0.3"
 wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType"] }

apps/figcraft-web/src/main.rs

@@ -14,7 +14,16 @@
 //!   join from other machines.
 //!
 //! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU.
+//!
+//! URL fragment: `#join=<invite link or join code>` joins that live session once the page has
+//! loaded, so a bookmark opens a shared file. `join` takes the rest of the fragment: put it last.
+//! The link carries the session's secret; a fragment is never sent to the web host, but the address
+//! bar and the browser history keep it, so the URL is as private as the link itself.
 
+#[cfg(any(target_arch = "wasm32", test))]
+mod query;
+#[cfg(test)]
+mod query_tests;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/figcraft-web/src/query.rs

@@ -0,0 +1,15 @@
+//! The page's URL: the invite link its fragment names.
+
+/// The invite link in `#join=<link>` (`fragment` is `location.hash`, with or without its `#`), still
+/// escaped. The fragment, unlike the query, never leaves the browser, so the link's secret stays out
+/// of the web host's logs and `Referer` headers. `join` takes the rest of the fragment, so a pasted
+/// `figcraft://join?host=…&file=…&token=…` keeps its own `&`s. Anything longer than an escaped invite
+/// link can be is ignored; what is left is checked by `collab.join` like a link the desktop app is
+/// opened with.
+pub fn join_link(fragment: &str) -> Option<&str> {
+    // An invite link is at most 2 KiB; every byte of it escaped is three.
+    const MAX: usize = 3 * 2048;
+    let fragment = fragment.strip_prefix('#').unwrap_or(fragment);
+    let start = if fragment.starts_with("join=") { 0 } else { fragment.find("&join=")? + 1 };
+    fragment.get(start + "join=".len()..).filter(|link| !link.is_empty() && link.len() <= MAX)
+}

apps/figcraft-web/src/query_tests.rs

@@ -0,0 +1,29 @@
+//! `#join=` in the page's URL.
+
+use crate::query::join_link;
+
+#[test]
+fn join_takes_the_rest_of_the_fragment() {
+    let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv";
+    assert_eq!(join_link(&format!("#join={link}")), Some(link), "a pasted link keeps its own &s");
+    assert_eq!(join_link(&format!("#x=1&join={link}")), Some(link), "after other entries");
+    assert_eq!(join_link("#join=figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), Some("figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), "escaped, decoded later");
+    assert_eq!(join_link("join=K7M-2QX-9TD"), Some("K7M-2QX-9TD"), "a join code, no leading #");
+}
+
+#[test]
+fn no_join_without_the_entry() {
+    assert_eq!(join_link(""), None);
+    assert_eq!(join_link("#"), None);
+    assert_eq!(join_link("#join="), None);
+    assert_eq!(join_link("#rejoin=x"), None, "only the whole entry name");
+    assert_eq!(join_link("#xjoin=x&a=1"), None);
+    assert_eq!(join_link("?join=x"), None, "the query isn't read: it goes to the web host");
+}
+
+#[test]
+fn an_overlong_link_is_ignored() {
+    let long = format!("#join=figcraft://join?host=h&file=f&token={}", "a".repeat(7000));
+    assert_eq!(join_link(&long), None);
+    assert_eq!(join_link(&format!("#join={}", "é".repeat(4000))), None, "length counts bytes");
+}

apps/figcraft-web/src/web.rs

@@ -40,7 +40,13 @@ pub fn start() {
                     // on the socket wakes the page for a frame.
                     let ctx = cc.egui_ctx.clone();
                     session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint()))));
-                    let fig = FigApp::new(session, Box::new(WebServices { reduce_motion }));
+                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+                    // `#join=<link>`: join that session, as opening an invite link does on the desktop.
+                    let hash = web_sys::window().and_then(|w| w.location().hash().ok()).unwrap_or_default();
+                    if let Some(link) = crate::query::join_link(&hash) {
+                        let link = js_sys::decode_uri_component(link).ok().and_then(|s| s.as_string()).unwrap_or_else(|| link.to_string());
+                        figcraft_ui_egui::live::open_invite(&mut fig, &link);
+                    }
                     Ok(Box::new(WebShell { fig }))
                 }),
             )
@@ -69,14 +75,35 @@ impl eframe::App for WebShell {
     }
 }
 
-/// Browser services. File dialogs return nothing for now (the trait's defaults); the clipboard
-/// goes through egui's own web clipboard handling.
+/// Browser services. Open dialogs return nothing for now (the trait's defaults); files are saved
+/// as downloads. Copies go to the system clipboard through egui's output; pastes arrive as paste
+/// events with their text (a page can't read the clipboard when it likes).
 struct WebServices {
     /// `prefers-reduced-motion: reduce` (it follows the setting while the page is open).
     reduce_motion: Option<web_sys::MediaQueryList>,
+    ctx: egui::Context,
 }
 
 impl Services for WebServices {
+    fn downloads(&self) -> bool {
+        true
+    }
+    /// A Blob behind a temporary `<a download>` link, clicked and removed.
+    fn download(&mut self, name: &str, bytes: &[u8]) -> bool {
+        match download(name, bytes) {
+            Ok(()) => true,
+            Err(e) => {
+                log::error!("couldn't download {name}: {e:?}");
+                false
+            }
+        }
+    }
+    fn clipboard_set_text(&mut self, s: &str) {
+        figcraft_ui_egui::egui_copy_text(&self.ctx, s);
+    }
+    fn clipboard_set_png(&mut self, w: u32, h: u32, rgba: &[u8]) {
+        figcraft_ui_egui::egui_copy_png(&self.ctx, w, h, rgba);
+    }
     fn open_url(&mut self, url: &str) {
         let Some(window) = web_sys::window() else { return };
         if let Err(e) = window.open_with_url_and_target(url, "_blank") {
@@ -108,3 +135,32 @@ impl Services for WebServices {
         held
     }
 }
+
+fn download(name: &str, bytes: &[u8]) -> Result<(), wasm_bindgen::JsValue> {
+    let window = web_sys::window().ok_or("no window")?;
+    let document = window.document().ok_or("no document")?;
+    let body = document.body().ok_or("no body")?;
+    let parts = js_sys::Array::of1(&js_sys::Uint8Array::from(bytes));
+    let blob = web_sys::Blob::new_with_u8_array_sequence_and_options(&parts, &{
+        let o = web_sys::BlobPropertyBag::new();
+        o.set_type("application/octet-stream");
+        o
+    })?;
+    let url = web_sys::Url::create_object_url_with_blob(&blob)?;
+    let a: web_sys::HtmlAnchorElement = document.create_element("a")?.dyn_into()?;
+    a.set_href(&url);
+    a.set_download(name);
+    body.append_child(&a)?;
+    a.click();
+    a.remove();
+    // Revoked later, not at once: some browsers cancel a download whose URL goes before it starts.
+    let revoke = wasm_bindgen::closure::Closure::once_into_js(move || {
+        let _ = web_sys::Url::revoke_object_url(&url);
+    });
+    // Without the timer the URL just stays until the page closes.
+    let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(revoke.unchecked_ref(), REVOKE_DOWNLOAD_MS);
+    Ok(())
+}
+
+/// How long a download's object URL is kept (milliseconds).
+const REVOKE_DOWNLOAD_MS: i32 = 40_000;

apps/figcraft/Cargo.toml

@@ -21,7 +21,7 @@ eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "
 serde_json = { workspace = true }
 log = { workspace = true }
 rfd = { workspace = true }
-arboard = { workspace = true, features = ["image-data"] }
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }
 webbrowser = { workspace = true }
 image = { workspace = true }
 env_logger = { version = "0.11", default-features = false, features = ["auto-color", "humantime"] }
@@ -31,8 +31,21 @@ env_logger = { version = "0.11", default-features = false, features = ["auto-col
 [target.'cfg(windows)'.dependencies]
 windows = { version = "0.62", default-features = false, features = ["UI_ViewManagement", "System_UserProfile", "Foundation_Collections", "Gaming_Input"] }
 
+# Finder double-clicks, Open With, Dock drops and `open -a FigCraft file.figcraft` arrive as a
+# kAEOpenDocuments Apple event, which winit 0.30 doesn't handle. This crate (also used by GridCraft,
+# EffectCraft and PhotoCraft) registers the handler behind a safe API (Objective-C interop needs
+# unsafe, which the workspace forbids). Pinned exactly: review the diff before bumping.
+[target.'cfg(target_os = "macos")'.dependencies]
+fmv-macos-events = "=0.1.0"
+
 [dev-dependencies]
 wat = { workspace = true }
 
 [build-dependencies]
 winresource = "0.1"
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# Use vector window controls without a title-font renderer or embedded Cantarell.
+winit = { version = "0.30", default-features = false, features = ["wayland-csd-adwaita-notitle"] }
+raw-window-handle = "0.6"
+wayland-client = "0.31"

apps/figcraft/src/apple_events.rs

@@ -0,0 +1,57 @@
+//! macOS open-documents and quit Apple events (#289).
+//!
+//! Finder double-clicks, Open With, drops on the Dock icon and `open -a FigCraft file.figcraft`
+//! don't pass paths on the command line: LaunchServices sends the running (or just-launched) app a
+//! `kAEOpenDocuments` ('odoc') Apple event. winit 0.30 doesn't handle it and owns the
+//! `NSApplicationDelegate`, so AppKit answered "FigCraft cannot open files in the FigCraft Document
+//! format". Handling it ourselves needs Objective-C class declarations, i.e. `unsafe`, which this
+//! workspace forbids. The `fmv-macos-events` crate (also used by GridCraft, EffectCraft and
+//! PhotoCraft) wraps exactly that, an `NSAppleEventManager` handler registered before Finder's
+//! launch event that leaves winit's delegate alone, behind a safe main-thread API.
+
+use std::path::PathBuf;
+
+use figcraft_ui_egui::FigApp;
+use fmv_macos_events::{Event, Inbox, Registration};
+use serde_json::json;
+
+/// Keeps the Apple-event handlers registered; hold it until the event loop returns.
+pub struct AppleEvents {
+    _registration: Registration,
+    inbox: Inbox,
+}
+
+impl AppleEvents {
+    /// Register the handlers. Call on the main thread before the event loop starts, so the event
+    /// that launched the app (a Finder double-click) is caught too.
+    pub fn install() -> Self {
+        let (registration, inbox) = Registration::install();
+        Self { _registration: registration, inbox }
+    }
+
+    /// The queue the app drains every frame ([`poll`]); events arriving later wake `ctx`.
+    pub fn connect(&self, ctx: &egui::Context) -> Inbox {
+        let ctx = ctx.clone();
+        self.inbox.set_wake(move || ctx.request_repaint());
+        self.inbox.clone()
+    }
+}
+
+/// Open the documents and act on the quit requests that arrived since the last frame.
+pub fn poll(inbox: &Inbox, fig: &mut FigApp, ctx: &egui::Context) {
+    for e in inbox.drain() {
+        match e {
+            Event::Open(paths) => open_documents(fig, paths),
+            Event::Quit => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+        }
+    }
+}
+
+/// Open `paths` as File › Open does; a file that fails shows its error and the others still open.
+pub fn open_documents(fig: &mut FigApp, paths: Vec<PathBuf>) {
+    for p in paths {
+        if fig.run_user("file.open", json!({"path": p.to_string_lossy()})).is_some() {
+            fig.ui.home = false;
+        }
+    }
+}

apps/figcraft/src/apple_events_tests.rs

@@ -0,0 +1,30 @@
+//! Documents macOS hands over in an open-documents Apple event (a Finder double-click, Open With,
+//! a drop on the Dock icon) open as File › Open opens them (#289).
+
+use std::path::PathBuf;
+
+use figcraft_engine::Session;
+use figcraft_ui_egui::{FigApp, NoServices};
+use serde_json::json;
+
+use crate::apple_events::open_documents;
+
+#[test]
+fn documents_from_finder_open_and_leave_the_home_screen() {
+    let dir = std::env::temp_dir().join(format!("figcraft-apple-events-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let file = dir.join("BLA-001.figcraft");
+    let mut s = Session::new();
+    s.execute("file.saveAs", &json!({"path": file.to_string_lossy()})).unwrap();
+
+    let mut app = FigApp::new(Session::empty(), Box::new(NoServices));
+    app.ui.home = true;
+    // A file that can't be read is reported and doesn't keep the others from opening.
+    open_documents(&mut app, vec![dir.join("Missing.figcraft"), file.clone()]);
+    let paths: Vec<_> = app.session.docs.iter().map(|d| d.path.clone().map(PathBuf::from)).collect();
+    assert_eq!(paths, [Some(file)]);
+    assert!(!app.ui.home, "the opened document shows");
+    assert!(app.ui.last_error.as_deref().is_some_and(|e| e.contains("Missing.figcraft")), "{:?}", app.ui.last_error);
+    let _ = std::fs::remove_dir_all(&dir);
+}

apps/figcraft/src/args.rs

@@ -1,4 +1,5 @@
-//! The command line: `figcraft [--control <port>] [files…] [figcraft://join?…]`. An invite link
+//! The command line: `figcraft [--control <port>] [--automation-read-root <dir>]…
+//! [--automation-write-root <dir>]… [files…] [figcraft://join?…]`. An invite link
 //! (what the system passes when a `figcraft://` link is opened) joins that session once the window
 //! is up; everything else that isn't a flag is a file to open, as a path or a `file://` URL (the
 //! Linux desktop entry passes URLs, `%U`, so that it can also hand over invite links).
@@ -11,6 +12,11 @@ pub struct Args {
     pub files: Vec<String>,
     /// The last invite link given.
     pub join: Option<String>,
+    /// `--automation-read-root <dir>` / `--automation-write-root <dir>` (each repeatable; `=` works
+    /// too): the folders the app's file access is confined to. A flag without a value gives `""`,
+    /// which is refused at startup.
+    pub read_roots: Vec<String>,
+    pub write_roots: Vec<String>,
 }
 
 /// An invite link rather than a file (`figcraft:` links, in any case).
@@ -49,7 +55,15 @@ pub fn parse(args: &[String]) -> Args {
     let mut out = Args::default();
     let mut it = args.iter();
     while let Some(a) = it.next() {
-        if a == "--control" {
+        let (flag, inline) = a.split_once('=').map_or((a.as_str(), None), |(f, v)| (f, Some(v.to_string())));
+        let roots = match flag {
+            "--automation-read-root" => Some(&mut out.read_roots),
+            "--automation-write-root" => Some(&mut out.write_roots),
+            _ => None,
+        };
+        if let Some(roots) = roots {
+            roots.push(inline.or_else(|| it.next().cloned()).unwrap_or_default());
+        } else if a == "--control" {
             out.control = it.next().and_then(|p| p.parse().ok());
         } else if is_invite(a) {
             out.join = Some(a.clone());

apps/figcraft/src/args_tests.rs

@@ -10,12 +10,22 @@ fn args(a: &[&str]) -> Vec<String> {
 fn files_and_the_control_port() {
     assert_eq!(parse(&args(&[])), Args::default());
     let a = parse(&args(&["--control", "4242", "a.figcraft", "--verbose", "b.svg"]));
-    assert_eq!(a, Args { control: Some(4242), files: args(&["a.figcraft", "b.svg"]), join: None });
+    assert_eq!(a, Args { control: Some(4242), files: args(&["a.figcraft", "b.svg"]), ..Args::default() });
     // A missing or bad port is ignored, not taken as a file.
     assert_eq!(parse(&args(&["--control"])), Args::default());
     assert_eq!(parse(&args(&["--control", "nope"])).control, None);
 }
 
+#[test]
+fn automation_roots_repeat_and_are_never_files() {
+    let a = parse(&args(&["--automation-read-root", "in", "--automation-write-root=out", "--automation-read-root=more", "a.figcraft"]));
+    assert_eq!(a.read_roots, args(&["in", "more"]));
+    assert_eq!(a.write_roots, args(&["out"]));
+    assert_eq!(a.files, args(&["a.figcraft"]));
+    // A flag without its folder is kept as an empty one, which startup refuses.
+    assert_eq!(parse(&args(&["--automation-write-root"])).write_roots, args(&[""]));
+}
+
 #[test]
 fn invite_links_join_instead_of_opening() {
     let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv";

apps/figcraft/src/control_server.rs

@@ -107,11 +107,17 @@ fn serve(mut out: TcpStream, queue: Queue, ctx: CtxSlot, timeout: Duration) -> s
                     },
                     Err(_) => {
                         cancelled.store(true, std::sync::atomic::Ordering::Relaxed);
-                        json!({"id": id, "ok": false, "error": "timed out waiting for the UI (is the window visible?)"})
+                        json!({"id": id, "ok": false, "error": "timed out waiting for the UI: screenshots and input need the FigCraft window on screen (is it minimised or covered?)"})
                     }
                 }
             }
-            Err(e) => json!({"id": null, "ok": false, "error": format!("bad JSON: {e}")}),
+            Err(e) => {
+                // A line that isn't JSON ends the connection: a web page can make the browser send
+                // an HTTP request here, and its header lines must not let the JSON lines of its body
+                // through as commands.
+                writeln!(out, "{}", json!({"id": null, "ok": false, "error": format!("bad JSON: {e}")}))?;
+                break;
+            }
         };
         writeln!(out, "{reply}")?;
     }

apps/figcraft/src/control_server_tests.rs

@@ -53,9 +53,8 @@ fn valid_frames_keep_their_order_ids_and_parameters() {
     let pending = queue();
     let q = pending.clone();
     let worker = std::thread::spawn(move || serve(server, q, context(), Duration::from_secs(5)));
-    client.write_all(b"\r\n{bad JSON}\n{\"id\":\"test\",\"method\":\"engine.execute\",\"params\":{\"command\":\"shape.rectangle\"}}\r\n").unwrap();
+    client.write_all(b"\r\n{\"id\":\"test\",\"method\":\"engine.execute\",\"params\":{\"command\":\"shape.rectangle\"}}\r\n").unwrap();
     let mut reader = BufReader::new(client);
-    assert_eq!(reply(&mut reader)["ok"], false);
     let start = Instant::now();
     let r = loop {
         if let Some(r) = pending.lock().unwrap().pop() {
@@ -73,6 +72,23 @@ fn valid_frames_keep_their_order_ids_and_parameters() {
     worker.join().unwrap().unwrap();
 }
 
+#[test]
+fn a_line_that_is_not_json_ends_the_connection_before_anything_after_it_runs() {
+    // What a browser sends when a web page posts to the port: the JSON line in its body never runs.
+    let (mut client, server) = pair();
+    let pending = queue();
+    let q = pending.clone();
+    let worker = std::thread::spawn(move || serve(server, q, context(), Duration::from_secs(5)));
+    let body = "{\"id\":1,\"method\":\"engine.execute\",\"params\":{\"command\":\"file.save\"}}\n";
+    let http = format!("POST / HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Type: text/plain\r\nContent-Length: {}\r\n\r\n{body}", body.len());
+    client.write_all(http.as_bytes()).unwrap();
+    let mut reader = BufReader::new(client);
+    assert_eq!(reply(&mut reader)["ok"], false);
+    assert_eq!(reader.read(&mut [0]).unwrap(), 0, "the connection is closed");
+    worker.join().unwrap().unwrap();
+    assert!(pending.lock().unwrap().is_empty(), "nothing was dispatched");
+}
+
 #[test]
 fn full_queue_rejects_before_dispatch_and_ui_queue_stays_bounded() {
     let (mut client, server) = pair();
@@ -144,7 +160,11 @@ fn connection_limit_rejects_excess_clients_and_reuses_finished_slots() {
     assert_eq!(workers.len(), 1);
     client.write_all(b"invalid\n").unwrap();
     assert_eq!(reply(&mut BufReader::new(client.try_clone().unwrap()))["ok"], false);
-    client.shutdown(Shutdown::Both).unwrap();
+    // The server closes this connection after answering an invalid request, and shutting down
+    // a socket whose peer has already closed is ENOTCONN on macOS and the BSDs where Linux
+    // returns Ok. Closing the client is what the worker is waiting for, so the result is moot:
+    // the other shutdowns in this file run while the peer is still open and stay checked.
+    let _ = client.shutdown(Shutdown::Both);
     workers.pop().unwrap().join().unwrap();
 }
 

apps/figcraft/src/linux_window.rs

@@ -0,0 +1,112 @@
+//! Request winit's frame only on Wayland compositors without xdg-decoration.
+//! Desktop/session names cannot identify the backend of an individual window.
+
+use std::os::unix::net::UnixStream;
+use std::path::PathBuf;
+use std::sync::mpsc;
+use std::time::Duration;
+
+use raw_window_handle::{HasDisplayHandle, RawDisplayHandle};
+use wayland_client::globals::{GlobalListContents, registry_queue_init};
+use wayland_client::protocol::wl_registry;
+use wayland_client::{Connection, Dispatch, QueueHandle};
+
+/// Capture the socket path before winit consumes an inherited WAYLAND_SOCKET.
+/// Never consume, duplicate or query that inherited connection: there may be no
+/// independently addressable display, or WAYLAND_DISPLAY may name another server.
+pub fn display_socket() -> Option<PathBuf> {
+    if std::env::var_os("WAYLAND_SOCKET").is_some_and(|s| !s.is_empty()) {
+        return None;
+    }
+    let display = std::env::var_os("WAYLAND_DISPLAY").filter(|s| !s.is_empty())?;
+    let path = PathBuf::from(display);
+    if path.is_absolute() {
+        Some(path)
+    } else {
+        std::env::var_os("XDG_RUNTIME_DIR").filter(|s| !s.is_empty()).map(|dir| PathBuf::from(dir).join(path))
+    }
+}
+
+pub fn needs_native_frame(cc: &eframe::CreationContext<'_>, socket: Option<PathBuf>) -> bool {
+    let wayland = cc.display_handle().is_ok_and(|h| matches!(h.as_raw(), RawDisplayHandle::Wayland(_)));
+    if !wayland {
+        log::debug!("window controls: non-Wayland window, retaining custom controls");
+        return false;
+    }
+    let server_decorations = socket.and_then(probe);
+    log::debug!("window controls: Wayland xdg-decoration available: {server_decorations:?}");
+    native_frame(wayland, server_decorations)
+}
+
+fn native_frame(wayland: bool, server_decorations: Option<bool>) -> bool {
+    wayland && server_decorations == Some(false)
+}
+
+fn probe(socket: PathBuf) -> Option<bool> {
+    // The compositor must not be able to block startup on a registry roundtrip.
+    // On failure/timeout retain FigCraft's own working title bar and buttons.
+    let (send, receive) = mpsc::sync_channel(1);
+    std::thread::Builder::new()
+        .name("wayland-decorations".into())
+        .spawn(move || {
+            let _ = send.send(registry_has_decorations(socket));
+        })
+        .ok()?;
+    receive.recv_timeout(Duration::from_millis(500)).ok().flatten()
+}
+
+fn registry_has_decorations(socket: PathBuf) -> Option<bool> {
+    // A fresh connection leaves winit's event queue and inherited descriptors alone.
+    let stream = UnixStream::connect(socket).ok()?;
+    let connection = Connection::from_socket(stream).ok()?;
+    let (globals, _queue) = registry_queue_init::<Registry>(&connection).ok()?;
+    Some(globals.contents().with_list(|list| list.iter().any(|g| g.interface == "zxdg_decoration_manager_v1")))
+}
+
+struct Registry;
+
+impl Dispatch<wl_registry::WlRegistry, GlobalListContents> for Registry {
+    fn event(
+        _state: &mut Self,
+        _registry: &wl_registry::WlRegistry,
+        _event: wl_registry::Event,
+        _data: &GlobalListContents,
+        _connection: &Connection,
+        _queue: &QueueHandle<Self>,
+    ) {
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn only_wayland_without_server_decorations_uses_the_frame() {
+        for (wayland, server_decorations, expected) in [
+            (false, None, false),
+            (false, Some(false), false),
+            (false, Some(true), false),
+            (true, Some(true), false),
+            (true, Some(false), true),
+            (true, None, false),
+        ] {
+            assert_eq!(super::native_frame(wayland, server_decorations), expected);
+        }
+    }
+
+    #[test]
+    fn an_unavailable_display_keeps_the_custom_controls() {
+        assert_eq!(super::probe("/nonexistent/figcraft-wayland-test".into()), None);
+    }
+
+    #[test]
+    fn an_unresponsive_display_cannot_block_window_startup() -> std::io::Result<()> {
+        let socket = std::env::temp_dir().join(format!("figcraft-decoration-timeout-{}", std::process::id()));
+        let listener = std::os::unix::net::UnixListener::bind(&socket)?;
+        let start = std::time::Instant::now();
+        assert_eq!(super::probe(socket.clone()), None);
+        assert!(start.elapsed() < std::time::Duration::from_secs(2));
+        drop(listener);
+        let _ = std::fs::remove_file(socket);
+        Ok(())
+    }
+}

apps/figcraft/src/main.rs

@@ -6,16 +6,28 @@
 //! `--control <port>` (or `FIGCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
 //! `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":0,"y":0,"width":100,"height":100}}}`
 //! → `{"id":1,"ok":true,"result":{…}}`. Methods: `figcraft_ui_egui::control`.
+//!
+//! `--automation-read-root <dir>` / `--automation-write-root <dir>` (each repeatable) confine the
+//! files the window and the control channel read and write (`figcraft_engine::file_access`); the
+//! app's own folders (settings, recovery copies, installed plugins) and opening the files given on
+//! the command line are not. A root that isn't an existing folder stops the app at startup.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 
+#[cfg(target_os = "macos")]
+mod apple_events;
 mod args;
 mod control_server;
 mod gamepad;
 mod graphics;
+#[cfg(target_os = "linux")]
+mod linux_window;
 mod recovery;
 mod services;
+mod startup;
 
+#[cfg(all(test, target_os = "macos"))]
+mod apple_events_tests;
 #[cfg(test)]
 mod args_tests;
 #[cfg(test)]
@@ -26,6 +38,8 @@ mod recovery_online_tests;
 mod recovery_tests;
 #[cfg(test)]
 mod services_tests;
+#[cfg(test)]
+mod startup_tests;
 
 use std::sync::{Arc, Mutex};
 
@@ -43,6 +57,9 @@ struct App {
     title: String,
     /// Shared with the services, which write the copies after a panic.
     recovery: recovery::Shared,
+    /// Documents and quit requests from Finder, the Dock and Open With.
+    #[cfg(target_os = "macos")]
+    apple_events: fmv_macos_events::Inbox,
 }
 
 impl eframe::App for App {
@@ -55,6 +72,9 @@ impl eframe::App for App {
         }
         let title = with_app(|fig| {
             control_server::drain_queue(&self.queue, &mut fig.control_queue);
+            figcraft_ui_egui::control::drain_hidden(fig, ctx);
+            #[cfg(target_os = "macos")]
+            apple_events::poll(&self.apple_events, fig, ctx);
             // Closing the window asks about unsaved changes (and keeps the app running while other
             // windows are open).
             figcraft_ui_egui::windows::on_close_request(fig, ctx);
@@ -81,16 +101,19 @@ impl eframe::App for App {
         }
     }
 
-    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
         let ctx = ui.ctx().clone();
-        with_app(|fig| figcraft_ui_egui::windows::guard(fig, &ctx, |fig| fig.ui(ui)));
+        services::parented(frame, || with_app(|fig| figcraft_ui_egui::windows::guard(fig, &ctx, |fig| fig.ui(ui))));
     }
 
     fn on_exit(&mut self) {
-        with_app(|fig| services::save_state(fig));
-        if let Some(r) = recovery::lock(&self.recovery).take() {
-            r.finish();
-        }
+        // With the app out of reach (busy), its recovery copies stay for the next start.
+        let copies = recovery::lock(&self.recovery).take();
+        with_app(|fig| services::shutdown(fig, services::config_dir().as_deref(), copies));
+        // Everything is kept: end before the windows' teardown, where AppKit's Touch Bar support
+        // throws on the content view AccessKit restores (craft-libs#3, #781).
+        #[cfg(target_os = "macos")]
+        std::process::exit(0);
     }
 }
 
@@ -106,6 +129,17 @@ fn main() -> eframe::Result {
         return Ok(());
     }
     let args = args::parse(&args);
+    let roots = match (
+        args.read_roots.is_empty() && args.write_roots.is_empty(),
+        figcraft_engine::file_access::Roots::new(&args.read_roots, &args.write_roots),
+    ) {
+        (true, _) => None,
+        (false, Ok(r)) => Some(Arc::new(r)),
+        (false, Err(e)) => {
+            eprintln!("FigCraft: {e}");
+            std::process::exit(2);
+        }
+    };
     let port = args.control.or_else(|| std::env::var("FIGCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok()));
     // System fonts: index them in the background, then wake the UI (an idle window draws no frames)
     // to lay text out again with them.
@@ -130,6 +164,7 @@ fn main() -> eframe::Result {
             log::error!("{f}: {e}");
         }
     }
+    let opened: Vec<u64> = session.docs.iter().map(|d| d.uid).collect();
     // Documents a crashed or killed run left unsaved come back; this run keeps its own copies.
     let recovery_root = services::config_dir().map(|d| d.join("Recovery"));
     // The preferences first: they hold the online files a recovered document may be one of.
@@ -157,8 +192,14 @@ fn main() -> eframe::Result {
     if session.docs.is_empty() && !first_run {
         let _ = session.execute("file.new", &json!({}));
     }
+    // The interface language from the first frame on, and for the message when the window can't
+    // open (no frame then).
+    figcraft_ui_egui::i18n::set(&session.prefs.language, figcraft_ui_egui::Services::system_language(&svc).as_deref());
     let mut fig = FigApp::new(session, Box::new(svc));
+    fig.automation_roots = roots;
     fig.ui.home = false;
+    // Files named on the command line are the user's too: their missing fonts are listed.
+    fig.ui.font_checks = opened;
     fig.note_recovered(recovered.copies);
     if let Some(link) = &args.join {
         figcraft_ui_egui::live::open_invite(&mut fig, link);
@@ -168,25 +209,79 @@ fn main() -> eframe::Result {
         control_server::start(p, queue.clone(), ctx_slot.clone());
     }
     let icon = services::window_icon();
+    // The app id is the Wayland app_id and the X11 window class on Linux: the desktop entry's name
+    // and StartupWMClass (FreeBSD's package matches the binary's name instead).
     let mut viewport = egui::ViewportBuilder::default()
         .with_title("FigCraft")
+        .with_app_id("ai.storyteller.figcraft")
         .with_inner_size([1440.0, 900.0])
         .with_min_inner_size([800.0, 500.0])
         .with_drag_and_drop(true);
-    // The tab strip is the title bar: macOS keeps its window buttons inset into it; elsewhere the
-    // window is frameless and FigCraft draws the buttons and resize edges.
-    if cfg!(target_os = "macos") {
-        viewport = viewport.with_fullsize_content_view(true).with_titlebar_shown(false).with_title_shown(false);
-        fig.ui.title_bar = figcraft_ui_egui::TitleBar::Inset;
-    } else {
-        viewport = viewport.with_decorations(false);
-        fig.ui.title_bar = figcraft_ui_egui::TitleBar::Custom;
-    }
+    // Start frameless on Linux; the app creator checks the actual display backend
+    // before enabling a client-side frame. Other windows inherit that decision.
+    fig.ui.title_bar = desktop_title_bar();
+    viewport = window_chrome(viewport, fig.ui.title_bar);
     if let Some(icon) = icon {
         viewport = viewport.with_icon(icon);
     }
     let mut options = eframe::NativeOptions { viewport, renderer: eframe::Renderer::Wgpu, ..Default::default() };
     graphics::configure(&mut options.wgpu_options);
     figcraft_ui_egui::windows::install(fig);
-    eframe::run_native("FigCraft", options, Box::new(move |_cc| Ok(Box::new(App { queue, ctx_slot, title: String::new(), recovery }))))
+    #[cfg(target_os = "linux")]
+    let linux_display = linux_window::display_socket();
+    // Registered before the event loop starts, so it catches the Finder event that launched the app
+    // as well as later ones. Lives until the event loop returns; the app creator only borrows it.
+    #[cfg(target_os = "macos")]
+    let apple_events = apple_events::AppleEvents::install();
+    #[cfg(target_os = "macos")]
+    let apple_events = &apple_events;
+    let result = eframe::run_native(
+        "FigCraft",
+        options,
+        Box::new(move |_cc| {
+            #[cfg(target_os = "linux")]
+            if linux_window::needs_native_frame(_cc, linux_display) {
+                let _ = with_app(|fig| fig.ui.title_bar = figcraft_ui_egui::TitleBar::Native);
+                _cc.egui_ctx.send_viewport_cmd(egui::ViewportCommand::Decorations(true));
+            }
+            Ok(Box::new(App {
+                queue,
+                ctx_slot,
+                title: String::new(),
+                recovery,
+                #[cfg(target_os = "macos")]
+                apple_events: apple_events.connect(&_cc.egui_ctx),
+            }))
+        }),
+    );
+    // Say why instead of quitting silently: release builds on Windows have no console.
+    if let Err(e) = &result {
+        startup::failed(e, port.is_some());
+    }
+    result
+}
+
+fn desktop_title_bar() -> figcraft_ui_egui::TitleBar {
+    use figcraft_ui_egui::TitleBar;
+    if cfg!(target_os = "macos") { TitleBar::Inset } else { TitleBar::Custom }
+}
+
+fn window_chrome(viewport: egui::ViewportBuilder, title_bar: figcraft_ui_egui::TitleBar) -> egui::ViewportBuilder {
+    use figcraft_ui_egui::TitleBar;
+    match title_bar {
+        TitleBar::Inset => viewport.with_fullsize_content_view(true).with_titlebar_shown(false).with_title_shown(false),
+        TitleBar::Native => viewport.with_decorations(true),
+        TitleBar::Custom => viewport.with_decorations(false),
+    }
+}
+
+#[cfg(all(test, target_os = "linux"))]
+mod linux_window_tests {
+    #[test]
+    fn linux_starts_with_the_existing_frameless_title_bar() {
+        let bar = super::desktop_title_bar();
+        assert_eq!(bar, figcraft_ui_egui::TitleBar::Custom);
+        let viewport = super::window_chrome(egui::ViewportBuilder::default(), bar);
+        assert_eq!(viewport.decorations, Some(false));
+    }
 }

apps/figcraft/src/recovery.rs

@@ -4,7 +4,10 @@
 //! in the config folder, in the background, at most every [`INTERVAL`] seconds, and the copy goes
 //! once the document is saved or closed. The app holds a lock on its folder. At startup, the folders
 //! whose lock is free belong to runs that ended without closing: their copies open again as
-//! unsaved documents (`file.recover`) and the folder goes. Closing the app normally removes its own.
+//! unsaved documents (`file.recover`). Each such copy **stays until this run has its own copy of
+//! the document** (or it is saved or closed): until then it is the only copy on disk, and a run
+//! that can't keep copies of its own leaves it for the next start. Then it goes, and its folder
+//! with its last copy. Closing the app normally removes its own.
 //!
 //! A document that is one of your online files has a note beside its copy (`<uid>.online`, written
 //! after the copy it describes): the server, the file's id, and who the app was in the file with
@@ -22,7 +25,8 @@ use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex, MutexGuard};
 use std::thread::JoinHandle;
 
-use figcraft_engine::Session;
+use figcraft_engine::{DocState, Session};
+use figcraft_format::{Branch, Version};
 use serde_json::json;
 
 /// Seconds between copies of a document that keeps changing.
@@ -41,20 +45,61 @@ pub struct Recovery {
     dir: PathBuf,
     /// Held while the app runs: a free lock means the run that wrote the folder is gone.
     _lock: File,
-    /// The revision each document was last copied at, and the write in flight.
-    written: HashMap<u64, (u64, Option<JoinHandle<()>>)>,
+    /// What was copied of each document, and the write in flight.
+    written: HashMap<u64, Copy>,
     /// When (UI clock) the next copies are due.
     next: f64,
     /// Copies of online files from earlier runs, kept until their outcome is known.
     waiting: Vec<Waiting>,
 }
 
-/// A copy of one of your online files whose file is being joined again as session `session`.
+/// The state of the copy of one document: only a write that succeeded counts as a copy.
+#[derive(Default)]
+struct Copy {
+    /// The [`stamp`] whose copy was written.
+    done: Option<Vec<u64>>,
+    /// The write in flight: the stamp it copies, and whether it succeeded once it ends.
+    flight: Option<(Vec<u64>, JoinHandle<bool>)>,
+}
+
+impl Copy {
+    /// Take in the result of the write in flight once it ended; a failed one leaves its revision uncopied.
+    fn reap(&mut self) {
+        if self.flight.as_ref().is_some_and(|f| f.1.is_finished()) {
+            self.join();
+        }
+    }
+
+    /// Wait for the write in flight and take in its result.
+    fn join(&mut self) {
+        if let Some((stamp, h)) = self.flight.take()
+            && h.join().unwrap_or(false)
+        {
+            self.done = Some(stamp);
+        }
+    }
+
+    /// Whether `stamp` has neither been copied nor is being copied.
+    fn pending(&self, stamp: &[u64]) -> bool {
+        self.done.as_deref() != Some(stamp) && self.flight.as_ref().is_none_or(|f| f.0 != stamp)
+    }
+}
+
+/// A copy from an earlier run, kept until what it became is safe.
 pub struct Waiting {
-    session: u64,
+    until: Until,
     copy: PathBuf,
-    /// The lock of the folder it is in: no other start takes the copy meanwhile.
-    _lock: Arc<File>,
+    /// The lock of the folder it is in: no other start takes the copy meanwhile (none for a copy
+    /// left directly in the root by older versions).
+    _lock: Option<Arc<File>>,
+}
+
+/// What a kept copy waits for.
+enum Until {
+    /// One of your online files, joined again as this session: its outcome.
+    Session(u64),
+    /// Opened as document `uid`: this run's own copy of it (or its save or close).
+    Copied(u64),
 }
 
 /// What [`recover_all`] brought back.
@@ -62,21 +107,25 @@ pub struct Waiting {
 pub struct Recovered {
     /// Documents opened from their copies.
     pub copies: usize,
-    /// Copies of online files waiting for their file ([`Recovery::adopt`]).
+    /// The copies kept until what they became is safe ([`Recovery::adopt`]).
     pub waiting: Vec<Waiting>,
 }
 
 impl Recovery {
     /// Take this run's folder under `root` (`None` when it can't be created or locked: no copies).
+    /// A crashed run with the same process id may still hold its folder (its copies kept): then
+    /// another name is taken.
     pub fn start(root: &Path) -> Option<Self> {
-        let dir = root.join(std::process::id().to_string());
-        std::fs::create_dir_all(&dir).ok()?;
-        let lock = File::create(dir.join(LOCK)).ok()?;
-        lock.try_lock().ok()?;
-        Some(Self { dir, _lock: lock, written: HashMap::new(), next: 0.0, waiting: Vec::new() })
+        let pid = std::process::id();
+        (0..10).find_map(|n| {
+            let dir = root.join(if n == 0 { pid.to_string() } else { format!("{pid}-{n}") });
+            std::fs::create_dir_all(&dir).ok()?;
+            let lock = lock_folder(&dir).ok()?;
+            Some(Self { dir, _lock: lock, written: HashMap::new(), next: 0.0, waiting: Vec::new() })
+        })
     }
 
-    /// Keep earlier runs' copies of online files until their outcome is known.
+    /// Keep earlier runs' copies until what they became is safe.
     pub fn adopt(&mut self, waiting: Vec<Waiting>) {
         self.waiting.extend(waiting);
     }
@@ -85,38 +134,47 @@ impl Recovery {
     /// were saved or closed. Returns how long until it needs to run again (`None`: nothing pending,
     /// an idle window can sleep).
     pub fn tick(&mut self, s: &Session, now: f64) -> Option<f64> {
+        self.written.values_mut().for_each(Copy::reap);
         self.settle(s);
-        // A join on its way settles within its timeouts: look again soon.
-        let settling = (!self.waiting.is_empty()).then_some(0.5);
-        let pending = s.docs.iter().any(|d| needs_copy(d) && self.written.get(&d.uid).is_none_or(|w| w.0 != d.revision));
+        // A join on its way settles within its timeouts: look again soon. A copy waiting for this
+        // run's own is looked at again with the next copies.
+        let joining = self.waiting.iter().any(|w| matches!(w.until, Until::Session(_)));
+        let settling = if joining { Some(0.5) } else { (!self.waiting.is_empty()).then_some(INTERVAL) };
         if now < self.next {
-            return pending.then_some(self.next - now).or(settling);
+            return self.pending(s).then_some(self.next - now).or(settling);
         }
         self.write(s, false);
         self.next = now + INTERVAL;
-        settling
+        // A copy that failed is tried again at the next turn, without another edit.
+        settling.or(self.pending(s).then_some(INTERVAL))
     }
 
-    /// Remove earlier runs' copies whose outcome is known, once what they became is copied here.
-    fn settle(&mut self, s: &Session) {
-        if self.waiting.iter().all(|w| s.live.recovering(w.session)) {
-            return;
+    /// Whether a document with unsaved changes has a revision that is neither copied nor being copied.
+    fn pending(&self, s: &Session) -> bool {
+        s.docs.iter().any(|d| needs_copy(s, d) && self.written.get(&d.uid).is_none_or(|w| w.pending(&stamp(s, d))))
+    }
+
+    /// Remove earlier runs' copies once what they became is safe: copied here (the write
+    /// succeeded), saved or closed. An online file's copy goes once its outcome is known and every
+    /// document is safe, since which of them it became isn't known.
+    pub fn settle(&mut self, s: &Session) {
+        let joined = |w: &Waiting| matches!(w.until, Until::Session(id) if !s.live.recovering(id));
+        if self.waiting.iter().any(joined) {
+            self.write(s, true);
         }
-        self.write(s, true);
-        let (done, waiting): (Vec<Waiting>, Vec<Waiting>) =
-            std::mem::take(&mut self.waiting).into_iter().partition(|w| !s.live.recovering(w.session));
+        let all_safe = s.docs.iter().all(|d| self.safe(s, d));
+        let (done, waiting): (Vec<Waiting>, Vec<Waiting>) = std::mem::take(&mut self.waiting).into_iter().partition(|w| match w.until {
+            Until::Session(_) => joined(w) && all_safe,
+            Until::Copied(uid) => s.docs.iter().find(|d| d.uid == uid).is_none_or(|d| self.safe(s, d)),
+        });
         self.waiting = waiting;
-        for w in done {
-            let _ = std::fs::remove_file(&w.copy);
-            let _ = std::fs::remove_file(w.copy.with_extension(ONLINE));
-            // The folder goes with its last copy (while another waits there its lock is held).
-            let dir = w.copy.parent().map(Path::to_path_buf).filter(|_| Arc::strong_count(&w._lock) == 1);
-            drop(w);
-            if let Some(dir) = dir {
-                let _ = std::fs::remove_file(dir.join(LOCK));
-                let _ = std::fs::remove_dir(dir);
-            }
-        }
+        done.into_iter().for_each(remove_kept);
+    }
+
+    /// Whether document `d`'s work is on disk: saved (or nothing to keep), or copied here (a write
+    /// that succeeded) with no write in flight.
+    fn safe(&self, s: &Session, d: &DocState) -> bool {
+        !needs_copy(s, d) || self.written.get(&d.uid).is_some_and(|w| w.done.is_some() && w.flight.is_none())
     }
 
     /// Copy every document with unsaved changes; `wait`: before returning (after a panic).
@@ -124,47 +182,60 @@ impl Recovery {
         for d in &s.docs {
             let path = self.dir.join(format!("{}.figcraft", d.uid));
             let note = path.with_extension(ONLINE);
-            if !needs_copy(d) {
-                if self.written.remove(&d.uid).is_some() {
+            if !needs_copy(s, d) {
+                if let Some(mut w) = self.written.remove(&d.uid) {
+                    // A write still running would bring the copy back after it was removed.
+                    w.join();
                     let _ = std::fs::remove_file(&path);
                     let _ = std::fs::remove_file(&note);
                 }
                 continue;
             }
-            let entry = self.written.entry(d.uid).or_insert((0, None));
-            let busy = entry.1.as_ref().is_some_and(|h| !h.is_finished());
-            if entry.0 == d.revision || busy {
+            let entry = self.written.entry(d.uid).or_default();
+            // An emergency save must copy the newest revision: let the write in flight finish first.
+            if wait {
+                entry.join();
+            } else {
+                entry.reap();
+            }
+            // A write still in flight (for any revision) is waited for; a failed one is tried again.
+            let stamp = stamp(s, d);
+            if entry.done.as_ref() == Some(&stamp) || entry.flight.is_some() {
                 continue;
             }
             let doc = d.doc.clone();
+            let (versions, branches) = (d.versions.clone(), figcraft_engine::branches::current(s, d.uid));
             // Which online file it is and what of the server's this very copy has (a line each:
             // the server, the file's id, then the session, client id and last change), while it
             // is one. Written after the copy, never before: a note must not promise more of the
             // server's changes than its copy holds.
             let online = s.online_of(d.uid).map(|(server, file, at)| format!("{server}\n{file}\n{} {} {}", at.session, at.client_id, at.seq));
             let job = move || {
-                if !write_atomic(&path, &doc) {
-                    return;
+                if !write_atomic(&path, &doc, &versions, &branches) {
+                    return false;
                 }
                 let _ = match online {
                     Some(text) => std::fs::write(&note, text),
                     None => std::fs::remove_file(&note),
                 };
+                true
             };
+            // The stamp counts as copied only once its write succeeded.
             if wait {
-                job();
-                entry.1 = None;
+                if job() {
+                    entry.done = Some(stamp);
+                }
             } else {
-                entry.1 = std::thread::Builder::new().name("recovery".into()).spawn(job).ok();
+                entry.flight = std::thread::Builder::new().name("recovery".into()).spawn(job).ok().map(|h| (stamp, h));
             }
-            entry.0 = d.revision;
         }
         // Closed documents.
         let open: Vec<u64> = s.docs.iter().map(|d| d.uid).collect();
         let dir = &self.dir;
-        self.written.retain(|uid, _| {
+        self.written.retain(|uid, w| {
             let keep = open.contains(uid);
             if !keep {
+                w.join();
                 let _ = std::fs::remove_file(dir.join(format!("{uid}.figcraft")));
                 let _ = std::fs::remove_file(dir.join(format!("{uid}.{ONLINE}")));
             }
@@ -172,12 +243,31 @@ impl Recovery {
         });
     }
 
+    /// Test hook: pretend a write of `uid` at `revision` is in flight in `writer`.
+    #[cfg(test)]
+    pub fn hold(&mut self, uid: u64, revision: u64, writer: JoinHandle<bool>) {
+        self.written.insert(uid, Copy { done: None, flight: Some((vec![revision], writer)) });
+    }
+
+    /// Quitting: a normal quit ([`finish`](Self::finish)) when the unsaved-changes question was
+    /// `asked` or nothing is unsaved. Otherwise (macOS's Quit menu ends the app without asking) the
+    /// unsaved documents are copied and the copies stay for the next start, as after a crash.
+    pub fn quit(mut self, s: &Session, asked: bool) {
+        if asked || !s.docs.iter().any(|d| needs_copy(s, d)) {
+            return self.finish();
+        }
+        self.write(s, true);
+        self.settle(s);
+    }
+
     /// A normal quit: the documents were saved or their changes discarded on purpose. (Earlier
     /// runs' copies still waiting for their outcome stay for the next start.)
     pub fn finish(self) {
-        let Self { dir, _lock, written, .. } = self;
+        let Self { dir, _lock, written, waiting, .. } = self;
+        // The documents earlier runs' copies became were saved or discarded too.
+        waiting.into_iter().filter(|w| matches!(w.until, Until::Copied(_))).for_each(remove_kept);
         // Windows removes a folder only once nothing in it is open: copies being written first.
-        for h in written.into_values().filter_map(|w| w.1) {
+        for (_, h) in written.into_values().filter_map(|w| w.flight) {
             let _ = h.join();
         }
         drop(_lock);
@@ -185,9 +275,34 @@ impl Recovery {
     }
 }
 
+/// Remove a kept copy and its note, and its folder with its last copy (while another is kept
+/// there, its lock is held).
+fn remove_kept(w: Waiting) {
+    let _ = std::fs::remove_file(&w.copy);
+    let _ = std::fs::remove_file(w.copy.with_extension(ONLINE));
+    let last = w._lock.as_ref().is_some_and(|l| Arc::strong_count(l) == 1);
+    let dir = w.copy.parent().map(Path::to_path_buf).filter(|_| last);
+    drop(w);
+    if let Some(dir) = dir {
+        let _ = std::fs::remove_file(dir.join(LOCK));
+        let _ = std::fs::remove_dir(dir);
+    }
+}
+
 /// The extension of the note beside the copy of a document that is one of your online files.
 const ONLINE: &str = "online";
 
+/// How long the startup waits, once, for folder locks that may free themselves (#334).
+#[cfg(unix)]
+const LOCK_WAIT: std::time::Duration = std::time::Duration::from_millis(100);
+
+/// Lock the folder `dir` (`WouldBlock` while another process holds it).
+fn lock_folder(dir: &Path) -> Result<File, std::fs::TryLockError> {
+    let lock = File::options().write(true).create(true).truncate(false).open(dir.join(LOCK)).map_err(std::fs::TryLockError::Error)?;
+    lock.try_lock()?;
+    Ok(lock)
+}
+
 /// The copy at `file` is of one of your online files: join that file again as its owner, keeping
 /// the copy to compare with what arrives. The session, or `None` when the copy isn't one (or its
 /// file isn't recorded any more, or is open already): then it opens as any other copy.
@@ -201,15 +316,27 @@ fn rejoin_online(file: &Path, s: &mut Session) -> Option<u64> {
     s.execute("collab.recoverFile", &params).ok()?.get("session")?.as_u64()
 }
 
-/// A document whose changes would be lost (a branch tab's edits are in its main file).
-fn needs_copy(d: &figcraft_engine::DocState) -> bool {
-    d.is_dirty() && d.branch_of.is_none()
+/// A file whose changes would be lost: in its document, its history or one of its branch tabs
+/// (a branch tab's edits are saved with its main file, so the tab has no copy of its own).
+fn needs_copy(s: &Session, d: &DocState) -> bool {
+    d.branch_of.is_none() && (d.is_dirty() || branch_tabs(s, d.uid).any(DocState::is_dirty))
 }
 
-/// Write `doc` to `path` through a temporary file; false when it couldn't be written (the copy
-/// before it is still there).
-fn write_atomic(path: &Path, doc: &figcraft_engine::doc::Document) -> bool {
-    let Ok(bytes) = figcraft_format::save_bytes(doc, None) else { return false };
+/// The tabs showing branches of the file in tab `uid`.
+fn branch_tabs(s: &Session, uid: u64) -> impl Iterator<Item = &DocState> {
+    s.docs.iter().filter(move |t| t.branch_of.as_ref().is_some_and(|(main, _)| *main == uid))
+}
+
+/// The revisions a copy of `d` is of: its own and its branch tabs' (a branch tab's edits change
+/// only its own revision). A new copy is due when they change.
+fn stamp(s: &Session, d: &DocState) -> Vec<u64> {
+    std::iter::once(d.revision).chain(branch_tabs(s, d.uid).map(|t| t.revision)).collect()
+}
+
+/// Write `doc` with its version history and branches to `path` through a temporary file; false
+/// when it couldn't be written (the copy before it is still there).
+fn write_atomic(path: &Path, doc: &figcraft_engine::doc::Document, versions: &[Version], branches: &[Branch]) -> bool {
+    let Ok(bytes) = figcraft_format::save_bytes_with_history(doc, None, versions, branches) else { return false };
     let tmp = path.with_extension("tmp");
     std::fs::write(&tmp, bytes).is_ok() && std::fs::rename(&tmp, path).is_ok()
 }
@@ -222,9 +349,9 @@ pub fn recover(root: &Path, s: &mut Session) -> usize {
 }
 
 /// Open the copies left by runs that ended without closing (folders under `root` whose lock is
-/// free, and copies directly in `root` from older versions) as unsaved documents, then remove them.
-/// A copy that can't be read stays where it is. A copy of one of your online files is kept
-/// instead while its file is joined again ([`Recovered::waiting`]).
+/// free, and copies directly in `root` from older versions) as unsaved documents. Each is kept
+/// until this run has its own copy of the document ([`Recovered::waiting`]); a copy of one of your
+/// online files, while its file is joined again. A copy that can't be read stays where it is.
 pub fn recover_all(root: &Path, s: &mut Session) -> Recovered {
     let mut out = Recovered::default();
     let Ok(entries) = std::fs::read_dir(root) else { return out };
@@ -234,12 +361,18 @@ pub fn recover_all(root: &Path, s: &mut Session) -> Recovered {
         }
         // One of your online files comes back from its server, its copy kept until then.
         if let Some((session, lock)) = lock.and_then(|l| Some((rejoin_online(file, s)?, l))) {
-            out.waiting.push(Waiting { session, copy: file.to_path_buf(), _lock: lock.clone() });
-        } else if s.execute("file.recover", &json!({"path": file.to_string_lossy()})).is_ok() {
+            out.waiting.push(Waiting { until: Until::Session(session), copy: file.to_path_buf(), _lock: Some(lock.clone()) });
+            return;
+        }
+        let before: Vec<u64> = s.docs.iter().map(|d| d.uid).collect();
+        if s.execute("file.recover", &json!({"path": file.to_string_lossy()})).is_ok() {
             out.copies += 1;
-            let _ = std::fs::remove_file(file);
+            if let Some(uid) = s.docs.iter().map(|d| d.uid).find(|u| !before.contains(u)) {
+                out.waiting.push(Waiting { until: Until::Copied(uid), copy: file.to_path_buf(), _lock: lock.cloned() });
+            }
         }
     };
+    let (mut free, mut held) = (Vec::new(), Vec::new());
     for e in entries.flatten() {
         let path = e.path();
         if !path.is_dir() {
@@ -247,10 +380,22 @@ pub fn recover_all(root: &Path, s: &mut Session) -> Recovered {
             continue;
         }
         // Still running (another window of the app), or not ours to take.
-        let Ok(lock) = File::options().write(true).create(true).truncate(false).open(path.join(LOCK)) else { continue };
-        if lock.try_lock().is_err() {
-            continue;
+        match lock_folder(&path) {
+            Ok(lock) => free.push((path, lock)),
+            Err(std::fs::TryLockError::WouldBlock) => held.push(path),
+            Err(_) => {}
         }
+    }
+    // A child between its `fork` and its `exec` shares the run's open descriptors, and a `flock`
+    // lasts while any of them is open, so an ended run's folder can look held for a moment. Wait
+    // once, however many folders are held, and try those again (#334). Windows doesn't pass the
+    // lock to child processes.
+    #[cfg(unix)]
+    if !held.is_empty() {
+        std::thread::sleep(LOCK_WAIT);
+        free.extend(held.into_iter().filter_map(|path| lock_folder(&path).ok().map(|lock| (path, lock))));
+    }
+    for (path, lock) in free {
         let lock = Arc::new(lock);
         let files: Vec<PathBuf> = std::fs::read_dir(&path).into_iter().flatten().flatten().map(|f| f.path()).collect();
         for f in &files {
@@ -265,7 +410,7 @@ pub fn recover_all(root: &Path, s: &mut Session) -> Recovered {
         for f in files.iter().filter(|f| f.extension().is_some_and(|e| e == ONLINE) && !f.with_extension("figcraft").exists()) {
             let _ = std::fs::remove_file(f);
         }
-        // Empty now unless a copy couldn't be read, or waits for its file (kept, its lock held).
+        // Empty now unless a copy couldn't be read, or is kept (its lock held).
         if Arc::strong_count(&lock) == 1 {
             drop(lock);
             let _ = std::fs::remove_file(path.join(LOCK));

apps/figcraft/src/recovery_online_tests.rs

@@ -223,6 +223,30 @@ fn a_copy_ahead_of_the_server_has_its_edits_applied_and_sent() {
     let _ = std::fs::remove_dir_all(&root);
 }
 
+#[test]
+fn an_online_copy_stays_while_what_it_became_cant_be_copied() {
+    let root = root("ahead-blocked");
+    let (mut s, script, mut server, _) = shared();
+    s.execute("shape.ellipse", &json!({"x": 30, "y": 0, "width": 10, "height": 10})).unwrap();
+    script.lock().unwrap().sent.clear();
+    let left = crash(&s, &root);
+    let (mut next, script, mut r, _) = restart(&s, &root);
+    arrive(&mut next, &script, &mut server);
+    assert!(next.docs[1].is_dirty(), "the copy's edit is on top, not saved anywhere yet");
+    // Something is in the way of this run's copy: writing it fails.
+    let mine = root.join(std::process::id().to_string()).join(format!("{}.figcraft", next.docs[1].uid));
+    std::fs::create_dir_all(&mine).unwrap();
+    r.tick(&next, 1.0);
+    assert_eq!((copies(&left, "figcraft"), copies(&left, "online")), (1, 1), "kept: the work is nowhere else on disk");
+    // Once it can be written, the old copy goes.
+    std::fs::remove_dir(&mine).unwrap();
+    next.execute("shape.rectangle", &json!({"x": 50, "y": 0, "width": 4, "height": 4})).unwrap();
+    r.tick(&next, 2.0);
+    assert!(!left.exists());
+    drop(r);
+    let _ = std::fs::remove_dir_all(&root);
+}
+
 #[test]
 fn a_copy_the_server_already_has_is_discarded() {
     let root = root("equal");
@@ -332,7 +356,7 @@ fn without_its_record_the_copy_opens_as_any_other() {
     assert_eq!(recover(&root, &mut next), 1);
     assert!(script.lock().unwrap().joined.is_empty());
     assert!(next.docs.first().is_some_and(|d| d.is_dirty() && d.path.is_none()));
-    assert!(std::fs::read_dir(&root).unwrap().next().is_none(), "the folder is gone");
+    assert!(std::fs::read_dir(&root).unwrap().next().is_some(), "the copy stays until a run has its own");
     let _ = std::fs::remove_dir_all(&root);
 }
 

apps/figcraft/src/recovery_tests.rs

@@ -4,7 +4,7 @@
 use figcraft_engine::Session;
 use serde_json::json;
 
-use crate::recovery::{Recovery, recover};
+use crate::recovery::{Recovery, recover, recover_all};
 
 fn root(name: &str) -> std::path::PathBuf {
     let r = std::env::temp_dir().join(format!("figcraft-recovery-{name}-{}", std::process::id()));
@@ -34,7 +34,7 @@ fn a_crashed_runs_unsaved_documents_come_back() {
     let ds = next.docs.first().unwrap();
     assert!(ds.is_dirty() && ds.path.is_none());
     assert_eq!(next.doc().unwrap().node(next.doc().unwrap().pages[0]).map(|p| p.children.len()), Some(1));
-    assert!(std::fs::read_dir(&root).unwrap().next().is_none(), "the folder is gone");
+    assert!(std::fs::read_dir(&root).unwrap().next().is_some(), "the copy stays until a run has its own");
     let _ = std::fs::remove_dir_all(&root);
 }
 
@@ -62,3 +62,329 @@ fn copies_follow_saves_and_a_normal_quit_leaves_nothing() {
     assert!(!dir.exists(), "a normal quit removes the copies");
     let _ = std::fs::remove_dir_all(&root);
 }
+
+/// A run that ended without closing, leaving a copy of `s`'s unsaved document: its folder (as
+/// another process's).
+fn crashed(s: &Session, root: &std::path::Path) -> std::path::PathBuf {
+    let mut r = Recovery::start(root).unwrap();
+    r.write(s, true);
+    drop(r);
+    let left = root.join("crashed");
+    std::fs::rename(root.join(std::process::id().to_string()), &left).unwrap();
+    left
+}
+
+fn copies_in(d: &std::path::Path) -> usize {
+    std::fs::read_dir(d).map_or(0, |d| d.flatten().filter(|f| f.path().extension().is_some_and(|e| e == "figcraft")).count())
+}
+
+/// The next start: the copies come back, and this run's recovery keeps them until it covers them.
+fn restart(root: &std::path::Path) -> (Session, Recovery) {
+    let mut next = Session::empty();
+    let recovered = recover_all(root, &mut next);
+    assert_eq!(recovered.copies, 1);
+    let mut r = Recovery::start(root).unwrap();
+    r.adopt(recovered.waiting);
+    (next, r)
+}
+
+#[test]
+fn a_recovered_copy_stays_until_this_run_has_its_own_copy() {
+    let root = root("handoff");
+    let left = crashed(&edited(), &root);
+    let (next, mut r) = restart(&root);
+    assert_eq!(copies_in(&left), 1, "the only copy on disk until this run writes one");
+    r.write(&next, true);
+    r.tick(&next, 100.0);
+    assert!(!left.exists(), "covered by this run's copy, the old one goes");
+    assert_eq!(copies_in(&root.join(std::process::id().to_string())), 1);
+    r.finish();
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn a_recovered_copy_stays_while_its_replacement_cant_be_written() {
+    let root = root("blocked");
+    let left = crashed(&edited(), &root);
+    let (next, mut r) = restart(&root);
+    // Something is in the way of this run's copy: writing it fails.
+    let mine = root.join(std::process::id().to_string()).join(format!("{}.figcraft", next.docs[0].uid));
+    std::fs::create_dir_all(&mine).unwrap();
+    r.write(&next, true);
+    r.tick(&next, 100.0);
+    assert_eq!(copies_in(&left), 1, "kept: the work is nowhere else on disk");
+    // Once it can be written, the old copy goes.
+    std::fs::remove_dir(&mine).unwrap();
+    let mut next = next;
+    next.execute("shape.rectangle", &json!({"x": 1, "y": 1, "width": 2, "height": 2})).unwrap();
+    r.write(&next, true);
+    r.tick(&next, 200.0);
+    assert!(!left.exists());
+    r.finish();
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn without_a_recovery_of_its_own_the_copy_stays_for_the_next_start() {
+    let root = root("nocopies");
+    crashed(&edited(), &root);
+    let mut next = Session::empty();
+    let recovered = recover_all(&root, &mut next);
+    assert_eq!(recovered.copies, 1);
+    // This run couldn't take a folder of its own: it ends (or crashes) with nothing copied.
+    drop(recovered);
+    let mut after = Session::empty();
+    assert_eq!(recover(&root, &mut after), 1, "the work comes back again");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn a_recovered_copy_goes_once_its_document_is_saved_or_closed() {
+    for close in [false, true] {
+        let root = root(if close { "closed" } else { "saved" });
+        let left = crashed(&edited(), &root);
+        let (mut next, mut r) = restart(&root);
+        if close {
+            next.docs.clear();
+        } else {
+            next.ds_mut().unwrap().mark_saved();
+        }
+        r.tick(&next, 0.0);
+        assert!(!left.exists(), "close {close}");
+        r.finish();
+        let _ = std::fs::remove_dir_all(&root);
+    }
+}
+
+#[test]
+fn a_normal_quit_removes_the_recovered_copies_it_took_over() {
+    let root = root("quitafter");
+    let left = crashed(&edited(), &root);
+    let (_, r) = restart(&root);
+    // Quitting asked to save or discard every document.
+    r.finish();
+    assert!(!left.exists());
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn quitting_without_the_unsaved_question_keeps_copies_for_the_next_start() {
+    let root = root("quitunasked");
+    // macOS's Quit menu: nothing asked, so the unsaved document comes back next time.
+    let s = edited();
+    Recovery::start(&root).unwrap().quit(&s, false);
+    let mut next = Session::empty();
+    assert_eq!(recover(&root, &mut next), 1);
+    let _ = std::fs::remove_dir_all(&root);
+    // Asked (saved or discarded on purpose), or nothing unsaved: nothing is left.
+    for (s, asked) in [(edited(), true), (Session::new(), false)] {
+        Recovery::start(&root).unwrap().quit(&s, asked);
+        assert!(std::fs::read_dir(&root).unwrap().next().is_none(), "asked: {asked}");
+    }
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn a_run_whose_folder_name_is_still_held_takes_another() {
+    let root = root("pidreuse");
+    // A crashed run with this process's id whose folder the start still holds (its copy waits).
+    let held = root.join(std::process::id().to_string());
+    std::fs::create_dir_all(&held).unwrap();
+    let lock = std::fs::File::create(held.join("lock")).unwrap();
+    lock.try_lock().unwrap();
+    let mut r = Recovery::start(&root).expect("a folder of its own");
+    let s = edited();
+    r.write(&s, true);
+    assert_eq!(copies_in(&held), 0);
+    let dirs = std::fs::read_dir(&root).unwrap().flatten().filter(|e| e.path() != held).count();
+    assert_eq!(dirs, 1);
+    r.finish();
+    drop(lock);
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// #334: a lock that frees itself is not a run that is still going. A child between its `fork` and
+/// its `exec` inherits the run's open descriptors and a `flock` lasts while any descriptor for the
+/// file is open, so a crashed run's copies must still come back once that child has exec'd.
+#[cfg(unix)]
+#[test]
+fn a_lock_freed_a_moment_later_is_not_a_run_that_is_still_going() {
+    let root = root("fork-window");
+    crashed(&edited(), &root);
+    // Hold the crashed run's folder lock on a second descriptor, the way a child forked before its
+    // exec holds it, and free it shortly after.
+    let lock = std::fs::File::options().write(true).create(true).truncate(false).open(root.join("crashed").join("lock")).unwrap();
+    lock.try_lock().unwrap();
+    let freed = std::thread::spawn(move || {
+        std::thread::sleep(std::time::Duration::from_millis(10));
+        drop(lock);
+    });
+    // The next start waits for that lock rather than reading the run as still going.
+    let mut next = Session::empty();
+    assert_eq!(recover(&root, &mut next), 1, "the copies come back once the lock frees itself");
+    freed.join().unwrap();
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// The rectangles in `doc`.
+fn rectangles(doc: &figcraft_engine::doc::Document) -> usize {
+    doc.nodes().filter(|n| matches!(n.kind, figcraft_engine::doc::NodeKind::Rectangle)).count()
+}
+
+/// The documents a crashed run's copies under `root` open as.
+fn crash_and_recover(r: Recovery, root: &std::path::Path) -> Session {
+    drop(r);
+    let mut next = Session::empty();
+    assert_eq!(recover(root, &mut next), 1);
+    next
+}
+
+#[test]
+fn copies_keep_the_version_history_and_branches() {
+    // #185: a copy has what a save would write, the latest edits on a branch tab included.
+    let root = root("history");
+    let mut s = edited();
+    s.execute("file.saveVersion", &json!({"name": "v1"})).unwrap();
+    s.execute("branch.create", &json!({"name": "Explore"})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 20, "y": 0, "width": 10, "height": 10})).unwrap();
+    let mut r = Recovery::start(&root).unwrap();
+    r.write(&s, true);
+    let next = crash_and_recover(r, &root);
+    let ds = next.docs.first().unwrap();
+    assert_eq!(ds.versions.iter().map(|v| v.name.as_str()).collect::<Vec<_>>(), ["v1"]);
+    assert_eq!(ds.branches.iter().map(|b| (b.name.as_str(), rectangles(&b.head))).collect::<Vec<_>>(), [("Explore", 2)]);
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// The one copy under `root` (the run's folder), read back.
+fn copy(root: &std::path::Path) -> figcraft_format::Loaded {
+    let dir = std::fs::read_dir(root).unwrap().flatten().next().unwrap().path();
+    let file = std::fs::read_dir(dir).unwrap().flatten().map(|f| f.path()).find(|f| f.extension().is_some_and(|e| e == "figcraft")).unwrap();
+    figcraft_format::load_bytes_with_versions(&std::fs::read(file).unwrap()).unwrap()
+}
+
+#[test]
+fn a_change_only_on_a_branch_tab_or_to_the_history_is_copied() {
+    let root = root("history-only");
+    let mut s = edited();
+    s.execute("file.saveVersion", &json!({"name": "v1"})).unwrap();
+    s.execute("branch.create", &json!({"name": "Explore"})).unwrap();
+    for d in &mut s.docs {
+        d.mark_saved();
+    }
+    let mut r = Recovery::start(&root).unwrap();
+    // An edit on the branch tab only: the main file has no changes of its own yet.
+    s.execute("shape.rectangle", &json!({"x": 20, "y": 0, "width": 10, "height": 10})).unwrap();
+    r.write(&s, true);
+    assert_eq!(copy(&root).branches.iter().map(|b| rectangles(&b.head)).collect::<Vec<_>>(), [2]);
+    s.execute("shape.rectangle", &json!({"x": 40, "y": 0, "width": 10, "height": 10})).unwrap();
+    r.write(&s, true);
+    assert_eq!(copy(&root).branches.iter().map(|b| rectangles(&b.head)).collect::<Vec<_>>(), [3]);
+    // A version renamed on the main file leaves its document as it was.
+    s.execute("doc.switch", &json!({"index": 0})).unwrap();
+    r.write(&s, true);
+    let id = s.docs[0].versions[0].id.clone();
+    s.execute("version.rename", &json!({"id": id, "name": "v1 (renamed)"})).unwrap();
+    r.write(&s, true);
+    assert_eq!(copy(&root).versions.iter().map(|v| v.name.as_str()).collect::<Vec<_>>(), ["v1 (renamed)"]);
+    r.finish();
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+fn slow_write(path: std::path::PathBuf) -> std::thread::JoinHandle<bool> {
+    std::thread::spawn(move || {
+        std::thread::sleep(std::time::Duration::from_millis(150));
+        std::fs::write(path, b"stale").is_ok()
+    })
+}
+
+#[test]
+fn saving_or_closing_waits_for_a_slow_write_so_the_copy_does_not_come_back() {
+    let root = root("slow-cleanup");
+    let mut s = edited();
+    let mut r = Recovery::start(&root).unwrap();
+    let dir = std::fs::read_dir(&root).unwrap().flatten().next().unwrap().path();
+    let uid = s.docs[0].uid;
+    let copy = dir.join(format!("{uid}.figcraft"));
+    r.hold(uid, 1, slow_write(copy.clone()));
+    s.ds_mut().unwrap().mark_saved();
+    r.write(&s, false);
+    std::thread::sleep(std::time::Duration::from_millis(400));
+    assert!(!copy.exists(), "a saved document's copy stays removed");
+    // Closed: the same.
+    let s = edited();
+    let uid = s.docs[0].uid;
+    let copy = dir.join(format!("{uid}.figcraft"));
+    r.hold(uid, 1, slow_write(copy.clone()));
+    r.write(&Session::empty(), false);
+    std::thread::sleep(std::time::Duration::from_millis(400));
+    assert!(!copy.exists(), "a closed document's copy stays removed");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn an_emergency_save_waits_for_the_write_in_flight_and_copies_the_newest_revision() {
+    let root = root("slow-emergency");
+    let s = edited();
+    let mut r = Recovery::start(&root).unwrap();
+    let dir = std::fs::read_dir(&root).unwrap().flatten().next().unwrap().path();
+    let uid = s.docs[0].uid;
+    let copy = dir.join(format!("{uid}.figcraft"));
+    r.hold(uid, 0, slow_write(copy.clone()));
+    r.write(&s, true);
+    assert!(std::fs::read(&copy).is_ok_and(|b| b != b"stale"), "the newest revision replaced the slow write");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+/// The files named `*.figcraft` in the run folder under `root`.
+fn copy_count(root: &std::path::Path) -> usize {
+    let Some(dir) = std::fs::read_dir(root).unwrap().flatten().next().map(|e| e.path()) else { return 0 };
+    std::fs::read_dir(dir).unwrap().flatten().filter(|f| f.path().extension().is_some_and(|e| e == "figcraft")).count()
+}
+
+/// A folder at the path of `s`'s first document's copy in the run folder under `root`.
+fn blocked_copy(root: &std::path::Path, s: &Session) -> std::path::PathBuf {
+    let dir = std::fs::read_dir(root).unwrap().flatten().next().unwrap().path();
+    let blocker = dir.join(format!("{}.figcraft", s.docs[0].uid));
+    std::fs::create_dir(&blocker).unwrap();
+    blocker
+}
+
+#[test]
+fn a_copy_that_failed_is_tried_again_without_another_edit() {
+    let root = root("retry");
+    let s = edited();
+    let mut r = Recovery::start(&root).unwrap();
+    // A folder where the copy goes makes its write fail on every platform (renaming the run folder
+    // away fails on Windows, where the run's lock file keeps it open).
+    let blocker = blocked_copy(&root, &s);
+    r.write(&s, true);
+    std::fs::remove_dir(&blocker).unwrap();
+    // Nothing was edited since: the same revision still has to be copied.
+    r.write(&s, true);
+    assert_eq!(copy_count(&root), 1, "the failed revision was copied again");
+    r.finish();
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn a_background_copy_that_failed_is_tried_again_without_another_edit() {
+    let root = root("retry-bg");
+    let s = edited();
+    let mut r = Recovery::start(&root).unwrap();
+    let blocker = blocked_copy(&root, &s);
+    r.write(&s, false);
+    // Let the failing write end before the way is clear again.
+    std::thread::sleep(std::time::Duration::from_millis(300));
+    std::fs::remove_dir(&blocker).unwrap();
+    for _ in 0..50 {
+        r.write(&s, false);
+        if copy_count(&root) == 1 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(100));
+    }
+    assert_eq!(copy_count(&root), 1, "the failed revision was copied again");
+    r.finish();
+    let _ = std::fs::remove_dir_all(&root);
+}

apps/figcraft/src/services.rs

@@ -1,11 +1,12 @@
 //! Desktop services: native file dialogs, clipboard, URLs, persisted preferences.
 
+use std::cell::RefCell;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 
 use figcraft_engine::{Prefs, Session};
-use figcraft_ui_egui::{FigApp, Services};
+use figcraft_ui_egui::{DialogFuture, FigApp, Services};
 use serde_json::{Value, json};
 
 pub struct Desktop {
@@ -59,12 +60,16 @@ impl Desktop {
 
 /// The system's preferred interface languages, most preferred first, comma-separated
 /// ("nl-NL,de-DE,en-US"): Windows' language list, macOS's AppleLanguages, `LANGUAGE` and the
-/// locale variables elsewhere. The UI shows the first one it has a catalog for.
+/// locale variables elsewhere. The UI shows the first language in the list that has a catalog.
+/// Windows keeps only its first preferred language (and English when it has no catalog): that
+/// list is also the input-language list, so a language added for a keyboard (Deutsch on a Polish
+/// system) must not decide the interface language.
 fn system_language() -> Option<String> {
     #[cfg(target_os = "windows")]
     {
         windows::System::UserProfile::GlobalizationPreferences::Languages()
-            .map(|l| l.into_iter().map(|s| s.to_string()).collect::<Vec<_>>().join(","))
+            .and_then(|l| l.GetAt(0))
+            .map(|s| s.to_string())
             .inspect_err(|e| log::info!("language: can't read the system languages: {e}"))
             .ok()
     }
@@ -162,10 +167,18 @@ fn reveal(path: &Path) -> std::io::Result<()> {
 /// The preferences' file in the config folder.
 const STATE: &str = "state.json";
 
-pub fn save_state(app: &FigApp) {
-    if let Some(dir) = config_dir() {
-        write_prefs(&dir, &app.session.prefs);
+/// Everything quitting keeps, all done when it returns (macOS then ends the process): the
+/// preferences in `dir`, this run's recovery copies ([`Recovery::quit`](crate::recovery::Recovery::quit))
+/// and the live sessions' ends (one this app hosts tells everyone and stops; a joined one leaves).
+pub fn shutdown(app: &mut FigApp, dir: Option<&Path>, recovery: Option<crate::recovery::Recovery>) {
+    if let Some(dir) = dir {
+        write_prefs(dir, &app.session.prefs);
     }
+    // Before the sessions end: a recovered online file's copy waits for its session's outcome.
+    if let Some(r) = recovery {
+        r.quit(&app.session, app.ui.quit);
+    }
+    drop(std::mem::take(&mut app.session.live));
 }
 
 /// Write `prefs` to `dir` atomically (a temporary file renamed over the old one: a crash leaves
@@ -194,15 +207,74 @@ fn write_private(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
     f.write_all(bytes)
 }
 
+thread_local! {
+    /// While the main window draws: a dialog parented to it, so a dialog opened from it stays in
+    /// front of it (a sheet on macOS). eframe gives other windows no handle: theirs have no parent.
+    static PARENT: RefCell<Option<rfd::AsyncFileDialog>> = const { RefCell::new(None) };
+}
+
+/// Run the main window's frame `f` with the dialogs it opens parented to `frame`'s window.
+pub fn parented<R>(frame: &eframe::Frame, f: impl FnOnce() -> R) -> R {
+    PARENT.with(|p| p.replace(Some(rfd::AsyncFileDialog::new().set_parent(frame))));
+    let r = f();
+    PARENT.with(|p| p.replace(None));
+    r
+}
+
+/// A dialog with `title`, parented to the main window while it draws.
+fn dialog(title: &str) -> rfd::AsyncFileDialog {
+    PARENT.with(|p| p.borrow().clone()).unwrap_or_default().set_title(title)
+}
+
+/// The dialog opens now; its future gives the path picked.
+fn picked(pick: impl Future<Output = Option<rfd::FileHandle>> + 'static) -> DialogFuture {
+    Box::pin(async move { pick.await.map(|f| f.path().to_path_buf()) })
+}
+
+/// How long a clipboard read may wait on the app that copied (Linux and the BSDs).
+#[cfg(all(unix, not(target_os = "macos")))]
+const CLIPBOARD_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(2);
+
+/// Read the clipboard. On Linux and the BSDs the read runs on a helper thread with its own handle
+/// and gives up after [`CLIPBOARD_TIMEOUT`]: a Wayland read waits on the app that copied with no
+/// timeout of its own, so an app that hangs must not hang the window too.
+#[cfg(all(unix, not(target_os = "macos")))]
+fn read_clipboard<T: Send + 'static>(_: &mut arboard::Clipboard, read: fn(&mut arboard::Clipboard) -> Option<T>) -> Option<T> {
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let _ = tx.send(arboard::Clipboard::new().ok().and_then(|mut c| read(&mut c)));
+    });
+    rx.recv_timeout(CLIPBOARD_TIMEOUT).ok().flatten()
+}
+
+/// Read the clipboard (the system's own reads don't wait on the app that copied).
+#[cfg(not(all(unix, not(target_os = "macos"))))]
+fn read_clipboard<T>(c: &mut arboard::Clipboard, read: fn(&mut arboard::Clipboard) -> Option<T>) -> Option<T> {
+    read(c)
+}
+
+/// Native Save as filters; other callers keep their existing combined filter.
+fn save_filters<'a>(exts: &'a [&'a str]) -> Vec<(&'static str, &'a [&'a str])> {
+    if exts == ["figcraft", "fig"] {
+        vec![("FigCraft (.figcraft)", &exts[..1]), (figcraft_ui_egui::i18n::tr(".fig (experimental)"), &exts[1..])]
+    } else {
+        vec![("File", exts)]
+    }
+}
+
 impl Services for Desktop {
-    fn pick_open(&mut self, title: &str, exts: &[&str]) -> Option<PathBuf> {
-        rfd::FileDialog::new().set_title(title).add_filter("Supported files", exts).pick_file()
+    fn pick_open(&mut self, title: &str, exts: &[&str]) -> DialogFuture {
+        picked(dialog(title).add_filter("Supported files", exts).pick_file())
     }
-    fn pick_save(&mut self, title: &str, name: &str, exts: &[&str]) -> Option<PathBuf> {
-        rfd::FileDialog::new().set_title(title).set_file_name(name).add_filter("File", exts).save_file()
+    fn pick_save(&mut self, title: &str, name: &str, exts: &[&str]) -> DialogFuture {
+        let mut dialog = dialog(title).set_file_name(name);
+        for (label, extensions) in save_filters(exts) {
+            dialog = dialog.add_filter(label, extensions);
+        }
+        picked(dialog.save_file())
     }
-    fn pick_folder(&mut self, title: &str) -> Option<PathBuf> {
-        rfd::FileDialog::new().set_title(title).pick_folder()
+    fn pick_folder(&mut self, title: &str) -> DialogFuture {
+        picked(dialog(title).pick_folder())
     }
     fn clipboard_set_text(&mut self, s: &str) {
         if let Some(c) = self.clipboard.as_mut() {
@@ -210,7 +282,10 @@ impl Services for Desktop {
         }
     }
     fn clipboard_get_text(&mut self) -> Option<String> {
-        self.clipboard.as_mut()?.get_text().ok()
+        read_clipboard(self.clipboard.as_mut()?, |c| c.get_text().ok())
+    }
+    fn clipboard_get_html(&mut self) -> Option<String> {
+        read_clipboard(self.clipboard.as_mut()?, |c| c.get().html().ok())
     }
     fn clipboard_set_png(&mut self, w: u32, h: u32, rgba: &[u8]) {
         if let Some(c) = self.clipboard.as_mut() {
@@ -218,7 +293,7 @@ impl Services for Desktop {
         }
     }
     fn clipboard_get_image(&mut self) -> Option<(u32, u32, Vec<u8>)> {
-        let img = self.clipboard.as_mut()?.get_image().ok()?;
+        let img = read_clipboard(self.clipboard.as_mut()?, |c| c.get_image().ok())?;
         let (w, h) = (u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?);
         // Refuse absurd sizes (and mismatched buffers) rather than allocate.
         if w == 0 || h == 0 || u64::from(w) * u64::from(h) > 100_000_000 || img.bytes.len() != (w as usize) * (h as usize) * 4 {
@@ -242,6 +317,8 @@ impl Services for Desktop {
     fn emergency_save(&mut self, session: &Session) {
         if let Some(r) = crate::recovery::lock(&self.recovery).as_mut() {
             r.write(session, true);
+            // Earlier runs' copies now covered go, so the next start doesn't open them twice.
+            r.settle(session);
         }
     }
     fn reduce_motion(&self) -> bool {
@@ -266,3 +343,24 @@ pub fn window_icon() -> Option<egui::IconData> {
     let (w, h) = img.dimensions();
     Some(egui::IconData { rgba: img.into_raw(), width: w, height: h })
 }
+
+#[cfg(test)]
+mod save_filter_tests {
+    use super::save_filters;
+
+    #[test]
+    fn native_and_fig_save_filters_are_separate_with_native_first() {
+        let extensions = ["figcraft", "fig"];
+        assert_eq!(
+            save_filters(&extensions),
+            vec![("FigCraft (.figcraft)", &extensions[..1]), (figcraft_ui_egui::i18n::tr(".fig (experimental)"), &extensions[1..])]
+        );
+    }
+
+    #[test]
+    fn other_save_filters_keep_one_combined_group() {
+        for extensions in [&["figcraft"][..], &["fig"][..], &["png"][..], &["png", "jpg", "webp"][..], &[][..]] {
+            assert_eq!(save_filters(extensions), vec![("File", extensions)]);
+        }
+    }
+}

apps/figcraft/src/services_tests.rs

@@ -82,3 +82,38 @@ fn preferences_are_readable_by_their_owner_only() {
     assert_eq!(mode(&dir.join("state.json")), 0o600);
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// A live link that only records the sessions it was told to leave.
+struct Leaves(Arc<Mutex<Vec<u64>>>);
+
+impl figcraft_engine::live::LiveLink for Leaves {
+    fn host(&mut self, _: u64, _: figcraft_engine::live::HostOptions) -> Result<figcraft_engine::live::SessionInfo, String> {
+        Err("not in this test".into())
+    }
+    fn join(&mut self, _: u64, _: &str, _: &str) -> Result<(), String> {
+        Ok(())
+    }
+    fn leave(&mut self, session: u64) {
+        self.0.lock().unwrap().push(session);
+    }
+    fn presence(&mut self, _: u64, _: &figcraft_engine::live::Presence) {}
+    fn send(&mut self, _: u64, _: figcraft_engine::figcraft_collab::message::ClientMsg) {}
+    fn poll(&mut self) -> Vec<(u64, figcraft_engine::live::Event)> {
+        Vec::new()
+    }
+}
+
+#[test]
+fn quitting_keeps_the_preferences_and_ends_the_live_sessions() {
+    let dir = root("shutdown");
+    let mut fig = start(&dir);
+    let left = Arc::new(Mutex::new(Vec::new()));
+    fig.session.live.install(Box::new(Leaves(left.clone())));
+    let joined = fig.run("collab.join", json!({"link": "ws://127.0.0.1:9/?file=f1&token=EditSecretEditSecret00"})).unwrap();
+    fig.session.prefs.user_name = "Ada".into();
+    crate::services::shutdown(&mut fig, Some(&dir), None);
+    assert_eq!(*left.lock().unwrap(), [joined["session"].as_u64().unwrap()], "the session was left");
+    assert!(!fig.session.live.available(), "nothing is left to send on");
+    assert_eq!(start(&dir).session.prefs.user_name, "Ada", "the preferences were kept");
+    let _ = std::fs::remove_dir_all(&dir);
+}

apps/figcraft/src/startup.rs

@@ -0,0 +1,27 @@
+//! When the window can't open.
+//!
+//! Release builds on Windows have no console, so an error from `eframe::run_native` (no usable
+//! graphics adapter, a surface or device the driver refuses) went to a standard error nobody sees
+//! and the app quit without a word (#261). Now it is logged and shown in a message box.
+
+/// Log the failure and, unless `quiet` (started for an agent with `--control`: a modal box would
+/// keep the caller waiting, and it reads standard error), show it in a message box.
+pub fn failed(error: &eframe::Error, quiet: bool) {
+    // In the interface language: the text and its catalog entries are the UI crate's.
+    let text = figcraft_ui_egui::dialogs::window_failed(&error.to_string(), std::env::var_os("WGPU_BACKEND").is_some());
+    // Standard error even when RUST_LOG turned errors off.
+    if log::log_enabled!(log::Level::Error) {
+        log::error!("{text}");
+    } else {
+        eprintln!("figcraft: {text}");
+    }
+    if quiet {
+        return;
+    }
+    let _ = rfd::MessageDialog::new()
+        .set_level(rfd::MessageLevel::Error)
+        .set_title("FigCraft")
+        .set_description(text)
+        .set_buttons(rfd::MessageButtons::Ok)
+        .show();
+}

apps/figcraft/src/startup_tests.rs

@@ -0,0 +1,35 @@
+//! The message shown when the window can't open: it carries the error, a next step and where to
+//! report it, instead of the app quitting silently (#261).
+
+use figcraft_ui_egui::dialogs::window_failed as message;
+
+const ERROR: &str = "WGPU error: Failed to create surface for any enabled backend: {}";
+
+#[test]
+fn the_message_carries_the_error_and_where_to_report_it() {
+    let text = message(ERROR, false);
+    assert!(text.contains(ERROR), "the error itself: {text}");
+    assert!(text.contains("https://github.com/storytold/figcraft/issues"), "where to report it: {text}");
+}
+
+#[test]
+fn without_wgpu_backend_it_suggests_the_driver_and_another_graphics_api() {
+    let text = message(ERROR, false);
+    assert!(text.contains("graphics driver"), "{text}");
+    assert!(text.contains("WGPU_BACKEND"), "another graphics API to try: {text}");
+    assert!(!text.contains("unsetting"), "{text}");
+}
+
+#[cfg(windows)]
+#[test]
+fn on_windows_it_shows_how_to_start_with_opengl() {
+    let text = message(ERROR, false);
+    assert!(text.contains("set WGPU_BACKEND=gl"), "a release build has no console to look this up from: {text}");
+}
+
+#[test]
+fn with_wgpu_backend_set_it_suggests_unsetting_it() {
+    let text = message(ERROR, true);
+    assert!(text.contains("unsetting"), "{text}");
+    assert!(!text.contains("graphics driver"), "the chosen backend is the likelier cause: {text}");
+}

contributors/people.toml

@@ -16,3 +16,43 @@
 #
 # To remove your names, delete your entry (or set fields empty) in a PR. The next
 # contributors.py run, and the next build, drop them.
+
+[people.VanTan666]
+display_name = "VanTan"
+
+[people.tylerjenningsw]
+real_name = "Tyler Jennings"
+display_name = "tylerjenningsw"
+
+[people.Silvertree2010]
+display_name = "Netter"
+sync_github_name = false
+
+[people.yyamandevrim]
+real_name = "Yaman Devrim"
+sync_github_name = true
+
+[people.justinjohn0306]
+real_name = "Justin John"
+
+[people.Losminek]
+
+[people.RevDonz]
+
+[people.Nael-Nathanael]
+sync_github_name = true
+
+[people.volkovskey]
+real_name = "Andrii Volkov"
+
+[people.marcoarnulfo]
+real_name = "Marco Arnulfo"
+display_name = "Marco Arnulfo"
+sync_github_name = false
+
+[people.krinry]
+display_name = "krinry"
+sync_github_name = true
+
+[people.pechnikov2026-star]
+sync_github_name = true

crates/collab-net/src/barred_tests.rs

@@ -0,0 +1,53 @@
+//! Addresses removed from a file are kept only while its session lasts, so a long-running server
+//! doesn't collect them for every file it ever had open.
+
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr};
+
+use figcraft_collab::{Limits, Server};
+use figcraft_doc::Document;
+
+use super::{Admission, Backend, Closing, Hub, InFlight, Room};
+
+/// A backend that closes a file as soon as everyone left it.
+struct Closes;
+
+impl Backend for Closes {
+    fn admit(&mut self, _file: &str, _token: &str) -> Result<Admission, String> {
+        Err("no".into())
+    }
+
+    fn open(&mut self, _file: &str) -> Result<Server, String> {
+        Err("no".into())
+    }
+
+    fn idle(&mut self, _file: &str, _server: &mut Server) -> bool {
+        true
+    }
+
+    fn closing(&self) -> Closing {
+        Closing::Restarting
+    }
+}
+
+#[test]
+fn a_closed_file_forgets_whom_it_barred() {
+    let mut doc = Document::new("File");
+    doc.repair();
+    let mut hub = Hub {
+        in_flight: InFlight(Default::default()),
+        backend: Closes,
+        rooms: HashMap::from([("f".to_string(), Room::new(Server::new(doc, "", Limits::default())))]),
+        conns: HashMap::new(),
+        local: None,
+        outbox: Vec::new(),
+        barred: HashMap::new(),
+    };
+    let ip = IpAddr::V4(Ipv4Addr::new(10, 0, 0, 7));
+    hub.barred.entry("f".into()).or_default().insert(ip);
+    hub.barred.entry("other".into()).or_default().insert(ip);
+    hub.close_if_empty("f");
+    assert!(!hub.rooms.contains_key("f"), "everyone left: the file closed");
+    assert!(!hub.barred.contains_key("f"), "and its barred addresses went with it");
+    assert!(hub.barred.contains_key("other"), "another file's stay");
+}

crates/collab-net/src/host.rs

@@ -11,6 +11,7 @@ use figcraft_collab::{Outgoing, Server, same_secret};
 use figcraft_doc::Document;
 use figcraft_engine::live::{Event, PEOPLE};
 
+pub use crate::hub::REMOVED;
 use crate::hub::{Admission, Backend, Closing, Hosting, Local, clean_name, to_local};
 use crate::inbox::Inbox;
 pub use crate::join::ENDED;
@@ -129,6 +130,12 @@ impl Host {
         self.hosting.send(msg);
     }
 
+    /// Remove client `id` from the session: they are disconnected and can't join again from
+    /// their address while it runs. The host can't remove themselves.
+    pub fn remove(&self, id: u32) {
+        self.hosting.remove(id);
+    }
+
     /// Cut every connection as a network failure would (no close frame).
     #[cfg(test)]
     pub(crate) fn cut_connections(&self) {

crates/collab-net/src/hub.rs

@@ -21,7 +21,7 @@
 //! backend may refuse addresses or limit what they do. A plain `GET /healthz` on the same port is
 //! answered `200 ok` for uptime checks.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::io::{self, Read, Write};
 use std::net::{IpAddr, Ipv6Addr, SocketAddr, TcpListener, TcpStream};
 use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
@@ -413,6 +413,8 @@ enum HubIn {
     },
     Local(Presence),
     LocalMsg(ClientMsg),
+    /// The person hosting removes client `id` from their file (app sessions).
+    Remove(u32),
     /// Cut every connection without a word (tests: a network failure).
     #[cfg(test)]
     Cut,
@@ -461,7 +463,15 @@ impl Hosting {
     pub(crate) fn start<B: Backend>(listener: TcpListener, backend: B, limits: NetLimits, local: Option<Local>) -> io::Result<Hosting> {
         let addr = listener.local_addr()?;
         let in_flight = InFlight(Arc::default());
-        let mut hub = Hub { backend, rooms: HashMap::new(), conns: HashMap::new(), local: None, outbox: Vec::new(), in_flight: in_flight.clone() };
+        let mut hub = Hub {
+            backend,
+            rooms: HashMap::new(),
+            conns: HashMap::new(),
+            local: None,
+            outbox: Vec::new(),
+            in_flight: in_flight.clone(),
+            barred: HashMap::new(),
+        };
         if let Some(l) = local {
             let mut room = Room::new(l.server);
             room.local = Some((l.id, l.inbox));
@@ -551,6 +561,12 @@ impl Hosting {
         let _ = self.hub.send(HubIn::LocalMsg(msg));
     }
 
+    /// The hosting person removes client `id` from their file (app sessions; see
+    /// [`HubIn::Remove`]).
+    pub(crate) fn remove(&self, id: u32) {
+        let _ = self.hub.send(HubIn::Remove(id));
+    }
+
     /// Cut every connection as a network failure would (no close frame).
     #[cfg(test)]
     pub(crate) fn cut_connections(&self) {
@@ -1108,6 +1124,16 @@ fn unsupported(protocol: u32) -> String {
 /// sharing): the session's end for them.
 pub const STOPPED: &str = "Sharing was stopped: the link you joined with no longer works. Your copy stays open";
 
+/// What someone removed from a file is told: the session's end for them (they keep their copy;
+/// nothing retries).
+pub const REMOVED: &str = "You were removed from this session. Your copy stays open";
+
+/// Why a removed person's address can't join the file again.
+const BARRED: &str = "you were removed from this session";
+
+/// The most addresses one file keeps barred.
+const MAX_BARRED: usize = 256;
+
 /// What everyone in a file is told when its changes couldn't be saved (they reconnect).
 const UNSAVED: &str = "The server couldn't save the latest changes; reconnecting";
 
@@ -1121,6 +1147,9 @@ struct Hub<B> {
     local: Option<String>,
     /// What the servers said, sent once the backend made what changed durable.
     outbox: Vec<(String, Outgoing)>,
+    /// Addresses ([`ip_key`]) removed from each open file: they can't join it again until its
+    /// session closes (the file is closed or removed; the entry goes with it).
+    barred: HashMap<String, HashSet<IpAddr>>,
 }
 
 impl<B: Backend> Hub<B> {
@@ -1208,6 +1237,13 @@ impl<B: Backend> Hub<B> {
                     self.client_message(&file, id, msg, None);
                 }
             }
+            HubIn::Remove(id) => {
+                if let Some(file) = self.local.clone()
+                    && let Err(why) = self.remove_peer(&file, id)
+                {
+                    log::info!("live session: couldn't remove client {id}: {why}");
+                }
+            }
             #[cfg(test)]
             HubIn::Cut => {
                 for c in self.conns.values() {
@@ -1232,6 +1268,14 @@ impl<B: Backend> Hub<B> {
                 self.client_message(&file, id, msg, Some(bytes));
             }
             Some(Kind::Hosting { owns }) => match msg {
+                ClientMsg::Admin(Admin::RemovePeer { file, client }) => {
+                    let reply = if owns.as_deref() == Some(file.as_str()) {
+                        self.removed_reply(&file, client)
+                    } else {
+                        AdminReply::Failed { reason: "an owner token manages only its own file".into() }
+                    };
+                    self.answer(conn, &ServerMsg::Admin(Box::new(reply)));
+                }
                 ClientMsg::Admin(req) => {
                     let owns = owns.clone();
                     let rooms = &self.rooms;
@@ -1243,6 +1287,10 @@ impl<B: Backend> Hub<B> {
                 _ => self.kick(&[conn], "only publishing and managing your own files are spoken on this connection"),
             },
             Some(Kind::Managing) => match msg {
+                ClientMsg::Admin(Admin::RemovePeer { file, client }) => {
+                    let reply = self.removed_reply(&file, client);
+                    self.answer(conn, &ServerMsg::Admin(Box::new(reply)));
+                }
                 ClientMsg::Admin(req) => self.admin(conn, req),
                 ClientMsg::Ping => self.answer(conn, &ServerMsg::Pong),
                 _ => self.kick(&[conn], "only requests to manage files are spoken on this connection"),
@@ -1305,6 +1353,10 @@ impl<B: Backend> Hub<B> {
             Ok(a) => a,
             Err(why) => return refuse(&c.out, &why),
         };
+        if self.barred.get(&hello.file).is_some_and(|b| b.contains(&c.ip)) {
+            log::info!("event=refused ip={} reason=removed", c.ip);
+            return refuse(&c.out, BARRED);
+        }
         let hosting = reads_hosting(&hello.client_version);
         // The backend checked the secret: the sessions don't keep it.
         hello.token.clear();
@@ -1362,6 +1414,34 @@ impl<B: Backend> Hub<B> {
         }
     }
 
+    /// Remove client `id` from `file`: they are told the session is over for them and
+    /// disconnected, and their address can't join the file again while its session lasts. The
+    /// person hosting can't be removed.
+    fn remove_peer(&mut self, file: &str, id: u32) -> Result<(), String> {
+        let room = self.rooms.get(file).ok_or("nobody is in this file")?;
+        if room.local.as_ref().is_some_and(|(local, _)| *local == id) {
+            return Err("the person hosting can't be removed".into());
+        }
+        let conn = *room.ids.get(&id).ok_or_else(|| format!("nobody with client id {id} is in this file"))?;
+        let c = self.conns.get(&conn).ok_or_else(|| format!("nobody with client id {id} is in this file"))?;
+        let barred = self.barred.entry(file.to_string()).or_default();
+        if barred.len() < MAX_BARRED {
+            barred.insert(c.ip);
+        }
+        log::info!("event=removed file={file} client={id} ip={}", c.ip);
+        let _ = c.out.tx.try_send(Out::Close(CloseCode::Away, REMOVED.into()));
+        self.gone(conn);
+        Ok(())
+    }
+
+    /// [`remove_peer`](Self::remove_peer) as a managing connection's answer.
+    fn removed_reply(&mut self, file: &str, id: u32) -> AdminReply {
+        match self.remove_peer(file, id) {
+            Ok(()) => AdminReply::Done,
+            Err(reason) => AdminReply::Failed { reason },
+        }
+    }
+
     /// Take in connection `c` as `kind` and send it `first`.
     fn take_in(&mut self, conn: u64, c: Pending, kind: Kind, first: &ServerMsg) {
         self.conns.insert(conn, Conn { out: c.out, sock: c.sock, kind, ip: c.ip });
@@ -1479,6 +1559,7 @@ impl<B: Backend> Hub<B> {
                 .collect();
             // Closed without saving: the file is gone.
             self.rooms.remove(&file);
+            self.barred.remove(&file);
             self.kick(&users, "this file was removed from the server");
         }
         if let Some(ip) = handled.blocked {
@@ -1556,6 +1637,7 @@ impl<B: Backend> Hub<B> {
         let Some(room) = self.rooms.get_mut(file).filter(|r| r.empty()) else { return };
         if self.backend.idle(file, &mut room.server) {
             self.rooms.remove(file);
+            self.barred.remove(file);
         }
     }
 
@@ -1661,3 +1743,7 @@ pub(crate) fn to_local(inbox: &Inbox, local: u32, msg: &ServerMsg) {
 #[cfg(test)]
 #[path = "queue_tests.rs"]
 mod queue_tests;
+
+#[cfg(test)]
+#[path = "barred_tests.rs"]
+mod barred_tests;

crates/collab-net/src/invite.rs

@@ -203,7 +203,7 @@ fn pairs(query: &str) -> Result<Vec<(String, String)>, String> {
 fn with_port(authority: &str, default: u16) -> String {
     let has_port = match authority.rsplit_once(':') {
         // `[v6]` alone has colons inside the brackets only.
-        Some((h, p)) => !(h.starts_with('[') && !h.ends_with(']')) && !p.contains(']'),
+        Some((h, p)) => (!h.starts_with('[') || h.ends_with(']')) && !p.contains(']'),
         None => false,
     };
     if has_port { authority.to_string() } else { format!("{authority}:{default}") }

crates/collab-net/src/limits.rs

@@ -12,7 +12,9 @@ pub struct NetLimits {
     /// before: its hello.
     pub max_client_message: usize,
     pub max_hello: usize,
-    /// Largest message a client accepts from the host (a welcome carries the whole document).
+    /// Largest message a client accepts from the host (a welcome carries the whole document): 1 GiB,
+    /// room for any file up to 1023 MiB and well past the servers' defaults, while a hostile server
+    /// (any link can name one) can't make the app or a browser tab buffer more than that.
     pub max_server_message: usize,
     /// Messages a client may send per second on average, and in a burst; beyond that it is
     /// disconnected.
@@ -61,7 +63,7 @@ impl Default for NetLimits {
             max_connections: 64,
             max_client_message: figcraft_collab::Limits::default().max_message_bytes,
             max_hello: 64 << 10,
-            max_server_message: figcraft_collab::Limits::default().max_message_bytes,
+            max_server_message: 1 << 30,
             rate: 100.0,
             burst: 400.0,
             hello_timeout: Duration::from_secs(10),

crates/collab-net/src/link.rs

@@ -243,6 +243,18 @@ impl LiveLink for NetLink {
         }
     }
 
+    fn remove(&mut self, session: SessionId, client: u32) -> Result<(), String> {
+        match self.sessions.get(session) {
+            Some(Active::Host(h)) if h.me().client_id == client => Err("you can't remove yourself: stop the session instead".into()),
+            Some(Active::Host(h)) => {
+                h.remove(client);
+                Ok(())
+            }
+            Some(Active::Guest(_)) => Err("only the person hosting can remove people from this session".into()),
+            None => Err("this session is over".into()),
+        }
+    }
+
     fn leave(&mut self, session: SessionId) {
         if let Some(active) = self.sessions.remove(session) {
             active.end();

crates/collab-net/src/loopback_tests.rs

@@ -15,7 +15,7 @@ use tungstenite::protocol::WebSocket;
 use tungstenite::{Bytes, Message};
 
 use crate::guest::{Guest, GuestConfig};
-use crate::host::{ENDED, Host, HostConfig};
+use crate::host::{ENDED, Host, HostConfig, REMOVED};
 use crate::inbox::Inbox;
 use crate::invite::Invite;
 use crate::net::{Bucket, NetLimits};
@@ -611,3 +611,34 @@ fn until_presence_or_pong(r: &mut Raw) -> Option<ServerMsg> {
         }
     }
 }
+
+#[test]
+fn the_host_removes_someone_and_they_cant_come_back() {
+    let (mut host, mut hp, invite) = start();
+    let (_a, mut ap) = join(&invite, "Ada");
+    let (b, mut bp) = join(&invite, "Bo");
+    ap.wait("welcome", welcomed);
+    bp.wait("welcome", welcomed);
+    let (ada, bo) = (ap.me(), bp.me());
+    connections_settle(&host, 2);
+    // The host can't remove themselves, nor someone who isn't there: nothing happens.
+    host.remove(host.me().client_id);
+    host.remove(9999);
+    host.remove(ada);
+    // Ada is told the session is over for her (no reconnecting); the others see her leave.
+    ap.wait("Ada removed", |e| e.iter().any(|e| matches!(e, Event::Ended { reason } if reason == REMOVED)));
+    hp.wait("the host sees Ada leave", |e| e.iter().any(|e| matches!(e, Event::PeerLeft(id) if *id == ada)));
+    bp.wait("Bo sees Ada leave", |e| e.iter().any(|e| matches!(e, Event::PeerLeft(id) if *id == ada)));
+    connections_settle(&host, 1);
+    assert!(!ap.events.iter().any(|e| matches!(e, Event::Status(Status::Reconnecting { .. }))), "a removed guest doesn't reconnect");
+    assert!(!hp.left().contains(&bo), "only Ada was removed");
+    // Her address can't join again with the same invite (every guest here comes from 127.0.0.1).
+    let (_again, mut againp) = join(&invite, "Ada");
+    againp.wait("a refusal", |e| e.iter().any(|e| matches!(e, Event::Status(Status::Failed { reason }) if reason.contains("removed"))));
+    assert!(!welcomed(&againp.events));
+    // Bo, already in, stays and can still talk to the host.
+    b.presence(presence(3.0, 4.0));
+    hp.wait("Bo's cursor", |e| e.iter().any(|e| matches!(e, Event::Presence(id, _) if *id == bo)));
+    host.stop();
+    assert_eq!(host.connections(), 0);
+}

crates/collab/src/client.rs

@@ -307,7 +307,8 @@ impl Client {
     /// Queue `changes` as a new batch (already shown in the view).
     fn queue(&mut self, changes: Vec<Change>, kind: BatchKind, step: Option<u64>) {
         let batch_id = self.next_batch;
-        self.next_batch += 1;
+        // `next_batch` starts from the welcome's `last_batch`, the host's word: saturate.
+        self.next_batch = self.next_batch.saturating_add(1);
         self.pending.push_back(Pending { batch_id, base_seq: self.seq, changes, kind, step, rebased: false, sent: false });
     }
 
@@ -484,7 +485,11 @@ impl Client {
 
     /// A batch the server accepted (in order). Follow-ups it causes are queued.
     fn accepted(&mut self, acc: Accepted, recompute: &dyn Recompute) -> Result<(), Error> {
-        if acc.seq != self.seq + 1 {
+        // The host's sequence number is untrusted: at `u64::MAX` it can't step past it.
+        let Some(next) = self.seq.checked_add(1) else {
+            return Err(Error::Protocol(format!("sequence {} after {}", acc.seq, self.seq)));
+        };
+        if acc.seq != next {
             return Err(Error::Protocol(format!("sequence {} after {}", acc.seq, self.seq)));
         }
         if acc.author != self.id {

crates/collab/src/client_tests.rs

@@ -0,0 +1,43 @@
+//! A client's handling of the host's messages: sequence numbers and batch ids come from the host,
+//! so they are treated as hostile input (they must never overflow).
+
+use figcraft_doc::NodeKind;
+
+use crate::message::{Accepted, ClientMsg, Hello, ServerMsg};
+use crate::sim_tests::base;
+use crate::{Client, Limits, NoRecompute, Outgoing, Server};
+
+fn hello() -> Hello {
+    let ClientMsg::Hello(h) = Client::hello("f", "tok", "Ada", "#FF8800") else { panic!("not a hello") };
+    h
+}
+
+/// A welcome whose sequence numbers are what a lying host would send.
+fn hostile_welcome(seq: u64, last_batch: u64) -> ServerMsg {
+    let mut s = Server::new(base(), "tok", Limits::default());
+    let (_, out) = s.join(hello()).unwrap();
+    let mut welcome = out
+        .into_iter()
+        .find_map(|o| match o {
+            Outgoing::To(_, m) => Some(m),
+            _ => None,
+        })
+        .unwrap();
+    let ServerMsg::Welcome { seq: seq0, processed, .. } = &mut welcome else { panic!("no welcome") };
+    *seq0 = seq;
+    processed.last_batch = last_batch;
+    welcome
+}
+
+#[test]
+fn hostile_sequence_numbers_do_not_overflow_the_client() {
+    let mut c = Client::join(hostile_welcome(u64::MAX, u64::MAX)).unwrap();
+    // This client's own first batch must not overflow its batch counter.
+    let mut d = c.document().clone();
+    let page = d.first_page().unwrap();
+    d.create(page, NodeKind::Rectangle, "R", 0.0, 0.0, 10.0, 10.0).unwrap();
+    assert!(c.edit(&d).unwrap().is_some(), "the edit is batched");
+    // A batch the host claims follows `u64::MAX` can't exist: refuse it, don't overflow.
+    let acc = Accepted { seq: 0, author: c.id().wrapping_add(1), batch_id: 0, changes: Vec::new() };
+    assert!(c.receive(ServerMsg::Changes(acc), &NoRecompute).is_err());
+}

crates/collab/src/codec_tests.rs

@@ -75,6 +75,7 @@ fn samples() -> (Vec<ClientMsg>, Vec<ServerMsg>) {
         ClientMsg::Admin(Admin::Block { ip: "203.0.113.9".into() }),
         ClientMsg::Admin(Admin::Unblock { ip: "2001:db8::".into() }),
         ClientMsg::Admin(Admin::Blocked),
+        ClientMsg::Admin(Admin::RemovePeer { file: "f".into(), client: 7 }),
         ClientMsg::Report { reason: "Spam ☕".into() },
     ];
     let snapshot = Replica::new(Document::new("Snap")).snapshot().unwrap();

crates/collab/src/lib.rs

@@ -123,6 +123,8 @@ impl Recompute for NoRecompute {
     fn recompute(&self, _: &mut Document, _: &Document, _: &BTreeSet<NodeId>) {}
 }
 
+#[cfg(test)]
+mod client_tests;
 #[cfg(test)]
 mod codec_tests;
 #[cfg(test)]

crates/collab/src/message.rs

@@ -274,6 +274,10 @@ pub enum Admin {
     /// these `(file id, owner token)` pairs own, at most [`MAX_OWNED`] of them:
     /// [`AdminReply::Owned`]. Servers older than this request can't read it.
     Owned { files: Vec<(String, String)> },
+    /// Remove client `client` from `file`'s session: they are disconnected and their address
+    /// can't join the file again while its session lasts. With the server key, or on an open
+    /// hosting connection with `file`'s owner token. Servers older than this request can't read it.
+    RemovePeer { file: String, client: u32 },
 }
 
 /// The most files one [`Admin::Owned`] asks about.

crates/color/src/lib.rs

@@ -11,6 +11,7 @@ use serde::{Deserialize, Serialize};
 mod blend;
 mod hsx;
 mod icc;
+mod named;
 mod profile;
 pub use blend::BlendMode;
 pub use hsx::*;
@@ -139,7 +140,13 @@ impl Color {
         Some(Self::from_rgba8(r, g, b, a))
     }
 
-    /// Parse a CSS colour: hex, `rgb()/rgba()`, `hsl()/hsla()` or a few common names.
+    /// What a colour field accepts: hex as [`Color::from_hex`] reads it, or a CSS colour name
+    /// (`red` → `FF0000`, `Cornflower Blue` → `6495ED`; opaque).
+    pub fn from_hex_or_name(s: &str) -> Option<Self> {
+        Self::from_hex(s).or_else(|| named::lookup(s).map(|[r, g, b]| Self::from_rgba8(r, g, b, 255)))
+    }
+
+    /// Parse a CSS colour: hex, `rgb()/rgba()`, `hsl()/hsla()`, a CSS colour name or `transparent`.
     pub fn parse_css(s: &str) -> Option<Self> {
         let t = s.trim().to_ascii_lowercase();
         if t.starts_with('#') {
@@ -166,21 +173,10 @@ impl Color {
             let alpha = parts.get(3).and_then(|a| parse_alpha(a)).unwrap_or(1.0);
             return Some(Hsl { h, s, l }.to_color().with_alpha(alpha));
         }
-        let named = match t.as_str() {
-            "black" => Color::BLACK,
-            "white" => Color::WHITE,
-            "transparent" => Color::TRANSPARENT,
-            "red" => Color::from_rgb8_const(255, 0, 0),
-            "green" => Color::from_rgb8_const(0, 128, 0),
-            "lime" => Color::from_rgb8_const(0, 255, 0),
-            "blue" => Color::from_rgb8_const(0, 0, 255),
-            "yellow" => Color::from_rgb8_const(255, 255, 0),
-            "orange" => Color::from_rgb8_const(255, 165, 0),
-            "purple" => Color::from_rgb8_const(128, 0, 128),
-            "gray" | "grey" => Color::from_rgb8_const(128, 128, 128),
-            _ => return Self::from_hex(&t),
-        };
-        Some(named)
+        if t == "transparent" {
+            return Some(Color::TRANSPARENT);
+        }
+        Self::from_hex_or_name(&t)
     }
 
     /// CSS `rgba(...)` / hex text for copy-as-CSS.

crates/color/src/named.rs

@@ -0,0 +1,197 @@
+//! The CSS named colours (CSS Color Module Level 4 §6.1), so a colour field takes `red` as well as
+//! `FF0000`.
+
+/// Every CSS named colour except `transparent`, sorted by name for binary search.
+const NAMED: [(&str, [u8; 3]); 148] = [
+    ("aliceblue", [240, 248, 255]),
+    ("antiquewhite", [250, 235, 215]),
+    ("aqua", [0, 255, 255]),
+    ("aquamarine", [127, 255, 212]),
+    ("azure", [240, 255, 255]),
+    ("beige", [245, 245, 220]),
+    ("bisque", [255, 228, 196]),
+    ("black", [0, 0, 0]),
+    ("blanchedalmond", [255, 235, 205]),
+    ("blue", [0, 0, 255]),
+    ("blueviolet", [138, 43, 226]),
+    ("brown", [165, 42, 42]),
+    ("burlywood", [222, 184, 135]),
+    ("cadetblue", [95, 158, 160]),
+    ("chartreuse", [127, 255, 0]),
+    ("chocolate", [210, 105, 30]),
+    ("coral", [255, 127, 80]),
+    ("cornflowerblue", [100, 149, 237]),
+    ("cornsilk", [255, 248, 220]),
+    ("crimson", [220, 20, 60]),
+    ("cyan", [0, 255, 255]),
+    ("darkblue", [0, 0, 139]),
+    ("darkcyan", [0, 139, 139]),
+    ("darkgoldenrod", [184, 134, 11]),
+    ("darkgray", [169, 169, 169]),
+    ("darkgreen", [0, 100, 0]),
+    ("darkgrey", [169, 169, 169]),
+    ("darkkhaki", [189, 183, 107]),
+    ("darkmagenta", [139, 0, 139]),
+    ("darkolivegreen", [85, 107, 47]),
+    ("darkorange", [255, 140, 0]),
+    ("darkorchid", [153, 50, 204]),
+    ("darkred", [139, 0, 0]),
+    ("darksalmon", [233, 150, 122]),
+    ("darkseagreen", [143, 188, 143]),
+    ("darkslateblue", [72, 61, 139]),
+    ("darkslategray", [47, 79, 79]),
+    ("darkslategrey", [47, 79, 79]),
+    ("darkturquoise", [0, 206, 209]),
+    ("darkviolet", [148, 0, 211]),
+    ("deeppink", [255, 20, 147]),
+    ("deepskyblue", [0, 191, 255]),
+    ("dimgray", [105, 105, 105]),
+    ("dimgrey", [105, 105, 105]),
+    ("dodgerblue", [30, 144, 255]),
+    ("firebrick", [178, 34, 34]),
+    ("floralwhite", [255, 250, 240]),
+    ("forestgreen", [34, 139, 34]),
+    ("fuchsia", [255, 0, 255]),
+    ("gainsboro", [220, 220, 220]),
+    ("ghostwhite", [248, 248, 255]),
+    ("gold", [255, 215, 0]),
+    ("goldenrod", [218, 165, 32]),
+    ("gray", [128, 128, 128]),
+    ("green", [0, 128, 0]),
+    ("greenyellow", [173, 255, 47]),
+    ("grey", [128, 128, 128]),
+    ("honeydew", [240, 255, 240]),
+    ("hotpink", [255, 105, 180]),
+    ("indianred", [205, 92, 92]),
+    ("indigo", [75, 0, 130]),
+    ("ivory", [255, 255, 240]),
+    ("khaki", [240, 230, 140]),
+    ("lavender", [230, 230, 250]),
+    ("lavenderblush", [255, 240, 245]),
+    ("lawngreen", [124, 252, 0]),
+    ("lemonchiffon", [255, 250, 205]),
+    ("lightblue", [173, 216, 230]),
+    ("lightcoral", [240, 128, 128]),
+    ("lightcyan", [224, 255, 255]),
+    ("lightgoldenrodyellow", [250, 250, 210]),
+    ("lightgray", [211, 211, 211]),
+    ("lightgreen", [144, 238, 144]),
+    ("lightgrey", [211, 211, 211]),
+    ("lightpink", [255, 182, 193]),
+    ("lightsalmon", [255, 160, 122]),
+    ("lightseagreen", [32, 178, 170]),
+    ("lightskyblue", [135, 206, 250]),
+    ("lightslategray", [119, 136, 153]),
+    ("lightslategrey", [119, 136, 153]),
+    ("lightsteelblue", [176, 196, 222]),
+    ("lightyellow", [255, 255, 224]),
+    ("lime", [0, 255, 0]),
+    ("limegreen", [50, 205, 50]),
+    ("linen", [250, 240, 230]),
+    ("magenta", [255, 0, 255]),
+    ("maroon", [128, 0, 0]),
+    ("mediumaquamarine", [102, 205, 170]),
+    ("mediumblue", [0, 0, 205]),
+    ("mediumorchid", [186, 85, 211]),
+    ("mediumpurple", [147, 112, 219]),
+    ("mediumseagreen", [60, 179, 113]),
+    ("mediumslateblue", [123, 104, 238]),
+    ("mediumspringgreen", [0, 250, 154]),
+    ("mediumturquoise", [72, 209, 204]),
+    ("mediumvioletred", [199, 21, 133]),
+    ("midnightblue", [25, 25, 112]),
+    ("mintcream", [245, 255, 250]),
+    ("mistyrose", [255, 228, 225]),
+    ("moccasin", [255, 228, 181]),
+    ("navajowhite", [255, 222, 173]),
+    ("navy", [0, 0, 128]),
+    ("oldlace", [253, 245, 230]),
+    ("olive", [128, 128, 0]),
+    ("olivedrab", [107, 142, 35]),
+    ("orange", [255, 165, 0]),
+    ("orangered", [255, 69, 0]),
+    ("orchid", [218, 112, 214]),
+    ("palegoldenrod", [238, 232, 170]),
+    ("palegreen", [152, 251, 152]),
+    ("paleturquoise", [175, 238, 238]),
+    ("palevioletred", [219, 112, 147]),
+    ("papayawhip", [255, 239, 213]),
+    ("peachpuff", [255, 218, 185]),
+    ("peru", [205, 133, 63]),
+    ("pink", [255, 192, 203]),
+    ("plum", [221, 160, 221]),
+    ("powderblue", [176, 224, 230]),
+    ("purple", [128, 0, 128]),
+    ("rebeccapurple", [102, 51, 153]),
+    ("red", [255, 0, 0]),
+    ("rosybrown", [188, 143, 143]),
+    ("royalblue", [65, 105, 225]),
+    ("saddlebrown", [139, 69, 19]),
+    ("salmon", [250, 128, 114]),
+    ("sandybrown", [244, 164, 96]),
+    ("seagreen", [46, 139, 87]),
+    ("seashell", [255, 245, 238]),
+    ("sienna", [160, 82, 45]),
+    ("silver", [192, 192, 192]),
+    ("skyblue", [135, 206, 235]),
+    ("slateblue", [106, 90, 205]),
+    ("slategray", [112, 128, 144]),
+    ("slategrey", [112, 128, 144]),
+    ("snow", [255, 250, 250]),
+    ("springgreen", [0, 255, 127]),
+    ("steelblue", [70, 130, 180]),
+    ("tan", [210, 180, 140]),
+    ("teal", [0, 128, 128]),
+    ("thistle", [216, 191, 216]),
+    ("tomato", [255, 99, 71]),
+    ("turquoise", [64, 224, 208]),
+    ("violet", [238, 130, 238]),
+    ("wheat", [245, 222, 179]),
+    ("white", [255, 255, 255]),
+    ("whitesmoke", [245, 245, 245]),
+    ("yellow", [255, 255, 0]),
+    ("yellowgreen", [154, 205, 50]),
+];
+
+/// Longest name in [`NAMED`]; anything longer can't match.
+const LONGEST: usize = 20;
+
+/// The opaque sRGB bytes of a CSS colour name. Case, spaces, `-` and `_` are ignored, so
+/// `Light Blue`, `light-blue` and `lightblue` are the same colour.
+pub fn lookup(s: &str) -> Option<[u8; 3]> {
+    let key: String = s.chars().filter(|c| !c.is_whitespace() && *c != '-' && *c != '_').take(LONGEST + 1).collect::<String>().to_ascii_lowercase();
+    if key.is_empty() || key.len() > LONGEST {
+        return None;
+    }
+    NAMED.binary_search_by(|(name, _)| name.cmp(&key.as_str())).ok().and_then(|i| NAMED.get(i)).map(|(_, rgb)| *rgb)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn table_is_sorted_and_unique() {
+        assert!(NAMED.windows(2).all(|w| w[0].0 < w[1].0));
+        assert_eq!(NAMED.iter().map(|(n, _)| n.len()).max(), Some(LONGEST));
+    }
+
+    #[test]
+    fn every_name_is_found() {
+        for (name, rgb) in NAMED {
+            assert_eq!(lookup(name), Some(rgb), "{name}");
+        }
+    }
+
+    #[test]
+    fn lookup_normalises() {
+        assert_eq!(lookup("Red"), Some([255, 0, 0]));
+        assert_eq!(lookup("  CORNFLOWER blue "), Some([100, 149, 237]));
+        assert_eq!(lookup("light-goldenrod_yellow"), Some([250, 250, 210]));
+        assert_eq!(lookup(""), None);
+        assert_eq!(lookup("transparent"), None);
+        assert_eq!(lookup("reddish"), None);
+        assert_eq!(lookup("rédé"), None);
+        assert_eq!(lookup(&"a".repeat(10_000)), None);
+    }
+}

crates/color/src/tests.rs

@@ -17,6 +17,23 @@ fn css_parsing() {
     assert_eq!(Color::parse_css("rgba(0 0 255 / 50%)").unwrap().to_rgba8(), [0, 0, 255, 128]);
     assert_eq!(Color::parse_css("hsl(120, 100%, 50%)").unwrap().to_hex(), "00FF00");
     assert_eq!(Color::parse_css("white").unwrap(), Color::WHITE);
+    assert_eq!(Color::parse_css("RebeccaPurple").unwrap().to_hex(), "663399");
+    assert_eq!(Color::parse_css("transparent").unwrap(), Color::TRANSPARENT);
+}
+
+#[test]
+fn colour_fields_take_names() {
+    assert_eq!(Color::from_hex_or_name("red").unwrap().to_css_hex(), "#FF0000");
+    assert_eq!(Color::from_hex_or_name(" Cornflower Blue ").unwrap().to_hex(), "6495ED");
+    assert_eq!(Color::from_hex_or_name("darkblue").unwrap().to_rgba8(), [0, 0, 139, 255]);
+    // Hex wins: every digit string still reads as hex.
+    assert_eq!(Color::from_hex_or_name("abc").unwrap().to_hex(), "AABBCC");
+    assert_eq!(Color::from_hex_or_name("#0D99FF").unwrap().to_hex(), "0D99FF");
+    // Names are opaque; `transparent` is not a field colour.
+    assert!(Color::from_hex_or_name("transparent").is_none());
+    for junk in ["", "#", "redd", "re d d", "12345", "\u{0}", "🟥", &"x".repeat(100_000)] {
+        assert!(Color::from_hex_or_name(junk).is_none(), "{junk:?}");
+    }
 }
 
 #[test]

crates/doc/src/geometry.rs

@@ -51,6 +51,10 @@ pub fn is_closed(n: &Node) -> bool {
     }
 }
 
+/// How much further than `tol` a stroke with nothing filled reaches: a thin line or stroke-only path
+/// is hard to land on with the plain tolerance, so it gets a wider band (5 screen px for the usual 2 px tolerance).
+const STROKE_REACH: f64 = 2.5;
+
 /// Whether `pt` hits `n` itself; in `outline` mode (nothing filled on the canvas) a shape only where
 /// its outline is.
 fn hits_node_itself(doc: &Document, id: NodeId, n: &Node, pt: Point, tol: f64, outline: bool) -> bool {
@@ -62,7 +66,7 @@ fn hits_node_itself(doc: &Document, id: NodeId, n: &Node, pt: Point, tol: f64, o
         NodeKind::Group | NodeKind::BooleanOp { .. } | NodeKind::Page { .. } => false,
         NodeKind::Text(_) | NodeKind::Slice => n.local_rect().inflate(tol_l, tol_l).contains(lp),
         NodeKind::Line => {
-            let half = (n.stroke.weight / 2.0).max(tol_l);
+            let half = (n.stroke.weight / 2.0).max(tol_l * STROKE_REACH);
             lp.x >= -half && lp.x <= n.width + half && lp.y.abs() <= half
         }
         NodeKind::Frame | NodeKind::Component { .. } | NodeKind::ComponentSet { .. } | NodeKind::Instance { .. } | NodeKind::Section { .. } => {
@@ -78,7 +82,9 @@ fn hits_path(n: &Node, path: &BezPath, lp: Point, tol: f64, inside: bool) -> boo
     if inside && (n.fills.iter().any(|f| f.visible) || !n.has_visible_stroke()) {
         return true;
     }
-    let reach = (n.stroke.max_weight() / 2.0).max(tol);
+    // Only a stroke with nothing filled gets the wider band: a filled shape's edge keeps the plain one.
+    let stroke_only = n.has_visible_stroke() && !n.fills.iter().any(|f| f.visible);
+    let reach = (n.stroke.max_weight() / 2.0).max(if stroke_only { tol * STROKE_REACH } else { tol });
     if !path.bounding_box().inflate(reach, reach).contains(lp) {
         return false;
     }

crates/doc/src/lib.rs

@@ -77,17 +77,19 @@ pub enum DocError {
 
 pub type DocResult<T> = Result<T, DocError>;
 
-/// The set of touched node ids, and whether any layer is a mask (worked out when first asked
-/// after a change: hit testing skips its mask checks without one). Never part of equality or
+/// The set of touched node ids, whether any layer is a mask (hit testing skips its mask checks
+/// without one) and the largest background blur radius (renders keep that much overlap between
+/// their bands), both worked out when first asked after a change. Never part of equality or
 /// serialisation.
 #[derive(Clone, Debug, Default)]
-pub struct Dirty(pub std::collections::BTreeSet<NodeId>, std::sync::OnceLock<bool>);
+pub struct Dirty(pub std::collections::BTreeSet<NodeId>, std::sync::OnceLock<bool>, std::sync::OnceLock<f64>);
 
 impl Dirty {
     /// Record node `id` as touched (edited, added or removed).
     fn touch(&mut self, id: NodeId) {
         self.0.insert(id);
         self.1 = std::sync::OnceLock::new();
+        self.2 = std::sync::OnceLock::new();
     }
 }
 
@@ -254,6 +256,11 @@ impl Document {
         *self.dirty.1.get_or_init(|| self.nodes.values().any(|n| n.is_mask))
     }
 
+    /// The largest background blur or glass radius of any layer's effects (0 without any).
+    pub fn max_backdrop_radius(&self) -> f64 {
+        *self.dirty.2.get_or_init(|| self.nodes.values().flat_map(|n| n.effects.iter()).map(Effect::backdrop_radius).fold(0.0, f64::max))
+    }
+
     /// Node ids touched so far (without clearing).
     pub fn dirty(&self) -> &std::collections::BTreeSet<NodeId> {
         &self.dirty.0
@@ -781,6 +788,23 @@ impl Document {
         self.paste_nodes(&src_nodes, &map, id, parent, index)
     }
 
+    /// Deep-copy each of `ids`' subtrees to the end of `parent`, in order, returning the new root
+    /// ids. One id map covers every copy, so references between the copied subtrees (a navigation
+    /// from one copied frame to another) point at the copies.
+    pub fn duplicate_all_into(&mut self, ids: &[NodeId], parent: NodeId) -> DocResult<Vec<NodeId>> {
+        let mut map = BTreeMap::new();
+        let mut trees = Vec::with_capacity(ids.len());
+        for &id in ids {
+            let src_nodes: Vec<Node> = self.subtree(id).into_iter().filter_map(|i| self.node(i).cloned()).collect();
+            for n in &src_nodes {
+                let nid = self.alloc_id();
+                map.insert(n.id, nid);
+            }
+            trees.push((id, src_nodes));
+        }
+        trees.into_iter().map(|(id, src_nodes)| self.paste_nodes(&src_nodes, &map, id, parent, None)).collect()
+    }
+
     /// Insert copies of `nodes` (a subtree rooted at `root`, from this or another document) with ids
     /// remapped by `map`. Interactions, instance references and pattern sources pointing inside the
     /// subtree are remapped too.
@@ -903,15 +927,22 @@ impl Document {
     /// A unique name like "Frame 3" for a new node of a kind.
     pub fn next_name(&self, base: &str) -> String {
         let mut max = 0u64;
+        let mut taken = std::collections::BTreeSet::new();
         for n in self.nodes() {
             if let Some(rest) = n.name.strip_prefix(base)
                 && let Some(num) = rest.strip_prefix(' ')
                 && let Ok(k) = num.parse::<u64>()
             {
                 max = max.max(k);
+                taken.insert(k);
             }
         }
-        format!("{base} {}", max + 1)
+        let next = match max.checked_add(1) {
+            Some(next) => next,
+            // The counter is spent: the lowest free number instead of wrapping onto a name.
+            None => (1u64..).find(|k| !taken.contains(k)).unwrap_or(1),
+        };
+        format!("{base} {next}")
     }
 
     pub fn style(&self, id: &str) -> Option<&Style> {
@@ -1093,8 +1124,14 @@ impl Document {
     /// mask with the layers above it up to the next mask, or a single layer. An auto layout frame
     /// whose first child paints on top paints the runs in reverse (see [`Node::paint_order`]).
     pub fn paint_runs(&self, n: &Node) -> Vec<std::ops::Range<usize>> {
-        let kids = &n.children;
-        let node = |i: usize| kids.get(i).and_then(|k| self.node(*k));
+        let kids: Vec<Option<&Node>> = n.children.iter().map(|k| self.node(*k)).collect();
+        Self::paint_runs_of(&kids, n.layout.as_ref().is_some_and(|l| l.reverse_z))
+    }
+
+    /// [`Self::paint_runs`] of children already looked up (`None`: not in the document), last run
+    /// first when `reverse_z`.
+    pub fn paint_runs_of(kids: &[Option<&Node>], reverse_z: bool) -> Vec<std::ops::Range<usize>> {
+        let node = |i: usize| kids.get(i).copied().flatten();
         let mut runs = Vec::new();
         let mut i = 0;
         while i < kids.len() {
@@ -1107,7 +1144,7 @@ impl Document {
             runs.push(i..j);
             i = j;
         }
-        if n.layout.as_ref().is_some_and(|l| l.reverse_z) {
+        if reverse_z {
             runs.reverse();
         }
         runs

crates/doc/src/proto.rs

@@ -860,7 +860,35 @@ pub struct Device {
 
 impl PrototypeSettings {
     /// The devices to pick from ("None" presents the frame at its own size).
-    pub const DEVICES: [Device; 6] = [
+    pub const DEVICES: [Device; 19] = [
+        Device {
+            name: "iPhone 17",
+            width: 402.0,
+            height: 874.0,
+            rotates: true,
+            colors: &[c("Black", 0x38, 0x39, 0x3D), c("White", 0xE9, 0xE9, 0xE5)],
+        },
+        Device {
+            name: "iPhone 17 Pro",
+            width: 402.0,
+            height: 874.0,
+            rotates: true,
+            colors: &[c("Black", 0x38, 0x39, 0x3D), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
+        Device {
+            name: "iPhone 17 Pro Max",
+            width: 440.0,
+            height: 956.0,
+            rotates: true,
+            colors: &[c("Black", 0x38, 0x39, 0x3D), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
+        Device {
+            name: "iPhone Air",
+            width: 420.0,
+            height: 912.0,
+            rotates: true,
+            colors: &[c("Black", 0x38, 0x39, 0x3D), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
         Device {
             name: "iPhone 16",
             width: 393.0,
@@ -874,6 +902,13 @@ impl PrototypeSettings {
                 c("Blue", 0x72, 0x84, 0xD4),
             ],
         },
+        Device {
+            name: "iPhone 16 Pro",
+            width: 402.0,
+            height: 874.0,
+            rotates: true,
+            colors: &[c("Black", 0x3B, 0x3A, 0x38), c("White", 0xEC, 0xEB, 0xE6)],
+        },
         Device {
             name: "iPhone 16 Pro Max",
             width: 440.0,
@@ -881,6 +916,55 @@ impl PrototypeSettings {
             rotates: true,
             colors: &[c("Black", 0x3B, 0x3A, 0x38), c("White", 0xEC, 0xEB, 0xE6), c("Natural", 0xBF, 0xB9, 0xAF), c("Sand", 0xC6, 0xAC, 0x8F)],
         },
+        Device {
+            name: "iPhone 16 Plus",
+            width: 430.0,
+            height: 932.0,
+            rotates: true,
+            colors: &[c("Black", 0x3A, 0x3B, 0x3F), c("White", 0xEE, 0xED, 0xE8)],
+        },
+        Device {
+            name: "iPhone 15 Pro",
+            width: 393.0,
+            height: 852.0,
+            rotates: true,
+            colors: &[c("Black", 0x3B, 0x3A, 0x38), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
+        Device {
+            name: "iPhone 15 Pro Max",
+            width: 430.0,
+            height: 932.0,
+            rotates: true,
+            colors: &[c("Black", 0x3B, 0x3A, 0x38), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
+        Device {
+            name: "iPhone 15 Plus",
+            width: 430.0,
+            height: 932.0,
+            rotates: true,
+            colors: &[c("Black", 0x3A, 0x3B, 0x3F), c("White", 0xEE, 0xED, 0xE8)],
+        },
+        Device {
+            name: "iPhone 14 Pro",
+            width: 393.0,
+            height: 852.0,
+            rotates: true,
+            colors: &[c("Black", 0x3B, 0x3A, 0x38), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
+        Device {
+            name: "iPhone 14 Pro Max",
+            width: 430.0,
+            height: 932.0,
+            rotates: true,
+            colors: &[c("Black", 0x3B, 0x3A, 0x38), c("Silver", 0xD7, 0xD7, 0xD5)],
+        },
+        Device {
+            name: "iPhone 14",
+            width: 390.0,
+            height: 844.0,
+            rotates: true,
+            colors: &[c("Black", 0x3A, 0x3B, 0x3F), c("White", 0xEE, 0xED, 0xE8)],
+        },
         Device {
             name: "Android Compact",
             width: 412.0,
@@ -888,6 +972,13 @@ impl PrototypeSettings {
             rotates: true,
             colors: &[c("Black", 0x2E, 0x2F, 0x33), c("Silver", 0xD6, 0xD8, 0xDB), c("Green", 0xA6, 0xC0, 0xA3)],
         },
+        Device {
+            name: "Android Medium",
+            width: 700.0,
+            height: 840.0,
+            rotates: true,
+            colors: &[c("Black", 0x2E, 0x2F, 0x33), c("Silver", 0xD6, 0xD8, 0xDB)],
+        },
         Device {
             name: "iPad mini",
             width: 744.0,

crates/doc/src/proto_expr.rs

@@ -143,7 +143,7 @@ impl Expr {
             return "…".into();
         }
         match self {
-            Expr::Value(VariableValue::Alias(id)) => vars.get(id).map_or_else(|| "(missing variable)".into(), |v| v.name.clone()),
+            Expr::Value(VariableValue::Alias(id)) => vars.get(id).map_or_else(|| "(missing variable)".into(), |v| var_ref(vars, v)),
             Expr::Value(VariableValue::String(s)) => quote(s),
             // Exact numbers and `#` colours, so the text reads back as the same expression.
             Expr::Value(VariableValue::Number(n)) => format!("{n}"),
@@ -178,6 +178,18 @@ impl Expr {
     }
 }
 
+/// A variable as written in an expression: its bare name when that reads back as this variable,
+/// otherwise `{name}` (or `{id}` when even the braced name wouldn't), so names like `1`, `2x` or
+/// `"q"` don't read back as literals or errors.
+fn var_ref(vars: &Variables, v: &crate::Variable) -> String {
+    let this = Expr::var(v.id.clone());
+    if Expr::parse(&v.name, vars).is_ok_and(|e| e == this) {
+        return v.name.clone();
+    }
+    let braced = !v.name.contains('}') && v.name.trim() == v.name && vars.get(&v.name).is_some_and(|x| x.id == v.id);
+    if braced { format!("{{{}}}", v.name) } else { format!("{{{}}}", v.id) }
+}
+
 /// A collection or mode name as written inside `mode(…)` or `[…]`: as it is, or quoted when it has
 /// spaces at its ends, quotes or brackets.
 fn name_arg(name: &str) -> String {

crates/doc/src/proto_expr_parse_tests.rs

@@ -176,3 +176,22 @@ fn hostile_text_is_bounded() {
         }
     }
 }
+
+#[test]
+fn names_that_look_like_literals_read_back_as_variables() {
+    for name in ["count", "count total", "2x", "1", "-3", ".5", "(x)", "#ff", "\"q\"", "not", "true"] {
+        let mut v = vars();
+        if let Some(var) = v.variables.iter_mut().find(|x| x.id == "n") {
+            var.name = name.into();
+        }
+        for e in [Expr::var("n"), Expr::op(ExprOp::Add, vec![Expr::var("n"), n(1.0)]), Expr::InMode { variable: "n".into(), mode: "dark".into() }] {
+            let shown = e.display(&v);
+            assert_eq!(Expr::parse(&shown, &v), Ok(e.clone()), "{name:?} shown as {shown:?}");
+        }
+    }
+    // Plain names stay bare, and literals still read as literals.
+    let v = vars();
+    assert_eq!(Expr::var("n").display(&v), "n-name");
+    assert_eq!(parse("1"), n(1.0));
+    assert_eq!(parse("\"q\""), Expr::Value(VariableValue::String("q".into())));
+}

crates/doc/src/tests.rs

@@ -168,6 +168,27 @@ fn text_runs_restyle_and_replace() {
     assert_eq!(t.characters, "");
 }
 
+/// A run that reaches past the text (a file can carry one: nothing clamps `runs` on load)
+/// must not overflow the arithmetic that shifts the runs along, and must not leave the
+/// text unwritable.
+#[test]
+fn text_runs_past_the_text_never_overflow() {
+    let style = || TextStyle { font_style: "Bold".into(), ..Default::default() };
+    for end in [usize::MAX, usize::MAX - 1, 1_000_000] {
+        let mut t = TextData::new("hi");
+        t.runs = vec![StyleRun { start: 0, end, style: style() }];
+        // Typing at the caret, and replacing a selection: both shift `end`.
+        t.replace_range(0, 0, "x");
+        assert_eq!(t.characters, "xhi", "end {end}");
+        t.replace_range(0, 3, "yo");
+        assert_eq!(t.characters, "yo", "end {end}");
+        // The text is still writable and the runs are back inside it.
+        t.replace_range(0, 0, "!");
+        assert_eq!(t.characters, "!yo", "end {end}");
+        assert!(t.runs.iter().all(|r| r.start < r.end && r.end <= t.char_count()), "end {end}: {:?}", t.runs);
+    }
+}
+
 #[test]
 fn text_case() {
     assert_eq!(TextCase::Title.apply("hello big world"), "Hello Big World");
@@ -335,6 +356,16 @@ fn next_name_increments() {
     assert_eq!(d.next_name("Ellipse"), "Ellipse 1");
 }
 
+#[test]
+fn next_name_never_overflows() {
+    let mut d = Document::new("x");
+    let p = page(&d);
+    d.create(p, NodeKind::Frame, "Frame 18446744073709551615", 0.0, 0.0, 1.0, 1.0).unwrap();
+    assert_eq!(d.next_name("Frame"), "Frame 1", "the counter can't step past u64::MAX");
+    d.create(p, NodeKind::Frame, "Frame 1", 0.0, 0.0, 1.0, 1.0).unwrap();
+    assert_eq!(d.next_name("Frame"), "Frame 2");
+}
+
 #[test]
 fn custom_easings() {
     use crate::proto::Easing;
@@ -371,3 +402,65 @@ fn custom_easings() {
     assert_eq!(back, Easing::CustomSpring { mass: 2.0, stiffness: 50.0, damping: 5.0 });
     assert_eq!(serde_json::from_value::<Easing>(serde_json::json!("easeInOut")).unwrap(), Easing::EaseInOut);
 }
+
+#[test]
+fn text_style_updates_merge_equal_runs() {
+    let def = TextStyle { font_size: 14.0, ..Default::default() };
+    let mut t = TextData::new("abcd");
+    t.link_text_style(0, 2, &def, "S");
+    t.link_text_style(2, 4, &def, "S");
+    t.restyle(2, 4, |s| s.font_size = 24.0);
+    assert_eq!(t.runs.len(), 2);
+    t.update_text_style("S", &TextStyle { font_size: 24.0, ..def.clone() });
+    let spans = t.spans();
+    assert_eq!(spans.len(), 1);
+    assert_eq!((spans[0].0, spans[0].1), (0, 4));
+    assert_eq!(spans[0].2.font_size, 24.0);
+    assert_eq!(spans[0].2.style_id.as_deref(), Some("S"));
+
+    // Remapping two links to one id merges the runs.
+    let mut t = TextData::new("ab");
+    t.link_text_style(0, 1, &def, "A");
+    t.link_text_style(1, 2, &def, "B");
+    t.map_text_styles(|_| Some("C".into()));
+    assert_eq!(t.spans().len(), 1);
+    assert_eq!(t.style_at(1).style_id.as_deref(), Some("C"));
+
+    // Different values stay separate.
+    let mut t = TextData::new("ab");
+    t.link_text_style(0, 1, &def, "A");
+    t.link_text_style(1, 2, &TextStyle { font_size: 30.0, ..Default::default() }, "B");
+    t.map_text_styles(|_| Some("C".into()));
+    let spans = t.spans();
+    assert_eq!(spans.len(), 2);
+    assert_eq!((spans[0].2.font_size, spans[1].2.font_size), (14.0, 30.0));
+
+    // Unlinking a run equal to the base drops it.
+    let mut t = TextData::new("ab");
+    let base = t.style.clone();
+    t.link_text_style(0, 1, &base, "S");
+    t.map_text_styles(|_| None);
+    assert!(t.runs.is_empty());
+}
+
+#[test]
+fn text_style_empty_range_links_and_unlinks_all() {
+    let def = TextStyle { font_style: "Bold".into(), ..Default::default() };
+    let mut t = TextData::new("abcd");
+    t.link_text_style(2, 2, &def, "S");
+    assert!((0..4).all(|i| t.style_at(i).style_id.as_deref() == Some("S") && t.style_at(i).font_style == "Bold"));
+    t.unlink_text_style(2, 2);
+    assert!((0..4).all(|i| t.style_at(i).style_id.is_none() && t.style_at(i).font_style == "Bold"));
+    // Partial ranges stay partial.
+    t.link_text_style(0, 4, &def, "S");
+    t.unlink_text_style(1, 3);
+    assert_eq!(t.style_at(0).style_id.as_deref(), Some("S"));
+    assert!(t.style_at(1).style_id.is_none() && t.style_at(2).style_id.is_none());
+    assert_eq!(t.style_at(3).style_id.as_deref(), Some("S"));
+    // Empty text changes the base style.
+    let mut e = TextData::new("");
+    e.link_text_style(0, 0, &def, "S");
+    assert_eq!(e.style.style_id.as_deref(), Some("S"));
+    e.unlink_text_style(0, 0);
+    assert!(e.style.style_id.is_none());
+}

crates/doc/src/text.rs

@@ -215,6 +215,10 @@ pub struct ParaList {
     pub list: ListStyle,
     /// Nesting level (0 = outermost; plain paragraphs are always 0).
     pub indent: u8,
+    /// A numbered list that starts counting at this paragraph counts from `start_offset + 1`
+    /// (items that go on counting ignore it; other paragraphs are always 0).
+    #[serde(skip_serializing_if = "crate::node::is_default")]
+    pub start_offset: u32,
 }
 
 /// Character style. In runs, every field is an override; `None` means "inherit the base".
@@ -562,7 +566,7 @@ impl TextData {
         }
     }
 
-    /// Drop empty/out-of-range runs and runs equal to the base style.
+    /// Drop empty/out-of-range runs and runs equal to the base style, and merge touching equal runs.
     pub fn normalize(&mut self) {
         let n = self.char_count();
         let base = self.style.clone();
@@ -571,6 +575,14 @@ impl TextData {
             r.end = r.end.min(n);
         }
         self.runs.sort_by_key(|r| r.start);
+        let mut merged: Vec<StyleRun> = Vec::with_capacity(self.runs.len());
+        for r in std::mem::take(&mut self.runs) {
+            match merged.last_mut() {
+                Some(prev) if prev.end == r.start && prev.style == r.style => prev.end = r.end,
+                _ => merged.push(r),
+            }
+        }
+        self.runs = merged;
     }
 
     /// Replace chars `start..end` with `text`, shifting runs (inserted text takes the style at `start`).
@@ -602,7 +614,9 @@ impl TextData {
                 if p <= start {
                     p
                 } else if p >= end {
-                    p - removed + inserted
+                    // Runs of a file that reach past the text (nothing clamps them on load)
+                    // would otherwise overflow here; `normalize` below drops what is left.
+                    p.saturating_sub(removed).saturating_add(inserted)
                 } else {
                     start + inserted
                 }
@@ -627,13 +641,13 @@ impl TextData {
 
     /// Paragraph `p`'s list settings.
     pub fn para_list(&self, p: usize) -> ParaList {
-        self.paragraphs.get(p).copied().unwrap_or(ParaList { list: self.list, indent: 0 })
+        self.paragraphs.get(p).copied().unwrap_or(ParaList { list: self.list, ..ParaList::default() })
     }
 
     /// Spell out every paragraph's list settings in `paragraphs` (and drop extra entries).
     fn fill_paragraphs(&mut self) {
         let n = self.paragraph_count();
-        let fill = ParaList { list: self.list, indent: 0 };
+        let fill = ParaList { list: self.list, ..ParaList::default() };
         self.paragraphs.resize(n, fill);
     }
 
@@ -647,17 +661,23 @@ impl TextData {
     }
 
     /// Apply `f` to the list settings of the paragraphs chars `start..end` touch (plain
-    /// paragraphs stay at level 0, levels stop at [`MAX_LIST_INDENT`]); one style for all with
-    /// no nesting folds back into `list`.
+    /// paragraphs stay at level 0, only numbered ones keep a start, levels stop at
+    /// [`MAX_LIST_INDENT`]); one style for all with no nesting or start folds back into `list`.
     pub fn set_para_lists(&mut self, start: usize, end: usize, f: impl Fn(&mut ParaList)) {
         let (a, b) = self.para_span(start, end);
         self.fill_paragraphs();
         for pl in self.paragraphs.get_mut(a..=b).unwrap_or(&mut []) {
             f(pl);
-            pl.indent = if pl.list == ListStyle::None { 0 } else { pl.indent.min(MAX_LIST_INDENT) };
+            if pl.list == ListStyle::None {
+                pl.indent = 0;
+            }
+            if pl.list != ListStyle::Numbered {
+                pl.start_offset = 0;
+            }
+            pl.indent = pl.indent.min(MAX_LIST_INDENT);
         }
         if let Some(first) = self.paragraphs.first().copied()
-            && first.indent == 0
+            && first == (ParaList { list: first.list, ..ParaList::default() })
             && self.paragraphs.iter().all(|p| *p == first)
         {
             self.list = first.list;
@@ -665,21 +685,24 @@ impl TextData {
         }
     }
 
-    /// The list settings shared by the paragraphs chars `start..end` touch, or None when they differ.
+    /// The list style and level shared by the paragraphs chars `start..end` touch (the first
+    /// one's settings), or None when they differ. Start numbers don't count.
     pub fn common_para_list(&self, start: usize, end: usize) -> Option<ParaList> {
         let (a, b) = self.para_span(start, end);
         let first = self.para_list(a);
-        (a..=b).all(|p| self.para_list(p) == first).then_some(first)
+        (a..=b).all(|p| self.para_list(p).list == first.list && self.para_list(p).indent == first.indent).then_some(first)
     }
 
     /// Link chars `start..end` (all of them when the range is empty or the whole text) to text
     /// style `id`, defined as `def`.
     pub fn link_text_style(&mut self, start: usize, end: usize, def: &TextStyle, id: &str) {
+        let (start, end) = if start == end { (0, self.char_count()) } else { (start, end) };
         self.restyle(start, end, |s| s.take_text_style(def, id));
     }
 
     /// Unlink chars `start..end` (all when empty or whole) from their text styles; values stay.
     pub fn unlink_text_style(&mut self, start: usize, end: usize) {
+        let (start, end) = if start == end { (0, self.char_count()) } else { (start, end) };
         self.restyle(start, end, |s| s.style_id = None);
     }
 
@@ -770,4 +793,29 @@ mod case_tests {
         assert_eq!(st.variations.keys().collect::<Vec<_>>(), ["wdth"]);
         assert!(valid_axis_tag("wght") && !valid_axis_tag("weight"));
     }
+
+    #[test]
+    fn list_starts_load_from_old_files_and_follow_edits() {
+        use ListStyle::{Bulleted as B, None as P, Numbered as N};
+        // Files written before start numbers load with none, and write the same bytes.
+        let old = r#"{"list":"numbered","indent":1}"#;
+        let pl: ParaList = serde_json::from_str(old).unwrap();
+        assert_eq!(pl, ParaList { list: N, indent: 1, start_offset: 0 });
+        assert_eq!(serde_json::to_string(&pl).unwrap(), old);
+        // One numbered paragraph with a start keeps it (it doesn't fold into `list`).
+        let mut t = TextData { characters: "Next".into(), ..Default::default() };
+        t.set_para_lists(0, 0, |p| *p = ParaList { list: N, indent: 0, start_offset: 1 });
+        assert_eq!(t.para_list(0), ParaList { list: N, indent: 0, start_offset: 1 });
+        // Enter copies it to the new item; different starts don't make the list mixed.
+        t.replace_range(4, 4, "\nMore");
+        assert_eq!(t.para_list(1).start_offset, 1);
+        t.set_para_lists(5, 5, |p| p.start_offset = 0);
+        assert!(t.common_para_list(0, t.char_count()).is_some_and(|p| p.list == N));
+        // Bullets have no number, so no start.
+        t.set_para_lists(0, 0, |p| *p = ParaList { list: B, indent: 1, start_offset: 4 });
+        assert_eq!(t.para_list(0), ParaList { list: B, indent: 1, start_offset: 0 });
+        // A plain paragraph has none.
+        t.set_para_lists(0, 0, |p| p.list = P);
+        assert_eq!(t.para_list(0), ParaList::default());
+    }
 }

crates/doc/src/vector.rs

@@ -468,9 +468,9 @@ impl VectorNetwork {
         start_dir(&self.outward(seg, at_a)?)
     }
 
-    /// Whether any point has a stroke cap or join of its own.
-    pub fn has_point_styles(&self) -> bool {
-        self.vertices.iter().any(|v| v.cap.is_some() || v.join.is_some())
+    /// Whether any point has a stroke cap of its own or a join other than the layer's `layer_join`.
+    pub fn has_point_styles(&self, layer_join: StrokeJoin) -> bool {
+        self.vertices.iter().any(|v| v.cap.is_some() || v.join.is_some_and(|j| j != layer_join))
     }
 
     /// The fill path: every region's loops.

crates/doc/src/vector_faces.rs

@@ -136,8 +136,8 @@ impl VectorNetwork {
         }
         let k = key(&face.loops);
         match (self.regions.iter().position(|r| key(&r.loops) == k), want) {
-            (Some(i), None | Some(false)) => {
-                self.regions.remove(i);
+            (Some(_), None | Some(false)) => {
+                self.regions.retain(|r| key(&r.loops) != k);
                 Some(false)
             }
             (Some(_), Some(true)) => Some(true),
@@ -525,4 +525,21 @@ mod tests {
         let _ = j.paint(Point::new(f64::NAN, 5.0));
         assert!(interior_point(&BezPath::new()).is_none());
     }
+
+    #[test]
+    fn the_bucket_unfills_a_face_with_duplicate_regions_in_one_click() {
+        let c = Point::new(50.0, 50.0);
+        let mut n = square(0.0, 0.0, 100.0);
+        n.regions.push(n.regions[0].clone());
+        assert_eq!(n.paint(c), Some(false));
+        assert!(!n.fill_contains(c));
+        assert_eq!(n.region_at(c), None);
+        assert_eq!(n.paint(c), Some(true));
+        assert!(n.fill_contains(c));
+
+        let mut e = square(0.0, 0.0, 100.0);
+        e.regions.push(e.regions[0].clone());
+        assert_eq!(e.paint_to(c, Some(false)), Some(false));
+        assert!(!e.fill_contains(c));
+    }
 }

crates/doc/src/vector_regions.rs

@@ -18,8 +18,9 @@ impl VectorNetwork {
     /// second; a segment that doesn't touch the point reached so far (a malformed loop) is taken
     /// as stored. Missing segments are skipped.
     pub fn loop_walk(&self, lp: &[usize]) -> Vec<(usize, bool)> {
-        let Some(first) = lp.first().and_then(|i| self.segments.get(*i)) else { return Vec::new() };
-        let forward_first = match lp.get(1).and_then(|i| self.segments.get(*i)) {
+        let mut existing = lp.iter().filter_map(|i| self.segments.get(*i));
+        let Some(first) = existing.next() else { return Vec::new() };
+        let forward_first = match existing.next() {
             Some(second) => first.b == second.a || first.b == second.b,
             None => true,
         };
@@ -102,10 +103,18 @@ impl VectorNetwork {
         (0..self.regions.len()).rev().find(|r| self.region_contains(*r, p))
     }
 
-    /// Every point on region `r`'s loops (holes' too), each once, sorted.
+    /// Every point on region `r`'s loops (holes' too), each once, sorted (segments or points that
+    /// don't exist are left out).
     pub fn region_points(&self, r: usize) -> Vec<usize> {
         let Some(region) = self.regions.get(r) else { return Vec::new() };
-        let mut out: Vec<usize> = region.loops.iter().flatten().filter_map(|i| self.segments.get(*i)).flat_map(|s| [s.a, s.b]).collect();
+        let mut out: Vec<usize> = region
+            .loops
+            .iter()
+            .flatten()
+            .filter_map(|i| self.segments.get(*i))
+            .flat_map(|s| [s.a, s.b])
+            .filter(|v| *v < self.vertices.len())
+            .collect();
         out.sort_unstable();
         out.dedup();
         out

crates/doc/src/vector_regions_tests.rs

@@ -148,6 +148,28 @@ fn a_loop_that_does_not_close_is_closed_implicitly() {
     assert_eq!(n.region_at(p(300.0, 100.0)), None);
 }
 
+#[test]
+fn missing_segments_are_skipped_wherever_they_sit_in_a_loop() {
+    use figcraft_geom::Shape;
+    let mut n = VectorNetwork::default();
+    square(&mut n, 0.0, 0.0, 200.0);
+    n.regions = vec![region(vec![vec![0, 1, 2]], WindingRule::NonZero)];
+    let control = n.region_path(0).unwrap();
+    let control_walk = n.loop_walk(&[0, 1, 2]);
+    for lp in [vec![99, 0, 1, 2], vec![0, 99, 1, 2], vec![99, 98, 0, 1, 2]] {
+        n.regions = vec![region(vec![lp.clone()], WindingRule::NonZero)];
+        assert_eq!(n.loop_walk(&lp), control_walk, "{lp:?}");
+        assert_eq!(n.region_at(p(100.0, 100.0)), Some(0), "{lp:?}");
+        assert!(n.region_contains(0, p(100.0, 100.0)), "{lp:?}");
+        let path = n.region_path(0).unwrap();
+        assert_eq!(path.elements().len(), control.elements().len(), "{lp:?}");
+        assert!((path.area().abs() - control.area().abs()).abs() < 1e-6, "{lp:?}");
+    }
+    n.regions = vec![region(vec![vec![99]], WindingRule::NonZero)];
+    assert!(n.region_path(0).is_none());
+    assert!(!n.region_contains(0, p(100.0, 100.0)));
+}
+
 #[test]
 fn a_regions_points_are_listed_once() {
     let mut n = nested();
@@ -186,6 +208,19 @@ fn empty_and_damaged_networks_have_no_regions_and_never_panic() {
     }
 }
 
+#[test]
+fn region_points_leave_out_segment_ends_that_do_not_exist() {
+    let mut n = VectorNetwork::default();
+    let ring = square(&mut n, 0.0, 0.0, 100.0);
+    n.regions = vec![region(vec![ring], WindingRule::NonZero)];
+    assert_eq!(n.region_points(0), vec![0, 1, 2, 3]);
+    n.segments[3] = Segment::line(3, 9);
+    assert_eq!(n.region_points(0), vec![0, 1, 2, 3]);
+    assert!(n.region_path(0).is_some());
+    n.regions = vec![region(vec![vec![99]], WindingRule::NonZero)];
+    assert!(n.region_points(0).is_empty());
+}
+
 #[test]
 fn the_topology_key_ignores_moved_points_but_not_new_segments() {
     let mut n = nested();

crates/engine/Cargo.toml

@@ -20,6 +20,7 @@ figcraft-render = { workspace = true }
 figcraft-format = { workspace = true }
 figcraft-svg = { workspace = true }
 figcraft-pdf = { workspace = true }
+craft-docpath = { workspace = true }
 figcraft-plugin = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/engine/clippy.toml

@@ -0,0 +1,39 @@
+# The workspace settings (../../clippy.toml; clippy reads only the nearest file), plus the engine's
+# own rule: shipped engine code reaches the file system only through `file_access`, which enforces
+# the automation roots (#715), so every command is confined without a check of its own.
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
+allow-panic-in-tests = true
+too-many-arguments-threshold = 10
+disallowed-methods = [
+    { path = "std::fs::read", reason = "use file_access::read (automation roots)" },
+    { path = "std::fs::read_to_string", reason = "use file_access::read (automation roots)" },
+    { path = "std::fs::write", reason = "use file_access::write (automation roots)" },
+    { path = "std::fs::metadata", reason = "use file_access::metadata (automation roots)" },
+    { path = "std::fs::symlink_metadata", reason = "use file_access (automation roots)" },
+    { path = "std::fs::read_dir", reason = "use file_access::read_dir (automation roots)" },
+    { path = "std::fs::canonicalize", reason = "use file_access (automation roots)" },
+    { path = "std::fs::copy", reason = "use file_access (automation roots)" },
+    { path = "std::fs::rename", reason = "use file_access (automation roots)" },
+    { path = "std::fs::create_dir", reason = "use file_access::create_dir_all (automation roots)" },
+    { path = "std::fs::create_dir_all", reason = "use file_access::create_dir_all (automation roots)" },
+    { path = "std::fs::remove_file", reason = "use file_access (automation roots)" },
+    { path = "std::fs::remove_dir", reason = "use file_access (automation roots)" },
+    { path = "std::fs::remove_dir_all", reason = "use file_access (automation roots)" },
+    { path = "std::fs::hard_link", reason = "use file_access (automation roots)" },
+    { path = "std::fs::File::open", reason = "use file_access::open (automation roots)" },
+    { path = "std::fs::File::create", reason = "use file_access::write (automation roots)" },
+    { path = "std::fs::File::create_new", reason = "use file_access::write (automation roots)" },
+    { path = "std::fs::OpenOptions::open", reason = "use file_access (automation roots)" },
+    { path = "std::path::Path::exists", reason = "use file_access::exists (automation roots)" },
+    { path = "std::path::Path::try_exists", reason = "use file_access::exists (automation roots)" },
+    { path = "std::path::Path::is_file", reason = "use file_access::metadata (automation roots)" },
+    { path = "std::path::Path::is_dir", reason = "use file_access::is_dir (automation roots)" },
+    { path = "std::path::Path::metadata", reason = "use file_access::metadata (automation roots)" },
+    { path = "std::path::Path::symlink_metadata", reason = "use file_access (automation roots)" },
+    { path = "std::path::Path::read_dir", reason = "use file_access::read_dir (automation roots)" },
+    { path = "std::path::Path::canonicalize", reason = "use file_access (automation roots)" },
+    { path = "figcraft_format::write_file_atomic", reason = "use file_access::write (automation roots)" },
+    { path = "figcraft_format::save_file", reason = "use file_access::write (automation roots)" },
+    { path = "figcraft_format::load_file", reason = "use file_access::read (automation roots)" },
+]

crates/engine/src/al_behaviour_tests.rs

@@ -180,6 +180,23 @@ fn vertical_wrap_columns_take_arrows_and_drops() {
     assert_eq!(line, Some([30.0, 48.0, 50.0, 48.0]));
 }
 
+#[test]
+fn adding_auto_layout_to_a_frame_keeps_its_size() {
+    // An existing frame with content hugs it (padding inferred, so the size is preserved);
+    // an empty one keeps its size instead of collapsing to its padding.
+    let mut s = Session::new();
+    let f = id(s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 300, "height": 200})).unwrap());
+    rect(&mut s, f, 40.0, 20.0, "#FF0000");
+    s.execute("layout.add", &json!({"ids": [f]})).unwrap();
+    assert_eq!(sizing(&s, f), (Sizing::Hug, Sizing::Hug));
+    assert_eq!(size(&s, f), (300.0, 200.0));
+    // An empty frame keeps its size too.
+    let e = id(s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 300, "height": 200})).unwrap());
+    s.execute("layout.add", &json!({"ids": [e]})).unwrap();
+    assert_eq!(sizing(&s, e), (Sizing::Fixed, Sizing::Fixed));
+    assert_eq!(size(&s, e), (300.0, 200.0));
+}
+
 #[test]
 fn canvas_stacking_paints_and_exports_the_first_child_on_top() {
     // Documented: the last child is on top by default; "first on top" flips which one is drawn

crates/engine/src/al_keys_tests.rs

@@ -74,6 +74,27 @@ fn along_the_flow_skips_hidden_and_absolute_siblings() {
     assert_eq!(kids(&s, col), vec![c1, c0], "Right does nothing in a lone column");
 }
 
+#[test]
+fn single_item_wrapped_lines_move_and_drop_by_line() {
+    let mut s = Session::new();
+    // Full-width items: one per row.
+    let row = al(&mut s, None, "horizontal", 160.0, 200.0);
+    set(&mut s, row, json!({"wrap": true}));
+    let k: Vec<NodeId> = (0..2).map(|_| rect(&mut s, row, 160.0, 20.0)).collect();
+    assert_eq!(s.doc().unwrap().world_bounds(k[1]).unwrap().y0, 30.0, "second row");
+    let slot = crate::drop::auto_layout_slot(s.doc().unwrap(), row, figcraft_geom::Point::new(10.0, 35.0), &[]);
+    assert_eq!(slot, Some((1, Some([-2.0, 30.0, -2.0, 50.0]))));
+    arrow(&mut s, &[k[1]], 0, -1);
+    assert_eq!(kids(&s, row), vec![k[1], k[0]]);
+
+    // Full-height items in a vertical wrap: one per column.
+    let col = al(&mut s, None, "vertical", 200.0, 160.0);
+    set(&mut s, col, json!({"wrap": true}));
+    let c: Vec<NodeId> = (0..3).map(|_| rect(&mut s, col, 20.0, 160.0)).collect();
+    arrow(&mut s, &[c[2]], -1, 0);
+    assert_eq!(kids(&s, col), vec![c[0], c[2], c[1]]);
+}
+
 #[test]
 fn wrapped_rows_move_up_and_down_a_row() {
     let mut s = Session::new();

crates/engine/src/autosave_tests.rs

@@ -73,3 +73,52 @@ fn autosaves_keep_their_flag_in_the_file() {
     assert!(!autosave(&mut t));
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn files_that_save_themselves_still_get_checkpoints() {
+    let dir = std::env::temp_dir().join(format!("figcraft-autosave-on-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("auto.figcraft").to_string_lossy().to_string();
+    let mut s = Session::new();
+    s.execute("pref.autoSave", &json!({"on": true})).unwrap();
+    rect(&mut s, 0.0);
+    s.execute("file.save", &json!({"path": path})).unwrap();
+    assert!(autosave(&mut s), "saved, but changed since the last version");
+    assert!(!autosave(&mut s), "no change since the checkpoint");
+    // Just opened: nothing to checkpoint.
+    let mut t = Session::empty();
+    t.execute("pref.autoSave", &json!({"on": true})).unwrap();
+    t.execute("file.open", &json!({"path": path})).unwrap();
+    assert!(!autosave(&mut t));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_file_encoded_elsewhere_is_saved_as_of_its_snapshot() {
+    use crate::cmd::file::FileSnapshot;
+    let dir = std::env::temp_dir().join(format!("figcraft-snapshot-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("snap.figcraft").to_string_lossy().to_string();
+    let mut s = Session::new();
+    s.execute("file.save", &json!({"path": path})).unwrap();
+    rect(&mut s, 0.0);
+    let file = FileSnapshot::of(s.ds().unwrap());
+    let bytes = file.encode().unwrap();
+    rect(&mut s, 50.0);
+    assert!(file.save(&mut s, &bytes).unwrap());
+    assert!(s.ds().unwrap().is_dirty(), "the edit since the snapshot is still unsaved");
+    let mut t = Session::empty();
+    t.execute("file.open", &json!({"path": path})).unwrap();
+    assert_eq!(t.ds().unwrap().doc.page_content_bounds(t.ds().unwrap().page).unwrap().x1, 10.0, "the file is the snapshot");
+    // Saved meanwhile: the older bytes never overwrite the newer file.
+    let file = FileSnapshot::of(s.ds().unwrap());
+    let bytes = file.encode().unwrap();
+    rect(&mut s, 100.0);
+    s.execute("file.save", &json!({})).unwrap();
+    assert!(!file.save(&mut s, &bytes).unwrap());
+    assert!(!s.ds().unwrap().is_dirty());
+    let mut t = Session::empty();
+    t.execute("file.open", &json!({"path": path})).unwrap();
+    assert_eq!(t.ds().unwrap().doc.page_content_bounds(t.ds().unwrap().page).unwrap().x1, 110.0);
+    let _ = std::fs::remove_dir_all(&dir);
+}

crates/engine/src/batch_rollback_tests.rs

@@ -61,3 +61,25 @@ fn failed_plugin_run_restores_each_document_without_restoring_unrelated_state()
     assert_eq!(s.journal, before_journal);
     assert_eq!(s.message, before_message);
 }
+
+#[test]
+fn failed_group_keeps_the_redo_steps() {
+    let mut s = Session::new();
+    s.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+    assert!(s.undo().unwrap());
+    assert_eq!(s.undo_depth().1, 1);
+
+    let result = s.execute(
+        "command.batch",
+        &json!({
+            "commands": [
+                {"command": "shape.rectangle", "params": {"x": 20, "y": 20, "width": 10, "height": 10}},
+                {"command": "node.set", "params": {"id": 999999, "props": {"name": "must fail"}}}
+            ]
+        }),
+    );
+
+    assert!(result.is_err());
+    assert_eq!(s.undo_depth().1, 1, "the redo step survives the failed batch");
+    assert!(s.redo().unwrap());
+}

crates/engine/src/batch_step_ref_tests.rs

@@ -0,0 +1,112 @@
+use serde_json::json;
+
+use crate::{EngineError, Session};
+
+fn id(value: &serde_json::Value) -> crate::NodeId {
+    crate::params::id_of(&value["id"]).unwrap()
+}
+
+#[test]
+fn later_steps_target_layers_created_by_earlier_steps() {
+    let mut s = Session::new();
+    let results = s
+        .execute(
+            "command.batch",
+            &json!({
+                "label": "Card",
+                "commands": [
+                    {"command": "node.create", "params": {"type": "frame", "x": 0, "y": 0, "width": 200, "height": 100}},
+                    {"command": "node.create", "params": {"type": "rectangle", "parent": {"$step": 0}, "x": 10, "y": 10, "width": 20, "height": 20}},
+                    {"command": "node.set", "params": {"ids": [{"$step": 1}], "props": {"name": "Swatch"}}}
+                ]
+            }),
+        )
+        .unwrap();
+
+    let frame = id(&results[0]);
+    let rect = id(&results[1]);
+    let doc = s.doc().unwrap();
+    assert_eq!(doc.node(rect).unwrap().parent, Some(frame));
+    assert_eq!(doc.node(rect).unwrap().name, "Swatch");
+    assert_eq!(s.ds().unwrap().history.undo.len(), 1, "still one undo step");
+}
+
+#[test]
+fn field_picks_another_part_of_the_result() {
+    let mut s = Session::new();
+    let results = s
+        .execute(
+            "command.batch",
+            &json!({"commands": [
+                {"command": "node.create", "params": {"type": "frame", "width": 50, "height": 50}},
+                {"command": "node.create", "params": {"type": "text", "text": "hi", "parent": {"$step": 0, "field": "id"}}}
+            ]}),
+        )
+        .unwrap();
+    assert_eq!(s.doc().unwrap().node(id(&results[1])).unwrap().parent, Some(id(&results[0])));
+}
+
+#[test]
+fn bad_references_fail_and_roll_back() {
+    let mut s = Session::new();
+    let before = s.doc().unwrap().node(s.page().unwrap()).unwrap().children.len();
+    let frame = json!({"command": "node.create", "params": {"type": "frame", "width": 10, "height": 10}});
+    for (bad, needle) in [
+        (json!({"$step": 1}), "earlier step"),
+        (json!({"$step": 5}), "earlier step"),
+        (json!({"$step": -1}), "step index"),
+        (json!({"$step": "0"}), "step index"),
+        (json!({"$step": 0, "field": "nope"}), "no `nope`"),
+        (json!({"$step": 0, "field": 3}), "`field` must be a string"),
+        (json!({"$step": 0, "extra": true}), "not `extra`"),
+    ] {
+        let r = s.execute("command.batch", &json!({"commands": [frame, {"command": "node.set", "params": {"ids": [bad], "props": {"name": "x"}}}]}));
+        match r {
+            Err(EngineError::BadParams { msg, .. }) => assert!(msg.contains(needle), "{msg} should mention {needle}"),
+            other => panic!("expected BadParams for {bad}, got {other:?}"),
+        }
+        assert_eq!(s.doc().unwrap().node(s.page().unwrap()).unwrap().children.len(), before, "rolled back");
+    }
+}
+
+#[test]
+fn deep_params_are_refused_not_overflowed() {
+    let mut s = Session::new();
+    let mut deep = json!(1);
+    for _ in 0..200 {
+        deep = json!([deep]);
+    }
+    let r = s.execute("command.batch", &json!({"commands": [{"command": "select.none", "params": {"x": deep}}]}));
+    assert!(matches!(r, Err(EngineError::BadParams { .. })));
+}
+
+#[test]
+fn text_that_looks_like_a_reference_is_left_alone() {
+    let mut s = Session::new();
+    let results = s
+        .execute("command.batch", &json!({"commands": [{"command": "node.create", "params": {"type": "text", "text": "$step 0 {\"$step\": 0}"}}]}))
+        .unwrap();
+    let n = s.doc().unwrap().node(id(&results[0])).unwrap().clone();
+    assert!(matches!(n.kind, figcraft_doc::NodeKind::Text(t) if t.characters == "$step 0 {\"$step\": 0}"));
+}
+
+#[test]
+fn a_nested_batch_refers_to_its_own_steps() {
+    let mut s = Session::new();
+    let frame = |name: &str| json!({"command": "node.create", "params": {"type": "frame", "name": name, "width": 100, "height": 100}});
+    let results = s
+        .execute(
+            "command.batch",
+            &json!({"commands": [
+                frame("Outer"),
+                {"command": "command.batch", "params": {"commands": [
+                    frame("Inner"),
+                    {"command": "node.create", "params": {"type": "rectangle", "parent": {"$step": 0}, "width": 10, "height": 10}}
+                ]}}
+            ]}),
+        )
+        .unwrap();
+    let inner = &results[1];
+    let rect = s.doc().unwrap().node(id(&inner[1])).unwrap().clone();
+    assert_eq!(rect.parent, Some(id(&inner[0])), "in the nested batch's own first frame, not the outer one");
+}

crates/engine/src/branches.rs

@@ -156,6 +156,22 @@ pub(crate) fn sync(s: &mut Session) {
     }
 }
 
+/// The branches of the file in tab `uid` as saving it now would write them: [`sync`] only puts a
+/// branch tab's latest edits in before the next command.
+pub fn current(s: &Session, uid: u64) -> Vec<Branch> {
+    let Some(ds) = s.docs.iter().find(|d| d.uid == uid) else { return Vec::new() };
+    let mut branches = ds.branches.clone();
+    for d in &s.docs {
+        let Some((_, id)) = d.branch_of.as_ref().filter(|(main, _)| *main == uid) else { continue };
+        let Some(b) = branches.iter_mut().find(|b| b.id == *id) else { continue };
+        b.head = d.document_itself().clone();
+        if d.versions_changed {
+            b.versions = d.versions.clone();
+        }
+    }
+    branches
+}
+
 /// The tab a save writes: the main file's for a branch tab, else the active tab.
 pub fn file_tab(s: &Session) -> usize {
     s.ds().ok().and_then(|d| d.branch_of.as_ref()).and_then(|(m, _)| s.docs.iter().position(|d| d.uid == *m)).unwrap_or(s.active)

crates/engine/src/catalog.rs

@@ -213,6 +213,8 @@ pub static MENU: &[MenuItem] = &[
     m!("Text/Case", "Uppercase", "text.caseUpper"),
     m!("Text/Case", "Lowercase", "text.caseLower"),
     m!("Text/Case", "Title case", "text.caseTitle"),
+    m!("Text", SEP, ""),
+    m!("Text", "Missing fonts…", "text.missingFonts"),
     // Arrange
     m!("Arrange", "Align left", "align.left"),
     m!("Arrange", "Align horizontal centers", "align.hcenter"),
@@ -287,7 +289,7 @@ pub fn items() -> impl Iterator<Item = &'static MenuItem> {
 }
 
 /// Items of FigCraft's own that the parity count leaves out (as it does the `collab.` ones).
-const OWN: [&str; 2] = ["file.newFromTemplate", "help.gettingStarted"];
+const OWN: [&str; 3] = ["file.newFromTemplate", "help.gettingStarted", "text.missingFonts"];
 
 /// Coverage: (implemented, total, missing ids). `extra` lists ids implemented by the UI layer.
 pub fn parity(extra: &[&str]) -> (usize, usize, Vec<&'static str>) {

crates/engine/src/cmd/arrange.rs

@@ -19,6 +19,13 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("align.bottom", "Align bottom", "{ids?}", true, |s, p| align(s, p, Al::Bottom)),
         spec!("distribute.horizontal", "Distribute horizontal spacing", "{ids?, spacing?}", true, |s, p| distribute(s, p, true)),
         spec!("distribute.vertical", "Distribute vertical spacing", "{ids?, spacing?}", true, |s, p| distribute(s, p, false)),
+        spec!(
+            "arrange.spacing",
+            "Spacing",
+            "{ids?, horizontal?, vertical?, fromGesture?} (page units; fromGesture uses the interaction snapshot)",
+            true,
+            spacing
+        ),
         spec!("arrange.tidy", "Tidy up", "{ids?, spacing?}", true, tidy),
         spec!("arrange.packH", "Pack horizontal", "{ids?}", true, |s, p| pack(s, p, true)),
         spec!("arrange.packV", "Pack vertical", "{ids?}", true, |s, p| pack(s, p, false)),
@@ -145,21 +152,28 @@ pub fn rotate_world(doc: &mut Document, id: NodeId, pivot: Point, deg: f64) -> R
     Ok(())
 }
 
+/// Whether aligning `ids` would move anything: a layer alone on the page has nothing to align to.
+pub fn can_align(doc: &Document, ids: &[NodeId]) -> bool {
+    align_target(doc, &roots(doc, ids)).is_some()
+}
+
+/// What `roots` align to: one layer to its parent frame, several to their combined bounds.
+fn align_target(doc: &Document, roots: &[NodeId]) -> Option<Rect> {
+    match roots {
+        [] => None,
+        [id] => {
+            let parent = doc.node(*id)?.parent.filter(|pp| !doc.node(*pp).is_some_and(Node::is_page))?;
+            Some(doc.world_bounds(parent).unwrap_or_default())
+        }
+        _ => Some(doc.bounds_of(roots).unwrap_or_default()),
+    }
+}
+
 fn align(s: &mut Session, p: &Value, a: Al) -> Result<Value> {
     let ids = req_targets("align", s, p)?;
     let doc = s.doc_mut()?;
     let ids = roots(doc, &ids);
-    // One layer aligns within its parent frame; several align to their combined bounds.
-    let target: Rect = if ids.len() == 1 {
-        let Some(id) = ids.first() else { return ok() };
-        let parent = doc.get(*id)?.parent;
-        match parent.filter(|pp| !doc.node(*pp).is_some_and(Node::is_page)) {
-            Some(pp) => doc.world_bounds(pp).unwrap_or_default(),
-            None => return ok(),
-        }
-    } else {
-        doc.bounds_of(&ids).unwrap_or_default()
-    };
+    let Some(target) = align_target(doc, &ids) else { return ok() };
     for i in ids {
         let Some(b) = doc.world_bounds(i) else { continue };
         let (dx, dy) = match a {
@@ -325,8 +339,12 @@ fn zorder(s: &mut Session, p: &Value, z: Z) -> Result<Value> {
         }
     }
     if matches!(z, Z::Back) {
-        for (k, i) in ids.iter().enumerate() {
-            doc.reorder(*i, k)?;
+        let mut next: std::collections::HashMap<NodeId, usize> = std::collections::HashMap::new();
+        for i in &ids {
+            let Some(pp) = doc.get(*i)?.parent else { continue };
+            let k = next.entry(pp).or_insert(0);
+            doc.reorder(*i, *k)?;
+            *k += 1;
         }
     }
     ok()
@@ -535,3 +553,53 @@ pub(crate) fn resize_cmd(s: &mut Session, p: &Value) -> Result<Value> {
     }
     ok()
 }
+
+/// Set the distances between smart-selection tracks without rebuilding/reparenting the layers.
+fn spacing(s: &mut Session, p: &Value) -> Result<Value> {
+    let ids = req_targets("arrange.spacing", s, p)?;
+    // A scrub is absolute from the interaction snapshot, even if tracks overlap or cross.
+    let ds = s.ds()?;
+    let base = ds.interaction.as_ref().filter(|_| boolean(p, "fromGesture") == Some(true)).map(|i| i.doc.clone()).unwrap_or_else(|| ds.doc.clone());
+    let layout = crate::selection_spacing::selection_spacing(&base, &ids);
+    let mut offsets = std::collections::BTreeMap::<NodeId, (Option<f64>, Option<f64>)>::new();
+    let mut any = false;
+    for (key, axis, vertical) in [("horizontal", &layout.horizontal, false), ("vertical", &layout.vertical, true)] {
+        if get(p, key).is_none() {
+            continue;
+        }
+        let value = req_num("arrange.spacing", p, key)?;
+        if value.abs() > 1_000_000.0 {
+            return Err(bad("arrange.spacing", "spacing out of range"));
+        }
+        let axis = axis.as_ref().ok_or_else(|| bad("arrange.spacing", "selection has no spacing on this axis"))?;
+        any = true;
+        for (id, delta) in axis.offsets(value) {
+            if !delta.is_finite() {
+                return Err(bad("arrange.spacing", "non-finite spacing result"));
+            }
+            let pair = offsets.entry(id).or_default();
+            if vertical {
+                pair.1 = Some(delta);
+            } else {
+                pair.0 = Some(delta);
+            }
+        }
+    }
+    if !any {
+        return Err(bad("arrange.spacing", "pass horizontal or vertical spacing"));
+    }
+    let doc = s.doc_mut()?;
+    let mut moves = Vec::new();
+    for (id, (dx, dy)) in offsets {
+        let (Some(before), Some(now)) = (base.world_bounds(id), doc.world_bounds(id)) else { continue };
+        let (dx, dy) = (dx.map_or(0.0, |d| before.x0 + d - now.x0), dy.map_or(0.0, |d| before.y0 + d - now.y0));
+        if !dx.is_finite() || !dy.is_finite() {
+            return Err(bad("arrange.spacing", "non-finite spacing result"));
+        }
+        moves.push((id, dx, dy));
+    }
+    for (id, dx, dy) in moves {
+        move_world(doc, id, dx, dy)?;
+    }
+    ok()
+}

crates/engine/src/cmd/component.rs

@@ -68,7 +68,7 @@ pub fn specs() -> Vec<CommandSpec> {
             let cmd = "instance.create";
             let c = req_id(cmd, p, "component")?;
             let page = s.page()?;
-            let parent = id(p, "parent").unwrap_or(page);
+            let parent = crate::params::opt_id(cmd, p, "parent")?.unwrap_or(page);
             let doc = s.doc_mut()?;
             let c = main_of(doc, c).ok_or_else(|| bad(cmd, "`component` must be a component or component set"))?;
             let (x, y) = match (num(p, "x"), num(p, "y")) {
@@ -678,8 +678,8 @@ fn push_changes(s: &mut Session, p: &Value) -> Result<Value> {
     if !doc.contains(component) {
         return Err(EngineError::Disabled(cmd.into(), "the main component was deleted (use component.restoreMain)".into()));
     }
-    // Copy every overridden layer's values to its source in the main (geometry, swaps, property
-    // values and slot content stay with the instance).
+    // Copy every overridden layer's values to its source in the main (geometry, resizing, swaps,
+    // property values and slot content stay with the instance).
     let mut pushed = 0;
     for d in doc.subtree(inst) {
         let Some(n) = doc.node(d).cloned() else { continue };
@@ -691,7 +691,7 @@ fn push_changes(s: &mut Session, p: &Value) -> Result<Value> {
         let groups: BTreeSet<String> = n
             .overrides
             .iter()
-            .filter(|g| !matches!(g.as_str(), "size" | "position" | "component" | "props" | SLOT) && !(d == inst && g.as_str() == "name"))
+            .filter(|g| !(matches!(g.as_str(), "size" | "resizing" | "position" | "component" | "props" | SLOT) || d == inst && g.as_str() == "name"))
             .cloned()
             .collect();
         for g in &groups {

crates/engine/src/cmd/create.rs

@@ -7,7 +7,7 @@ use serde_json::{Value, json};
 
 use super::{CommandSpec, ok};
 use crate::params::*;
-use crate::{EngineError, Result, Session, bad, spec};
+use crate::{Result, Session, bad, spec};
 
 /// Frame presets shown by the Frame tool (category, name, width, height).
 pub const FRAME_PRESETS: &[(&str, &str, f64, f64)] = &[
@@ -167,7 +167,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
     let t = string(p, "type").ok_or_else(|| bad(cmd, "`type` is required"))?;
     let (mut kind, base) = kind_for(&t).ok_or_else(|| bad(cmd, format!("unknown type `{t}`")))?;
     let page = s.page()?;
-    let parent = id(p, "parent").unwrap_or(page);
+    let parent = crate::params::opt_id(cmd, p, "parent")?.unwrap_or(page);
     let doc = s.doc()?;
     let pn = doc.get(parent)?;
     if !pn.kind.is_container() {
@@ -216,7 +216,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
         }
     }
     if let NodeKind::Text(td) = &mut kind {
-        td.characters = string(p, "text").or_else(|| string(p, "characters")).unwrap_or_default();
+        td.characters = super::props::normalize_line_endings(&string(p, "text").or_else(|| string(p, "characters")).unwrap_or_default());
         if w > 0.0 {
             td.auto_resize = TextAutoResize::Height;
         }
@@ -242,7 +242,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
     let doc = ds.doc_mut();
     let nid = doc.alloc_id();
     let mut node = if base == "Section" { Node::new_section(nid, name, w, h) } else { Node::new(nid, kind, name, w, h) };
-    if app_text && let Some(fills) = crate::tools::readable_text_fills(doc, doc.page_of(parent).unwrap_or(page)) {
+    if app_text && let Some(fills) = crate::tools::readable_text_fills(doc, parent) {
         node.fills = fills;
     }
     node.transform = space.inverse() * figcraft_geom::Affine::translate((x + offset.0, y + offset.1));
@@ -255,7 +255,7 @@ pub fn create(s: &mut Session, p: &Value) -> Result<Value> {
         node.width = tw;
         node.height = th;
     }
-    let index = num(p, "index").map(|i| i.max(0.0) as usize);
+    let index = crate::params::opt_index(cmd, p, "index")?;
     doc.insert(node, parent, index)?;
     if let Some(Value::Object(props)) = get(p, "props") {
         super::props::apply(cmd, doc, nid, props)?;
@@ -313,12 +313,12 @@ fn free_spot(s: &Session, w: f64, h: f64) -> Result<(f64, f64)> {
 
 #[cfg(not(target_arch = "wasm32"))]
 fn read_path(path: &str) -> Result<Vec<u8>> {
-    std::fs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))
+    crate::file_access::read(path)
 }
 
 #[cfg(target_arch = "wasm32")]
 fn read_path(path: &str) -> Result<Vec<u8>> {
-    Err(EngineError::Other(format!("{path}: files can't be read in the browser")))
+    Err(crate::EngineError::Other(format!("{path}: files can't be read in the browser")))
 }
 
 /// Place an image as a rectangle with an image fill (Figma's image layer).
@@ -340,7 +340,7 @@ pub fn place_image(s: &mut Session, p: &Value) -> Result<Value> {
         _ => ImageScaleMode::Fill,
     };
     let page = s.page()?;
-    let parent = id(p, "parent").unwrap_or(page);
+    let parent = crate::params::opt_id(cmd, p, "parent")?.unwrap_or(page);
     let ds = s.ds_mut()?;
     let doc = ds.doc_mut();
     let (hash, iw, ih) = figcraft_format::add_image(doc, bytes).map_err(|e| bad(cmd, e.to_string()))?;

crates/engine/src/cmd/edit.rs

@@ -18,13 +18,20 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "edit.duplicate",
             "Duplicate",
-            "{ids?, dx?, dy? (offset; default 0 for frames-in-place... Figma offsets top-level frames to the right)}",
+            "{ids?, dx?, dy? (page offset; default: the offset of the last duplicate when ids are its copies, still selected; else top-level frames to the right with a 100 gap, everything else in place)}",
             true,
             duplicate
         ),
         spec!("edit.copy", "Copy", "{ids?}", false, copy),
         spec!("edit.cut", "Cut", "{ids?}", true, cut),
         spec!("edit.paste", "Paste", "{parent?, x?, y? (page coordinates of the pasted top-left)}", true, paste),
+        spec!(
+            "edit.pasteDesignLayers",
+            "Paste design layers",
+            "{html (the clipboard's HTML) | data (base64 of the clipboard's design data, at most 256 MB), parent?, x?, y?}  layers copied from another design app (a .fig canvas in the clipboard's HTML), read like a .fig file (best effort, with `warnings`), pasted as edit.paste pastes",
+            true,
+            paste_design_layers
+        ),
         spec!("edit.pasteOver", "Paste over selection", "{}", true, paste_over),
         spec!("edit.pasteReplace", "Paste to replace", "{ids?}", true, paste_replace),
         spec!("edit.copyProperties", "Copy properties", "{id?}", false, copy_props),
@@ -253,7 +260,7 @@ pub fn specs() -> Vec<CommandSpec> {
             ok()
         }),
         spec!("effect.set", "Set effect", "{ids?, index, effect {..}}", true, |s, p| {
-            let i = req_num("effect.set", p, "index")? as usize;
+            let i = req_index("effect.set", p, "index")?;
             let e: Effect = parse("effect.set", p, "effect")?.ok_or_else(|| bad("effect.set", "`effect` required"))?;
             for id in req_targets("effect.set", s, p)? {
                 let n = s.doc_mut()?.get_mut(id)?;
@@ -302,7 +309,7 @@ pub fn specs() -> Vec<CommandSpec> {
             true,
             |s, p| {
                 let cmd = "export.update";
-                let i = req_num(cmd, p, "index")? as usize;
+                let i = req_index(cmd, p, "index")?;
                 super::file::export_setting(cmd, ExportSetting::default(), p)?;
                 for id in req_targets(cmd, s, p)? {
                     let n = s.doc_mut()?.get_mut(id)?;
@@ -314,7 +321,7 @@ pub fn specs() -> Vec<CommandSpec> {
             }
         ),
         spec!("export.remove", "Remove export setting", "{ids?, index}", true, |s, p| {
-            let i = req_num("export.remove", p, "index")? as usize;
+            let i = req_index("export.remove", p, "index")?;
             for id in req_targets("export.remove", s, p)? {
                 let n = s.doc_mut()?.get_mut(id)?;
                 if i < n.exports.len() {
@@ -412,13 +419,48 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"deleted": ids}))
 }
 
+/// Layers duplicated last (Duplicate or Alt-drag) and their copies, in the same order. While the
+/// copies are the selection, Duplicate places the next copies as far from them as they are from
+/// their sources, measured then: so moving the copies first sets the step.
+#[derive(Clone, Debug)]
+pub struct Duplicated {
+    pub sources: Vec<NodeId>,
+    pub copies: Vec<NodeId>,
+}
+
+impl Duplicated {
+    pub fn is_selection(&self, sel: &[NodeId]) -> bool {
+        let set = |v: &[NodeId]| v.iter().copied().collect::<BTreeSet<_>>();
+        !self.copies.is_empty() && set(&self.copies) == set(sel)
+    }
+
+    /// The page offset from the sources to the copies, if both are still there and the copies move
+    /// freely (an auto layout places its own).
+    fn offset(&self, doc: &Document) -> Option<(f64, f64)> {
+        let free = self
+            .copies
+            .iter()
+            .all(|c| doc.node(*c).is_some_and(|n| n.child_layout.absolute || n.parent.and_then(|p| doc.node(p)).is_none_or(|p| p.layout.is_none())));
+        if !free || self.sources.iter().chain(&self.copies).any(|i| !doc.contains(*i)) {
+            return None;
+        }
+        let (a, b) = (doc.bounds_of(&self.sources)?, doc.bounds_of(&self.copies)?);
+        let d = (b.x0 - a.x0, b.y0 - a.y0);
+        (d.0.is_finite() && d.1.is_finite() && (d.0 != 0.0 || d.1 != 0.0)).then_some(d)
+    }
+}
+
 fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("edit.duplicate", s, p)?;
     let rename = s.prefs.rename_duplicates;
+    let explicit = num(p, "dx").is_some() || num(p, "dy").is_some();
+    let ds = s.ds()?;
+    let roots_now = z_sorted(&ds.doc, &roots(&ds.doc, &ids));
+    let repeat = ds.last_duplicate.as_ref().filter(|d| !explicit && d.is_selection(&roots_now)).and_then(|d| d.offset(&ds.doc));
     let doc = s.doc_mut()?;
-    let ids = z_sorted(doc, &roots(doc, &ids));
+    let ids = roots_now;
     let mut out = Vec::new();
-    for i in ids {
+    for i in ids.iter().copied() {
         let n = doc.get(i)?;
         let parent = n.parent.ok_or_else(|| bad("edit.duplicate", "pages are duplicated with page.duplicate"))?;
         let top_frame = doc.node(parent).is_some_and(Node::is_page) && n.kind.is_frame_like();
@@ -432,30 +474,56 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
             _ if top_frame => (w + 100.0, 0.0),
             _ => (0.0, 0.0),
         };
-        let nn = doc.get_mut(nid)?;
-        nn.transform = Affine::translate((dx, dy)) * nn.transform;
+        match repeat {
+            Some((rx, ry)) => super::arrange::move_world(doc, nid, rx, ry)?,
+            None => {
+                let nn = doc.get_mut(nid)?;
+                nn.transform = Affine::translate((dx, dy)) * nn.transform;
+            }
+        }
         if rename {
+            let nn = doc.get_mut(nid)?;
             nn.name = bump_name(&nn.name);
         }
         out.push(nid);
     }
     s.set_selection(out.clone());
+    s.ds_mut()?.last_duplicate = Some(Duplicated { sources: ids, copies: out.clone() });
     Ok(json!({"ids": out}))
 }
 
 fn bump_name(n: &str) -> String {
     if let Some((base, num)) = n.rsplit_once(' ')
         && let Ok(k) = num.parse::<u64>()
+        && let Some(next) = k.checked_add(1)
     {
-        return format!("{base} {}", k + 1);
+        return format!("{base} {next}");
     }
     format!("{n} 2")
 }
 
 /// The copied form of the selection.
-pub fn copy_to_clipboard(s: &mut Session, ids: &[NodeId]) -> Result<()> {
+pub fn copy_to_clipboard(s: &mut Session, cmd: &str, ids: &[NodeId]) -> Result<()> {
     let ds = s.ds()?;
-    let doc = &ds.doc;
+    // Pages are not layers: they can't be pasted anywhere.
+    let layers: Vec<NodeId> = ids.iter().copied().filter(|i| !ds.doc.node(*i).is_some_and(Node::is_page)).collect();
+    if layers.is_empty() && !ids.is_empty() {
+        return Err(EngineError::Disabled(cmd.into(), "pages can't be copied; use page.duplicate".into()));
+    }
+    let (nodes, images, bounds) = copied(&ds.doc, &layers);
+    let (source, source_path, uid) = (ds.doc.clone(), ds.path.clone(), ds.uid);
+    s.clipboard.source = Some(source);
+    s.clipboard.source_path = source_path;
+    s.clipboard.source_doc = uid;
+    s.clipboard.nodes = nodes;
+    s.clipboard.images = images;
+    s.clipboard.bounds = bounds;
+    Ok(())
+}
+
+type Copied = (Vec<(NodeId, Vec<Node>)>, BTreeMap<String, ImageData>, Option<figcraft_geom::Rect>);
+
+fn copied(doc: &Document, ids: &[NodeId]) -> Copied {
     let ids = z_sorted(doc, &roots(doc, ids));
     let mut nodes = Vec::new();
     let mut images = BTreeMap::new();
@@ -478,28 +546,73 @@ pub fn copy_to_clipboard(s: &mut Session, ids: &[NodeId]) -> Result<()> {
         nodes.push((*i, sub));
     }
     let bounds = doc.bounds_of(&ids);
-    let uid = ds.uid;
-    let source = Some(ds.doc.clone());
-    let source_path = ds.path.clone();
-    s.clipboard.source = source;
-    s.clipboard.source_path = source_path;
-    s.clipboard.nodes = nodes;
-    s.clipboard.images = images;
-    s.clipboard.bounds = bounds;
-    s.clipboard.source_doc = uid;
-    Ok(())
+    (nodes, images, bounds)
+}
+
+/// The markers around the copied layers in the clipboard's HTML, spelt as that format spells them.
+pub const CLIP_OPEN: &str = "(figma)";
+pub const CLIP_CLOSE: &str = "(/figma)";
+/// Largest design data read from the clipboard: the `.fig` import's own canvas cap (256 MB). Its
+/// base64 is checked first, so neither the text nor the decoded bytes can pass it.
+const MAX_CLIP_DATA: usize = 256 * 1024 * 1024;
+const MAX_CLIP_BASE64: usize = MAX_CLIP_DATA.div_ceil(3) * 4;
+
+/// Base64 `text` (whitespace ignored, padding optional) when it fits [`MAX_CLIP_DATA`].
+fn clip_base64(text: &str) -> Option<Vec<u8>> {
+    use base64::Engine as _;
+    if text.bytes().filter(|b| !b.is_ascii_whitespace()).count() > MAX_CLIP_BASE64 {
+        return None;
+    }
+    let b64: String = text.chars().filter(|c| !c.is_ascii_whitespace()).collect();
+    base64::engine::general_purpose::STANDARD.decode(&b64).or_else(|_| base64::engine::general_purpose::STANDARD_NO_PAD.decode(&b64)).ok()
+}
+
+/// Layers copied from another design app travel in the clipboard's HTML as a `.fig` canvas in
+/// base64 between [`CLIP_OPEN`] and [`CLIP_CLOSE`]. This gives those bytes, or `None` when the HTML
+/// holds no readable design data (it may just mention the marker).
+pub fn design_clipboard_buffer(html: &str) -> Option<Vec<u8>> {
+    let start = html.find(CLIP_OPEN)? + CLIP_OPEN.len();
+    let len = html.get(start..)?.find(CLIP_CLOSE)?;
+    let bytes = clip_base64(html.get(start..start + len)?)?;
+    figcraft_format::fig::is_fig(&bytes).then_some(bytes)
+}
+
+fn paste_design_layers(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "edit.pasteDesignLayers";
+    let bytes = match (string(p, "html"), string(p, "data")) {
+        (Some(html), _) => design_clipboard_buffer(&html).ok_or_else(|| bad(CMD, "the HTML holds no copied design layers"))?,
+        (None, Some(d)) => clip_base64(&d).ok_or_else(|| bad(CMD, "`data` is not base64 of at most 256 MB"))?,
+        (None, None) => return Err(bad(CMD, "pass `html` or `data`")),
+    };
+    let other = super::file::load_fig(&bytes, "Pasted layers").ok_or_else(|| bad(CMD, "the data is not copied design layers"))??;
+    let doc = std::sync::Arc::new(other.doc);
+    let tops: Vec<NodeId> = doc.pages.iter().filter_map(|pg| doc.node(*pg)).flat_map(|pg| pg.children.iter().copied()).collect();
+    if tops.is_empty() {
+        return Err(EngineError::Disabled(CMD.into(), "the copied layers came in empty".into()));
+    }
+    let (nodes, images, bounds) = copied(&doc, &tops);
+    let props = s.clipboard.props.take();
+    // No open file has id 0. So paste treats this copy as a copy from a different file.
+    s.clipboard = crate::Clipboard { nodes, images, props, bounds, source_doc: 0, source: Some(doc), source_path: None };
+    let mut out = paste(s, p)?;
+    if !other.issues.is_empty() {
+        out["warnings"] = json!(other.issues);
+    }
+    Ok(out)
 }
 
 fn copy(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("edit.copy", s, p)?;
-    copy_to_clipboard(s, &ids)?;
+    copy_to_clipboard(s, "edit.copy", &ids)?;
     Ok(json!({"copied": s.clipboard.nodes.len()}))
 }
 
 fn cut(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("edit.cut", s, p)?;
-    copy_to_clipboard(s, &ids)?;
-    delete(s, &json!({"ids": ids}))
+    copy_to_clipboard(s, "edit.cut", &ids)?;
+    let doc = s.doc()?;
+    let layers: Vec<NodeId> = ids.into_iter().filter(|i| !doc.node(*i).is_some_and(Node::is_page)).collect();
+    delete(s, &json!({"ids": layers}))
 }
 
 /// Paste the clipboard under `parent` with the copied top-left moved to `at` (page coords).
@@ -803,7 +916,8 @@ pub fn opacity_from_digits(digits: &str) -> Option<f32> {
     let mut n = 0u32;
     let mut count = 0;
     for c in digits.chars() {
-        n = n * 10 + c.to_digit(10)?;
+        // Input-derived: a number that outgrows `u32` stops the scan (None); it never wraps.
+        n = n.checked_mul(10)?.checked_add(c.to_digit(10)?)?;
         count += 1;
     }
     match count {
@@ -944,21 +1058,37 @@ fn batch_rename(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"names": names.iter().map(|(i, n)| json!({"id": i, "name": n})).collect::<Vec<_>>()}))
 }
 
+/// Char index of the first case-insensitive occurrence of `needle` in `hay` at or after `from`.
+/// Works on char indices (what `replace_range` takes), so lowercasing never shifts offsets.
+fn find_ci(hay: &[char], needle: &[char], from: usize) -> Option<usize> {
+    if needle.is_empty() {
+        return None;
+    }
+    (from..hay.len())
+        .find(|&i| hay.get(i..i + needle.len()).is_some_and(|w| w.iter().zip(needle).all(|(a, b)| a == b || a.to_lowercase().eq(b.to_lowercase()))))
+}
+
 fn find_replace(s: &mut Session, p: &Value) -> Result<Value> {
     let find = req_string("edit.findReplace", p, "find")?;
     if find.is_empty() {
         return Err(bad("edit.findReplace", "`find` is empty"));
     }
-    let replace = string(p, "replace");
+    // Line breaks stored as the editor stores them (CRLF, CR, U+2028 and U+2029 become LF).
+    let replace = string(p, "replace").map(|r| super::props::normalize_line_endings(&r));
     let names = boolean(p, "layerNames").unwrap_or(false);
     let page = s.page()?;
     let doc = s.doc_mut()?;
     let mut hits = Vec::new();
-    let lower = find.to_lowercase();
+    let needle: Vec<char> = find.chars().collect();
+    let r_chars: Vec<char> = replace.as_deref().map(|r| r.chars().collect()).unwrap_or_default();
     for i in doc.subtree(page) {
         let Some(n) = doc.node(i) else { continue };
-        let text_hit = matches!(&n.kind, NodeKind::Text(t) if t.characters.to_lowercase().contains(&lower));
-        let name_hit = names && n.name.to_lowercase().contains(&lower);
+        let text: Option<Vec<char>> = match &n.kind {
+            NodeKind::Text(t) => Some(t.characters.chars().collect()),
+            _ => None,
+        };
+        let text_hit = text.as_deref().is_some_and(|c| find_ci(c, &needle, 0).is_some());
+        let name_hit = names && find_ci(&n.name.chars().collect::<Vec<_>>(), &needle, 0).is_some();
         if !(text_hit || name_hit) || n.is_page() {
             continue;
         }
@@ -966,19 +1096,27 @@ fn find_replace(s: &mut Session, p: &Value) -> Result<Value> {
         if let Some(r) = &replace {
             let n = doc.get_mut(i)?;
             if names && name_hit {
-                n.name = n.name.replace(find.as_str(), r);
+                let chars: Vec<char> = n.name.chars().collect();
+                let mut out = String::new();
+                let mut at = 0;
+                while let Some(pos) = find_ci(&chars, &needle, at) {
+                    out.extend(chars.get(at..pos).unwrap_or_default());
+                    out.push_str(r);
+                    at = pos + needle.len();
+                }
+                out.extend(chars.get(at..).unwrap_or_default());
+                n.name = out;
             }
-            if let NodeKind::Text(t) = &mut n.kind {
-                // Replace occurrence by occurrence so styles shift correctly.
-                let mut guard = 0;
-                while let Some(pos) = t.characters.find(find.as_str()) {
-                    let start = t.characters.get(..pos).map(|x| x.chars().count()).unwrap_or(0);
-                    let len = find.chars().count();
-                    t.replace_range(start, start + len, r);
-                    guard += 1;
-                    if guard > 10_000 || r.contains(find.as_str()) {
-                        break;
-                    }
+            if let (NodeKind::Text(t), Some(mut chars)) = (&mut n.kind, text) {
+                // Replace occurrence by occurrence so styles shift correctly. The search resumes
+                // after each inserted replacement, so a replacement that matches `find` (in any
+                // case) neither loops forever nor stops the other occurrences.
+                let mut cursor = 0;
+                for _ in 0..10_000 {
+                    let Some(start) = find_ci(&chars, &needle, cursor) else { break };
+                    t.replace_range(start, start + needle.len(), r);
+                    chars.splice(start..start + needle.len(), r_chars.iter().copied());
+                    cursor = start + r_chars.len();
                 }
             }
         }
@@ -1018,9 +1156,34 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
             .collect(),
         None => Vec::new(),
     };
+    let mut warnings = font_style_warnings(&s.ds()?.doc, &ids, &props);
+    // Auto layout keys go to the layers that can have auto layout; with none among the targets,
+    // the first refuses them (`props::layout_mut`).
+    let layout_keys: Vec<&str> = props.keys().map(String::as_str).filter(|k| super::props::LAYOUT_KEYS.contains(k)).collect();
+    let mut without_layout = props.clone();
+    let mut skipped = BTreeSet::new();
+    if !layout_keys.is_empty() {
+        let doc = &s.ds()?.doc;
+        let frame_like = |i: &NodeId| doc.node(*i).is_some_and(|n| n.kind.is_frame_like());
+        if ids.iter().any(frame_like) {
+            skipped = ids.iter().copied().filter(|i| !frame_like(i)).collect();
+            without_layout.retain(|k, _| !layout_keys.contains(&k.as_str()));
+        }
+        if !skipped.is_empty() {
+            let names: Vec<String> =
+                skipped.iter().take(10).filter_map(|i| doc.node(*i)).map(|n| format!("{} “{}” ({})", n.id, n.name, n.kind.type_name())).collect();
+            let more = if skipped.len() > names.len() { format!(" and {} more", skipped.len() - names.len()) } else { String::new() };
+            warnings.push(format!(
+                "{} skipped on {}{more}: only frames, components and instances have auto layout",
+                layout_keys.iter().map(|k| format!("`{k}`")).collect::<Vec<_>>().join(", "),
+                names.join(", ")
+            ));
+        }
+    }
     let doc = s.doc_mut()?;
     for i in ids {
-        super::props::apply("node.set", doc, i, &props)?;
+        let props = if skipped.contains(&i) { &without_layout } else { &props };
+        super::props::apply("node.set", doc, i, props)?;
     }
     if let Some(o) = pivot {
         for (i, q) in pinned {
@@ -1030,7 +1193,43 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
             }
         }
     }
-    ok()
+    if warnings.is_empty() { ok() } else { Ok(json!({"ok": true, "warnings": warnings})) }
+}
+
+/// A `fontStyle` draws in the family's face nearest to it, as a text layer resolves it. When that
+/// face has another weight or slant than the name asks for ("Black" on a family whose heaviest is
+/// Bold), say which face it is. Families that aren't installed, and names that match a style or a
+/// named instance (spelled any way: "SemiBold", "Semi Bold"), say nothing.
+fn font_style_warnings(doc: &figcraft_doc::Document, ids: &[NodeId], props: &serde_json::Map<String, Value>) -> Vec<String> {
+    let Some(style) = props.get("fontStyle").and_then(Value::as_str) else { return Vec::new() };
+    let mut families: Vec<String> = match props.get("fontFamily").and_then(Value::as_str) {
+        Some(f) => vec![f.to_string()],
+        None => ids
+            .iter()
+            .filter_map(|i| doc.node(*i))
+            .filter_map(|n| n.kind.text())
+            .flat_map(|t| t.spans().into_iter().map(|(_, _, st)| st.font_family.clone()).collect::<Vec<_>>())
+            .collect(),
+    };
+    families.sort();
+    families.dedup();
+    let norm = |s: &str| s.to_lowercase().replace([' ', '-', '_'], "");
+    let (want_w, want_i) = (i32::from(figcraft_doc::style_weight(style)), style.to_lowercase().contains("italic"));
+    families
+        .into_iter()
+        .filter_map(|family| {
+            let styles = figcraft_text::family_styles(&family);
+            if styles.is_empty() || styles.iter().any(|x| norm(x) == norm(style)) {
+                return None;
+            }
+            let face = figcraft_text::find_face(&family, style).filter(|f| f.family.eq_ignore_ascii_case(&family))?;
+            let w = face.axis("wght").map_or(i32::from(face.weight), |a| a.clamp(f64::from(want_w)).round() as i32);
+            if face.instance(style).is_some() || (w == want_w && face.italic == want_i) {
+                return None;
+            }
+            Some(format!("{family} has no `{style}` style: it draws in {}, the nearest (it has: {})", face.style, styles.join(", ")))
+        })
+        .collect()
 }
 
 /// `stroke.widthProfile`: a preset or points (through `node.set`'s `widthProfile`, so instances
@@ -1109,7 +1308,7 @@ fn paint_list(s: &mut Session, p: &Value, fills: bool, add: bool) -> Result<Valu
 fn paint_set(s: &mut Session, p: &Value, fills: bool) -> Result<Value> {
     let cmd = if fills { "fill.set" } else { "stroke.set" };
     let ids = req_targets(cmd, s, p)?;
-    let idx = num(p, "index").map(|x| x.max(0.0) as usize);
+    let idx = opt_index(cmd, p, "index")?;
     let new_paint = match get(p, "paint") {
         Some(v) => Some(paint_of(v).ok_or_else(|| bad(cmd, "invalid paint"))?),
         None => None,
@@ -1157,7 +1356,7 @@ fn pattern_fill(s: &mut Session, p: &Value) -> Result<Value> {
     const CMD: &str = "fill.pattern";
     let src = req_id(CMD, p, "source")?;
     let doc = s.doc()?;
-    if !doc.node(src).is_some_and(|n| !n.is_page()) {
+    if doc.node(src).is_none_or(|n| n.is_page()) {
         return Err(bad(CMD, "`source` must be a layer"));
     }
     if req_targets(CMD, s, p)?.iter().any(|t| doc.is_ancestor(*t, src)) {

crates/engine/src/cmd/file.rs

@@ -30,7 +30,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "file.open",
             "Open",
-            "{path, variables? (REST: the local variables JSON as an object, JSON text or a path; default `<name>.variables.json` or `variables.json` next to the file)} (.figcraft, .json: FigCraft or REST API file JSON, .fig (best effort), .svg, .png, .jpg …); REST and .fig imports return `warnings`",
+            "{path | data (base64) + name (tells the format; opens as a new unsaved document), variables? (REST: the local variables JSON as an object, JSON text or a path; default `<name>.variables.json` or `variables.json` next to the file)} (.figcraft, .json: FigCraft or REST API file JSON, .fig (best effort), .svg, .png, .jpg …); REST and .fig imports return `warnings`; a file opened anew returns `summary` {name, pages, layers, images} (one that was already open just returns its `index`)",
             false,
             open
         ),
@@ -41,8 +41,20 @@ pub fn specs() -> Vec<CommandSpec> {
             false,
             open_recent
         ),
-        spec!("file.save", "Save", "{path?} (programmatic saves need a path the first time)", false, save),
-        spec!("file.saveAs", "Save as", "{path}", false, save_as),
+        spec!(
+            "file.save",
+            "Save",
+            "{path?} (programmatic saves need a path the first time); a .fig path writes an experimental export copy of the shown document with `warnings`, keeping the native path, unsaved changes and version preview",
+            false,
+            save
+        ),
+        spec!(
+            "file.saveAs",
+            "Save as",
+            "{path} (no extension adds .figcraft); a .fig path writes an experimental export copy of the shown document with `warnings`, keeping the native path, unsaved changes and version preview",
+            false,
+            save_as
+        ),
         spec!(
             "file.export",
             "Export",
@@ -74,7 +86,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "file.import",
             "Import",
-            "{path | data (base64) + name, x?, y?, center? (SVG: centre it on x, y), variables? (REST: the local variables JSON as an object, JSON text or a path)}  SVG becomes an editable frame (shapes, text, gradients, masks, effects; with `warnings` for what it left out), images become image layers, .figcraft, REST API file JSON and .fig pages are appended with their variables and flows (REST and .fig: with `warnings`)",
+            "{path | data (base64) + name, x?, y?, center? (SVG: centre it on x, y), variables? (REST: the local variables JSON as an object, JSON text or a path)}  SVG becomes an editable frame (shapes, text, gradients, masks, effects; with `warnings` for what it left out), images become image layers, .figcraft, REST API file JSON and .fig pages are appended with their variables and flows (REST and .fig: with `warnings`; those return `summary` {name, pages, layers, images} of the file read)",
             true,
             import
         ),
@@ -195,7 +207,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "version.autosave",
             "Autosave version",
-            "{}  save an automatic checkpoint when the document has unsaved changes since the last version (the app does this every 30 minutes); keeps the newest 20 autosaves → {saved, version?}",
+            "{}  save an automatic checkpoint when the document has unsaved changes since the last version (with `pref.autoSave` on: changes made since it was opened); the app does this every 30 minutes; keeps the newest 20 autosaves → {saved, version?}",
             false,
             autosave
         ),
@@ -219,7 +231,7 @@ pub fn specs() -> Vec<CommandSpec> {
             }
         ),
         spec!("doc.switch", "Switch document", "{index}", false, |s, p| {
-            let i = req_num("doc.switch", p, "index")? as usize;
+            let i = req_index("doc.switch", p, "index")?;
             if i >= s.docs.len() {
                 return Err(bad("doc.switch", "no such document"));
             }
@@ -257,8 +269,11 @@ pub const MAX_AUTOSAVES: usize = 20;
 
 /// `version.autosave`: a checkpoint of a document with unsaved changes since the last version.
 fn autosave(s: &mut Session, _: &Value) -> Result<Value> {
+    let auto_save = s.prefs.auto_save;
     let ds = s.ds_mut()?;
-    if ds.preview.is_some() || !ds.is_dirty() || !ds.changed_since_checkpoint() {
+    // A file that saves itself is rarely unsaved: edits since it was opened count then.
+    let edited = ds.is_dirty() || (auto_save && !ds.history.undo.is_empty());
+    if ds.preview.is_some() || !edited || !ds.changed_since_checkpoint() {
         return Ok(json!({"saved": false}));
     }
     Ok(match add_version(ds, AUTOSAVE, "", true) {
@@ -420,7 +435,7 @@ pub(crate) fn recovered(path: &str) -> Result<DocState> {
 
 #[cfg(not(target_arch = "wasm32"))]
 fn read(path: &str) -> Result<Vec<u8>> {
-    std::fs::read(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))
+    crate::file_access::read(path)
 }
 
 #[cfg(target_arch = "wasm32")]
@@ -430,22 +445,15 @@ fn read(path: &str) -> Result<Vec<u8>> {
 
 /// The bytes of file `path`, refused when it's larger than `max`.
 pub(crate) fn read_capped(path: &str, max: u64) -> Result<Vec<u8>> {
-    let meta = std::fs::metadata(path).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-    if !meta.is_file() || meta.len() > max {
-        return Err(EngineError::Other(format!("{path}: not a file of at most {max} bytes")));
-    }
-    read(path)
+    crate::file_access::read_capped(path, max)
 }
 
+/// Write `bytes` to `path` through a uniquely named, exclusively created staging file and one
+/// atomic rename (see [`figcraft_format::write_file_atomic`]): a failed or interrupted write never
+/// truncates `path`, and no file or symlink at a staging name is ever written through.
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn write(path: &str, bytes: &[u8]) -> Result<()> {
-    let tmp = format!("{path}.tmp-figcraft");
-    std::fs::write(&tmp, bytes).map_err(|e| EngineError::Other(format!("{tmp}: {e}")))?;
-    std::fs::rename(&tmp, path).map_err(|e| {
-        // Leave nothing behind when the file can't take its place.
-        let _ = std::fs::remove_file(&tmp);
-        EngineError::Other(format!("{path}: {e}"))
-    })
+    crate::file_access::write(path, bytes)
 }
 
 #[cfg(target_arch = "wasm32")]
@@ -461,6 +469,11 @@ fn file_stem(path: &str) -> String {
     std::path::Path::new(path).file_stem().and_then(|e| e.to_str()).unwrap_or("Untitled").to_string()
 }
 
+/// The counts the import report shows for a freshly loaded document.
+fn import_summary(doc: &Document) -> Value {
+    json!({"name": doc.name, "pages": doc.pages.len(), "layers": doc.nodes().filter(|n| !n.is_page()).count(), "images": doc.images.len()})
+}
+
 /// Load a document from any supported file (REST API file JSON images come from an `images`
 /// folder next to the file).
 pub fn load(path: &str) -> Result<(Document, Vec<String>)> {
@@ -506,10 +519,8 @@ fn load_with(
             Ok((doc.into(), false))
         }
         _ => {
-            if let Some(r) = figcraft_format::fig::try_import(bytes, &file_stem(name_hint)) {
-                let (mut doc, warnings) = r.map_err(|e| EngineError::Other(e.to_string()))?;
-                link_instances(&mut doc);
-                return Ok((figcraft_format::Loaded { issues: warnings, ..doc.into() }, true));
+            if let Some(r) = load_fig(bytes, &file_stem(name_hint)) {
+                return Ok((r?, true));
             }
             if let Some(r) = figcraft_format::rest::try_import_with(bytes, variables, images) {
                 let (mut doc, warnings) = r.map_err(|e| EngineError::Other(e.to_string()))?;
@@ -525,10 +536,20 @@ fn load_with(
     }
 }
 
+/// Gives `None` when `bytes` are not a `.fig` file. Then other readers can try.
+pub(crate) fn load_fig(bytes: &[u8], name: &str) -> Option<Result<figcraft_format::Loaded>> {
+    let r = figcraft_format::fig::try_import(bytes, name)?;
+    Some(r.map_err(|e| EngineError::Other(e.to_string())).map(|(mut doc, warnings)| {
+        link_instances(&mut doc);
+        figcraft_format::Loaded { issues: warnings, ..doc.into() }
+    }))
+}
+
 /// Link imported instances to their mains (layer sources, overrides found by comparing values),
 /// innermost first so outer instances settle last.
 fn link_instances(doc: &mut Document) {
     crate::style_vars::after_load(doc);
+    super::styles::apply_paint_bindings_on_load(doc);
     let mut insts: Vec<(usize, NodeId)> =
         doc.nodes().filter(|n| matches!(n.kind, NodeKind::Instance { .. })).map(|n| (doc.ancestors(n.id).len(), n.id)).collect();
     insts.sort_by_key(|a| std::cmp::Reverse(a.0));
@@ -552,11 +573,9 @@ fn rest_images(path: &str) -> impl Fn(&str) -> Option<Vec<u8>> {
             return None;
         }
         let dir = dir.as_ref()?;
-        ["", ".png", ".jpg", ".jpeg", ".gif", ".webp"].iter().find_map(|e| {
-            let p = dir.join(format!("{r}{e}"));
-            let meta = std::fs::metadata(&p).ok()?;
-            if meta.is_file() && meta.len() <= MAX_IMAGE_FILE { std::fs::read(&p).ok() } else { None }
-        })
+        ["", ".png", ".jpg", ".jpeg", ".gif", ".webp"]
+            .iter()
+            .find_map(|e| crate::file_access::read_capped(dir.join(format!("{r}{e}")), MAX_IMAGE_FILE).ok())
     }
 }
 
@@ -579,11 +598,7 @@ fn sibling_variables(path: &str) -> Option<Value> {
     let file = std::path::Path::new(path);
     let dir = file.parent()?;
     [format!("{}.variables.json", file_stem(path)), "variables.json".to_string()].iter().map(|n| dir.join(n)).filter(|c| c != file).find_map(|c| {
-        let meta = std::fs::metadata(&c).ok()?;
-        if !meta.is_file() || meta.len() > MAX_VARIABLES_FILE {
-            return None;
-        }
-        let v: Value = serde_json::from_slice(&std::fs::read(&c).ok()?).ok()?;
+        let v: Value = serde_json::from_slice(&crate::file_access::read_capped(c, MAX_VARIABLES_FILE).ok()?).ok()?;
         figcraft_format::rest::is_variables_json(&v).then_some(v)
     })
 }
@@ -621,20 +636,29 @@ fn remember(s: &mut Session, path: &str) {
 }
 
 fn open_recent(s: &mut Session, p: &Value) -> Result<Value> {
+    use crate::file_access::{Access, allow, allowed};
     const CMD: &str = "file.openRecent";
+    // Confined to automation roots, the recent files outside them are never listed, opened, removed
+    // or named: `index` counts the files listed.
+    let listed = |r: &String| allowed(r, Access::Read);
     if p.get("clear").and_then(Value::as_bool) == Some(true) {
-        s.prefs.recent_files.clear();
+        s.prefs.recent_files.retain(|r| !listed(r));
     }
     if let Some(gone) = string(p, "remove") {
-        s.prefs.recent_files.retain(|r| *r != gone);
+        s.prefs.recent_files.retain(|r| *r != gone || !listed(r));
     }
     let path = match (string(p, "path"), num(p, "index")) {
-        (Some(path), _) => Some(path),
-        (None, Some(i)) => Some(s.prefs.recent_files.get(i.max(0.0) as usize).cloned().ok_or_else(|| bad(CMD, "no such recent file"))?),
+        (Some(path), _) => {
+            allow(&path, Access::Read)?;
+            Some(path)
+        }
+        (None, Some(i)) => {
+            Some(s.prefs.recent_files.iter().filter(|r| listed(r)).nth(i.max(0.0) as usize).cloned().ok_or_else(|| bad(CMD, "no such recent file"))?)
+        }
         _ => None,
     };
     if let Some(path) = path {
-        if !std::path::Path::new(&path).exists() {
+        if !crate::file_access::exists(&path) {
             s.prefs.recent_files.retain(|r| *r != path);
             return Err(bad(CMD, format!("{path} no longer exists")));
         }
@@ -644,17 +668,23 @@ fn open_recent(s: &mut Session, p: &Value) -> Result<Value> {
         .prefs
         .recent_files
         .iter()
+        .filter(|r| listed(r))
         .map(|r| {
             let name = std::path::Path::new(r).file_name().map_or_else(|| r.clone(), |f| f.to_string_lossy().into_owned());
-            json!({"path": r, "name": name, "exists": std::path::Path::new(r).exists()})
+            json!({"path": r, "name": name, "exists": crate::file_access::exists(r)})
         })
         .collect();
     Ok(json!({"files": files}))
 }
 
 fn open(s: &mut Session, p: &Value) -> Result<Value> {
-    let path = req_string("file.open", p, "path")?;
     let variables = variables_param("file.open", p)?;
+    if string(p, "path").is_none()
+        && let Some(d) = string(p, "data")
+    {
+        return open_data(s, &d, p, variables.as_ref());
+    }
+    let path = req_string("file.open", p, "path")?;
     // Already open: switch to it.
     if let Some(i) = s.docs.iter().position(|d| d.path.as_deref() == Some(path.as_str())) {
         s.active = i;
@@ -672,9 +702,26 @@ fn open(s: &mut Session, p: &Value) -> Result<Value> {
             more => format!("{}: {} problems were repaired or left out while opening it, e.g. {}", file_stem(&path), more.len(), more[0]),
         });
     }
+    let summary = import_summary(&loaded.doc);
     s.docs.push(DocState::new(loaded.doc, native.then_some(path)).with_versions(loaded.versions).with_branches(loaded.branches));
     s.active = s.docs.len() - 1;
-    let mut out = json!({"index": s.active});
+    let mut out = json!({"index": s.active, "summary": summary});
+    out[if warnings { "warnings" } else { "repairs" }] = json!(loaded.issues);
+    Ok(out)
+}
+
+/// [`open`] for a file given as base64 `data` (a file dropped without a path on disk): `name` tells
+/// the format. It opens as a new document with no path, so the first save asks where to put it.
+fn open_data(s: &mut Session, data: &str, p: &Value, variables: Option<&Value>) -> Result<Value> {
+    let name = req_string("file.open", p, "name")?;
+    let data = data.split_once(',').map_or(data, |(_, b)| b);
+    let bytes = base64::engine::general_purpose::STANDARD.decode(data.trim()).map_err(|e| bad("file.open", e.to_string()))?;
+    let (loaded, rest) = load_with(&bytes, &name, variables, &figcraft_format::rest::no_images)?;
+    let warnings = rest || ext(&name) == "svg";
+    let summary = import_summary(&loaded.doc);
+    s.docs.push(DocState::new(loaded.doc, None).with_versions(loaded.versions).with_branches(loaded.branches));
+    s.active = s.docs.len() - 1;
+    let mut out = json!({"index": s.active, "summary": summary});
     out[if warnings { "warnings" } else { "repairs" }] = json!(loaded.issues);
     Ok(out)
 }
@@ -696,10 +743,71 @@ pub fn thumbnail(doc: &Document) -> Option<Vec<u8>> {
 
 /// The `.figcraft` file for a document: content, thumbnail and version history.
 pub fn file_bytes(ds: &DocState) -> Result<Vec<u8>> {
-    let mut doc = (*ds.doc).clone();
-    doc.current_page = Some(ds.page);
-    let thumb = thumbnail(&doc);
-    figcraft_format::save_bytes_with_history(&doc, thumb.as_deref(), &ds.versions, &ds.branches).map_err(|e| EngineError::Other(e.to_string()))
+    FileSnapshot::of(ds).encode()
+}
+
+/// A document's file as it is at one moment, so the slow part of saving it (the thumbnail and the
+/// encoding) can run on another thread while editing goes on: [`encode`](Self::encode) there, then
+/// [`save`](Self::save) the bytes back on the session's thread.
+pub struct FileSnapshot {
+    uid: u64,
+    path: Option<String>,
+    revision: u64,
+    doc: Arc<Document>,
+    /// The document as last saved when the snapshot was taken: another save since makes it stale.
+    saved: Arc<Document>,
+    page: NodeId,
+    versions: Vec<Version>,
+    branches: Vec<figcraft_format::Branch>,
+}
+
+impl FileSnapshot {
+    pub fn of(ds: &DocState) -> Self {
+        Self {
+            uid: ds.uid,
+            path: ds.path.clone(),
+            revision: ds.revision,
+            doc: ds.doc.clone(),
+            saved: ds.saved_doc.clone(),
+            page: ds.page,
+            versions: ds.versions.clone(),
+            branches: ds.branches.clone(),
+        }
+    }
+
+    /// The file's bytes: content, thumbnail and version history.
+    pub fn encode(&self) -> Result<Vec<u8>> {
+        let mut doc = (*self.doc).clone();
+        doc.current_page = Some(self.page);
+        let thumb = thumbnail(&doc);
+        figcraft_format::save_bytes_with_history(&doc, thumb.as_deref(), &self.versions, &self.branches)
+            .map_err(|e| EngineError::Other(e.to_string()))
+    }
+
+    /// Write `bytes` (this snapshot's [`encode`](Self::encode)) to the document's file: it is saved
+    /// as of the snapshot, and edits since stay unsaved. False (nothing written) when the document
+    /// was closed, saved, reverted or given another path since: the bytes are out of date.
+    pub fn save(self, s: &mut Session, bytes: &[u8]) -> Result<bool> {
+        let Some(ds) = s.docs.iter_mut().find(|d| d.uid == self.uid && d.path == self.path && Arc::ptr_eq(&d.saved_doc, &self.saved)) else {
+            return Ok(false);
+        };
+        write(self.path.as_deref().ok_or(EngineError::NoDocument)?, bytes)?;
+        // The history or branches may have changed since: then they still count as unsaved.
+        if ds.revision == self.revision {
+            ds.versions_changed = false;
+        }
+        ds.saved_doc = self.doc;
+        ds.revision += 1;
+        branch_tabs_saved(s, self.uid);
+        Ok(true)
+    }
+}
+
+/// The branch tabs of the file in tab `uid` were saved with it.
+fn branch_tabs_saved(s: &mut Session, uid: u64) {
+    for tab in s.docs.iter_mut().filter(|d| d.branch_of.as_ref().is_some_and(|(m, _)| *m == uid)) {
+        tab.mark_saved();
+    }
 }
 
 fn color_profile(s: &mut Session, p: &Value) -> Result<Value> {
@@ -714,8 +822,20 @@ fn color_profile(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"profile": profile.id(), "changed": changed}))
 }
 
-/// Save the file of the active tab (the main file for a branch tab, with its branches).
+/// Native saves act on the current document; a `.fig` copy exports the version shown, and a
+/// pending Save As choice must leave it shown until its destination is known.
+pub(crate) fn save_ends_preview(s: &Session, cmd: &str, p: &Value) -> bool {
+    let path =
+        string(p, "path").or_else(|| if cmd == "file.save" { s.docs.get(crate::branches::file_tab(s)).and_then(|ds| ds.path.clone()) } else { None });
+    path.is_some_and(|path| ext(&path) != "fig")
+}
+
+/// Save the file of the active tab (the main file for a branch tab, with its branches), or export
+/// the active document as an experimental `.fig` copy without changing its native save state.
 fn save_to(s: &mut Session, path: String) -> Result<Value> {
+    if ext(&path) == "fig" {
+        return export_fig(s, &json!({"path": path}));
+    }
     let i = crate::branches::file_tab(s);
     let ds = s.docs.get_mut(i).ok_or(EngineError::NoDocument)?;
     let bytes = file_bytes(ds)?;
@@ -724,9 +844,7 @@ fn save_to(s: &mut Session, path: String) -> Result<Value> {
     ds.mark_saved();
     ds.revision += 1;
     let uid = ds.uid;
-    for tab in s.docs.iter_mut().filter(|d| d.branch_of.as_ref().is_some_and(|(m, _)| *m == uid)) {
-        tab.mark_saved();
-    }
+    branch_tabs_saved(s, uid);
     remember(s, &path);
     Ok(json!({"path": path, "bytes": bytes.len()}))
 }
@@ -736,6 +854,11 @@ fn save(s: &mut Session, p: &Value) -> Result<Value> {
         return save_to(s, path);
     }
     match s.docs.get(crate::branches::file_tab(s)).ok_or(EngineError::NoDocument)?.path.clone() {
+        // Earlier builds wrote native data under a .fig name: never overwrite that file with an export.
+        Some(path) if ext(&path) == "fig" => {
+            s.request_ui("dialog.saveAs", json!({}));
+            Err(EngineError::Disabled("file.save".into(), "the saved path ends in .fig: choose Save as or pass `path`".into()))
+        }
         Some(path) => save_to(s, path),
         None => {
             s.request_ui("dialog.saveAs", json!({}));
@@ -765,12 +888,21 @@ pub fn export_bytes(doc: &Document, ids: &[NodeId], format: ExportFormat, scale:
 }
 
 /// The page area exporting `ids` with `setting` covers: what they paint (a clipping frame's own
-/// area), or their boxes with "include bounding box" and for slices.
+/// area), or their boxes with "include bounding box" and for slices. Hidden layers paint nothing,
+/// so they take no room next to visible ones (a hidden-only export keeps its own area).
 pub fn export_area(doc: &Document, ids: &[NodeId], setting: &ExportSetting) -> Option<figcraft_geom::Rect> {
+    let any_visible = ids.iter().any(|i| doc.node(*i).is_some_and(|n| n.visible));
     ids.iter()
         .filter_map(|i| {
-            let slice = doc.node(*i).is_some_and(|n| matches!(n.kind, NodeKind::Slice));
-            if setting.include_bounding_box || slice { doc.world_bounds(*i) } else { figcraft_render::export_bounds(doc, *i) }
+            let node = doc.node(*i);
+            let slice = node.is_some_and(|n| matches!(n.kind, NodeKind::Slice));
+            if setting.include_bounding_box || slice {
+                doc.world_bounds(*i)
+            } else if any_visible && node.is_some_and(|n| !n.visible) {
+                None
+            } else {
+                figcraft_render::export_bounds(doc, *i)
+            }
         })
         .reduce(|a, b| a.union(b))
 }
@@ -1051,7 +1183,7 @@ fn export_layers(s: &mut Session, p: &Value) -> Result<Value> {
                 let path = std::path::Path::new(d).join(&job.file);
                 // A layer name with slashes exports into folders.
                 if let Some(parent) = path.parent() {
-                    let _ = std::fs::create_dir_all(parent);
+                    let _ = crate::file_access::create_dir_all(parent);
                 }
                 let path = path.to_string_lossy().to_string();
                 write(&path, &bytes)?;
@@ -1147,8 +1279,9 @@ fn import(s: &mut Session, p: &Value) -> Result<Value> {
             };
             let sibling = if variables.is_none() { path.as_deref().and_then(sibling_variables) } else { None };
             let (other, rest) = load_with(&bytes, &name, variables.as_ref().or(sibling.as_ref()), images)?;
+            let summary = import_summary(&other.doc);
             let pages = append_pages(s.doc_mut()?, &other.doc)?;
-            let mut out = json!({"pages": pages});
+            let mut out = json!({"pages": pages, "summary": summary});
             if rest {
                 out["warnings"] = json!(other.issues);
             }
@@ -1184,6 +1317,19 @@ fn append_pages(doc: &mut Document, other: &Document) -> Result<Vec<NodeId>> {
             map.insert(id, doc.alloc_id());
         }
     }
+    // Library copies a .fig import keeps (cached definitions) have no library record to follow:
+    // the layers of its store come along into the store of `doc`. Recorded copies are left to
+    // `merge_store`, which shares them with copies `doc` already has.
+    let cached: Vec<NodeId> = other
+        .library_store()
+        .and_then(|s| other.node(s))
+        .map(|s| s.children.iter().copied().filter(|root| other.libraries.import_of(*root).is_none()).collect())
+        .unwrap_or_default();
+    for root in &cached {
+        for id in other.subtree(*root) {
+            map.insert(id, doc.alloc_id());
+        }
+    }
     let mut new_pages = Vec::new();
     for pg in &other.pages {
         let Some(pn) = other.node(*pg) else { continue };
@@ -1201,6 +1347,13 @@ fn append_pages(doc: &mut Document, other: &Document) -> Result<Vec<NodeId>> {
         }
         new_pages.push(np);
     }
+    if !cached.is_empty() {
+        let store = doc.ensure_library_store();
+        for root in &cached {
+            let nodes: Vec<Node> = other.subtree(*root).into_iter().filter_map(|i| other.node(i).cloned()).collect();
+            doc.paste_nodes(&nodes, &map, *root, store, None)?;
+        }
+    }
     for new in map.values() {
         let src = doc.node(*new).and_then(|n| n.source).and_then(|s| map.get(&s).copied());
         if let (Some(src), Some(n)) = (src, doc.node_mut(*new)) {
@@ -1212,7 +1365,7 @@ fn append_pages(doc: &mut Document, other: &Document) -> Result<Vec<NodeId>> {
 }
 
 fn close(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = num(p, "index").map(|x| x as usize).unwrap_or(s.active);
+    let i = if get(p, "index").is_none() { s.active } else { req_index("file.close", p, "index")? };
     let Some(ds) = s.docs.get(i) else { return Err(bad("file.close", "no such document")) };
     // A branch tab's edits are in its main file already (which then has unsaved changes).
     if ds.branch_of.is_none() && ds.is_dirty() && !boolean(p, "force").unwrap_or(false) {
@@ -1266,6 +1419,70 @@ mod rest_import_tests {
         doc.nodes().find(|n| matches!(n.kind, NodeKind::Instance { .. })).unwrap()
     }
 
+    /// What a .fig import with a cached library component leaves: the main in the hidden store, a
+    /// visible instance of it and a layer linked to the main's layer.
+    fn cached_import() -> Document {
+        let mut doc = Document::new("Cached");
+        let page = doc.first_page().unwrap();
+        let store = doc.ensure_library_store();
+        let main = doc
+            .create(store, NodeKind::Component { description: String::new(), props: Default::default() }, "Cached main", 0.0, 0.0, 20.0, 20.0)
+            .unwrap();
+        let body = doc.create(main, NodeKind::Rectangle, "Body", 0.0, 0.0, 20.0, 20.0).unwrap();
+        let inst =
+            doc.create(page, NodeKind::Instance { component: main, props: Default::default() }, "Cached instance", 0.0, 0.0, 20.0, 20.0).unwrap();
+        let mut copy = doc.node(body).unwrap().clone();
+        copy.id = doc.alloc_id();
+        copy.parent = None;
+        copy.source = Some(body);
+        let copy_id = copy.id;
+        doc.insert(copy, inst, None).unwrap();
+        assert!(doc.is_remote(main) && doc.node(copy_id).unwrap().source == Some(body));
+        doc
+    }
+
+    /// Pasting layers that use a cached main into another document leaves the main behind, as it
+    /// does for other mains that are not published: no link points at a layer of the target.
+    #[test]
+    fn pasting_instances_of_cached_components_leaves_no_dangling_links() {
+        let src = cached_import();
+        let mut doc = Document::new("Target");
+        let page = doc.first_page().unwrap();
+        for i in 0..8 {
+            doc.create(page, NodeKind::Rectangle, &format!("Filler {i}"), 0.0, 0.0, 5.0, 5.0).unwrap();
+        }
+        let inst = src.nodes().find(|n| n.name == "Cached instance").unwrap().id;
+        let ids = src.subtree(inst);
+        let map: std::collections::BTreeMap<NodeId, NodeId> = ids.iter().map(|i| (*i, doc.alloc_id())).collect();
+        let nodes: Vec<Node> = ids.iter().filter_map(|i| src.node(*i).cloned()).collect();
+        doc.paste_nodes(&nodes, &map, inst, page, None).unwrap();
+        crate::library::adopt_pasted(&mut doc, &src, None, &map).unwrap();
+        let pasted = doc.node(map[&inst]).unwrap();
+        let NodeKind::Instance { component, .. } = pasted.kind else { panic!() };
+        assert!(!doc.contains(component), "the main stays behind: {component:?}");
+        assert!(doc.node(pasted.children[0]).unwrap().source.is_none_or(|s| !doc.contains(s)));
+    }
+
+    #[test]
+    fn appending_pages_with_cached_library_components_brings_the_components() {
+        let other = cached_import();
+        let mut doc = Document::new("Target");
+        let page = doc.first_page().unwrap();
+        // Ids of the target that would collide with the other document's store.
+        for i in 0..8 {
+            doc.create(page, NodeKind::Rectangle, &format!("Filler {i}"), 0.0, 0.0, 5.0, 5.0).unwrap();
+        }
+        append_pages(&mut doc, &other).unwrap();
+        assert!(doc.validate().is_empty(), "{:?}", doc.validate());
+        assert!(crate::components::mirror_issues(&doc).is_empty(), "{:?}", crate::components::mirror_issues(&doc));
+        let inst = doc.nodes().find(|n| n.name == "Cached instance").unwrap();
+        let NodeKind::Instance { component, .. } = inst.kind else { panic!() };
+        assert_eq!(doc.node(component).unwrap().name, "Cached main");
+        assert!(doc.is_remote(component), "the main comes along into the store");
+        let layer = doc.node(inst.children[0]).unwrap();
+        assert_eq!(layer.source, doc.node(component).unwrap().children.first().copied());
+    }
+
     #[test]
     fn rest_json_loads_with_linked_instances() {
         let bytes = serde_json::to_vec(&kit()).unwrap();
@@ -1283,6 +1500,25 @@ mod rest_import_tests {
         assert!(thumbnail(&doc).is_some());
     }
 
+    #[test]
+    fn open_takes_data_and_a_name_as_a_new_unsaved_document() {
+        let mut saved = Session::new();
+        saved.execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+        let bytes = file_bytes(saved.ds().unwrap()).unwrap();
+        let data = base64::engine::general_purpose::STANDARD.encode(&bytes);
+        let mut s = Session::new();
+        let recent = s.prefs.recent_files.clone();
+        let r = s.execute("file.open", &json!({"data": data, "name": "Dropped.figcraft"})).unwrap();
+        let open = s.docs.len();
+        assert_eq!(r["index"], open - 1, "a document of its own, made active");
+        assert_eq!(s.ds().unwrap().path, None, "no path to save over");
+        assert!(s.doc().unwrap().nodes().any(|n| matches!(n.kind, NodeKind::Rectangle)));
+        assert_eq!(s.prefs.recent_files, recent, "nothing on disk to remember");
+        assert!(s.execute("file.open", &json!({"data": data})).is_err(), "the name tells the format");
+        assert!(s.execute("file.open", &json!({"data": "not base64!", "name": "x.svg"})).is_err());
+        assert_eq!(s.docs.len(), open, "a refused open adds nothing");
+    }
+
     #[test]
     fn open_and_import_rest_json() {
         let dir = std::env::temp_dir().join(format!("figcraft-rest-{}", std::process::id()));
@@ -1327,3 +1563,126 @@ mod rest_import_tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 }
+
+#[cfg(test)]
+mod staging_write_tests {
+    use super::*;
+
+    fn dir(name: &str) -> std::path::PathBuf {
+        let d = std::env::temp_dir().join(format!("figcraft-engine-staging-{name}-{}", std::process::id()));
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    /// A symlink `from` → `to`; false when the platform won't make one (Windows needs privileges).
+    #[cfg(unix)]
+    fn symlink(from: &std::path::Path, to: &std::path::Path) -> bool {
+        std::os::unix::fs::symlink(to, from).is_ok()
+    }
+
+    #[cfg(windows)]
+    fn symlink(from: &std::path::Path, to: &std::path::Path) -> bool {
+        std::os::windows::fs::symlink_file(to, from).is_ok()
+    }
+
+    #[test]
+    fn an_existing_staging_file_is_never_written_through() {
+        let d = dir("existing");
+        let path = d.join("shot.svg");
+        // The old deterministic staging name, held by an unrelated file: the write must pick its
+        // own staging name instead of truncating this one.
+        let old = d.join("shot.svg.tmp-figcraft");
+        std::fs::write(&old, b"not yours").unwrap();
+        write(&path.to_string_lossy(), b"<svg/>").unwrap();
+        assert_eq!(std::fs::read(&path).unwrap(), b"<svg/>");
+        assert_eq!(std::fs::read(&old).unwrap(), b"not yours", "an unrelated file at a staging name is untouched");
+        // Just the file and the untouched staging file: no new staging leftovers.
+        assert_eq!(std::fs::read_dir(&d).unwrap().count(), 2);
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn a_staging_symlink_is_never_followed() {
+        let d = dir("symlink");
+        let path = d.join("shot.svg");
+        let victim = d.join("victim.txt");
+        std::fs::write(&victim, b"innocent").unwrap();
+        let old = d.join("shot.svg.tmp-figcraft");
+        if !symlink(&old, &victim) {
+            return; // Making a symlink needs privileges on some Windows setups.
+        }
+        write(&path.to_string_lossy(), b"<svg/>").unwrap();
+        assert_eq!(std::fs::read(&victim).unwrap(), b"innocent", "the symlink was never written through");
+        assert_eq!(std::fs::read(&path).unwrap(), b"<svg/>");
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn concurrent_writers_of_one_file_never_interleave() {
+        let d = dir("concurrent");
+        let path = d.join("shot.svg");
+        for round in 0..5u8 {
+            let mut handles = Vec::new();
+            for w in 0u8..4 {
+                let (path, bytes) = (path.clone(), vec![b'0' + w; 8192]);
+                handles.push(std::thread::spawn(move || write(&path.to_string_lossy(), &bytes)));
+            }
+            let mut wins = 0;
+            for h in handles {
+                // On Windows a rename over a file another writer just replaced can lose the race.
+                if h.join().unwrap().is_ok() {
+                    wins += 1;
+                }
+            }
+            assert!(wins > 0, "round {round}: every writer lost");
+            // Whatever landed is one writer's complete payload, never a mix.
+            let got = std::fs::read(&path).unwrap();
+            assert_eq!(got.len(), 8192, "round {round}: a complete payload landed");
+            assert!(got.windows(2).all(|w| w[0] == w[1]), "round {round}: one writer's payload, not a mix");
+        }
+        // No staging file was left stuck (a failed writer removes its own).
+        let left = std::fs::read_dir(&d).unwrap().count();
+        assert!(left <= if cfg!(windows) { 5 } else { 1 }, "{left} files left in the staging directory");
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn a_failed_write_leaves_the_destination_alone_and_cleans_up() {
+        let d = dir("failure");
+        // The destination is a directory: the rename fails, our staging file is removed and the
+        // directory is untouched.
+        let taken = d.join("over-a-directory");
+        std::fs::create_dir_all(&taken).unwrap();
+        assert!(write(&taken.to_string_lossy(), b"payload").is_err());
+        assert!(taken.is_dir());
+        assert_eq!(std::fs::read_dir(&d).unwrap().count(), 1, "no staging file left behind");
+        // A missing parent directory fails without creating anything anywhere.
+        assert!(write(&d.join("no").join("such.svg").to_string_lossy(), b"payload").is_err());
+        assert!(!d.join("no").exists());
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            // A read-only directory refuses the staging file, and the old destination stays.
+            let ro = d.join("read-only");
+            std::fs::create_dir_all(&ro).unwrap();
+            let dest = ro.join("keep.svg");
+            std::fs::write(&dest, b"keep").unwrap();
+            let mut perms = std::fs::metadata(&ro).unwrap().permissions();
+            perms.set_mode(0o500);
+            std::fs::set_permissions(&ro, perms).unwrap();
+            // Running as root would defeat the read-only directory: skip instead of failing.
+            let probe = ro.join(".probe");
+            if std::fs::write(&probe, b"").is_ok() {
+                let _ = std::fs::remove_file(&probe);
+            } else {
+                assert!(write(&dest.to_string_lossy(), b"payload").is_err());
+                assert_eq!(std::fs::read(&dest).unwrap(), b"keep");
+                assert_eq!(std::fs::read_dir(&ro).unwrap().count(), 1, "no staging file left behind");
+            }
+            let mut perms = std::fs::metadata(&ro).unwrap().permissions();
+            perms.set_mode(0o700);
+            std::fs::set_permissions(&ro, perms).unwrap();
+        }
+        let _ = std::fs::remove_dir_all(&d);
+    }
+}

crates/engine/src/cmd/mod.rs

@@ -71,6 +71,7 @@ fn registry() -> &'static Registry {
         list.extend(create::specs());
         list.extend(edit::specs());
         list.extend(lists::specs());
+        list.extend(crate::selection_colors::specs());
         list.extend(arrange::specs());
         list.extend(structure::specs());
         list.extend(section::specs());
@@ -79,6 +80,7 @@ fn registry() -> &'static Registry {
         list.extend(page::specs());
         list.extend(view::specs());
         list.extend(text::specs());
+        list.extend(crate::fonts::specs());
         list.extend(styles::specs());
         list.extend(image::specs());
         list.extend(variables::specs());

crates/engine/src/cmd/page.rs

@@ -1,5 +1,6 @@
 //! Pages.
 
+use figcraft_doc::proto::Flow;
 use figcraft_doc::*;
 use serde_json::{Value, json};
 
@@ -23,10 +24,24 @@ fn settle(s: &mut Session, cmd: &str) -> crate::Result<()> {
     Ok(())
 }
 
+/// The page a command targets: the explicit `id` (which must be a page) or the open page.
+fn page_target(s: &Session, cmd: &str, p: &Value) -> crate::Result<NodeId> {
+    let Some(target) = id(p, "id") else { return s.page() };
+    if !s.doc()?.pages.contains(&target) {
+        return Err(bad(cmd, format!("{target} is not a page")));
+    }
+    Ok(target)
+}
+
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         spec!("page.add", "Add page", "{name?} (a name starting with a hyphen adds a divider)", true, |s, p| {
-            let background = s.new_page_background();
+            // An added page takes the current page's colour; the theme only decides new files.
+            let current = s.page().ok().and_then(|p| match s.doc().ok()?.node(p)?.kind {
+                NodeKind::Page { background, .. } => Some(background),
+                _ => None,
+            });
+            let background = current.unwrap_or_else(|| s.new_page_background());
             let doc = s.doc_mut()?;
             let name = string(p, "name").unwrap_or_else(|| format!("Page {}", doc.pages.len() + 1));
             let id = doc.add_page(&name);
@@ -47,7 +62,7 @@ pub fn specs() -> Vec<CommandSpec> {
             let id = match id(p, "id") {
                 Some(i) => i,
                 None => {
-                    let k = req_num("page.select", p, "index")? as usize;
+                    let k = req_index("page.select", p, "index")?;
                     *doc.pages.get(k).ok_or_else(|| bad("page.select", "no such page"))?
                 }
             };
@@ -66,13 +81,13 @@ pub fn specs() -> Vec<CommandSpec> {
         }),
         spec!("page.rename", "Rename page", "{id?, name} (an empty page named with a leading hyphen becomes a divider)", true, |s, p| {
             let name = req_string("page.rename", p, "name")?;
-            let id = id(p, "id").unwrap_or(s.page()?);
+            let id = page_target(s, "page.rename", p)?;
             s.doc_mut()?.get_mut(id)?.name = name;
             settle(s, "page.rename")?;
             ok()
         }),
         spec!("page.delete", "Delete page", "{id?}", true, |s, p| {
-            let id = id(p, "id").unwrap_or(s.page()?);
+            let id = page_target(s, "page.delete", p)?;
             s.doc_mut()?.remove(id)?;
             settle(s, "page.delete")?;
             ok()
@@ -82,13 +97,25 @@ pub fn specs() -> Vec<CommandSpec> {
             let doc = s.doc_mut()?;
             let name = format!("Copy of {}", doc.get(src)?.name);
             let np = doc.add_page(&name);
-            if let NodeKind::Page { background, .. } = doc.get(src)?.kind.clone()
-                && let NodeKind::Page { background: b, .. } = &mut doc.get_mut(np)?.kind
+            // One copy with one id map, so navigation between the copied frames points at the copies;
+            // then each layer and its copy (also those in sections), so flows can follow their start frames.
+            let children = doc.get(src)?.children.clone();
+            let copied = doc.duplicate_all_into(&children, np)?;
+            let mut copies = Vec::new();
+            for (c, copy) in children.iter().zip(&copied) {
+                copies.extend(doc.subtree(*c).into_iter().zip(doc.subtree(*copy)));
+            }
+            // The copy keeps the page's colour, flows (pointing at the copied frames), prototype settings and guides.
+            if let NodeKind::Page { background, flows, prototype, guides } = doc.get(src)?.kind.clone()
+                && let NodeKind::Page { background: b, flows: f, prototype: pr, guides: g } = &mut doc.get_mut(np)?.kind
             {
                 *b = background;
-            }
-            for c in doc.get(src)?.children.clone() {
-                doc.duplicate_into(c, np, None)?;
+                *f = flows
+                    .into_iter()
+                    .filter_map(|fl| copies.iter().find(|(old, _)| *old == fl.start).map(|(_, new)| Flow { start: *new, ..fl }))
+                    .collect();
+                *pr = prototype;
+                *g = guides;
             }
             // Keep the new page right after the source.
             if let Some(si) = doc.pages.iter().position(|x| *x == src) {
@@ -102,6 +129,9 @@ pub fn specs() -> Vec<CommandSpec> {
             let id = id(p, "id").unwrap_or(s.page()?);
             let k = req_num("page.move", p, "index")?.max(0.0) as usize;
             let doc = s.doc_mut()?;
+            if !doc.pages.contains(&id) {
+                return Err(bad("page.move", format!("{id} is not a page")));
+            }
             doc.pages.retain(|x| *x != id);
             let k = k.min(doc.pages.len());
             doc.pages.insert(k, id);
@@ -109,7 +139,7 @@ pub fn specs() -> Vec<CommandSpec> {
         }),
         spec!("page.setBackground", "Page background", "{id?, color}", true, |s, p| {
             let c = color(p, "color").ok_or_else(|| bad("page.setBackground", "`color` required"))?;
-            let id = id(p, "id").unwrap_or(s.page()?);
+            let id = page_target(s, "page.setBackground", p)?;
             if let NodeKind::Page { background, .. } = &mut s.doc_mut()?.get_mut(id)?.kind {
                 *background = c;
             }
@@ -155,8 +185,11 @@ pub fn specs() -> Vec<CommandSpec> {
             }
             guides.remove(k);
             let ds = s.ds_mut()?;
-            if ds.guide == Some((owner, k)) {
-                ds.guide = None;
+            match ds.guide {
+                Some((o, i)) if o == owner && i == k => ds.guide = None,
+                // A later guide of the same owner moves up one place; keep the selection on it.
+                Some((o, i)) if o == owner && i > k => ds.guide = Some((o, i - 1)),
+                _ => {}
             }
             ok()
         }),

crates/engine/src/cmd/props.rs

@@ -13,7 +13,7 @@ pub const STROKE_SIDES: [&str; 4] = ["strokeTopWeight", "strokeRightWeight", "st
 
 /// Keys `node.set` understands (documented for agents).
 pub const KEYS: &str = "name, visible, locked, opacity (0-1), blend, x, y (relative to the parent frame; groups don't count), width, height, rotation (degrees), \
-fills (paints or colours), fill (colour), strokes, stroke (colour), strokeWeight, strokeAlign (inside|center|outside), strokeSides [t,r,b,l], strokeTopWeight / strokeRightWeight / strokeBottomWeight / strokeLeftWeight (one side; turns on individual strokes), \
+fills (paints or colours; gradients as {type: linearGradient|radialGradient|angularGradient|diamondGradient, stops: [\"#hex\", ...], from?, to?} too), fill (colour), strokes, stroke (colour), strokeWeight, strokeAlign (inside|center|outside), strokeSides [t,r,b,l], strokeTopWeight / strokeRightWeight / strokeBottomWeight / strokeLeftWeight (one side; turns on individual strokes), \
 strokeCap / startCap / endCap, strokeJoin, miterAngle (degrees: sharper joins bevel; or miterLimit as a ratio), dashes [..], widthProfile (preset uniform|wedge|taper|eye|rounded|pinch, [[t, scale], ...] or null), brush (preset id, {preset, spacing, sizeJitter, rotationJitter, scatter, seed} or null), cornerRadius (n or [tl,tr,br,bl]), cornerSmoothing (0-1), effects, \
 clip, isMask, layout (null|horizontal|vertical|grid|{...}), gap, crossGap, padding (n or [t,r,b,l]), paddingTop/Right/Bottom/Left, \
 mainAlign (min|center|max, or the auto gaps spaceBetween|spaceAround|spaceEvenly), crossAlign (min|center|max|baseline: first text baselines, horizontal layouts), contentAlign (wrapped lines: auto = packed where crossAlign says | spaceBetween), wrap (rows of a horizontal layout, columns of a vertical one), strokesIncluded (the frame's inside stroke takes up space), reverseZ (canvas stacking: true = first on top), \
@@ -30,6 +30,11 @@ fontVariations / variationSettings ({axis: number}, e.g. {\"wght\": 550, \"wdth\
 arcInner, booleanOperation (a boolean group's operation, or an operand's own; null: the group's), operandOperation (a layer in a boolean \
 group: how it combines with the operands below it; null: the group's), constrainProportions, description, interactions, overflow, pluginData {k: v}";
 
+/// CRLF, bare CR, U+2028 and U+2029 become LF, the only line ending text layout understands (editor insertion does the same).
+pub(crate) fn normalize_line_endings(s: &str) -> String {
+    s.replace("\r\n", "\n").replace(['\r', '\u{2028}', '\u{2029}'], "\n")
+}
+
 /// camelCase object keys → snake_case (accept the inspect/camel forms for serde-backed values).
 pub fn snake(v: &Value) -> Value {
     match v {
@@ -260,6 +265,56 @@ fn ensure_layout(n: &mut Node) -> &mut AutoLayout {
     n.layout.get_or_insert_with(|| AutoLayout { padding: [0.0; 4], gap: 0.0, ..Default::default() })
 }
 
+/// The keys that set a frame's auto layout (through [`layout_mut`]).
+pub const LAYOUT_KEYS: &[&str] = &[
+    "gap",
+    "itemSpacing",
+    "columnGap",
+    "crossGap",
+    "counterAxisSpacing",
+    "rowGap",
+    "padding",
+    "paddingTop",
+    "paddingRight",
+    "paddingBottom",
+    "paddingLeft",
+    "paddingHorizontal",
+    "paddingVertical",
+    "mainAlign",
+    "primaryAxisAlignItems",
+    "crossAlign",
+    "counterAxisAlignItems",
+    "contentAlign",
+    "counterAxisAlignContent",
+    "wrap",
+    "gridColumns",
+    "gridRows",
+    "strokesIncluded",
+    "reverseZ",
+    "columnTracks",
+    "gridColumnTracks",
+    "rowTracks",
+    "gridRowTracks",
+];
+
+/// The auto layout of a frame-like node, created when it has none yet. Other nodes can't hold an
+/// auto layout: an auto layout key on them is refused, not stored where nothing reads it
+/// (`node.set` on several layers skips them instead, see `edit::set`).
+fn layout_mut<'a>(cmd: &str, k: &str, n: &'a mut Node) -> Result<&'a mut AutoLayout> {
+    if !n.kind.is_frame_like() {
+        return Err(bad(
+            cmd,
+            format!(
+                "`{k}` is an auto layout property, and layer {} “{}” is a {} (only frames, components and instances have auto layout)",
+                n.id,
+                n.name,
+                n.kind.type_name()
+            ),
+        ));
+    }
+    Ok(ensure_layout(n))
+}
+
 /// Apply a property map to one node. `x`/`y` are relative to the parent.
 pub fn apply(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Value>) -> Result<()> {
     let mut unknown = Vec::new();
@@ -447,56 +502,56 @@ pub fn apply(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Valu
                 }
             }
             "gap" | "itemSpacing" | "columnGap" => {
-                ensure_layout(doc.get_mut(id)?).gap = f64_of(v).ok_or_else(|| bad(cmd, format!("`{k}` must be a number")))?
+                layout_mut(cmd, k, doc.get_mut(id)?)?.gap = f64_of(v).ok_or_else(|| bad(cmd, format!("`{k}` must be a number")))?
             }
             "crossGap" | "counterAxisSpacing" | "rowGap" => {
-                ensure_layout(doc.get_mut(id)?).cross_gap = f64_of(v).ok_or_else(|| bad(cmd, format!("`{k}` must be a number")))?
+                layout_mut(cmd, k, doc.get_mut(id)?)?.cross_gap = f64_of(v).ok_or_else(|| bad(cmd, format!("`{k}` must be a number")))?
             }
             "padding" => {
                 let p = four(v).ok_or_else(|| bad(cmd, "padding: n or [t,r,b,l]"))?;
-                ensure_layout(doc.get_mut(id)?).padding = p.map(|x| x.max(0.0));
+                layout_mut(cmd, k, doc.get_mut(id)?)?.padding = p.map(|x| x.max(0.0));
             }
             "paddingTop" | "paddingRight" | "paddingBottom" | "paddingLeft" => {
                 let i = ["paddingTop", "paddingRight", "paddingBottom", "paddingLeft"].iter().position(|x| *x == k).unwrap_or(0);
                 let val = f64_of(v).ok_or_else(|| bad(cmd, format!("`{k}` must be a number")))?.max(0.0);
-                if let Some(slot) = ensure_layout(doc.get_mut(id)?).padding.get_mut(i) {
+                if let Some(slot) = layout_mut(cmd, k, doc.get_mut(id)?)?.padding.get_mut(i) {
                     *slot = val;
                 }
             }
             "paddingHorizontal" => {
                 let val = f64_of(v).unwrap_or(0.0).max(0.0);
-                let l = ensure_layout(doc.get_mut(id)?);
+                let l = layout_mut(cmd, k, doc.get_mut(id)?)?;
                 l.padding[1] = val;
                 l.padding[3] = val;
             }
             "paddingVertical" => {
                 let val = f64_of(v).unwrap_or(0.0).max(0.0);
-                let l = ensure_layout(doc.get_mut(id)?);
+                let l = layout_mut(cmd, k, doc.get_mut(id)?)?;
                 l.padding[0] = val;
                 l.padding[2] = val;
             }
             "mainAlign" | "primaryAxisAlignItems" => {
-                ensure_layout(doc.get_mut(id)?).main_align =
+                layout_mut(cmd, k, doc.get_mut(id)?)?.main_align =
                     enum_of(v).ok_or_else(|| bad(cmd, "mainAlign: min|center|max|spaceBetween|spaceAround|spaceEvenly"))?
             }
             "crossAlign" | "counterAxisAlignItems" => {
-                ensure_layout(doc.get_mut(id)?).cross_align = enum_of(v).ok_or_else(|| bad(cmd, "crossAlign: min|center|max|baseline"))?
+                layout_mut(cmd, k, doc.get_mut(id)?)?.cross_align = enum_of(v).ok_or_else(|| bad(cmd, "crossAlign: min|center|max|baseline"))?
             }
             "contentAlign" | "counterAxisAlignContent" => {
-                ensure_layout(doc.get_mut(id)?).content_align = enum_of(v).ok_or_else(|| bad(cmd, "contentAlign: auto|spaceBetween"))?
+                layout_mut(cmd, k, doc.get_mut(id)?)?.content_align = enum_of(v).ok_or_else(|| bad(cmd, "contentAlign: auto|spaceBetween"))?
             }
-            "wrap" => ensure_layout(doc.get_mut(id)?).wrap = v.as_bool().unwrap_or(false),
+            "wrap" => layout_mut(cmd, k, doc.get_mut(id)?)?.wrap = v.as_bool().unwrap_or(false),
             "gridColumns" | "gridRows" => {
                 let count = f64_of(v).ok_or_else(|| bad(cmd, format!("`{k}` must be a number")))?.clamp(1.0, 1000.0) as u32;
-                let l = ensure_layout(doc.get_mut(id)?);
+                let l = layout_mut(cmd, k, doc.get_mut(id)?)?;
                 // Tracks past the new count go away (new tracks are 1fr).
                 let (n, tracks) =
                     if k == "gridColumns" { (&mut l.grid_columns, &mut l.column_tracks) } else { (&mut l.grid_rows, &mut l.row_tracks) };
                 *n = count;
                 tracks.truncate(count as usize);
             }
-            "strokesIncluded" => ensure_layout(doc.get_mut(id)?).strokes_included = v.as_bool().unwrap_or(false),
-            "reverseZ" => ensure_layout(doc.get_mut(id)?).reverse_z = v.as_bool().unwrap_or(false),
+            "strokesIncluded" => layout_mut(cmd, k, doc.get_mut(id)?)?.strokes_included = v.as_bool().unwrap_or(false),
+            "reverseZ" => layout_mut(cmd, k, doc.get_mut(id)?)?.reverse_z = v.as_bool().unwrap_or(false),
             "sizingH" | "layoutSizingHorizontal" => {
                 let s = sizing(v).ok_or_else(|| bad(cmd, "sizing: fixed|hug|fill"))?;
                 set_sizing(cmd, doc, id, s, true)?;
@@ -528,7 +583,7 @@ pub fn apply(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Valu
             "columnTracks" | "gridColumnTracks" | "rowTracks" | "gridRowTracks" => {
                 let a = v.as_array().ok_or_else(|| bad(cmd, format!("`{k}` must be an array of tracks")))?;
                 let tracks = a.iter().map(track_of).collect::<Option<Vec<_>>>().ok_or_else(|| bad(cmd, TRACK_HELP))?;
-                let l = ensure_layout(doc.get_mut(id)?);
+                let l = layout_mut(cmd, k, doc.get_mut(id)?)?;
                 if k.contains("olumn") {
                     l.grid_columns = (tracks.len() as u32).clamp(1, 1000);
                     l.column_tracks = tracks;
@@ -599,7 +654,7 @@ pub fn apply(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Valu
                 let n = doc.get_mut(id)?;
                 let t = text_mut(cmd, n)?;
                 let len = t.char_count();
-                t.replace_range(0, len, &s);
+                t.replace_range(0, len, &normalize_line_endings(&s));
                 n.overrides.insert("characters".into());
             }
             "fontFamily"
@@ -778,12 +833,14 @@ pub fn apply(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Valu
     if !unknown.is_empty() {
         return Err(bad(cmd, format!("unknown properties: {} (known: {KEYS})", unknown.join(", "))));
     }
-    // Inside an instance, record which property groups were overridden (an instance's own export
-    // settings and interactions are its own, not overrides).
+    // Inside an instance, record which property groups were overridden (an instance's own
+    // resizing, export settings and interactions are its own, not overrides).
     let own_root = matches!(doc.get(id)?.kind, NodeKind::Instance { .. }) && !crate::components::inside_instance(doc, id);
     let n = doc.get_mut(id)?;
     if n.source.is_some() {
-        for g in props.keys().map(|k| override_group(k)).filter(|g| *g != "other" && !(own_root && matches!(*g, "exports" | "interactions"))) {
+        for g in
+            props.keys().map(|k| override_group(k)).filter(|g| *g != "other" && !(own_root && matches!(*g, "resizing" | "exports" | "interactions")))
+        {
             n.overrides.insert(g.to_string());
         }
     }
@@ -805,7 +862,8 @@ pub fn override_group(k: &str) -> &'static str {
         "features" | "fontFeatures" | "openTypeFeatures" | "listStyle" | "indentation" | "listSpacing" | "maxLines" | "variationSettings"
         | "hangingPunctuation" | "hangingList" => "textStyle",
         "cornerRadius" | "cornerSmoothing" | "topLeftRadius" | "topRightRadius" | "bottomRightRadius" | "bottomLeftRadius" => "corners",
-        "width" | "height" | "w" | "h" | "sizingH" | "sizingV" => "size",
+        "width" | "height" | "w" | "h" => "size",
+        "sizingH" | "sizingV" | "layoutSizingHorizontal" | "layoutSizingVertical" | "minWidth" | "maxWidth" | "minHeight" | "maxHeight" => "resizing",
         "gap" | "itemSpacing" | "columnGap" | "crossGap" | "counterAxisSpacing" | "rowGap" => "gap",
         "padding" | "paddingTop" | "paddingRight" | "paddingBottom" | "paddingLeft" | "paddingHorizontal" | "paddingVertical" => "padding",
         "mainAlign" | "primaryAxisAlignItems" | "crossAlign" | "counterAxisAlignItems" | "contentAlign" | "counterAxisAlignContent" => "alignment",

crates/engine/src/cmd/structure.rs

@@ -26,10 +26,17 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "object.convertToFrame",
             "Convert to frame",
-            "{ids?} (groups become frames of the same box in place, their layers staying where they are: no fill, not clipping. Frames are left alone; instances, main components and layers inside instances are refused)",
+            "{ids?} (groups become frames of the same box in place, their layers staying where they are: no fill, not clipping; sections become frames that keep their fill and don't clip. Frames are left alone; instances, main components, layers inside instances and sections holding sections are refused)",
             true,
             |s, p| convert(s, p, "object.convertToFrame", true)
         ),
+        spec!(
+            "object.convertToSection",
+            "Convert to section",
+            "{ids?} (frames on the page or in a section become sections in place, keeping their fill and layers; what only a frame has goes: auto layout, clipping, layout grids, guides and scrolling. Sections are left alone; nested frames, instances and main components are refused)",
+            true,
+            convert_to_section
+        ),
         spec!(
             "object.wrapInSection",
             "Wrap in new section",
@@ -199,6 +206,13 @@ fn convert(s: &mut Session, p: &Value, cmd: &'static str, to_frame: bool) -> Res
         let n = doc.get(i)?;
         let refuse = |why: &str| Err(bad(cmd, format!("\"{}\" {why}", n.name)));
         match (&n.kind, to_frame) {
+            // A frame can't hold sections.
+            (NodeKind::Section { .. }, true)
+                if n.children.iter().any(|c| doc.node(*c).is_some_and(|c| matches!(c.kind, NodeKind::Section { .. }))) =>
+            {
+                return refuse("holds sections, which can't go inside a frame: convert those first");
+            }
+            (NodeKind::Section { .. }, true) => todo.push(i),
             (NodeKind::Instance { .. }, _) => return refuse("is an instance: its layers come from its main component (detach it first)"),
             (NodeKind::Component { .. }, _) => return refuse("is a main component, which stays a frame"),
             (NodeKind::Frame | NodeKind::Group, _) if crate::components::owning_instance(doc, i).is_some() => {
@@ -212,12 +226,15 @@ fn convert(s: &mut Session, p: &Value, cmd: &'static str, to_frame: bool) -> Res
     }
     for i in &todo {
         if to_frame {
-            // The group's box as it is; nothing painted or clipped, so the look stays.
+            // The box as it is and nothing clipped, so the look stays: a group has nothing painted, a
+            // section keeps its fill.
             let n = doc.get_mut(*i)?;
+            if matches!(n.kind, NodeKind::Group) {
+                n.fills.clear();
+                n.strokes.clear();
+            }
             n.kind = NodeKind::Frame;
             n.clip = false;
-            n.fills.clear();
-            n.strokes.clear();
             continue;
         }
         let n = doc.get_mut(*i)?;
@@ -242,6 +259,43 @@ fn convert(s: &mut Session, p: &Value, cmd: &'static str, to_frame: bool) -> Res
     Ok(json!({"ids": todo}))
 }
 
+/// Frames on the page or in a section become sections in place (sections only sit there).
+fn convert_to_section(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "object.convertToSection";
+    let ids = req_targets(cmd, s, p)?;
+    let doc = s.doc_mut()?;
+    let mut todo = Vec::new();
+    for i in ids {
+        let n = doc.get(i)?;
+        let refuse = |why: &str| Err(bad(cmd, format!("\"{}\" {why}", n.name)));
+        let on_board = n.parent.and_then(|p| doc.node(p)).is_some_and(|p| p.is_page() || matches!(p.kind, NodeKind::Section { .. }));
+        match &n.kind {
+            NodeKind::Section { .. } => {}
+            NodeKind::Instance { .. } => return refuse("is an instance: its layers come from its main component (detach it first)"),
+            NodeKind::Component { .. } | NodeKind::ComponentSet { .. } => return refuse("is a main component, which stays a frame"),
+            NodeKind::Frame if !on_board => return refuse("is inside a frame or group: only frames on the page or in a section become sections"),
+            NodeKind::Frame => todo.push(i),
+            _ => return refuse("is not a frame"),
+        }
+    }
+    for i in &todo {
+        let n = doc.get_mut(*i)?;
+        n.kind = NodeKind::Section { contents_hidden: false };
+        (n.layout, n.clip, n.overflow) = (None, false, proto::Overflow::None);
+        n.grids.clear();
+        n.guides.clear();
+        n.styles.grid = None;
+        n.bound.retain(|k, _| !k.starts_with("padding") && !matches!(k.as_str(), "gap" | "counterAxisSpacing"));
+        let kids = n.children.clone();
+        for k in kids {
+            // Out of the flow there is nothing to fill or to be absolute against.
+            doc.get_mut(k)?.child_layout.absolute = false;
+        }
+        figcraft_layout::coherent_sizing(doc, *i);
+    }
+    Ok(json!({"ids": todo}))
+}
+
 fn ungroup(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("object.ungroup", s, p)?;
     let doc = s.doc_mut()?;
@@ -309,33 +363,46 @@ fn flatten(s: &mut Session, p: &Value) -> Result<Value> {
     let parent = doc.get(top)?.parent.ok_or_else(|| bad("vector.flatten", "can't flatten a page"))?;
     let index = doc.index_in_parent(top).map(|i| i + 1);
     let pw = doc.world_transform(parent);
-    let mut path = BezPath::new();
-    let mut even = false;
+    let mut net = VectorNetwork::default();
     for i in &ids {
         let Some(n) = doc.node(*i) else { continue };
-        // Booleans flatten to their result; strokes don't get outlined.
-        let Some((mut op, rule)) = (match &n.kind {
-            NodeKind::Group | NodeKind::Frame | NodeKind::Component { .. } | NodeKind::Instance { .. } => figcraft_render::subtree_outline(doc, n, 0),
-            _ => figcraft_render::node_outline(doc, n),
-        }) else {
-            continue;
+        // Vectors keep their own network (open paths and unfilled loops have no fill outline);
+        // booleans flatten to their result; strokes don't get outlined.
+        let mut part = match &n.kind {
+            NodeKind::Vector { network } => network.clone(),
+            _ => {
+                let Some((op, rule)) = (match &n.kind {
+                    NodeKind::Group | NodeKind::Frame | NodeKind::Component { .. } | NodeKind::Instance { .. } => {
+                        figcraft_render::subtree_outline(doc, n, 0)
+                    }
+                    _ => figcraft_render::node_outline(doc, n),
+                }) else {
+                    continue;
+                };
+                let mut part = VectorNetwork::from_path(&op);
+                if rule == figcraft_render::FillRule::EvenOdd {
+                    for r in &mut part.regions {
+                        r.winding = WindingRule::EvenOdd;
+                    }
+                }
+                part
+            }
         };
-        even |= rule == figcraft_render::FillRule::EvenOdd;
         // Into the common parent's space.
-        let w = doc.world_transform(*i);
-        op.apply_affine(pw.inverse() * w);
-        path.extend(op.elements().iter().copied());
+        let all: Vec<usize> = (0..part.vertices.len()).collect();
+        crate::vectoredit::ops::transform_vertices(&mut part, &all, pw.inverse() * doc.world_transform(*i));
+        let (nv, ns) = (net.vertices.len(), net.segments.len());
+        net.vertices.extend(part.vertices);
+        net.segments.extend(part.segments.into_iter().map(|s| Segment { a: s.a + nv, b: s.b + nv, ..s }));
+        net.regions.extend(
+            part.regions.into_iter().map(|r| Region { loops: r.loops.into_iter().map(|l| l.into_iter().map(|s| s + ns).collect()).collect(), ..r }),
+        );
     }
-    if path.elements().is_empty() {
+    let Some(bb) = net.bounds() else {
         return Err(EngineError::Disabled("vector.flatten".into(), "nothing to flatten".into()));
-    }
+    };
     let first = ids.first().and_then(|i| doc.node(*i)).cloned();
-    let bb = path.bounding_box();
-    path.apply_affine(Affine::translate((-bb.x0, -bb.y0)));
-    let mut net = VectorNetwork::from_path(&path);
-    for r in &mut net.regions {
-        r.winding = if even { WindingRule::EvenOdd } else { WindingRule::NonZero };
-    }
+    net.translate(-bb.x0, -bb.y0);
     let vid = doc.alloc_id();
     let name = first.as_ref().map(|f| f.name.clone()).unwrap_or_else(|| "Vector".into());
     let mut v = Node::new(vid, NodeKind::Vector { network: net }, name, bb.width(), bb.height());
@@ -362,9 +429,9 @@ fn flatten(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn outline_stroke(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = req_targets("vector.outlineStroke", s, p)?;
-    let doc = s.doc_mut()?;
     let mut out = Vec::new();
     for i in ids {
+        let doc = s.doc_mut()?;
         let n = doc.get(i)?.clone();
         if !n.has_visible_stroke() {
             continue;
@@ -409,7 +476,7 @@ fn outline_stroke(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(g) = id_of(&r["id"]) {
                 out.push(g);
             }
-            return Ok(json!({"ids": out}));
+            continue;
         }
         // Standing in for the layer, the outline keeps how it is drawn and placed.
         (v.opacity, v.blend, v.effects, v.styles.effect) = (n.opacity, n.blend, n.effects.clone(), n.styles.effect);
@@ -477,11 +544,16 @@ fn layout_add(s: &mut Session, p: &Value) -> Result<Value> {
             let pb = doc.node(*b).map(|n| figcraft_geom::transform_rect_bbox(n.transform, n.local_rect())).unwrap_or_default();
             if vertical { pa.y0.total_cmp(&pb.y0) } else { pa.x0.total_cmp(&pb.x0) }
         });
+        let empty = doc.node(*f).is_some_and(|n| n.children.iter().filter_map(|c| doc.node(*c)).all(|c| !c.visible || c.child_layout.absolute));
         let n = doc.get_mut(*f)?;
         n.children = kids;
         n.layout = Some(al);
-        n.child_layout.sizing_h = Sizing::Hug;
-        n.child_layout.sizing_v = Sizing::Hug;
+        if !all_frames || !empty {
+            // A frame wrapped around the selection hugs it; an existing frame with no flow
+            // children keeps its size instead of collapsing to its padding.
+            n.child_layout.sizing_h = Sizing::Hug;
+            n.child_layout.sizing_v = Sizing::Hug;
+        }
     }
     s.set_selection(targets.clone());
     Ok(json!({"ids": targets}))
@@ -556,6 +628,10 @@ fn offset_path(s: &mut Session, p: &Value) -> Result<Value> {
     for i in req_targets("vector.offset", s, p)? {
         let doc = s.doc_mut()?;
         let n = doc.get(i)?.clone();
+        // A vector can't hold children: leave containers (frames, groups, instances) alone.
+        if !n.children.is_empty() {
+            continue;
+        }
         let Some((path, _)) = figcraft_render::node_outline(doc, &n) else { continue };
         let props = StrokeProps { weight: d.abs() * 2.0, join: StrokeJoin::Round, align: StrokeAlign::Center, ..Default::default() };
         let ring = figcraft_pathops::stroke_center(&path, d.abs() * 2.0, &props);

crates/engine/src/cmd/styles.rs

@@ -112,6 +112,9 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("variable.createCollection", "Create variable collection", "{name, modes? [names]}", true, |s, p| {
             let name = req_string("variable.createCollection", p, "name")?;
             let doc = s.doc_mut()?;
+            if doc.variables.collections.iter().any(|c| c.name == name) {
+                return Err(bad("variable.createCollection", format!("a collection named `{name}` already exists")));
+            }
             let id = doc.new_collection_id();
             let modes: Vec<String> = match get(p, "modes") {
                 Some(Value::Array(a)) => a.iter().filter_map(|m| m.as_str().map(str::to_string)).collect(),
@@ -910,6 +913,24 @@ pub fn apply_bindings(doc: &mut Document) {
 
 /// [`apply_bindings`] for the layers `only` (every bound layer when `None`).
 pub fn apply_bindings_to(doc: &mut Document, only: Option<&std::collections::BTreeSet<NodeId>>) {
+    apply_bindings_matching(doc, only, |_| true);
+}
+
+/// Settle imported paint colours before the document is first shown. Other bindings can affect
+/// layout or component structure, which must be resolved through the normal edit pipeline.
+pub(crate) fn apply_paint_bindings_on_load(doc: &mut Document) {
+    let pending = doc.take_dirty();
+    apply_bindings_matching(doc, None, |field| {
+        super::lists::list_binding(field).is_some_and(|(list, _, prop)| {
+            matches!(list, super::lists::BoundList::Fills | super::lists::BoundList::Strokes)
+                && (prop == "color" || super::lists::stop_binding(prop).is_some())
+        })
+    });
+    doc.take_dirty();
+    doc.mark_dirty(pending);
+}
+
+fn apply_bindings_matching(doc: &mut Document, only: Option<&std::collections::BTreeSet<NodeId>>, include: impl Fn(&str) -> bool) {
     use super::lists::{BoundList, list_binding};
     if doc.variables.variables.is_empty() {
         return;
@@ -929,6 +950,9 @@ pub fn apply_bindings_to(doc: &mut Document, only: Option<&std::collections::BTr
         let mut grid_sets: Vec<(usize, String, f64)> = Vec::new();
         let mut prop_sets: Vec<(String, VariableValue)> = Vec::new();
         for (field, var) in binds {
+            if !include(&field) {
+                continue;
+            }
             let Some(val) = doc.variables.resolve(&var, &modes) else { continue };
             // One list item's value: a paint's colour, an effect's or a layout grid's field.
             if let Some((list, i, prop)) = list_binding(&field) {

crates/engine/src/cmd/text.rs

@@ -332,7 +332,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "text.preview",
             "Preview text change",
-            "{command: style.apply|library.applyStyle|text.setVariations|text.style, params}  shows what the command would do on the canvas without an undo step (a hovered text style or named instance, a dragged axis slider), in place of an earlier preview; text.endPreview or any other command ends it, so running the command for real commits it as one undo step",
+            "{command: style.apply|library.applyStyle|text.setVariations|text.style, params}  shows what the command would do on the canvas without an undo step (a hovered font family or style, text style or named instance, a dragged axis slider), in place of an earlier preview; text.endPreview or any other command ends it, so running the command for real commits it as one undo step",
             false,
             |s, p| {
                 let c = req_string("text.preview", p, "command")?;

crates/engine/src/cmd/variables.rs

@@ -87,7 +87,7 @@ fn update(s: &mut Session, p: &Value) -> Result<Value> {
         }
         None => None,
     };
-    let scopes = match get(p, "scopes") {
+    let scopes = match p.get("scopes") {
         None => None,
         Some(Value::Null) => Some(None),
         Some(Value::Array(a)) => {

crates/engine/src/cmd/variables_io.rs

@@ -25,7 +25,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "variable.import",
             "Import variables",
-            "{variables (the local variables JSON, as variable.export writes it: an object, JSON text or a path)}  collections join this file's collection of the same name (values by mode name; new modes and variables are added, a variable of another type is skipped), others are added  → {collections (added), variables (added), updated, warnings}",
+            "{variables (the local variables JSON, as variable.export writes it: an object, JSON text or a path; `variableCollections` and `variables` under `meta` or at the top level)}  collections join this file's collection of the same name (values by mode name; new modes and variables are added, a variable of another type is skipped), others are added  → {collections (added), variables (added), updated, warnings (also when it holds no variables, or fewer than its collections list)}",
             true,
             import
         ),

crates/engine/src/cmd/view.rs

@@ -19,30 +19,58 @@ fn flag(s: &mut Session, p: &Value, f: fn(&mut ViewState) -> &mut bool) -> Resul
     Ok(json!({"on": *slot}))
 }
 
+/// One of a view's on/off settings.
+type Slot = fn(&mut ViewState) -> &mut bool;
+
+/// The View menu's on/off toggles (Pixel preview, with its scale, has its own command), and
+/// whether the preferences keep each: files opened or made later start with the kept ones. Outline
+/// modes and the sRGB soft-proof stay with their file, so a new file never opens in one.
+const TOGGLES: &[(&str, Slot, bool)] = &[
+    ("view.pixelGrid", |v| &mut v.pixel_grid, true),
+    ("view.layoutGrids", |v| &mut v.layout_grids, true),
+    ("view.rulers", |v| &mut v.rulers, true),
+    ("view.slices", |v| &mut v.show_slices, true),
+    ("view.comments", |v| &mut v.comments, true),
+    ("view.multiplayerCursors", |v| &mut v.multiplayer_cursors, true),
+    ("view.outlines", |v| &mut v.outlines, false),
+    ("view.outlinesSelection", |v| &mut v.outlines_selection, false),
+    ("view.outlinesHiddenLayers", |v| &mut v.outline_hidden, true),
+    ("view.outlinesObjectBounds", |v| &mut v.outline_bounds, true),
+    ("view.maskOutlines", |v| &mut v.mask_outlines, true),
+    ("view.frameOutlines", |v| &mut v.frame_outlines, true),
+    ("view.proofSrgb", |v| &mut v.proof_srgb, false),
+    ("view.snapGeometry", |v| &mut v.snap_geometry, true),
+    ("view.snapObjects", |v| &mut v.snap_objects, true),
+    ("view.snapPixel", |v| &mut v.snap_pixel, true),
+];
+
+/// View toggle `id`: the file's view changes, and the preferences remember a kept one.
+fn toggle(s: &mut Session, p: &Value, id: &str) -> Result<Value> {
+    let Some(&(_, f, keep)) = TOGGLES.iter().find(|(k, ..)| *k == id) else { return Err(bad(id, "not a View toggle")) };
+    let r = flag(s, p, f)?;
+    if keep && let Some(on) = r.get("on").and_then(Value::as_bool) {
+        s.prefs.view.insert(id.to_string(), on);
+    }
+    Ok(r)
+}
+
+/// Set `v`'s View toggles to the ones the preferences keep (the others stay as they are).
+pub(crate) fn apply_kept(prefs: &crate::Prefs, v: &mut ViewState) {
+    for (id, f, _) in TOGGLES.iter().filter(|t| t.2) {
+        if let Some(on) = prefs.view.get(*id) {
+            *f(v) = *on;
+        }
+    }
+}
+
 /// Whether the View menu's toggle `id` is on (the menus show a check mark); `None` for a command
 /// that isn't one.
 pub fn checked(s: &Session, id: &str) -> Option<bool> {
-    let v = &s.ds().ok()?.view;
-    Some(match id {
-        "view.pixelGrid" => v.pixel_grid,
-        "view.layoutGrids" => v.layout_grids,
-        "view.rulers" => v.rulers,
-        "view.slices" => v.show_slices,
-        "view.comments" => v.comments,
-        "view.multiplayerCursors" => v.multiplayer_cursors,
-        "view.outlines" => v.outlines,
-        "view.outlinesSelection" => v.outlines_selection,
-        "view.outlinesHiddenLayers" => v.outline_hidden,
-        "view.outlinesObjectBounds" => v.outline_bounds,
-        "view.maskOutlines" => v.mask_outlines,
-        "view.pixelPreview" => v.pixel_preview,
-        "view.frameOutlines" => v.frame_outlines,
-        "view.proofSrgb" => v.proof_srgb,
-        "view.snapGeometry" => v.snap_geometry,
-        "view.snapObjects" => v.snap_objects,
-        "view.snapPixel" => v.snap_pixel,
-        _ => return None,
-    })
+    let mut v = s.ds().ok()?.view.clone();
+    if id == "view.pixelPreview" {
+        return Some(v.pixel_preview);
+    }
+    TOGGLES.iter().find(|(k, ..)| *k == id).map(|(_, f, _)| *f(&mut v))
 }
 
 /// Pixel preview: toggles, or turns on at a resolution of 1x or 2x.
@@ -138,8 +166,16 @@ fn page_step(s: &mut Session, dir: i64) -> Result<Value> {
     let pages = &ds.doc.pages;
     let i = pages.iter().position(|p| *p == ds.page).unwrap_or(0) as i64;
     let n = pages.len() as i64;
-    let next = (i + dir).clamp(0, n - 1) as usize;
-    let Some(pg) = pages.get(next).copied() else { return ok() };
+    // Dividers never open: step over them, and stay put when only dividers lie ahead.
+    let mut next = i + dir;
+    let pg = loop {
+        let page = usize::try_from(next).ok().and_then(|k| pages.get(k).copied());
+        match page {
+            Some(p) if !ds.doc.is_divider(p) => break p,
+            Some(_) if dir != 0 && next >= 0 && next < n => next += dir,
+            _ => break ds.page,
+        }
+    };
     let ds = s.ds_mut()?;
     ds.page = pg;
     ds.selection.clear();
@@ -227,46 +263,46 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("view.nextFrame", "Zoom to next frame", "{}", false, |s, _| zoom_frame(s, 1)),
         spec!("view.prevPage", "Previous page", "{}", false, |s, _| page_step(s, -1)),
         spec!("view.nextPage", "Next page", "{}", false, |s, _| page_step(s, 1)),
-        spec!("view.pixelGrid", "Pixel grid", "{on?}", false, |s, p| flag(s, p, |v| &mut v.pixel_grid)),
-        spec!("view.layoutGrids", "Layout grids", "{on?}", false, |s, p| flag(s, p, |v| &mut v.layout_grids)),
-        spec!("view.rulers", "Rulers", "{on?}", false, |s, p| flag(s, p, |v| &mut v.rulers)),
-        spec!("view.slices", "Slices", "{on?}", false, |s, p| flag(s, p, |v| &mut v.show_slices)),
-        spec!("view.comments", "Comments", "{on?}", false, |s, p| flag(s, p, |v| &mut v.comments)),
+        spec!("view.pixelGrid", "Pixel grid", "{on?}", false, |s, p| toggle(s, p, "view.pixelGrid")),
+        spec!("view.layoutGrids", "Layout grids", "{on?}", false, |s, p| toggle(s, p, "view.layoutGrids")),
+        spec!("view.rulers", "Rulers", "{on?}", false, |s, p| toggle(s, p, "view.rulers")),
+        spec!("view.slices", "Slices", "{on?}", false, |s, p| toggle(s, p, "view.slices")),
+        spec!("view.comments", "Comments", "{on?}", false, |s, p| toggle(s, p, "view.comments")),
         spec!("view.multiplayerCursors", "Multiplayer cursors", "{on?}  others' cursors in a live session", false, |s, p| {
-            flag(s, p, |v| &mut v.multiplayer_cursors)
+            toggle(s, p, "view.multiplayerCursors")
         }),
         spec!("view.pan", "Pan the view", "{dx, dy (arrow-key steps, e.g. 1 or -1), big? (ten times as far, like Shift)}", false, pan),
-        spec!("view.outlines", "Outlines", "{on?}", false, |s, p| flag(s, p, |v| &mut v.outlines)),
+        spec!("view.outlines", "Outlines", "{on?}", false, |s, p| toggle(s, p, "view.outlines")),
         spec!("view.outlinesSelection", "Outlines for selection", "{on?}  outline mode for the selected layers only", false, |s, p| {
-            flag(s, p, |v| &mut v.outlines_selection)
+            toggle(s, p, "view.outlinesSelection")
         }),
         spec!(
             "view.outlinesHiddenLayers",
             "Include hidden layers in outlines",
             "{on?}  outline mode (and outlines for the selection) outlines hidden layers too; they can be clicked there",
             false,
-            |s, p| { flag(s, p, |v| &mut v.outline_hidden) }
+            |s, p| { toggle(s, p, "view.outlinesHiddenLayers") }
         ),
         spec!(
             "view.outlinesObjectBounds",
             "Include object bounds in outlines",
             "{on?}  outline mode also draws each layer's box (groups, text, vectors); a click on a box's edge picks its layer",
             false,
-            |s, p| { flag(s, p, |v| &mut v.outline_bounds) }
+            |s, p| { toggle(s, p, "view.outlinesObjectBounds") }
         ),
-        spec!("view.maskOutlines", "Mask outlines", "{on?}", false, |s, p| flag(s, p, |v| &mut v.mask_outlines)),
+        spec!("view.maskOutlines", "Mask outlines", "{on?}", false, |s, p| toggle(s, p, "view.maskOutlines")),
         spec!("view.pixelPreview", "Pixel preview", "{on?, scale? (1|2: rendered pixels per page pixel; turns it on)}", false, pixel_preview),
-        spec!("view.frameOutlines", "Frame outlines", "{on?}", false, |s, p| flag(s, p, |v| &mut v.frame_outlines)),
+        spec!("view.frameOutlines", "Frame outlines", "{on?}", false, |s, p| toggle(s, p, "view.frameOutlines")),
         spec!(
             "view.proofSrgb",
             "Soft-proof sRGB",
             "{on?}  mark the colours of a Display P3 file that sRGB screens and files can't show",
             false,
-            |s, p| { flag(s, p, |v| &mut v.proof_srgb) }
+            |s, p| { toggle(s, p, "view.proofSrgb") }
         ),
-        spec!("view.snapGeometry", "Snap to geometry", "{on?}", false, |s, p| flag(s, p, |v| &mut v.snap_geometry)),
-        spec!("view.snapObjects", "Snap to objects", "{on?}", false, |s, p| flag(s, p, |v| &mut v.snap_objects)),
-        spec!("view.snapPixel", "Snap to pixel grid", "{on?}", false, |s, p| flag(s, p, |v| &mut v.snap_pixel)),
+        spec!("view.snapGeometry", "Snap to geometry", "{on?}", false, |s, p| toggle(s, p, "view.snapGeometry")),
+        spec!("view.snapObjects", "Snap to objects", "{on?}", false, |s, p| toggle(s, p, "view.snapObjects")),
+        spec!("view.snapPixel", "Snap to pixel grid", "{on?}", false, |s, p| toggle(s, p, "view.snapPixel")),
         spec!("view.toggleUi", "Show/Hide UI", "{on?}", false, |s, p| flag(s, p, |v| &mut v.ui_hidden)),
         spec!("view.fullscreen", "Full screen", "{on?}  the window fills the screen (the desktop app; a no-op headless)", false, |s, p| {
             s.request_ui("window.fullscreen", json!({"on": boolean(p, "on")}));
@@ -334,6 +370,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("pref.showDimensions", "Show dimensions on objects", "{on?}", false, |s, p| pref(s, p, |x| &mut x.show_dimensions)),
         spec!("pref.numberKeysOpacity", "Use number keys for opacity", "{on?}", false, |s, p| pref(s, p, |x| &mut x.number_keys_opacity)),
         spec!("pref.reduceMotion", "Reduce motion", "{on?}", false, |s, p| pref(s, p, |x| &mut x.reduce_motion)),
+        spec!("pref.autoSave", "Save files automatically", "{on?}", false, |s, p| pref(s, p, |x| &mut x.auto_save)),
         spec!("pref.nudge", "Nudge amount", "{small?, big?}", false, |s, p| {
             s.prefs.nudge_small = num(p, "small").unwrap_or(s.prefs.nudge_small).clamp(0.01, 1000.0);
             s.prefs.nudge_big = num(p, "big").unwrap_or(s.prefs.nudge_big).clamp(0.01, 10000.0);
@@ -369,18 +406,24 @@ pub fn specs() -> Vec<CommandSpec> {
                 Ok(json!({"url": s.prefs.publish_server, "default": crate::live::DEFAULT_SERVER}))
             }
         ),
-        spec!("pref.language", "Interface language", "{language: system|en|es|es-419|fr|de|pt-BR|ja|ko|zh-Hans|…; else English}", false, |s, p| {
-            let lang = req_string("pref.language", p, "language")?;
-            let lang = lang.trim();
-            // A BCP 47-style tag ("es", "pt-BR", "zh_Hans") or "system".
-            let tag = lang.len() <= 35
-                && lang.split(['-', '_']).all(|part| !part.is_empty() && part.len() <= 8 && part.chars().all(|c| c.is_ascii_alphanumeric()));
-            if !tag {
-                return Err(bad("pref.language", format!("`{lang}` is not a language code")));
+        spec!(
+            "pref.language",
+            "Interface language",
+            "{language: system|en|cs|ru|es|es-419|fr|de|pt-BR|ja|ko|zh-Hans|…; else English}",
+            false,
+            |s, p| {
+                let lang = req_string("pref.language", p, "language")?;
+                let lang = lang.trim();
+                // A BCP 47-style tag ("es", "pt-BR", "zh_Hans") or "system".
+                let tag = lang.len() <= 35
+                    && lang.split(['-', '_']).all(|part| !part.is_empty() && part.len() <= 8 && part.chars().all(|c| c.is_ascii_alphanumeric()));
+                if !tag {
+                    return Err(bad("pref.language", format!("`{lang}` is not a language code")));
+                }
+                s.prefs.language = lang.to_string();
+                Ok(json!({"language": s.prefs.language}))
             }
-            s.prefs.language = lang.to_string();
-            Ok(json!({"language": s.prefs.language}))
-        }),
+        ),
         spec!("app.preferences", "Preferences", "{}", false, |s, _| ui(s, "dialog.preferences")),
         spec!("app.actions", "Actions", "{}", false, |s, _| ui(s, "palette.actions")),
         spec!("help.shortcuts", "Keyboard shortcuts", "{}", false, |s, _| ui(s, "panel.shortcuts")),

crates/engine/src/codegen.rs

@@ -113,8 +113,58 @@ pub(crate) fn num(v: f64) -> String {
 }
 
 /// `code` with every pixel length (`12px`) in rem of `root` pixels (`0.75rem`); names that end
-/// in "px" are left alone.
+/// in "px", markup lines (layer text), string literals and comments are left alone.
 pub fn px_to_rem(code: &str, root: f64) -> String {
+    let mut out = String::with_capacity(code.len());
+    let mut in_comment = false;
+    for line in code.split_inclusive('\n') {
+        if !in_comment && line.trim_start().starts_with('<') {
+            out.push_str(line);
+            continue;
+        }
+        // Lengths outside strings and comments convert; `plain` is where that stretch starts.
+        let mut plain = 0;
+        let mut chars = line.char_indices().peekable();
+        while let Some((i, c)) = chars.next() {
+            if in_comment {
+                if c == '*' && chars.peek().is_some_and(|(_, n)| *n == '/') {
+                    chars.next();
+                    out.push_str(line.get(plain..i + 2).unwrap_or(""));
+                    plain = i + 2;
+                    in_comment = false;
+                }
+            } else if c == '/' && chars.peek().is_some_and(|(_, n)| *n == '*') {
+                chars.next();
+                out.push_str(&lengths_to_rem(line.get(plain..i).unwrap_or(""), root));
+                plain = i;
+                in_comment = true;
+            } else if c == '"' {
+                out.push_str(&lengths_to_rem(line.get(plain..i).unwrap_or(""), root));
+                let mut end = line.len();
+                while let Some((j, s)) = chars.next() {
+                    if s == '\\' {
+                        chars.next();
+                    } else if s == '"' {
+                        end = j + 1;
+                        break;
+                    }
+                }
+                out.push_str(line.get(i..end).unwrap_or(""));
+                plain = end;
+            }
+        }
+        let rest = line.get(plain..).unwrap_or("");
+        if in_comment {
+            out.push_str(rest);
+        } else {
+            out.push_str(&lengths_to_rem(rest, root));
+        }
+    }
+    out
+}
+
+/// `code` with every pixel length in rem of `root` pixels; names that end in "px" are left alone.
+fn lengths_to_rem(code: &str, root: f64) -> String {
     let ident = |c: char| c.is_alphanumeric() || c == '_';
     let mut out = String::with_capacity(code.len());
     let mut rest = code;

crates/engine/src/component_codegen.rs

@@ -615,10 +615,10 @@ pub fn definition(doc: &Document, c: &Component, lang: CodeLang) -> String {
     }
 }
 
-/// `data-*` attribute names for variant parameters.
-fn data_attr(p: &Param) -> String {
+/// `data-*` attribute names for variant parameters, unique among them (in order).
+fn data_attrs(variants: &[&Param]) -> Vec<String> {
     let mut used = Vec::new();
-    format!("data-{}", class_name(&p.prop, &mut used))
+    variants.iter().map(|p| format!("data-{}", class_name(&p.prop, &mut used))).collect()
 }
 
 /// `c`'s markup in React or Leptos (two levels in) and its stylesheet (variables as custom
@@ -628,6 +628,7 @@ fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String
     let root_name = c.set.and_then(|s| doc.node(s)).or_else(|| doc.node(c.comp)).map(|n| n.name.clone()).unwrap_or_default();
     let root_class = class_name(&root_name, &mut Vec::new());
     let variants: Vec<&Param> = c.params.iter().filter(|p| matches!(p.kind, ParamKind::Variant(_))).collect();
+    let attr_names = data_attrs(&variants);
     let pass = |root: NodeId| {
         let vctx = Ctx { doc, root, comp: Some(c), base: 2 };
         let mut m = Markup::new(&vctx, lang);
@@ -639,9 +640,10 @@ fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String
     m.root_class = Some(root_class.clone());
     m.root_attrs = variants
         .iter()
-        .map(|p| match lang {
-            CodeLang::Leptos => format!(" {}={{{}.as_str()}}", data_attr(p), rust_ident(&p.ident)),
-            _ => format!(" {}={{{}}}", data_attr(p), p.ident),
+        .zip(&attr_names)
+        .map(|(p, attr)| match lang {
+            CodeLang::Leptos => format!(" {attr}={{{}.as_str()}}", rust_ident(&p.ident)),
+            _ => format!(" {attr}={{{}}}", p.ident),
         })
         .collect();
     m.node(c.comp, None, 2, "");
@@ -653,7 +655,8 @@ fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String
         let pairs = variant_props(&vn.name);
         let attrs: String = variants
             .iter()
-            .filter_map(|p| pairs.get(&p.prop).map(|val| format!("[{}=\"{}\"]", data_attr(p), val.replace(['"', '\\'], ""))))
+            .zip(&attr_names)
+            .filter_map(|(p, attr)| pairs.get(&p.prop).map(|val| format!("[{attr}=\"{}\"]", val.replace(['"', '\\'], ""))))
             .collect();
         for (path, _, decls) in pass(v) {
             let Some((_, class, base)) = m.rules.iter().find(|(p, _, _)| *p == path) else { continue };

crates/engine/src/component_codegen_tests.rs

@@ -314,3 +314,32 @@ fn bound_variables_become_custom_properties() {
     let react = code(&mut s, c, "react");
     assert!(react.contains(":root {\n  --colors-brand-500: #3366FF;\n}"), "{react}");
 }
+
+#[test]
+fn case_colliding_variant_properties_get_distinct_data_attributes() {
+    let mut s = Session::new();
+    let mut variants = Vec::new();
+    for (k, (first, second, fill)) in [("Small", "Big", "#0000FF"), ("Large", "Small", "#FF0000")].iter().enumerate() {
+        let name = format!("Size={first}, size={second}");
+        let f = idv(&ex(
+            &mut s,
+            "frame.create",
+            json!({"x": k as f64 * 150.0, "y": 0, "width": 100, "height": 40, "name": name, "props": {"fill": fill}}),
+        ));
+        variants.push(idv(&ex(&mut s, "component.create", json!({"ids": [f]}))));
+    }
+    let set = idv(&ex(&mut s, "component.combineVariants", json!({"ids": variants})));
+    ex(&mut s, "node.set", json!({"id": set, "props": {"name": "Chip"}}));
+    for lang in ["react", "leptos"] {
+        let v = component_code(&mut s, set, lang);
+        let def = v["definition"].as_str().unwrap_or_default();
+        let root = def.lines().find(|l| l.trim_start().starts_with("<div ")).unwrap_or_default();
+        let attrs: Vec<&str> =
+            root.split_whitespace().filter_map(|w| w.strip_prefix("data-")).map(|w| w.split('=').next().unwrap_or_default()).collect();
+        assert_eq!(attrs.len(), 2, "{lang}: {root}");
+        assert_ne!(attrs[0], attrs[1], "{lang}: distinct attributes in {root}");
+        let sel = format!(".chip[data-{}=\"Large\"][data-{}=\"Small\"]", attrs[0], attrs[1]);
+        assert!(def.contains(&sel), "{lang}: {sel} in:\n{def}");
+        assert!(def.contains("#FF0000"), "{lang}:\n{def}");
+    }
+}

crates/engine/src/components.rs

@@ -11,12 +11,12 @@
 //! Override groups: `fills`, `strokes`, `effects`, `opacity`, `visible`, `name`, `corners`,
 //! `characters`, `textStyle` (font, size, spacing, resizing, …), `padding`, `gap` and `alignment`
 //! (of auto layout: its direction and other settings are the main's), `grids`, `exports`,
-//! `interactions`, `component` (a swapped nested instance), `props` (property values of a nested
-//! instance) and `slot` (a slot holding the instance's own content). An instance's own export
-//! settings and interactions are its own, like its place. `size` and `position` overrides of
-//! layers inside an instance are still read and kept, but new ones are refused
-//! ([`check_override_edit`]): those layers take their geometry, constraints and resizing from the
-//! main; the instance itself resizes.
+//! `interactions`, `size` and `resizing` (hug, fill or fixed, with min and max sizes) of layers
+//! inside an instance, `component` (a swapped nested instance), `props` (property values of a
+//! nested instance) and `slot` (a slot holding the instance's own content). An instance's own
+//! export settings, interactions and resizing are its own, like its place. `position`
+//! overrides of layers inside an instance are still read and kept, but new ones are refused
+//! ([`check_override_edit`]): those layers take their place and constraints from the main.
 //!
 //! Switching variants keeps an override where the layer's name path matches and the two variants
 //! agreed on that property (text layers keep all of theirs); swapping from the Assets panel keeps
@@ -58,6 +58,7 @@ pub const OVERRIDE_GROUPS: &[&str] = &[
     "exports",
     "interactions",
     "size",
+    "resizing",
     "position",
     "component",
     "props",
@@ -388,11 +389,14 @@ pub(crate) fn copy_group(from: &Node, to: &mut Node, g: &str) {
         "size" => {
             to.width = from.width;
             to.height = from.height;
-            to.child_layout = from.child_layout.clone();
             if let (NodeKind::Text(a), NodeKind::Text(b)) = (&from.kind, &mut to.kind) {
                 b.auto_resize = a.auto_resize;
             }
         }
+        "resizing" => {
+            let (a, b) = (&from.child_layout, &mut to.child_layout);
+            (b.sizing_h, b.sizing_v, b.min_w, b.max_w, b.min_h, b.max_h) = (a.sizing_h, a.sizing_v, a.min_w, a.max_w, a.min_h, a.max_h);
+        }
         "position" => to.transform = from.transform,
         "component" => {
             if let (NodeKind::Instance { component: a, .. }, NodeKind::Instance { component: b, .. }) = (&from.kind, &mut to.kind) {
@@ -472,11 +476,11 @@ fn apply_prop(doc: &Document, n: &mut Node, field: &str, val: &Value) {
             }
         }
         "characters" => {
-            if let (NodeKind::Text(t), Some(sv)) = (&mut n.kind, val.as_str())
+            if let (NodeKind::Text(t), Some(sv)) = (&mut n.kind, val.as_str().map(crate::cmd::props::normalize_line_endings))
                 && t.characters != sv
             {
                 let len = t.char_count();
-                t.replace_range(0, len, sv);
+                t.replace_range(0, len, &sv);
             }
         }
         "mainComponent" => {
@@ -773,6 +777,15 @@ fn sync_instance_depth(doc: &mut Document, inst: NodeId, depth: usize, spare: BT
     for s in &src {
         let Some(nid) = map.get(s).copied() else { continue };
         let Some(o) = old.get(&nid) else { continue };
+        // A frame that kept the size its own resizing gave it: its layers (copied at their main
+        // layers' places) follow their constraints from its main layer's size.
+        if o.overrides.contains("resizing")
+            && !o.overrides.contains("size")
+            && doc.node(nid).is_some_and(|n| n.kind.is_frame_like() && n.layout.is_none())
+            && let Some((mw, mh)) = doc.node(*s).map(|m| (m.width, m.height))
+        {
+            figcraft_layout::apply_constraints(doc, nid, mw, mh);
+        }
         if !o.overrides.contains("size") && !o.overrides.contains("position") {
             continue;
         }
@@ -985,6 +998,9 @@ pub fn diff_groups(a: &Node, b: &Node) -> Vec<&'static str> {
     if (a.width - b.width).abs() > 1e-6 || (a.height - b.height).abs() > 1e-6 {
         out.push("size");
     }
+    if resizing(a) != resizing(b) {
+        out.push("resizing");
+    }
     if a.transform != b.transform {
         out.push("position");
     }
@@ -1027,6 +1043,12 @@ pub fn diff_groups(a: &Node, b: &Node) -> Vec<&'static str> {
     out
 }
 
+/// The `resizing` group of a layer: how it sizes on each axis, and its min and max sizes.
+fn resizing(n: &Node) -> (Sizing, Sizing, [Option<f64>; 4]) {
+    let c = &n.child_layout;
+    (c.sizing_h, c.sizing_v, [c.min_w, c.max_w, c.min_h, c.max_h])
+}
+
 /// Whether two texts differ in anything but their characters (the `textStyle` group).
 fn text_style_differs(x: &TextData, y: &TextData) -> bool {
     x.style != y.style
@@ -1107,9 +1129,10 @@ pub fn sync_after_edit(doc: &mut Document, before: &Document, changed: &[NodeId]
         }
         let raw = diff_groups(b, n);
         let mut groups = raw.clone();
-        // An instance's own place, export settings and interactions are its own, not overrides.
+        // An instance's own place, resizing, export settings and interactions are its own, not
+        // overrides.
         if top_root {
-            groups.retain(|g| !matches!(*g, "component" | "props" | "position" | "exports" | "interactions"));
+            groups.retain(|g| !matches!(*g, "component" | "props" | "position" | "resizing" | "exports" | "interactions"));
         }
         if groups.iter().any(|g| matches!(*g, "size" | "position")) {
             groups.retain(|g| !matches!(*g, "size" | "position") || !geometry_derived(doc, before, id, g));
@@ -1414,7 +1437,7 @@ fn patch_structure(doc: &mut Document, before: &Document, seeds: &[NodeId]) -> b
 fn child_follows_main(doc: &Document, parent: NodeId, absolute: bool) -> bool {
     let Some(p) = doc.node(parent) else { return false };
     let constrains = p.layout.is_none() || absolute;
-    let resized = p.overrides.contains("size")
+    let resized = sized_own(p)
         || match &p.kind {
             NodeKind::Instance { component, .. } => {
                 doc.node(*component).is_none_or(|m| (m.width - p.width).abs() > 1e-9 || (m.height - p.height).abs() > 1e-9)
@@ -1475,7 +1498,7 @@ fn patch_copies(doc: &mut Document, seeds: &[(NodeId, Vec<&'static str>)]) -> bo
             let gs: Vec<&'static str> = groups
                 .iter()
                 .copied()
-                .filter(|g| !cn.overrides.contains(*g) && !(root && matches!(*g, "visible" | "name" | "position" | "exports" | "interactions")))
+                .filter(|g| !(cn.overrides.contains(*g) || root && matches!(*g, "visible" | "name" | "position" | "exports" | "interactions")))
                 .collect();
             if gs.is_empty() {
                 continue;
@@ -1518,7 +1541,7 @@ fn follows_main_geometry(doc: &Document, id: NodeId) -> bool {
     chain.windows(2).all(|w| {
         let (Some(below), Some(a)) = (w.first().and_then(|i| doc.node(*i)), w.get(1).and_then(|i| doc.node(*i))) else { return false };
         let constrains = a.layout.is_none() || below.child_layout.absolute;
-        if a.overrides.contains("size") && constrains {
+        if sized_own(a) && constrains {
             return false;
         }
         match &a.kind {
@@ -1530,6 +1553,12 @@ fn follows_main_geometry(doc: &Document, id: NodeId) -> bool {
     })
 }
 
+/// Whether a layer inside an instance overrides its size or resizing: it may not have its main
+/// layer's size, so the layers in it can't take their main layers' places as they are.
+fn sized_own(n: &Node) -> bool {
+    n.overrides.contains("size") || n.overrides.contains("resizing")
+}
+
 /// Rebuild every instance of `comps` (and of the components that hold those instances, and so on
 /// outwards), each outermost instance once, inner components first.
 fn rebuild_instances(doc: &mut Document, comps: &BTreeSet<NodeId>) {
@@ -1665,10 +1694,9 @@ pub fn check_override_edit(before: &Document, after: &Document) -> Result<(), St
 
 /// What about layer `id` an edit from `before` to `after` changed that only its main can: the
 /// auto layout of an instance or a layer in one but its padding, gap and alignment, or the
-/// position (rotation too), size, constraints or resizing of a layer inside an instance (the
-/// instance itself resizes, and its layers follow; text whose box follows its content still
-/// does). `None` when the edit is fine, also when the main changed the same way in this edit (a
-/// library update).
+/// position (rotation too), constraints or place in auto layout (absolute, grid cell) of a layer
+/// inside an instance (its size and resizing are overrides). `None` when the edit is fine, also
+/// when the main changed the same way in this edit (a library update).
 pub fn refused_override(before: &Document, after: &Document, id: NodeId) -> Option<&'static str> {
     let (n, b) = (after.node(id)?, before.node(id)?);
     if after.is_remote(id) || n.source != b.source || owning_instance(before, id).is_none() || owning_instance(after, id).is_none() {
@@ -1684,8 +1712,12 @@ pub fn refused_override(before: &Document, after: &Document, id: NodeId) -> Opti
             l
         })
     };
-    let size = |x: &Node| (x.width, x.height);
-    let resized = |x: &Node, y: &Node| (x.width - y.width).abs() > 1e-6 || (x.height - y.height).abs() > 1e-6;
+    // Child layout settings other than the resizing ones.
+    let placing = |x: &Node| {
+        let mut c = x.child_layout.clone();
+        (c.sizing_h, c.sizing_v, c.min_w, c.max_w, c.min_h, c.max_h) = (Sizing::Fixed, Sizing::Fixed, None, None, None, None);
+        c
+    };
     if mode(n) != mode(b) && mode(ma) == mode(mb) {
         return Some("The auto layout direction");
     }
@@ -1698,18 +1730,174 @@ pub fn refused_override(before: &Document, after: &Document, id: NodeId) -> Opti
     if n.transform != b.transform && ma.transform == mb.transform && !geometry_derived(after, before, id, "position") {
         return Some("A layer's position");
     }
-    if resized(n, b) && size(ma) == size(mb) && !geometry_derived(after, before, id, "size") {
-        return Some("A layer's size");
-    }
     if n.constraints != b.constraints && ma.constraints == mb.constraints {
         return Some("A layer's constraints");
     }
-    if n.child_layout != b.child_layout && ma.child_layout == mb.child_layout {
-        return Some("A layer's resizing");
+    if placing(n) != placing(b) && placing(ma) == placing(mb) {
+        return Some("A layer's place in auto layout");
     }
     None
 }
 
+/// Bounded source and parent lookups while a rebase reads an unchanged document.
+struct RebaseSources<'a> {
+    doc: &'a Document,
+    chains: BTreeMap<NodeId, Option<Vec<NodeId>>>,
+    parents: BTreeMap<(NodeId, NodeId), Option<bool>>,
+    main_changes: BTreeMap<NodeId, bool>,
+}
+
+impl<'a> RebaseSources<'a> {
+    const PARENTS: usize = 512;
+    const CACHE: usize = 8192;
+
+    fn new(doc: &'a Document) -> Self {
+        Self { doc, chains: BTreeMap::new(), parents: BTreeMap::new(), main_changes: BTreeMap::new() }
+    }
+
+    fn chain(&mut self, source: NodeId) -> Option<Vec<NodeId>> {
+        if let Some(chain) = self.chains.get(&source) {
+            return chain.clone();
+        }
+        let read = || {
+            let mut chain = Vec::new();
+            let mut seen = BTreeSet::new();
+            let mut current = Some(source);
+            for _ in 0..MAX_DEPTH {
+                let Some(id) = current else { return Some(chain) };
+                if !seen.insert(id) {
+                    return None;
+                }
+                let n = self.doc.node(id)?;
+                chain.push(id);
+                current = n.source;
+            }
+            current.is_none().then_some(chain)
+        };
+        let chain = read();
+        if self.chains.len() < Self::CACHE {
+            self.chains.insert(source, chain.clone());
+        }
+        chain
+    }
+
+    /// Validate the complete parent chain, even if `main` was found before a cycle.
+    fn in_main(&mut self, id: NodeId, main: NodeId) -> Option<bool> {
+        if let Some(found) = self.parents.get(&(id, main)) {
+            return *found;
+        }
+        let read = || {
+            let mut current = Some(id);
+            let mut seen = BTreeSet::new();
+            let mut found = false;
+            for _ in 0..Self::PARENTS {
+                let Some(id) = current else { return Some(found) };
+                if !seen.insert(id) {
+                    return None;
+                }
+                found |= id == main;
+                current = self.doc.node(id)?.parent;
+            }
+            current.is_none().then_some(found)
+        };
+        let found = read();
+        if self.parents.len() < Self::CACHE {
+            self.parents.insert((id, main), found);
+        }
+        found
+    }
+
+    fn member(&mut self, source: NodeId, main: NodeId, target: NodeId) -> Option<NodeId> {
+        let chain = self.chain(source)?;
+        if chain.contains(&target) {
+            return None;
+        }
+        let mut member = None;
+        for id in chain {
+            if self.in_main(id, main)? && id != main && member.is_none() {
+                member = Some(id);
+            }
+        }
+        member
+    }
+
+    /// Nearest enclosing instances and their current mains. Slots with own content end scope.
+    fn owners(&self, id: NodeId) -> Option<Vec<(NodeId, NodeId)>> {
+        let mut owners = Vec::new();
+        let mut current = self.doc.node(id)?.parent;
+        let mut seen = BTreeSet::from([id]);
+        for _ in 0..Self::PARENTS {
+            let Some(id) = current else { return Some(owners) };
+            if !seen.insert(id) {
+                return None;
+            }
+            let n = self.doc.node(id)?;
+            if holds_content(n) {
+                return Some(owners);
+            }
+            if let NodeKind::Instance { component, .. } = &n.kind {
+                owners.push((id, *component));
+            }
+            current = n.parent;
+        }
+        current.is_none().then_some(owners)
+    }
+
+    fn contextual(&mut self, source: NodeId, owners: &[(NodeId, NodeId)]) -> bool {
+        owners.iter().any(|(_, main)| self.in_main(source, *main) == Some(true) && source != *main)
+    }
+
+    /// A contextual child belongs to the same placed slot as its enclosing instance.
+    fn valid(&mut self, source: NodeId, target: NodeId, owners: &[(NodeId, NodeId)]) -> bool {
+        let Some((owner, main)) = owners.first() else { return false };
+        if self.member(source, *main, target).is_none() {
+            return false;
+        }
+        if self.in_main(source, *main) == Some(true) {
+            return true;
+        }
+        let Some(source_owner) = self.doc.node(*owner).and_then(|n| n.source) else { return false };
+        matches!(self.doc.node(source_owner).map(|n| &n.kind), Some(NodeKind::Instance { component, .. }) if component == main)
+            && self.owners(source).and_then(|owners| owners.first().copied()).is_some_and(|(id, _)| id == source_owner)
+    }
+
+    fn placed(&mut self, id: NodeId, owners: &[(NodeId, NodeId)]) -> Option<NodeId> {
+        let source = self.doc.node(id)?.source?;
+        if !matches!(self.doc.node(source)?.kind, NodeKind::Instance { .. } | NodeKind::Frame)
+            || !self.valid(source, id, owners)
+            || !self.contextual(source, owners)
+        {
+            return None;
+        }
+        Some(source)
+    }
+
+    fn beneath_swap(&mut self, owners: &[(NodeId, NodeId)], stop: NodeId) -> bool {
+        for (index, (id, main)) in owners.iter().enumerate() {
+            if *id == stop {
+                break;
+            }
+            let changed = if let Some(changed) = self.main_changes.get(id) {
+                *changed
+            } else {
+                let changed = self.placed(*id, &owners[index + 1..]).is_some_and(|source| match self.doc.node(source).map(|n| &n.kind) {
+                    Some(NodeKind::Instance { component, .. }) => component != main,
+                    Some(NodeKind::Frame) => true,
+                    _ => false,
+                });
+                if self.main_changes.len() < Self::CACHE {
+                    self.main_changes.insert(*id, changed);
+                }
+                changed
+            };
+            if changed {
+                return true;
+            }
+        }
+        false
+    }
+}
+
 /// Re-derive `source` links and overrides of instance `inst` against its own main by comparing
 /// values (after detaching an outer instance, restoring a main, or copying a nested instance out):
 /// the look is kept exactly. Values a component property sets aren't overrides.
@@ -1722,22 +1910,28 @@ pub fn rebase_instance(doc: &mut Document, inst: NodeId) {
         diff_groups(a, b).into_iter().filter(|g| !matches!(*g, "size" | "position")).map(str::to_string).collect()
     };
     let mut updates = Vec::new();
+    let mut sources = RebaseSources::new(doc);
+    let root_owners = sources.owners(inst).unwrap_or_default();
+    let placed_source = sources.placed(inst, &root_owners);
+    let mut contexts = vec![(inst, component)];
+    contexts.extend_from_slice(&root_owners);
     for (id, path) in &mine {
         let Some(n) = doc.node(*id) else { continue };
-        // Follow the source chain into the main first (exact), then fall back to the name path.
-        let mut main = None;
-        let mut cur = n.source;
-        for _ in 0..MAX_DEPTH {
-            let Some(c) = cur else { break };
-            if c != component && doc.contains(c) && doc.is_ancestor(component, c) {
-                main = Some(c);
-                break;
-            }
-            cur = doc.node(c).and_then(|x| x.source);
+        let owners = sources.owners(*id).unwrap_or_default();
+        let nearest_main = owners.first().map(|(_, main)| *main);
+        let valid_source = n.source.filter(|source| sources.valid(*source, *id, &owners));
+        let mut main = valid_source.and_then(|source| sources.member(source, component, *id));
+        // A swapped or Frame-to-Instance subtree is compared to its current main by the inner
+        // rebase. An outer name path must not rebind those children to the old expanded copies.
+        if main.is_none() && valid_source.is_some() && sources.beneath_swap(&owners, inst) {
+            updates.push((*id, valid_source, n.overrides.clone()));
+            continue;
         }
-        let main = main.or_else(|| theirs.get(path).copied());
+        main = main
+            .or_else(|| theirs.get(path).copied().filter(|source| nearest_main.is_some_and(|scope| sources.member(*source, scope, *id).is_some())));
+        let source = valid_source.filter(|source| sources.contextual(*source, &contexts)).filter(|_| main.is_some()).or(main);
         let mut overrides: BTreeSet<String> = n.overrides.iter().filter(|g| !matches!(g.as_str(), "component" | "props")).cloned().collect();
-        if let Some(m) = main.and_then(|m| doc.node(m)) {
+        if let Some(m) = source.and_then(|source| doc.node(source)) {
             let mut bound: Vec<&str> = m.prop_refs.keys().map(|f| field_group(f)).collect();
             bound.extend(variable_groups(n, m));
             overrides.extend(value_groups(m, n).into_iter().filter(|g| !bound.contains(&g.as_str())));
@@ -1745,36 +1939,53 @@ pub fn rebase_instance(doc: &mut Document, inst: NodeId) {
                 overrides.insert("component".into());
             }
         }
-        updates.push((*id, main, overrides));
+        updates.push((*id, source, overrides));
     }
+    // A placed nested root compares to its actual slot. A detached root compares to its own main.
+    let root_base = placed_source.or_else(|| {
+        let chain = sources.chain(component)?;
+        (!chain.contains(&inst) && sources.in_main(component, inst) == Some(false)).then_some(component)
+    });
+    let root_groups = match (root_base.and_then(|source| doc.node(source)), doc.node(inst)) {
+        (Some(m), Some(n)) => {
+            let from_variables = variable_groups(n, m);
+            let mut groups: Vec<String> = value_groups(m, n)
+                .into_iter()
+                .filter(|g| !matches!(g.as_str(), "name" | "exports" | "interactions") && !from_variables.contains(&g.as_str()))
+                .filter(|g| placed_source.is_some() || g != "resizing")
+                .collect();
+            let named = if placed_source.is_some() { n.name != m.name } else { n.name != default_instance_name(doc, component) };
+            if named {
+                groups.push("name".into());
+            }
+            if placed_source.is_some()
+                && matches!((&m.kind, &n.kind), (NodeKind::Instance { component: a, .. }, NodeKind::Instance { component: b, .. }) if a != b)
+            {
+                groups.push("component".into());
+            }
+            groups
+        }
+        _ => Vec::new(),
+    };
+    drop(sources);
     for (id, main, overrides) in updates {
         if let Some(n) = doc.node_mut(id) {
             n.source = main;
             n.overrides = if main.is_some() { overrides } else { BTreeSet::new() };
         }
     }
-    let root_groups = match (doc.node(component), doc.node(inst)) {
-        (Some(m), Some(n)) => {
-            let from_variables = variable_groups(n, m);
-            let mut groups: Vec<String> = value_groups(m, n)
-                .into_iter()
-                .filter(|g| !matches!(g.as_str(), "name" | "exports" | "interactions") && !from_variables.contains(&g.as_str()))
-                .collect();
-            // A layer name of its own (a nested instance renamed in its old main) stays.
-            if n.name != default_instance_name(doc, component) {
-                groups.push("name".into());
-            }
-            groups
-        }
-        _ => Vec::new(),
-    };
     if let Some(n) = doc.node_mut(inst) {
-        n.source = Some(component);
-        n.overrides.retain(|g| !matches!(g.as_str(), "component" | "props" | "position"));
+        n.source = root_base;
+        // A top-level instance's resizing is its own (a nested one's overrides its main layer's).
+        n.overrides.retain(|g| !matches!(g.as_str(), "component" | "props" | "position") && (placed_source.is_some() || g != "resizing"));
         n.overrides.extend(root_groups);
     }
 }
 
+#[cfg(test)]
+#[path = "components_rebase_source_tests.rs"]
+mod rebase_source_tests;
+
 /// A set's default variant: the one in its top-left corner (nearest to it, then the top-most, then
 /// the left-most).
 pub fn default_variant(doc: &Document, set: NodeId) -> Option<NodeId> {