Merge remote-tracking branch 'origin/main' into landb/1879

ROADMAP.md

@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (the Local variables window selects several variables (click, Shift+click for a range, Cmd/Ctrl+click to toggle, Escape to clear) and delete, move to a group and scope act on the selected local variables in one undo step (#2002); the desktop UI takes a system face for Ethiopic, Devanagari, Gurmukhi, Gujarati, Tamil, Telugu, Kannada and Malayalam, Sinhala, Lao, Myanmar, Khmer, Armenian and Georgian as it did for Hebrew and Arabic, so a String variable's Amharic value draws in the panels instead of boxes (#2014); a layer's effect binding takes only a field its effect has; ; the boolean operation menu leads each entry with an original icon (#2003); glass takes one sample instead of its dispersion window where the colours split under 1/256 px; glass bends towards its core, and rounded rectangles work it out in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no lonLine truncated
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (Suggest auto layout adds nested auto layout frames by rows and columns and keeps the placement of the design, as the help center describes (#1823); the Local variables window selects several variables (click, Shift+click for a range, Cmd/Ctrl+click to toggle, Escape to clear) and delete, move to a group and scope act on the selected local variables in one undo step (#2002); the desktop UI takes a system face for Ethiopic, Devanagari, Gurmukhi, Gujarati, Tamil, Telugu, Kannada and Malayalam, Sinhala, Lao, Myanmar, Khmer, Armenian and Georgian as it did for Hebrew and Arabic, so a String variable's Amharic value draws in the panels instead of boxes (#2014); a layer's effect binding takes only a field its effect has; ; the boolean operation menu leads each entry with an original icon (#2003); glass takes one sample instead of its dispersion window where the colours split under 1/256 px; glass bends towards its core, and rounded rectangles work it out in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet Line truncated
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -132,6 +132,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 ## Progress log
 
+- **2026-11-05** · M2, #1823: Suggest auto layout is its own command. `layout.suggest` used to run `layout.add` and made one row of everything. It now splits a frame's layers into rows or columns by the gaps between them, wraps each band of several layers in a hugging frame without fill and repeats inside it, so the design gets as many auto layout frames as it needs and keeps its placement where the gaps are even (the frame keeps its size). Uneven gaps, bands that start at different offsets across the flow (lined up at the smallest) and layers that overlap along both axes are reported as `warnings`, and instances and layers inside them are refused. `layout.add` is unchanged. Tests in `layout_suggest_tests.rs`. Numbers unchanged.
 - **2026-11-05** · M3, #2002: the Local variables window selects several variables with a click, Shift+click (range) and Cmd/Ctrl+click (toggle), cleared by Escape or a click on the empty space; delete, move to a group and scope act on the selected local variables as one undo step (`command.batch`); inherited variables can be selected but are left out, since they change in their own collection, and the bulk menu needs two or more local variables selected (otherwise the row shows its own menu). Rename and value edits stay single-row.
 - **2026-11-05** · M10, #2014: the desktop UI takes a system face for Ethiopic, Devanagari, Gurmukhi, Gujarati, Tamil, Telugu, Kannada and Malayalam, Sinhala, Lao, Myanmar, Khmer, Armenian and Georgian as it did for Hebrew and Arabic (`bidi::script_fallbacks`: one sample letter per script, the system's families for each; Bengali and Thai keep `crate::cjk`'s choice), so a layer name or a String variable's Amharic value draws in the panels instead of boxes. Test: `bidi::tests::other_scripts_take_an_installed_system_face`.
 - **2026-11-05** · M4, #1830: a paragraph's base direction can be forced (Text ▸ Text direction: Auto, Left to right, Right to left) as Add right-to-left text says ("controls are available to override text direction per paragraph"). `ParaList::direction`, `text.direction {direction, ids?}` and the three menu commands (the edited paragraphs while editing, else the layer's), `node.set textDirection`, the Type settings control once a right-to-left script is in the text, `textDirection` / `lineDirections` in inspect, the CSS `direction`, and the `.fig` lines' `sourceDirectionality` in and out. Layout gives each paragraph its base level (`Bidi::of` per paragraph). Tests: `text_behaviour_tests::text_direction_is_forced_per_paragraph`, `fig::text_direction_tests`.

apps/figcraft-server/src/codes_tests.rs

@@ -118,7 +118,7 @@ fn a_file_shared_online_is_joined_by_its_codes() {
     });
     for guest in [&b, &c] {
         assert!(guest.message.as_deref().unwrap_or_default().contains("Sharing was stopped"), "{:?}", guest.message);
-        assert_eq!(guest.live().status, Status::Off, "over, not failed: nothing retries");
+        assert!(guest.live().rejoinable() && !guest.live().status.active(), "over: nothing retries, and the tab says so");
     }
     assert_eq!(layers(&b), before + 2, "Bo keeps the copy");
     let folder = dir.path().join("files").join(&p.file);

apps/figcraft-server/src/server_tests.rs

@@ -160,7 +160,7 @@ fn revoked_links_stop_working_at_once() {
     assert_eq!((files.len(), files[0].people), (1, 3));
     // Revoked: Cy is out at once, the others stay.
     assert_eq!(ask(Admin::Revoke { file: file.clone(), link: review.link.id.clone() }), AdminReply::Done);
-    pump(&mut [&mut a, &mut b, &mut c], "Cy out", |s| s[2].live().status == Status::Off && s[0].live().peers.len() == 1);
+    pump(&mut [&mut a, &mut b, &mut c], "Cy out", |s| s[2].live().rejoinable() && s[0].live().peers.len() == 1);
     // Told as when a host stops: the session is over for Cy, whose copy stays open (no retries).
     assert!(c.message.as_deref().unwrap_or_default().contains("Sharing was stopped"), "{:?}", c.message);
     assert!(live(&b));

crates/collab-net/src/driver.rs

@@ -28,7 +28,7 @@ use crate::invite::Endpoint;
 use crate::join::{GuestConfig, Next, Outcome, Resuming, Seen, Taken, after, ask, closed, hello, resolved, take, too_large, unresolved};
 use crate::limits::NetLimits;
 use crate::requests::Publish;
-use crate::throttle::{PRESENCE_INTERVAL, Throttle, earliest};
+use crate::throttle::{PRESENCE_INTERVAL, Paced, Throttle, earliest};
 
 /// A WebSocket the driver opens, writes and closes; what it receives comes back through the
 /// driver's event methods.
@@ -79,6 +79,8 @@ pub(crate) struct Driver<S: Socket> {
     /// Your latest presence while not welcomed (sent with the welcome).
     pending: Option<Presence>,
     throttle: Throttle<Presence>,
+    /// Sync messages waiting their turn (a long queue from while offline).
+    paced: Paced<ClientMsg>,
     reconnect_at: Option<Instant>,
     /// What this connection asks a server (a managing one), and what follows its answers.
     asking: Option<(Box<Exchange>, Then)>,
@@ -86,7 +88,7 @@ pub(crate) struct Driver<S: Socket> {
 }
 
 impl<S: Socket> Driver<S> {
-    fn new(sock: S, cfg: GuestConfig, inbox: Inbox) -> Self {
+    fn new(sock: S, cfg: GuestConfig, inbox: Inbox, now: Instant) -> Self {
         Self {
             sock,
             cfg,
@@ -97,6 +99,7 @@ impl<S: Socket> Driver<S> {
             resume: Resuming::default(),
             pending: None,
             throttle: Throttle::new(PRESENCE_INTERVAL),
+            paced: Paced::new(now),
             reconnect_at: None,
             asking: None,
             done: false,
@@ -105,7 +108,7 @@ impl<S: Socket> Driver<S> {
 
     /// Start joining (progress arrives in `inbox`).
     pub(crate) fn start(sock: S, cfg: GuestConfig, inbox: Inbox, now: Instant) -> Self {
-        let mut d = Self::new(sock, cfg, inbox);
+        let mut d = Self::new(sock, cfg, inbox, now);
         d.inbox.push(Event::Status(Status::Connecting));
         d.connect(now);
         d
@@ -114,7 +117,7 @@ impl<S: Socket> Driver<S> {
     /// Start with what `next` asks a server (a background request): the events it ends in go to
     /// `inbox`, then the join it ends in, if any, as `cfg` says.
     pub(crate) fn asking(sock: S, cfg: GuestConfig, next: exchange::Next, inbox: Inbox, now: Instant) -> Self {
-        let mut d = Self::new(sock, cfg, inbox);
+        let mut d = Self::new(sock, cfg, inbox, now);
         d.follow(next, now);
         d
     }
@@ -159,6 +162,8 @@ impl<S: Socket> Driver<S> {
 
     fn connect(&mut self, now: Instant) {
         self.reconnect_at = None;
+        // A server counts per connection, and these were made for the last one.
+        self.paced = Paced::new(now);
         self.conn = Some(Conn::new(now));
         if let Err(e) = self.sock.open(&self.server().url()) {
             self.dropped(e, now);
@@ -303,13 +308,35 @@ impl<S: Socket> Driver<S> {
         if !self.conn.as_ref().is_some_and(|c| c.welcomed) {
             return;
         }
-        if !self.write(&msg) {
+        self.paced.push(msg);
+        if !self.send_paced(now) {
             self.end(Outcome::Retry("the connection dropped".into()), now);
         }
     }
 
+    /// Send the sync messages whose turn has come; false when one couldn't go.
+    fn send_paced(&mut self, now: Instant) -> bool {
+        while let Some(msg) = self.paced.take_due(now) {
+            if !self.write(&msg) {
+                return false;
+            }
+        }
+        true
+    }
+
+    /// Reconnect now, if it is waiting to: the pauses grow from the beginning again.
+    pub(crate) fn retry(&mut self, now: Instant) {
+        if !self.done && self.reconnect_at.is_some() {
+            self.attempt = 0;
+            self.connect(now);
+        }
+    }
+
     /// Leave the session.
     pub(crate) fn leave(&mut self, now: Instant) {
+        // What may go now still reaches the others. The rest would get the connection refused, and
+        // a page can't wait: the sync client says so when you leave.
+        let _ = self.send_paced(now);
         self.end(Outcome::Left, now);
     }
 
@@ -327,7 +354,7 @@ impl<S: Socket> Driver<S> {
                 [Some(c.last_ping + l.keepalive), Some(c.last_heard + c.silence_limit(l)), if c.welcomed { self.throttle.due() } else { None }]
             }
         });
-        earliest(conn.into_iter().flatten().chain([self.reconnect_at]))
+        earliest(conn.into_iter().flatten().chain([self.reconnect_at, self.paced.due()]))
     }
 
     /// Do what's due at `now`: reconnect, send held presence or a ping, give up on a connection
@@ -357,7 +384,7 @@ impl<S: Socket> Driver<S> {
         if now >= last_heard + silence {
             return self.end(Outcome::Retry("the host stopped answering".into()), now);
         }
-        let ok = self.throttle.take_due(now).is_none_or(|p| self.write(&ClientMsg::Presence(p)));
+        let ok = self.send_paced(now) && self.throttle.take_due(now).is_none_or(|p| self.write(&ClientMsg::Presence(p)));
         let ok = ok && (now < last_ping + l.keepalive || self.ping(now));
         if !ok {
             self.end(Outcome::Retry("the connection dropped".into()), now);
@@ -388,6 +415,8 @@ impl<S: Socket> Driver<S> {
             self.sock.close();
         }
         self.throttle = Throttle::new(PRESENCE_INTERVAL);
+        // Made for this connection: the sync client sends again what the server didn't get.
+        self.paced = Paced::new(now);
         match after(outcome, &self.cfg, self.was_live, &mut self.attempt, &self.inbox) {
             Next::Stop(e) => {
                 if let Some(e) = e {

crates/collab-net/src/driver_tests.rs

@@ -252,7 +252,7 @@ fn a_silent_host_counts_as_dropped_and_the_client_reconnects() {
 }
 
 #[test]
-fn reconnects_back_off_then_give_up() {
+fn a_live_connection_reconnects_in_rounds_and_never_gives_up() {
     let t0 = Instant::now();
     let (mut d, inbox) = start(Script::default(), t0);
     d.opened(t0);
@@ -260,7 +260,7 @@ fn reconnects_back_off_then_give_up() {
     let mut now = t0;
     let mut pauses = Vec::new();
     d.closed(1006, "", now);
-    while !d.done() {
+    for _ in 0..26 {
         let next = d.deadline().unwrap();
         pauses.push(next - now);
         now = next;
@@ -269,11 +269,183 @@ fn reconnects_back_off_then_give_up() {
         d.closed(1006, "", now);
     }
     let secs: Vec<f64> = pauses.iter().map(Duration::as_secs_f64).collect();
-    assert_eq!(secs, [0.5, 1.0, 2.0, 4.0, 8.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0]);
+    let round = [1.0, 2.0, 4.0, 8.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0];
+    assert_eq!(secs[0], 0.5);
+    assert_eq!(secs[1..12], round);
+    assert_eq!(secs[12], 60.0, "a longer pause after a round");
+    assert_eq!(secs[13..24], round, "then as many again");
+    assert_eq!(secs[24], 60.0);
+    assert!(!d.done());
     let st = statuses(&inbox.drain());
-    assert_eq!(st.len(), 14, "connecting, 12 reconnects, then failed");
-    assert!(matches!(st.last(), Some(Status::Failed { reason }) if reason.starts_with("Lost the connection to the host")), "{st:?}");
-    assert_eq!(d.deadline(), None);
+    assert!(!st.iter().any(|s| matches!(s, Status::Failed { .. })), "{st:?}");
+    assert!(matches!(st.last(), Some(Status::Reconnecting { attempt: 27 })), "{st:?}");
+}
+
+#[test]
+fn retry_now_skips_the_pause_and_starts_the_round_over() {
+    let t0 = Instant::now();
+    let (mut d, inbox) = start(Script::default(), t0);
+    d.opened(t0);
+    d.message(&welcome(), t0);
+    d.closed(1006, "", t0);
+    let mut now = t0;
+    for _ in 0..12 {
+        now = d.deadline().unwrap();
+        d.tick(now);
+        d.closed(1006, "", now);
+    }
+    assert_eq!(d.deadline().unwrap() - now, Duration::from_secs(60));
+    let opened = d.sock.opened.len();
+    d.retry(now);
+    assert_eq!(d.sock.opened.len(), opened + 1, "connects at once");
+    inbox.drain();
+    d.closed(1006, "", now);
+    assert_eq!(statuses(&inbox.drain()), vec![Status::Reconnecting { attempt: 1 }]);
+    assert_eq!(d.deadline().unwrap() - now, ms(500), "the pauses grow from the beginning again");
+}
+
+#[test]
+fn a_session_that_was_live_only_stops_for_a_refusal_that_is_for_good() {
+    let t0 = Instant::now();
+    // The words servers turn a session away with for now.
+    for reason in [
+        "too many messages",
+        "the server is busy: try again in a moment",
+        "the session is full",
+        "no hello in time",
+        "this file can't be opened on the server (its data is damaged); tell the server's owner",
+        "too many connections from your address lately: wait a minute and try again",
+    ] {
+        for frame in [false, true] {
+            let (mut d, inbox) = start(Script::default(), t0);
+            d.opened(t0);
+            d.message(&welcome(), t0);
+            inbox.drain();
+            if frame {
+                d.closed(1008, reason, t0);
+            } else {
+                d.message(&encode(&ServerMsg::Refused { reason: reason.into() }), t0);
+            }
+            assert!(!d.done(), "{reason}");
+            assert_eq!(statuses(&inbox.drain()), vec![Status::Reconnecting { attempt: 1 }], "{reason}");
+        }
+    }
+    // And the words for good.
+    for reason in [
+        "this link isn't valid (it may have been revoked)",
+        "this file isn't on the server (it may have been removed)",
+        "this file was removed from the server",
+        "you were removed from this session",
+        "this server no longer accepts connections from your address",
+        "this server doesn't accept connections from your address",
+        "wrong session token",
+        "protocol 9 isn't supported",
+        "message too large: this server takes at most 64 MiB at once (a change that big can't be kept here)",
+    ] {
+        let (mut d, inbox) = start(Script::default(), t0);
+        d.opened(t0);
+        d.message(&welcome(), t0);
+        d.closed(1008, reason, t0);
+        assert!(d.done(), "{reason}");
+        assert!(matches!(statuses(&inbox.drain()).last(), Some(Status::Failed { reason: r }) if r.contains(reason)), "{reason}");
+    }
+    // What this end finds it can't talk to: a text frame, or a message it can't read.
+    for text in [true, false] {
+        let (mut d, inbox) = start(Script::default(), t0);
+        d.opened(t0);
+        d.message(&welcome(), t0);
+        if text {
+            d.text(t0);
+        } else {
+            d.message(&[0xFF, 1, 2, 3], t0);
+        }
+        assert!(d.done(), "text: {text}");
+        assert!(matches!(statuses(&inbox.drain()).last(), Some(Status::Failed { .. })));
+    }
+}
+
+#[test]
+fn a_long_queue_goes_out_paced_and_in_order() {
+    let t0 = Instant::now();
+    let (mut d, _inbox) = start(Script::default(), t0);
+    d.opened(t0);
+    d.message(&welcome(), t0);
+    let before = d.sock.sent.len();
+    for seq in 0..500 {
+        d.send(ClientMsg::Ack { seq }, t0);
+    }
+    let at_once = d.sock.sent.len() - before;
+    assert!((1..=200).contains(&at_once), "{at_once} at once: a server drops a connection past 400");
+    let mut now = t0;
+    while d.sock.sent.iter().filter(|m| matches!(m, ClientMsg::Ack { .. })).count() < 500 {
+        now = d.deadline().unwrap();
+        d.tick(now);
+    }
+    let seqs: Vec<u64> = d.sock.sent.iter().filter_map(|m| if let ClientMsg::Ack { seq } = m { Some(*seq) } else { None }).collect();
+    assert_eq!(seqs, (0..500).collect::<Vec<u64>>());
+    assert!(now - t0 >= Duration::from_secs(4), "the rest take their time: {:?}", now - t0);
+    // Unsent ones were made for this connection: the sync client sends them again.
+    for seq in 0..500 {
+        d.send(ClientMsg::Ack { seq }, now);
+    }
+    d.closed(1006, "", now);
+    assert_eq!(d.deadline().unwrap() - now, ms(500), "nothing left to send but the reconnect");
+}
+
+#[test]
+fn messages_held_up_by_a_stall_dont_leave_together() {
+    let t0 = Instant::now();
+    let (mut d, _inbox) = start(Script::default(), t0);
+    d.opened(t0);
+    d.message(&welcome(), t0);
+    for seq in 0..700 {
+        d.send(ClientMsg::Ack { seq }, t0);
+    }
+    let acks = |d: &Driver<Script>| d.sock.sent.iter().filter(|m| matches!(m, ClientMsg::Ack { .. })).count();
+    let first = acks(&d);
+    // Nothing ran for 8 s.
+    d.tick(t0 + Duration::from_secs(8));
+    assert!(acks(&d) - first <= 200, "{} at once: a server drops a connection past 400", acks(&d) - first);
+}
+
+#[test]
+fn a_new_connection_starts_with_a_fresh_pace() {
+    let t0 = Instant::now();
+    let (mut d, _inbox) = start(Script::default(), t0);
+    d.opened(t0);
+    d.message(&welcome(), t0);
+    for seq in 0..500 {
+        d.send(ClientMsg::Ack { seq }, t0);
+    }
+    d.closed(1006, "", t0);
+    let back = d.deadline().unwrap();
+    d.tick(back);
+    d.opened(back);
+    d.message(&welcome(), back);
+    d.send(ClientMsg::Ack { seq: 900 }, back);
+    assert!(d.sock.sent.iter().any(|m| matches!(m, ClientMsg::Ack { seq: 900 })), "sent at once");
+}
+
+#[test]
+fn leaving_sends_what_may_go_at_its_pace() {
+    let t0 = Instant::now();
+    let (mut d, _inbox) = start(Script::default(), t0);
+    d.opened(t0);
+    d.message(&welcome(), t0);
+    for seq in 0..150 {
+        d.send(ClientMsg::Ack { seq }, t0);
+    }
+    let later = t0 + Duration::from_secs(1);
+    for seq in 150..600 {
+        d.send(ClientMsg::Ack { seq }, later);
+    }
+    let before = d.sock.sent.iter().filter(|m| matches!(m, ClientMsg::Ack { .. })).count();
+    d.leave(later + Duration::from_secs(1));
+    let seqs: Vec<u64> = d.sock.sent.iter().filter_map(|m| if let ClientMsg::Ack { seq } = m { Some(*seq) } else { None }).collect();
+    assert!(seqs.len() > before, "more goes on leaving");
+    assert!(seqs.len() - before <= 200, "{} at once: a server drops a connection past 400", seqs.len() - before);
+    assert_eq!(seqs, (0..seqs.len() as u64).collect::<Vec<u64>>(), "in order");
+    assert!(d.done());
 }
 
 #[test]

crates/collab-net/src/guest.rs

@@ -31,7 +31,7 @@ use crate::manage;
 use crate::net::{Duplex, NetLimits, config, open, shutdown};
 use crate::requests;
 pub use crate::requests::Publish;
-use crate::throttle::{PRESENCE_INTERVAL, Throttle, earliest};
+use crate::throttle::{PRESENCE_INTERVAL, Paced, Throttle, earliest};
 
 /// A joined (or joining) session. Dropping it leaves.
 pub struct Guest {
@@ -44,6 +44,8 @@ enum Cmd {
     /// For the server, in order (document changes).
     Send(ClientMsg),
     Leave,
+    /// Try now rather than after the pause under way (reconnecting).
+    Retry,
     /// The reader of connection `epoch` got its welcome.
     Welcomed(u64),
     /// Connection `epoch` ended.
@@ -133,6 +135,11 @@ impl Guest {
         let _ = self.cmd.send(Cmd::Send(msg));
     }
 
+    /// Reconnect now, if it is waiting to.
+    pub fn retry(&self) {
+        let _ = self.cmd.send(Cmd::Retry);
+    }
+
     /// Leave (returns at once: a connection attempt in progress ends on its own).
     pub fn leave(&mut self) {
         let _ = self.cmd.send(Cmd::Leave);
@@ -155,6 +162,9 @@ impl Drop for Guest {
     }
 }
 
+/// How long leaving keeps sending what was waiting its turn.
+const LEAVE_DRAIN: Duration = Duration::from_secs(10);
+
 /// A connected socket: reader and writer ends.
 struct Conn {
     reader: WebSocket<Duplex>,
@@ -227,6 +237,11 @@ fn supervise(cfg: &GuestConfig, inbox: &Inbox, rx: &Receiver<Cmd>, me: &Sender<C
                     match rx.recv_timeout(until.saturating_duration_since(Instant::now())) {
                         Ok(Cmd::Leave) | Err(RecvTimeoutError::Disconnected) => return,
                         Ok(Cmd::Presence(p)) => pending = Some(p),
+                        // A fresh start: the pauses grow from the beginning again.
+                        Ok(Cmd::Retry) => {
+                            attempt = 0;
+                            break;
+                        }
                         // From the old connection's client: the next welcome starts over.
                         Ok(_) => {}
                         Err(RecvTimeoutError::Timeout) => break,
@@ -267,14 +282,15 @@ fn session(
     let hello = hello(cfg, resume);
     let mut welcomed = false;
     let mut throttle = Throttle::new(PRESENCE_INTERVAL);
+    // Sync messages waiting their turn (a long queue from while offline).
+    let mut paced: Paced<ClientMsg> = Paced::new(Instant::now());
     let outcome = if send(&mut writer, &hello) {
         loop {
             let ping_at = last_ping + cfg.limits.keepalive;
-            let wake = earliest([throttle.due(), Some(ping_at)]).unwrap_or(ping_at);
+            let wake = earliest([throttle.due(), Some(ping_at), paced.due()]).unwrap_or(ping_at);
             let mut out = None;
-            let mut now_send = Vec::new();
             match rx.recv_timeout(wake.saturating_duration_since(Instant::now())) {
-                Ok(Cmd::Send(m)) if welcomed => now_send.push(m),
+                Ok(Cmd::Send(m)) if welcomed => paced.push(m),
                 // Made for the previous connection (the sync client sends again what the server
                 // didn't get once it has caught up with this connection's welcome).
                 Ok(Cmd::Send(_)) => {}
@@ -288,17 +304,22 @@ fn session(
                 }
                 Ok(Cmd::Lost(e, o)) if e == epoch => break o,
                 Ok(Cmd::Leave) | Err(RecvTimeoutError::Disconnected) => {
+                    leave_paced(&mut writer, &mut paced);
                     let _ = writer.close(Some(CloseFrame { code: CloseCode::Normal, reason: "".into() }));
                     break Outcome::Left;
                 }
                 // From an earlier connection.
-                Ok(Cmd::Welcomed(_) | Cmd::Lost(..)) => {}
+                Ok(Cmd::Welcomed(_) | Cmd::Lost(..) | Cmd::Retry) => {}
                 Err(RecvTimeoutError::Timeout) => {}
             }
-            if !now_send.iter().all(|m| send(&mut writer, m)) {
+            let now = Instant::now();
+            let mut sent = true;
+            while sent && let Some(m) = paced.take_due(now) {
+                sent = send(&mut writer, &m);
+            }
+            if !sent {
                 break Outcome::Retry("the connection dropped".into());
             }
-            let now = Instant::now();
             let out = out.or_else(|| throttle.take_due(now));
             let ok = out.is_none_or(|p| send(&mut writer, &ClientMsg::Presence(p)));
             let ok = ok
@@ -318,6 +339,28 @@ fn session(
     outcome
 }
 
+/// Send what was waiting its turn before leaving, at its pace, for at most [`LEAVE_DRAIN`]: nothing
+/// waits for this thread (the app has moved on), and going faster would get the rest refused. What
+/// doesn't go is left to the sync client, which says so when you leave.
+fn leave_paced(writer: &mut WebSocket<Duplex>, paced: &mut Paced<ClientMsg>) {
+    let give_up = Instant::now() + LEAVE_DRAIN;
+    loop {
+        let now = Instant::now();
+        if now >= give_up {
+            return;
+        }
+        if let Some(m) = paced.take_due(now) {
+            if !send(writer, &m) {
+                return;
+            }
+        } else if let Some(at) = paced.due().filter(|at| *at < give_up) {
+            std::thread::sleep(at.saturating_duration_since(now));
+        } else {
+            return;
+        }
+    }
+}
+
 /// Send one message; false when the connection is gone.
 fn send(ws: &mut WebSocket<Duplex>, msg: &ClientMsg) -> bool {
     message::encode(msg).is_ok_and(|b| ws.send(Message::Binary(Bytes::from(b))).is_ok())

crates/collab-net/src/hub/conn.rs

@@ -51,6 +51,12 @@ fn health_check(stream: &mut TcpStream, until: Instant) -> bool {
     let mut req = Vec::new();
     let mut chunk = [0u8; 1024];
     while !req.windows(4).any(|w| w == b"\r\n\r\n") && req.len() < 16 << 10 {
+        // The same deadline as the request line: a peer dripping header bytes would otherwise
+        // hold this thread and its connection slot for as long as it liked.
+        let left = until.saturating_duration_since(Instant::now());
+        if left.is_zero() || stream.set_read_timeout(Some(left)).is_err() {
+            break;
+        }
         match stream.read(&mut chunk) {
             Ok(0) | Err(_) => break,
             Ok(n) => req.extend_from_slice(chunk.get(..n).unwrap_or_default()),
@@ -409,3 +415,31 @@ fn linger(ws: &mut WebSocket<Duplex>) {
         }
     }
 }
+
+#[cfg(test)]
+mod health_check_tests {
+    use super::*;
+
+    #[test]
+    fn a_health_check_dripping_headers_ends_at_the_deadline() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let client = std::thread::spawn(move || {
+            let mut c = TcpStream::connect(addr).unwrap();
+            c.write_all(b"GET /healthz HTTP/1.1\r\n").unwrap();
+            // One header byte every 20 ms, far past the deadline, until the server hangs up.
+            for _ in 0..200 {
+                if c.write_all(b"X").is_err() {
+                    break;
+                }
+                std::thread::sleep(Duration::from_millis(20));
+            }
+        });
+        let (mut stream, _) = listener.accept().unwrap();
+        let start = Instant::now();
+        assert!(health_check(&mut stream, start + Duration::from_millis(300)));
+        assert!(start.elapsed() < Duration::from_secs(2), "{:?}", start.elapsed());
+        drop(stream);
+        client.join().unwrap();
+    }
+}

crates/collab-net/src/join.rs

@@ -39,8 +39,10 @@ pub struct GuestConfig {
     /// The pause before the first reconnect; it doubles each time up to `max_backoff`.
     pub backoff: Duration,
     pub max_backoff: Duration,
-    /// Reconnect attempts before giving up.
+    /// Reconnect attempts in a row before the longer pause (`round_pause`), after which it tries
+    /// as many again: a connection that was live is never given up on by itself.
     pub attempts: u32,
+    pub round_pause: Duration,
     /// Join as the client you were (an app that starts over after a crash): the first hello
     /// carries it, and a server that still knows the id gives it back.
     pub resume: Option<Resume>,
@@ -57,6 +59,7 @@ impl GuestConfig {
             backoff: Duration::from_millis(500),
             max_backoff: Duration::from_secs(10),
             attempts: 12,
+            round_pause: Duration::from_secs(60),
             resume: None,
         }
     }
@@ -65,6 +68,14 @@ impl GuestConfig {
     pub(crate) fn backoff(&self, attempt: u32) -> Duration {
         self.backoff.saturating_mul(1u32 << attempt.saturating_sub(1).min(16)).min(self.max_backoff)
     }
+
+    /// The pause before reconnect attempt `attempt` (from 1): growing within a round of
+    /// [`attempts`](Self::attempts), and [`round_pause`](Self::round_pause) between rounds.
+    pub(crate) fn pause(&self, attempt: u32) -> Duration {
+        let round = self.attempts.max(1);
+        let into_round = attempt.saturating_sub(1) % round;
+        if into_round == 0 && attempt > round { self.round_pause } else { self.backoff(into_round + 1) }
+    }
 }
 
 /// How a connection ended.
@@ -144,11 +155,39 @@ pub(crate) enum Next {
     Reconnect(Duration),
 }
 
-/// After `outcome`: a refusal or the end of the session is final, and so is a first join that
-/// can't reach the host; a live connection that dropped tries again with growing pauses until the
-/// attempts run out.
+/// What a server refuses for good, whenever you ask: the link, the file or your place in it is
+/// gone, or the two versions can't talk. Anything else a server refuses a session with (it is
+/// busy, a limit was hit, the file couldn't be read just now) may pass, and servers of any version
+/// say so in these words, so a reason not listed here means try again.
+const FINAL_REFUSALS: [&str; 12] = [
+    "isn't valid",
+    "isn't on the server",
+    "was removed from the server",
+    "were removed from this session",
+    "no longer accepts connections",
+    "doesn't accept connections",
+    "wrong session token",
+    "isn't supported",
+    "couldn't be read",
+    "message too large",
+    "this version can't read",
+    "sent a text message",
+];
+
+/// Whether `reason`, from a server refusing a session that was live, is for good.
+pub(crate) fn final_refusal(reason: &str) -> bool {
+    FINAL_REFUSALS.iter().any(|f| reason.contains(f))
+}
+
+/// After `outcome`: the end of the session is final, and so are a refusal for good and a first
+/// join that can't reach the host. A live connection that dropped or was turned away for now tries
+/// again until you leave: with growing pauses, and a longer one between rounds.
 pub(crate) fn after(outcome: Outcome, cfg: &GuestConfig, was_live: bool, attempt: &mut u32, inbox: &Inbox) -> Next {
     let failed = |reason: String| Next::Stop(Some(Box::new(Event::Status(Status::Failed { reason }))));
+    let outcome = match outcome {
+        Outcome::Refused(why) if was_live && !final_refusal(&why) => Outcome::Retry(why),
+        o => o,
+    };
     match outcome {
         Outcome::Left => Next::Stop(None),
         Outcome::Refused(why) => failed(format!("The host refused: {why}")),
@@ -156,13 +195,10 @@ pub(crate) fn after(outcome: Outcome, cfg: &GuestConfig, was_live: bool, attempt
         Outcome::Ended(reason) => Next::Stop(Some(Box::new(Event::Ended { reason }))),
         Outcome::Retry(why) if !was_live => failed(format!("Couldn't join the live session: {why}")),
         Outcome::Retry(why) => {
-            *attempt += 1;
-            if *attempt > cfg.attempts {
-                return failed(format!("Lost the connection to the host ({why})"));
-            }
+            *attempt = attempt.saturating_add(1);
             log::info!("live session: connection lost ({why}); reconnecting, attempt {attempt}");
             inbox.push(Event::Status(Status::Reconnecting { attempt: *attempt }));
-            Next::Reconnect(cfg.backoff(*attempt))
+            Next::Reconnect(cfg.pause(*attempt))
         }
     }
 }

crates/collab-net/src/link.rs

@@ -308,6 +308,12 @@ impl LiveLink for NetLink {
         }
     }
 
+    fn retry(&mut self, session: SessionId) {
+        if let Some(Active::Guest(g)) = self.sessions.get(session) {
+            g.retry();
+        }
+    }
+
     fn presence(&mut self, session: SessionId, p: &Presence) {
         match self.sessions.get(session) {
             Some(Active::Host(h)) => h.presence(p.clone()),

crates/collab-net/src/session_tests.rs

@@ -124,8 +124,9 @@ fn following_a_viewport_until_you_move() {
 fn the_host_stopping_ends_the_session_for_guests() {
     let (mut host, mut guest, _, _) = host_and_join();
     host.execute("collab.stop", &json!({})).unwrap();
-    pump(&mut host, &mut guest, "the end", |_, g| g.live().status == Status::Off);
-    assert!(guest.live().peers.is_empty());
+    pump(&mut host, &mut guest, "the end", |_, g| g.live().rejoinable());
+    assert!(guest.live().peers.is_empty() && !guest.live().syncing());
+    assert!(guest.live().disconnected(), "the tab says so");
     assert_eq!(guest.message.as_deref(), Some(crate::host::ENDED));
 }
 

crates/collab-net/src/sessions_tests.rs

@@ -158,8 +158,8 @@ fn two_files_are_hosted_and_joined_independently() {
     assert!(host.live_of(hb).presence.get(&ada(&host, hb)).is_none_or(|p| p.cursor.is_none()), "no cursor in the file that isn't in front");
     // The host closes B: its session ends for everyone, A's goes on.
     host.execute("file.close", &json!({"index": 1, "force": true})).unwrap();
-    pump(&mut [&mut host, &mut guest], "B's session ending", |s| s[0].live.iter().count() == 1 && s[1].live.iter().count() == 1);
-    assert_eq!(guest.live_of(gb).status, Status::Off);
+    pump(&mut [&mut host, &mut guest], "B's session ending", |s| s[0].live.iter().count() == 1 && s[1].live_of(gb).rejoinable());
+    assert!(guest.live_of(gb).disconnected(), "the guest's tab says so");
     assert_eq!(guest.docs.len(), 3, "the guest keeps its copy of B");
     assert_eq!((host.live_of(ha).status.clone(), host.live_of(ha).peers.len()), (Status::Live, 1));
     assert_eq!(guest.live_of(ga).status, Status::Live);

crates/collab-net/src/throttle.rs

@@ -2,6 +2,7 @@
 //! (replacing any older waiting value) until the interval has passed, so the last one is never
 //! lost. Used for presence on both ends (about 30 updates a second).
 
+use std::collections::VecDeque;
 use std::time::Duration;
 
 // `std::time::Instant` on native builds; the browser's clock in the web build.
@@ -10,6 +11,54 @@ use web_time::Instant;
 /// How often presence goes out at most.
 pub const PRESENCE_INTERVAL: Duration = Duration::from_millis(33);
 
+/// How many messages other than presence go out at once, and per second after that: with presence
+/// and pings that stays under what a server takes from a connection before it drops it.
+const PACE_BURST: f64 = 200.0;
+const PACE_RATE: f64 = 60.0;
+
+/// Messages that must all go out, in order, at a pace (everything queued while offline leaves at
+/// once when the connection comes back). The pace is counted when they go, so messages held up by
+/// a stalled connection don't leave together afterwards.
+#[derive(Debug)]
+pub struct Paced<T> {
+    tokens: f64,
+    last: Instant,
+    queue: VecDeque<T>,
+}
+
+impl<T> Paced<T> {
+    pub fn new(now: Instant) -> Self {
+        Self { tokens: PACE_BURST, last: now, queue: VecDeque::new() }
+    }
+
+    pub fn push(&mut self, v: T) {
+        self.queue.push_back(v);
+    }
+
+    /// The next message, if its turn has come at `now`.
+    pub fn take_due(&mut self, now: Instant) -> Option<T> {
+        if self.queue.is_empty() {
+            return None;
+        }
+        self.tokens = (self.tokens + now.saturating_duration_since(self.last).as_secs_f64() * PACE_RATE).min(PACE_BURST);
+        self.last = now;
+        // Within rounding of a whole turn counts as one: the time `due` gave has come.
+        if self.tokens < 1.0 - 1e-6 {
+            return None;
+        }
+        self.tokens -= 1.0;
+        self.queue.pop_front()
+    }
+
+    /// When the next message's turn comes (`None`: there's none).
+    pub fn due(&self) -> Option<Instant> {
+        self.queue.front()?;
+        // Rounded up to whole microseconds, so a timer set for this always finds the turn come.
+        let wait = ((1.0 - self.tokens).max(0.0) / PACE_RATE * 1e6).ceil() as u64;
+        Some(self.last + Duration::from_micros(wait))
+    }
+}
+
 #[derive(Debug)]
 pub struct Throttle<T> {
     interval: Duration,

crates/collab-net/src/web.rs

@@ -242,6 +242,10 @@ impl LiveLink for NetLink {
         }
     }
 
+    fn retry(&mut self, session: SessionId) {
+        self.with(session, |d, now| d.retry(now));
+    }
+
     fn presence(&mut self, session: SessionId, p: &Presence) {
         self.with(session, |d, now| d.presence(p.clone(), now));
     }

crates/doc/src/board_route.rs

@@ -72,6 +72,12 @@ pub fn attached_sides(from: RouteEnd, to: RouteEnd) -> (Option<Side>, Option<Sid
     (attach(from, to.centre()).1, attach(to, from.centre()).1)
 }
 
+/// Where a connector's ends attach, as routed now: the points [`ConnectorPath::Runs`] is measured
+/// from the middle of.
+pub fn attach_points(from: RouteEnd, to: RouteEnd) -> (Point, Point) {
+    (attach(from, to.centre()).0, attach(to, from.centre()).0)
+}
+
 /// The route's path handles: one for each run of an elbow and one for a curve, with the portion
 /// of the path each moves and where it sits.
 pub fn path_handles(pts: &[Point], routing: Routing) -> Vec<(usize, Point)> {
@@ -96,8 +102,9 @@ pub fn reshaped(from: RouteEnd, to: RouteEnd, routing: Routing, path: Option<&Co
     }
 }
 
-/// A path of more runs than this can't be made by hand: [`reshaped`] refuses another.
-const MAX_RUNS: usize = 64;
+/// A path of more runs than this can't be made by hand: [`reshaped`] refuses another, and an
+/// importer leaves a saved one to the router.
+pub const MAX_RUNS: usize = 64;
 
 /// The runs of the right-angled route `pts` with run `portion` moved to `p`.
 fn reshaped_runs(pts: &[Point], portion: usize, p: Point) -> Option<ConnectorPath> {

crates/doc/src/lib.rs

@@ -27,7 +27,7 @@ pub mod vector_faces;
 pub mod vector_regions;
 
 pub use board::*;
-pub use board_route::{END_GAP, RouteEnd, attached_sides, path_handles, reshaped, route_along, route_points};
+pub use board_route::{END_GAP, MAX_RUNS, RouteEnd, attach_points, attached_sides, path_handles, reshaped, route_along, route_points};
 pub use colors::*;
 pub use comments::*;
 pub use facilitation::*;

crates/doc/src/node.rs

@@ -948,7 +948,7 @@ impl Node {
                 if self.stroke.cap_start.is_arrow() || self.stroke.cap_end.is_arrow() || point_arrows { w.max(self.stroke.weight) * 3.0 } else { w };
             // Right-angled or smooth outlines (boxes, whole ellipses) end their mitres on the grown
             // box; an arc's corners don't.
-            let miter = if self.grows_by_exactly_its_spread() { 1.0 } else { self.stroke.miter_limit.clamp(1.0, 4.0) };
+            let miter = if self.outline_mitres_end_on_its_box() { 1.0 } else { self.stroke.miter_limit.clamp(1.0, 4.0) };
             base.max(if matches!(self.kind, NodeKind::Line | NodeKind::Vector { .. }) { caps } else { 0.0 }) * miter
         } else {
             0.0
@@ -964,9 +964,10 @@ impl Node {
         !(matches!(self.kind, NodeKind::Group) || (matches!(self.kind, NodeKind::Text(_)) && self.has_visible_stroke()))
     }
 
-    /// Whether a spread grows this node's outline by exactly the spread (no sharp corners). An arc
-    /// (an ellipse that doesn't go all the way round) has corners where its ends meet its sides.
-    fn grows_by_exactly_its_spread(&self) -> bool {
+    /// Whether this node's outline has no sharp corners (right-angled ones aside), so mitres along
+    /// it end on its box grown by as much: a box or a whole ellipse. An arc (an ellipse that doesn't
+    /// go all the way round) has corners where its ends meet its sides.
+    fn outline_mitres_end_on_its_box(&self) -> bool {
         match self.kind {
             NodeKind::Rectangle | NodeKind::Section { .. } => true,
             NodeKind::Ellipse { sweep, .. } => figcraft_geom::full_sweep(sweep),
@@ -974,9 +975,20 @@ impl Node {
         }
     }
 
+    /// Whether a spread grows this node by exactly the spread: its outline mitres end on its box
+    /// (see [`Node::outline_mitres_end_on_its_box`]), and so does its stroke. A dashed stroke is
+    /// cut into dashes with corners wherever they fall round the outline, and a width profile or a
+    /// brush can give the stroke corners of its own, which the spread mitres out.
+    fn grows_by_exactly_its_spread(&self) -> bool {
+        let s = &self.stroke;
+        let cornered = self.has_visible_stroke() && (!s.dashes.is_empty() || s.profile().is_some() || s.brush.is_some());
+        !cornered && self.outline_mitres_end_on_its_box()
+    }
+
     /// How much further than its spread a drop shadow can reach at the outline's sharp corners:
     /// spread moves the edges out in parallel and they meet in a mitre (see
-    /// [`SPREAD_MITER_LIMIT`]). Rectangles, frames and whole ellipses grow by exactly the spread.
+    /// [`SPREAD_MITER_LIMIT`]). Rectangles, frames and whole ellipses grow by exactly the spread,
+    /// unless their stroke has corners (see [`Node::grows_by_exactly_its_spread`]).
     fn spread_miter_reach(&self) -> f64 {
         if self.grows_by_exactly_its_spread() {
             return 0.0;

crates/doc/src/tests.rs

@@ -223,6 +223,7 @@ fn text_case() {
     assert_eq!(style_weight("Semi Bold Italic"), 600);
     assert_eq!(style_weight("Black"), 900);
     assert_eq!(style_weight("Regular"), 400);
+    assert_eq!(style_weight("Hairline"), 100);
 }
 
 #[test]

crates/doc/src/text.rs

@@ -439,8 +439,9 @@ pub fn style_weight(style: &str) -> u16 {
     {
         return n;
     }
-    let table: [(&str, u16); 10] = [
+    let table: [(&str, u16); 11] = [
         ("thin", 100),
+        ("hairline", 100),
         ("extralight", 200),
         ("ultralight", 200),
         ("light", 300),

crates/engine/src/cmd/structure.rs

@@ -10,6 +10,8 @@ use serde_json::{Value, json};
 
 use super::edit::{roots, z_sorted};
 use super::{CommandSpec, ok};
+
+mod suggest;
 use crate::params::{f64_of, get, id_of, num_or, req_id, req_index, req_num, req_targets, string, targets};
 use crate::{EngineError, Result, Session, bad, spec};
 
@@ -109,7 +111,13 @@ pub fn specs() -> Vec<CommandSpec> {
                 Ok(json!({"removed": removed}))
             }
         ),
-        spec!("layout.suggest", "Suggest auto layout", "{ids?, direction? (horizontal|vertical|grid)}", true, layout_add),
+        spec!(
+            "layout.suggest",
+            "Suggest auto layout",
+            "{ids?, direction? (horizontal|vertical|grid)}  splits each frame's layers into rows or columns by the gaps between them, wraps every band of several layers in a frame without fill that hugs it and does the same inside, so the layers keep their place where the gaps are even and the bands start at the same offset across the flow; the frame keeps its size, and the result carries `warnings` for gaps that differ, bands that start at different offsets (they line up at the smallest and some move) and layers that overlap. Instances and the layers inside them are refused. `direction` sets the top level's direction (nested frames follow the gaps); grid lays the layers out in one grid. A group is converted to a frame and several layers are wrapped in one, as Add auto layout does",
+            true,
+            suggest::layout_suggest
+        ),
         spec!("object.moveToPage", "Move to page", "{ids?, page}", true, move_to_page),
         spec!("object.setThumbnail", "Set as thumbnail", "{id?}", true, |s, p| {
             let id = targets(s, p).first().copied().ok_or_else(|| bad("object.setThumbnail", "select a frame"))?;

crates/engine/src/cmd/structure/suggest.rs

@@ -0,0 +1,278 @@
+//! Suggest auto layout (#1823): split a frame's layers into rows or columns by the gaps between
+//! them, wrap each band that holds several layers in a frame of its own and do the same inside
+//! it, so the design gets as many auto layout frames as it needs and keeps its placement.
+
+use figcraft_doc::{AutoLayout, Document, LayoutMode, NodeId, NodeKind, Sizing};
+use figcraft_geom::Rect;
+use serde_json::{Value, json};
+
+use super::{Wrap, convert, infer_layout, sort_layout_children, wrap};
+use crate::params::{id_of, req_targets, string};
+use crate::{EngineError, Result, Session, bad};
+
+/// How deep nested band frames go before a frame is laid out as a single list.
+const MAX_DEPTH: usize = 16;
+/// The most layers analysed in one frame; past this the frame is laid out as a single list.
+const MAX_CHILDREN: usize = 1000;
+/// Gaps that differ by more than this are reported.
+const GAP_TOLERANCE: f64 = 0.5;
+/// Edges closer than this count as touching.
+const EDGE_EPS: f64 = 1e-6;
+
+/// One row or column: the layers in it and the span it covers along both axes.
+struct Band {
+    members: Vec<(NodeId, Rect)>,
+    /// Start and end along the split axis.
+    lo: f64,
+    hi: f64,
+    /// Start and end along the other axis.
+    cross_lo: f64,
+    cross_hi: f64,
+}
+
+fn span(r: &Rect, vertical: bool) -> (f64, f64, f64, f64) {
+    if vertical { (r.y0, r.y1, r.x0, r.x1) } else { (r.x0, r.x1, r.y0, r.y1) }
+}
+
+/// Split the layers into bands along one axis: sorted by their start, a layer joins the current
+/// band while it starts before the band ends, and opens a new band when there is a gap or it
+/// only touches. Layers starting together always share a band.
+fn bands(boxes: &[(NodeId, Rect)], vertical: bool) -> Vec<Band> {
+    let mut sorted = boxes.to_vec();
+    sorted.sort_by(|a, b| span(&a.1, vertical).0.total_cmp(&span(&b.1, vertical).0));
+    let mut out: Vec<Band> = Vec::new();
+    for item in sorted {
+        let (lo, hi, cross_lo, cross_hi) = span(&item.1, vertical);
+        match out.last_mut() {
+            Some(b) if lo < b.hi - EDGE_EPS || lo - b.lo < EDGE_EPS => {
+                b.hi = b.hi.max(hi);
+                b.cross_lo = b.cross_lo.min(cross_lo);
+                b.cross_hi = b.cross_hi.max(cross_hi);
+                b.members.push(item);
+            }
+            _ => out.push(Band { members: vec![item], lo, hi, cross_lo, cross_hi }),
+        }
+    }
+    out
+}
+
+/// The layers a frame lays out, with their boxes in the frame's own space. `None` when a box
+/// isn't a finite number.
+fn flow_boxes(doc: &Document, frame: NodeId) -> Option<Vec<(NodeId, Rect)>> {
+    let mut out = Vec::new();
+    for c in figcraft_layout::flow_children(doc, frame) {
+        let n = doc.node(c)?;
+        let r = figcraft_geom::transform_rect_bbox(n.transform, n.local_rect());
+        if ![r.x0, r.y0, r.x1, r.y1].iter().all(|v| v.is_finite()) {
+            return None;
+        }
+        out.push((c, r));
+    }
+    Some(out)
+}
+
+fn finite_or_zero(v: f64) -> f64 {
+    if v.is_finite() { (v * 1000.0).round() / 1000.0 } else { 0.0 }
+}
+
+fn mode_from(direction: &str) -> LayoutMode {
+    match direction.to_ascii_lowercase().as_str() {
+        "vertical" | "column" => LayoutMode::Vertical,
+        "grid" => LayoutMode::Grid,
+        _ => LayoutMode::Horizontal,
+    }
+}
+
+/// The auto layout that places `bands` where they are: the gap between them, the room before the
+/// first and after the last, and on the other axis the smallest offset from each edge.
+fn layout_for(bands: &[Band], vertical: bool, frame_w: f64, frame_h: f64, name: &str, warnings: &mut Vec<String>) -> AutoLayout {
+    let gaps: Vec<f64> = bands.windows(2).filter_map(|w| Some((w.get(1)?.lo - w.first()?.hi).max(0.0))).collect();
+    let smallest = gaps.iter().copied().fold(f64::INFINITY, f64::min);
+    let largest = gaps.iter().copied().fold(0.0, f64::max);
+    if largest - smallest > GAP_TOLERANCE {
+        let what = if vertical { "rows" } else { "columns" };
+        warnings.push(format!(
+            "\"{name}\": the gaps between the {what} differ ({} to {}), so the smallest is used and later {what} move",
+            finite_or_zero(smallest),
+            finite_or_zero(largest)
+        ));
+    }
+    let (main_size, cross_size) = if vertical { (frame_h, frame_w) } else { (frame_w, frame_h) };
+    let main_start = bands.first().map_or(0.0, |b| b.lo).max(0.0);
+    let main_end = (main_size - bands.last().map_or(0.0, |b| b.hi)).max(0.0);
+    let cross_start = bands.iter().map(|b| b.cross_lo).fold(f64::INFINITY, f64::min).max(0.0);
+    let cross_end = bands.iter().map(|b| cross_size - b.cross_hi).fold(f64::INFINITY, f64::min).max(0.0);
+    // Every band is lined up at the start across the flow, so one that starts further in (a
+    // centred title above a card) moves to the smallest offset.
+    let widest_start = bands.iter().map(|b| b.cross_lo).fold(f64::NEG_INFINITY, f64::max);
+    let smallest_start = bands.iter().map(|b| b.cross_lo).fold(f64::INFINITY, f64::min);
+    if widest_start - smallest_start > GAP_TOLERANCE {
+        let what = if vertical { "rows" } else { "columns" };
+        warnings.push(format!(
+            "\"{name}\": the {what} start at different offsets ({} to {}), so they are lined up at the smallest and some move",
+            finite_or_zero(smallest_start),
+            finite_or_zero(widest_start)
+        ));
+    }
+    let [ms, me, cs, ce] = [main_start, main_end, cross_start, cross_end].map(finite_or_zero);
+    AutoLayout {
+        mode: if vertical { LayoutMode::Vertical } else { LayoutMode::Horizontal },
+        gap: finite_or_zero(smallest),
+        // Top, right, bottom, left.
+        padding: if vertical { [ms, ce, me, cs] } else { [cs, me, ce, ms] },
+        ..Default::default()
+    }
+}
+
+/// Lay a frame out as one list the way "Add auto layout" does: the direction is inferred, or
+/// `direction` forces it.
+fn flat_layout(s: &mut Session, frame: NodeId, direction: Option<&str>) -> Result<()> {
+    let doc = s.doc_mut()?;
+    let mut al = infer_layout(doc, frame);
+    if let Some(d) = direction {
+        al.mode = mode_from(d);
+    }
+    let mut kids = doc.get(frame)?.children.clone();
+    sort_layout_children(doc, &mut kids, al.mode == LayoutMode::Vertical);
+    let n = doc.get_mut(frame)?;
+    n.children = kids;
+    n.layout = Some(al);
+    Ok(())
+}
+
+/// Turn the frame's layers into bands and give the frame, and every band frame made on the way,
+/// the auto layout that keeps them where they are. Returns whether the frame got auto layout.
+fn split(s: &mut Session, frame: NodeId, depth: usize, direction: Option<&str>, warnings: &mut Vec<String>) -> Result<bool> {
+    let doc = s.doc()?;
+    let name = doc.get(frame)?.name.clone();
+    let (frame_w, frame_h) = (doc.get(frame)?.width, doc.get(frame)?.height);
+    let any_mask = doc.get(frame)?.children.iter().filter_map(|c| doc.node(*c)).any(|c| c.is_mask);
+    let Some(boxes) = flow_boxes(doc, frame) else {
+        warnings.push(format!("\"{name}\": a layer has no usable position, so no auto layout was added"));
+        return Ok(false);
+    };
+    if boxes.len() < 2 {
+        flat_layout(s, frame, direction)?;
+        return Ok(true);
+    }
+    if depth >= MAX_DEPTH || boxes.len() > MAX_CHILDREN || any_mask {
+        let why = if any_mask {
+            "it has a mask"
+        } else if depth >= MAX_DEPTH {
+            "the frames are nested too deep"
+        } else {
+            "it has too many layers to analyse"
+        };
+        warnings.push(format!("\"{name}\": {why}, so its layers are laid out in one list"));
+        flat_layout(s, frame, direction)?;
+        return Ok(true);
+    }
+    // The direction asked for decides the axis of the top level; nested frames follow the gaps.
+    let forced = direction.map(mode_from);
+    let (vertical, found) = match forced {
+        Some(LayoutMode::Vertical) => (true, bands(&boxes, true)),
+        Some(LayoutMode::Horizontal) => (false, bands(&boxes, false)),
+        Some(_) => (true, Vec::new()),
+        None => {
+            let rows = bands(&boxes, true);
+            if rows.len() >= 2 { (true, rows) } else { (false, bands(&boxes, false)) }
+        }
+    };
+    if found.len() < 2 {
+        if forced.is_some() {
+            if forced != Some(LayoutMode::Grid) {
+                warnings.push(format!("\"{name}\": its layers don't separate along the direction asked for, so they are laid out in one list"));
+            }
+            flat_layout(s, frame, direction)?;
+            return Ok(true);
+        }
+        warnings.push(format!("\"{name}\": its layers overlap along both axes, so no auto layout was added"));
+        return Ok(false);
+    }
+    let al = layout_for(&found, vertical, frame_w, frame_h, &name, warnings);
+    // Band frames first, while the layers are still where they were.
+    let mut made = Vec::new();
+    for band in &found {
+        if band.members.len() < 2 {
+            continue;
+        }
+        let ids: Vec<NodeId> = band.members.iter().map(|(id, _)| *id).collect();
+        let r = wrap(s, &json!({"ids": ids}), "layout.suggest", Wrap::Frame)?;
+        let fid = id_of(&r["id"]).ok_or_else(|| EngineError::Other("wrap failed".into()))?;
+        let f = s.doc_mut()?.get_mut(fid)?;
+        f.fills.clear();
+        f.clip = false;
+        made.push(fid);
+    }
+    let doc = s.doc_mut()?;
+    let mut kids = doc.get(frame)?.children.clone();
+    sort_layout_children(doc, &mut kids, vertical);
+    let n = doc.get_mut(frame)?;
+    n.children = kids;
+    n.layout = Some(al);
+    for fid in made {
+        if split(s, fid, depth + 1, None, warnings)? {
+            // A band frame that got auto layout is as big as what is in it (one that did not stays Fixed).
+            let f = s.doc_mut()?.get_mut(fid)?;
+            f.child_layout.sizing_h = Sizing::Hug;
+            f.child_layout.sizing_v = Sizing::Hug;
+        }
+    }
+    Ok(true)
+}
+
+/// Add auto layout to the frames, group or layers asked for the way "Add auto layout" finds its
+/// targets, then split each into nested rows and columns by the gaps between its layers.
+pub(super) fn layout_suggest(s: &mut Session, p: &Value) -> Result<Value> {
+    let ids = req_targets("layout.suggest", s, p)?;
+    let direction = string(p, "direction");
+    let doc = s.doc()?;
+    // An instance's layers come from its main component: nothing is added to them. Checked
+    // before anything changes, with the words Convert to group uses.
+    for i in &ids {
+        let n = doc.get(*i)?;
+        if matches!(n.kind, NodeKind::Instance { .. }) {
+            return Err(bad("layout.suggest", format!("\"{}\" is an instance: its layers come from its main component (detach it first)", n.name)));
+        }
+        if crate::components::owning_instance(doc, *i).is_some() {
+            return Err(bad("layout.suggest", format!("\"{}\" is inside an instance: edit its main component, or detach the instance", n.name)));
+        }
+    }
+    let all_frames = ids.iter().all(|i| doc.node(*i).is_some_and(|n| n.kind.is_frame_like() && n.layout.is_none()));
+    let single_group = ids.len() == 1 && ids.first().and_then(|i| doc.node(*i)).is_some_and(|n| matches!(n.kind, NodeKind::Group));
+    // A frame with auto layout already is wrapped, like a layer, and so are several layers.
+    let (targets, own_size) = if all_frames {
+        (ids, true)
+    } else if single_group {
+        // The group's layers are laid out directly, not inside a wrapper.
+        convert(s, &json!({"ids": ids}), "layout.suggest", true)?;
+        (ids, false)
+    } else {
+        let r = wrap(s, &json!({"ids": ids}), "layout.suggest", Wrap::Frame)?;
+        let fid = id_of(&r["id"]).ok_or_else(|| EngineError::Other("wrap failed".into()))?;
+        let f = s.doc_mut()?.get_mut(fid)?;
+        f.fills.clear();
+        f.clip = false;
+        (vec![fid], false)
+    };
+    let mut warnings = Vec::new();
+    for f in &targets {
+        // A frame keeps its size; a wrapper or a converted group has none of its own and hugs.
+        let got_layout = split(s, *f, 0, direction.as_deref(), &mut warnings)?;
+        if got_layout && !own_size {
+            let n = s.doc_mut()?.get_mut(*f)?;
+            if !single_group || n.child_layout.sizing_h != Sizing::Fill {
+                n.child_layout.sizing_h = Sizing::Hug;
+            }
+            if !single_group || n.child_layout.sizing_v != Sizing::Fill {
+                n.child_layout.sizing_v = Sizing::Hug;
+            }
+        }
+    }
+    s.set_selection(targets.clone());
+    let mut out = json!({"ids": targets});
+    if !warnings.is_empty() {
+        out["warnings"] = json!(warnings);
+    }
+    Ok(out)
+}

crates/engine/src/cmd/text.rs

@@ -129,11 +129,138 @@ fn toggle_italic(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
+/// Hiragino's weight names: "W3" is 300.
+fn w_number(word: &str) -> Option<u16> {
+    let n = word.strip_prefix('w')?.parse::<u16>().ok()?;
+    (1..=9).contains(&n).then_some(n * 100)
+}
+
+/// A weight number as some families name styles ("Condensed 600"). Below 100 it is something else
+/// (a width grade, an optical size: "Condensed 2", "Caption 12").
+fn number_weight(word: &str) -> Option<u16> {
+    let n = word.parse::<u16>().ok().filter(|_| word.bytes().all(|b| b.is_ascii_digit()))?;
+    (100..=1000).contains(&n).then_some(n)
+}
+
+/// Style-name words that give a weight or a slant.
+const WEIGHT_WORDS: [&str; 25] = [
+    "thin",
+    "hairline",
+    "extralight",
+    "ultralight",
+    "light",
+    "semilight",
+    "demilight",
+    "regular",
+    "normal",
+    "roman",
+    "book",
+    "medium",
+    "semibold",
+    "demibold",
+    "bold",
+    "extrabold",
+    "ultrabold",
+    "black",
+    "extrablack",
+    "ultrablack",
+    "heavy",
+    "italic",
+    "oblique",
+    "plain",
+    "standard",
+];
+
+/// Words that grade the weight word after them ("Extra Bold") but a width otherwise ("Extra Condensed").
+const GRADES: [&str; 4] = ["extra", "ultra", "semi", "demi"];
+
+/// The width a Univers number leading a style name gives, as Univers, Frutiger and Helvetica Neue
+/// LT name styles ("45 Light", "55 Roman", "57 Condensed", "67 Bold Condensed"): the first digit
+/// grades the weight, the second the width (3 or 4 extended, 5 or 6 normal, 7 or 8 condensed, 9
+/// ultra condensed; even is italic, which the name says too). Only before weight, slant and width
+/// words, so another leading number ("12 Regular", "55 Rounded") stays part of the width.
+fn univers_width(words: &[&str]) -> Option<u8> {
+    const WIDTHS: [&str; 6] = ["condensed", "compressed", "narrow", "extended", "expanded", "wide"];
+    let (code, rest) = words.split_first()?;
+    let &[b'1'..=b'9', d @ b'3'..=b'9'] = code.as_bytes() else { return None };
+    let known = |w: &&str| WEIGHT_WORDS.contains(w) || GRADES.contains(w) || WIDTHS.contains(w);
+    (!rest.is_empty() && rest.iter().all(known)).then_some((d - b'1') / 2)
+}
+
+/// What a style name says besides its weight and slant ("Narrow Bold Italic" → "narrow",
+/// "Extra Condensed Bold" → "extra condensed", "67 Bold Condensed" → its Univers width and "condensed").
+fn style_rest(style: &str) -> String {
+    let s = style.to_ascii_lowercase().replace('-', " ");
+    let words: Vec<&str> = s.split_whitespace().collect();
+    let weight = |w: &str| WEIGHT_WORDS.contains(&w) || w_number(w).or_else(|| number_weight(w)).is_some();
+    let rest = words.iter().enumerate().filter(|(i, w)| {
+        let graded = GRADES.contains(w) && words.get(i + 1).is_some_and(|next| weight(next) && !matches!(*next, "italic" | "oblique"));
+        !weight(w) && !graded
+    });
+    let univers = univers_width(&words).map(|d| format!("univers width {d}"));
+    // The Univers number (the first word kept) gives way to its width.
+    let rest = rest.map(|(_, w)| *w).skip(usize::from(univers.is_some()));
+    univers.as_deref().into_iter().chain(rest).collect::<Vec<_>>().join(" ")
+}
+
+/// A style name that slants: italic, or oblique as some families name it.
+fn slanted(style: &str) -> bool {
+    let s = style.to_ascii_lowercase();
+    s.contains("italic") || s.contains("oblique")
+}
+
+/// The weight a style name says ("W3", "W6 Italic", "Condensed W7", "Condensed 600" and "45 Light" too).
+pub(crate) fn name_weight(style: &str) -> u16 {
+    let s = style.to_ascii_lowercase().replace('-', " ");
+    let words: Vec<&str> = s.split_whitespace().collect();
+    // A Univers number's weight digit has no fixed CSS weight ("65" is Medium in Helvetica Neue,
+    // Bold in Univers): the words after it say it.
+    if let Some((_, rest)) = words.split_first().filter(|_| univers_width(&words).is_some()) {
+        return figcraft_doc::style_weight(&rest.join(" "));
+    }
+    words.iter().find_map(|w| w_number(w).or_else(|| number_weight(w))).unwrap_or_else(|| figcraft_doc::style_weight(style))
+}
+
+/// The next heavier (`up`) or lighter style of `styles` (a family's with the weight each is listed
+/// by, lightest first, as the style menu lists them) after the chars' style, with the same slant
+/// and width. The chars' style is found in the list by name and its neighbour taken; a style the
+/// family doesn't have, or a custom weight axis value, goes to the listed style of nearest weight
+/// that way. None when the family has nothing further.
+pub(crate) fn next_style(styles: &[(String, u16)], st: &TextStyle, up: bool) -> Option<String> {
+    let italic = st.italic() || slanted(&st.font_style);
+    let rest = style_rest(&st.font_style);
+    let mut same: Vec<&(String, u16)> = styles.iter().filter(|(x, _)| slanted(x) == italic && style_rest(x) == rest).collect();
+    let norm = |s: &str| s.to_lowercase().replace([' ', '-', '_'], "");
+    let here = same.iter().position(|(x, _)| norm(x) == norm(&st.font_style));
+    let axis = st.variations.contains_key("wght");
+    if let Some(i) = here.filter(|_| !axis) {
+        let next = if up { i.checked_add(1) } else { i.checked_sub(1) };
+        return next.and_then(|n| same.get(n)).map(|(x, _)| x.clone());
+    }
+    let w = i32::from(if axis { st.weight() } else { name_weight(&st.font_style) });
+    // Of equal weights, the one nearest in the family's order: the first going up, the last going down.
+    if !up {
+        same.reverse();
+    }
+    same.into_iter()
+        .map(|(x, xw)| (i32::from(*xw) - w, x))
+        .filter(|(d, _)| if up { *d > 0 } else { *d < 0 })
+        .min_by_key(|(d, _)| d.abs())
+        .map(|(_, x)| x.clone())
+}
+
+/// `text.weightUp` / `text.weightDown`: each targeted run moves to the next style of its family.
 fn step_weight(s: &mut Session, p: &Value, up: bool) -> Result<Value> {
     style(s, p, |st| {
-        let w = (i32::from(st.weight()) + if up { 100 } else { -100 }).clamp(100, 900) as u16;
-        let italic = st.italic();
-        st.set_font_style(styled_name(weight_name(w), italic));
+        let styles = figcraft_text::family_style_weights(&st.font_family);
+        if styles.is_empty() {
+            // A family that isn't installed: step the weight by 100 under its canonical name.
+            let w = (i32::from(st.weight()) + if up { 100 } else { -100 }).clamp(100, 900) as u16;
+            let italic = st.italic();
+            st.set_font_style(styled_name(weight_name(w), italic));
+        } else if let Some(next) = next_style(&styles, st, up) {
+            st.set_font_style(next);
+        }
     })
 }
 

crates/engine/src/collab_live_tests.rs

@@ -318,6 +318,129 @@ fn a_dropped_connection_keeps_editing_and_catches_up() {
     assert_eq!((doc.node(r).unwrap().name.as_str(), doc.node(f).unwrap().name.as_str()), ("Sent", "Offline"));
 }
 
+impl Room {
+    /// Person `i` has been told to join again: the server takes them as someone new.
+    fn welcome_anew(&mut self, i: usize) {
+        let ClientMsg::Hello(h) = Client::hello("f", "t", "Person", "") else { panic!("not a hello") };
+        let (id, out) = self.server.join(h).unwrap();
+        let w = welcome_of(&out, id);
+        let p = &mut self.people[i];
+        p.id = id;
+        p.online = true;
+        p.script.lock().unwrap().events.extend([Event::Welcome { info: info(Role::Guest, id), peers: vec![] }, Event::Sync(w)]);
+        p.s.live_poll();
+    }
+
+    fn event(&mut self, i: usize, e: Event) {
+        let p = &mut self.people[i];
+        p.script.lock().unwrap().events.push(e);
+        p.s.live_poll();
+    }
+}
+
+#[test]
+fn reconnecting_can_be_told_to_try_now_and_shows_as_disconnected() {
+    let mut room = Room::new(base(), 1, 7);
+    assert!(!room.s(0).live().disconnected());
+    assert!(room.s(0).execute("collab.reconnect", &json!({})).is_err(), "nothing was lost");
+    room.disconnect(0);
+    assert!(room.s(0).live().disconnected());
+    assert_eq!(room.s(0).execute("collab.reconnect", &json!({})).unwrap()["status"], "reconnecting");
+    let session = room.s(0).live().id;
+    assert_eq!(room.people[0].script.lock().unwrap().retried, [session]);
+}
+
+#[test]
+fn a_session_that_cant_go_on_stays_on_its_tab_and_joins_again_there() {
+    let mut room = Room::new(base(), 2, 7);
+    let (f, r) = frame_and_rect(room.server.document());
+    let uid = room.s(0).ds().unwrap().uid;
+    let tabs = room.s(0).docs.len();
+    room.disconnect(0);
+    room.s(0).execute("node.set", &json!({"id": r, "props": {"name": "Offline"}})).unwrap();
+    room.event(0, Event::Status(Status::Failed { reason: "The host refused: this link isn't valid".into() }));
+    // The tab says so, and is yours to go on working in.
+    let live = room.s(0).live();
+    assert!(live.disconnected() && live.rejoinable() && live.doc_uid == Some(uid));
+    assert!(room.s(0).live_read_only(uid).is_none());
+    room.s(0).execute("node.set", &json!({"id": f, "props": {"name": "Offline too"}})).unwrap();
+    // A try that fails leaves it just as it was.
+    assert_eq!(room.s(0).execute("collab.reconnect", &json!({})).unwrap()["status"], "connecting");
+    assert!(room.s(0).live().disconnected() && !room.s(0).live().rejoinable());
+    assert!(room.s(0).live_read_only(uid).is_none(), "it can still be edited while it tries");
+    room.event(0, Event::Status(Status::Failed { reason: "Couldn't join the live session: no answer".into() }));
+    assert!(room.s(0).live().rejoinable());
+    // Someone else's edit lands meanwhile.
+    room.s(1).execute("transform.move", &json!({"ids": [r], "dx": 5, "dy": 5})).unwrap();
+    room.settle();
+    // The next try joins in the same tab, and what was done offline opens beside it.
+    room.s(0).execute("collab.reconnect", &json!({})).unwrap();
+    room.welcome_anew(0);
+    let s = room.s(0);
+    assert_eq!(s.live().status, Status::Live);
+    assert!(!s.live().disconnected());
+    assert_eq!(s.docs.len(), tabs + 1, "the copy's is the only new tab");
+    let (tab, copy) = (s.docs.iter().find(|d| d.uid == uid).unwrap(), s.docs.last().unwrap());
+    assert_eq!(s.live().doc_uid, Some(uid));
+    assert_ne!(tab.doc.node(r).unwrap().name, "Offline", "the session's tab shows the server's version");
+    assert_eq!(copy.doc.name, format!("{} (offline copy)", tab.doc.name));
+    assert_eq!(copy.doc.node(r).unwrap().name, "Offline");
+    assert_eq!(copy.doc.node(f).unwrap().name, "Offline too");
+    assert!(copy.is_dirty(), "closing the copy asks first");
+    assert!(s.message.as_deref().is_some_and(|m| m.contains("offline copy")));
+}
+
+#[test]
+fn joining_again_with_nothing_changed_opens_no_copy() {
+    let mut room = Room::new(base(), 1, 7);
+    let tabs = room.s(0).docs.len();
+    room.disconnect(0);
+    room.event(0, Event::Ended { reason: "Sharing was stopped".into() });
+    assert!(room.s(0).live().rejoinable(), "the end of a session you were in shows on its tab too");
+    assert_eq!(room.s(0).message.as_deref(), Some("Sharing was stopped"));
+    room.s(0).execute("collab.reconnect", &json!({})).unwrap();
+    room.welcome_anew(0);
+    assert_eq!(room.s(0).docs.len(), tabs);
+    assert_eq!(room.s(0).live().status, Status::Live);
+}
+
+#[test]
+fn a_session_out_of_step_joins_again_by_itself() {
+    let mut room = Room::new(base(), 1, 7);
+    let joins = room.people[0].script.lock().unwrap().joined.len();
+    let tabs = room.s(0).docs.len();
+    // A batch from far in the future: it can't be applied.
+    room.event(0, Event::Sync(ServerMsg::Changes(figcraft_collab::Accepted { seq: 999, author: 42, batch_id: 1, changes: vec![] })));
+    assert_eq!(room.s(0).live().status, Status::Connecting);
+    assert!(room.s(0).live().disconnected());
+    assert_eq!(room.people[0].script.lock().unwrap().joined.len(), joins + 1);
+    room.welcome_anew(0);
+    assert_eq!(room.s(0).live().status, Status::Live);
+    assert_eq!(room.s(0).docs.len(), tabs);
+}
+
+#[test]
+fn leaving_with_changes_unconfirmed_says_so() {
+    let mut room = Room::new(base(), 1, 7);
+    let (_, r) = frame_and_rect(room.server.document());
+    room.s(0).execute("collab.leave", &json!({})).unwrap();
+    assert_eq!(room.s(0).message.as_deref(), Some("You left the session; your copy stays open here"));
+    let mut room = Room::new(base(), 1, 7);
+    room.s(0).execute("node.set", &json!({"id": r, "props": {"name": "Unconfirmed"}})).unwrap();
+    room.s(0).execute("collab.leave", &json!({})).unwrap();
+    assert!(room.s(0).message.as_deref().is_some_and(|m| m.contains("before your last changes were confirmed")));
+}
+
+#[test]
+fn leaving_a_lost_session_makes_the_tab_a_plain_copy() {
+    let mut room = Room::new(base(), 1, 7);
+    room.disconnect(0);
+    room.event(0, Event::Status(Status::Failed { reason: "gone".into() }));
+    room.s(0).execute("collab.leave", &json!({})).unwrap();
+    assert_eq!(room.s(0).live().status, Status::Off);
+    assert!(!room.s(0).live().disconnected());
+}
+
 #[test]
 fn random_commands_with_undo_and_drops_converge_through_the_engine() {
     for seed in 0..6 {

crates/engine/src/doc_list_paths_tests.rs

@@ -46,3 +46,37 @@ fn a_plugin_gets_names_but_no_paths() {
     assert!(out.contains("Front"), "{out}");
     assert!(!out.contains(SECRET) && !out.contains("path"), "{out}");
 }
+
+#[test]
+fn a_plugin_gets_library_names_but_not_their_links() {
+    const LINK: &str = "ws://tracker.example:9/?file=f&token=per-file-secret";
+    let mut s = Session::new();
+    s.doc_mut().unwrap().libraries_mut().enabled.push(figcraft_doc::LibraryLink {
+        id: "lib".into(),
+        name: "Kit".into(),
+        path: LINK.into(),
+        version: 3,
+    });
+    let tail = "(call $set_output (i32.const 40000) (call $reply_read (i32.const 40000) (i32.const 20000))) (return (i32.const 0))";
+    install(&mut s, manifest("org.test.libs", "read", &[]), &script(&[("library.list", json!({}))], OnRefusal::Fail, tail));
+    let out = ex(&mut s, "plugin.run", json!({"id": "org.test.libs"}))["output"].to_string();
+    assert!(out.contains("Kit"), "{out}");
+    assert!(!out.contains("per-file-secret") && !out.contains("\\\"path\\\""), "{out}");
+}
+
+#[test]
+fn a_plugin_gets_a_fixed_message_for_library_update_failures() {
+    const LINK: &str = "/home/someone/private/kits/kit.figcraft";
+    let mut s = Session::new();
+    s.doc_mut().unwrap().libraries_mut().enabled.push(figcraft_doc::LibraryLink {
+        id: "lib".into(),
+        name: "Kit".into(),
+        path: LINK.into(),
+        version: 3,
+    });
+    let tail = "(call $set_output (i32.const 40000) (call $reply_read (i32.const 40000) (i32.const 20000))) (return (i32.const 0))";
+    install(&mut s, manifest("org.test.upd", "read", &[]), &script(&[("library.updates", json!({}))], OnRefusal::Fail, tail));
+    let out = ex(&mut s, "plugin.run", json!({"id": "org.test.upd"}))["output"].to_string();
+    assert!(out.contains("could not be read"), "{out}");
+    assert!(!out.contains("someone") && !out.contains("private"), "{out}");
+}

crates/engine/src/extensions/plugins.rs

@@ -180,12 +180,21 @@ fn refusal(m: &Manifest, command: &str, params: &Value) -> Option<String> {
     if command == "variable.import" && get(params, "variables").and_then(Value::as_str).is_some_and(|t| !t.trim_start().starts_with('{')) {
         return Some("plugins can't read files: pass the variables JSON itself".into());
     }
+    // A saved version is the file's history, which plugins can't read (`version.` is denied).
+    if command == "dev.compare" && get(params, "version").is_some_and(|v| !v.is_null()) {
+        return Some("plugins can't read saved versions: leave out `version`".into());
+    }
     if !m.permissions.allows(command) {
         return Some(format!("`{command}` isn't in the commands {} asked permission for", m.name));
     }
     if m.permissions.access == Access::Read && find_command(command).is_some_and(|c| c.history) {
         return Some(format!("`{command}` edits the document, and {} may only read it", m.name));
     }
+    // Branches live beside the document (not in its undo history or its `Arc`), so the write
+    // checks below don't see them change.
+    if m.permissions.access == Access::Read && matches!(command, "branch.create" | "branch.updateFromMain" | "branch.merge" | "branch.archive") {
+        return Some(format!("`{command}` changes the file's branches, and {} may only read it", m.name));
+    }
     None
 }
 
@@ -263,10 +272,23 @@ impl figcraft_plugin::Host for EngineHost<'_> {
             Ok(v)
         });
         r.map(|mut v| {
-            // A plugin gets the open files' names, not where they are on disk (#1117).
-            if command == "doc.list" {
-                for e in v.as_array_mut().into_iter().flatten().filter_map(Value::as_object_mut) {
+            // A plugin gets the open files' and libraries' names, not where they are on disk or
+            // the share links (with their tokens) that reach them (#1117).
+            if matches!(command, "doc.list" | "library.list" | "library.updates") {
+                // `doc.list` is a list; `library.list` keeps its list under `libraries`, and
+                // `library.updates` its failures under `errors`.
+                let list = match command {
+                    "library.list" => v.get_mut("libraries"),
+                    "library.updates" => v.get_mut("errors"),
+                    _ => Some(&mut v),
+                };
+                for e in list.and_then(Value::as_array_mut).into_iter().flatten().filter_map(Value::as_object_mut) {
                     e.remove("path");
+                    // A failure's text may quote the path, a token or another form of it: the
+                    // plugin gets a fixed message.
+                    if let Some(err) = e.get_mut("error").filter(|v| v.is_string()) {
+                        *err = json!("the library could not be read");
+                    }
                 }
             }
             v.to_string()
@@ -708,6 +730,23 @@ mod refusal_tests {
         let r = refusal(&m, "library.publishToServer", &json!({}));
         assert!(r.is_some(), "library.publishToServer uploads the document and must be refused");
     }
+
+    #[test]
+    fn read_only_plugin_cannot_change_branches() {
+        let m = Manifest::parse(r#"{"id":"x.y","name":"X","main":"plugin.wasm"}"#).unwrap();
+        for cmd in ["branch.archive", "branch.updateFromMain", "branch.merge", "branch.create"] {
+            assert!(refusal(&m, cmd, &json!({})).is_some(), "{cmd} changes persisted branch state");
+        }
+        assert!(refusal(&m, "branch.list", &json!({})).is_none());
+    }
+
+    #[test]
+    fn plugins_cannot_compare_against_a_saved_version() {
+        let m = Manifest::parse(r#"{"id":"x.y","name":"X","main":"plugin.wasm","permissions":{"access":"write"}}"#).unwrap();
+        assert!(refusal(&m, "dev.compare", &json!({"version": "v1"})).is_some());
+        assert!(refusal(&m, "dev.compare", &json!({"version": null})).is_none());
+        assert!(refusal(&m, "dev.compare", &json!({})).is_none());
+    }
 }
 
 #[cfg(test)]

crates/engine/src/layout_suggest_tests.rs

@@ -0,0 +1,325 @@
+//! Suggest auto layout (#1823): a frame's layers are split into rows or columns by the gaps between
+//! them, each band of several layers gets a frame of its own, and the design keeps its placement.
+
+use serde_json::{Value, json};
+
+use crate::Session;
+use crate::params::id_of;
+use figcraft_doc::{LayoutMode, NodeId, NodeKind, Sizing};
+
+fn id(v: &Value) -> NodeId {
+    id_of(&v["id"]).unwrap()
+}
+
+fn ex(s: &mut Session, cmd: &str, p: Value) -> Value {
+    s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd} {p}: {e}"))
+}
+
+fn frame(s: &mut Session, x: f64, y: f64, w: f64, h: f64) -> NodeId {
+    id(&ex(s, "frame.create", json!({"x": x, "y": y, "width": w, "height": h})))
+}
+
+fn rect(s: &mut Session, parent: NodeId, x: f64, y: f64, w: f64, h: f64) -> NodeId {
+    id(&ex(s, "shape.rectangle", json!({"parent": parent, "x": x, "y": y, "width": w, "height": h})))
+}
+
+/// A layer's box on the page: `[x0, y0, x1, y1]`, rounded.
+fn page_box(s: &Session, n: NodeId) -> [f64; 4] {
+    let b = s.doc().unwrap().world_bounds(n).unwrap();
+    [b.x0, b.y0, b.x1, b.y1].map(|v| (v * 1000.0).round() / 1000.0)
+}
+
+fn boxes(s: &Session, ns: &[NodeId]) -> Vec<[f64; 4]> {
+    ns.iter().map(|n| page_box(s, *n)).collect()
+}
+
+fn kids(s: &Session, n: NodeId) -> Vec<NodeId> {
+    s.doc().unwrap().node(n).unwrap().children.clone()
+}
+
+fn mode(s: &Session, n: NodeId) -> Option<LayoutMode> {
+    s.doc().unwrap().node(n).unwrap().layout.as_ref().map(|l| l.mode)
+}
+
+/// A frame made by Suggest auto layout: no fill, no clipping, hugging what is in it.
+fn assert_band(s: &Session, n: NodeId, m: LayoutMode) {
+    let node = s.doc().unwrap().node(n).unwrap();
+    assert!(matches!(node.kind, NodeKind::Frame), "a band is a frame");
+    assert!(node.fills.is_empty() && !node.clip, "a band has no fill and does not clip");
+    assert_eq!(mode(s, n), Some(m));
+    assert_eq!((node.child_layout.sizing_h, node.child_layout.sizing_v), (Sizing::Hug, Sizing::Hug));
+}
+
+fn warnings(r: &Value) -> Vec<String> {
+    r["warnings"].as_array().map(|a| a.iter().filter_map(|w| w.as_str().map(String::from)).collect()).unwrap_or_default()
+}
+
+/// The issue's design: four 50 x 50 squares in a 200 x 200 frame, two rows of two.
+fn squares() -> (Session, NodeId, [NodeId; 4]) {
+    let mut s = Session::new();
+    let f = frame(&mut s, 100.0, 50.0, 200.0, 200.0);
+    let sq = [(0.0, 0.0), (60.0, 0.0), (0.0, 60.0), (60.0, 60.0)].map(|(x, y)| rect(&mut s, f, x, y, 50.0, 50.0));
+    (s, f, sq)
+}
+
+#[test]
+fn two_rows_of_two_squares_become_a_vertical_frame_of_two_horizontal_rows() {
+    let (mut s, f, sq) = squares();
+    let before_frame = page_box(&s, f);
+    let before = boxes(&s, &sq);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert_eq!(result["ids"], json!([f]));
+    assert!(warnings(&result).is_empty(), "{result}");
+    assert_eq!(mode(&s, f), Some(LayoutMode::Vertical));
+    let rows = kids(&s, f);
+    assert_eq!(rows.len(), 2, "two rows");
+    for (row, pair) in rows.iter().zip([[sq[0], sq[1]], [sq[2], sq[3]]]) {
+        assert_band(&s, *row, LayoutMode::Horizontal);
+        assert_eq!(kids(&s, *row), pair);
+    }
+    let node = s.doc().unwrap().node(f).unwrap();
+    assert_eq!(node.child_layout.sizing_h, Sizing::Fixed, "the frame keeps its size");
+    assert_eq!(node.child_layout.sizing_v, Sizing::Fixed);
+    assert_eq!(page_box(&s, f), before_frame);
+    assert_eq!(boxes(&s, &sq), before, "every square stays where it was");
+    assert_eq!(s.selection(), vec![f]);
+}
+
+#[test]
+fn suggesting_auto_layout_is_one_undo_step() {
+    let (mut s, f, sq) = squares();
+    let rows_before = kids(&s, f);
+    let steps = s.ds().unwrap().history.undo.len();
+    ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert_eq!(s.ds().unwrap().history.undo.len(), steps + 1);
+    let rows = kids(&s, f);
+    s.undo().unwrap();
+    assert_eq!(kids(&s, f), rows_before);
+    assert_eq!(mode(&s, f), None);
+    assert!(rows.iter().all(|r| s.doc().unwrap().node(*r).is_none()), "the band frames are gone");
+    assert_eq!(
+        boxes(&s, &sq),
+        [[100.0, 50.0, 150.0, 100.0], [160.0, 50.0, 210.0, 100.0], [100.0, 110.0, 150.0, 160.0], [160.0, 110.0, 210.0, 160.0]]
+    );
+}
+
+#[test]
+fn three_squares_in_a_row_get_one_horizontal_layout_without_nesting() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 20.0, 30.0, 200.0, 100.0);
+    let sq = [0.0, 70.0, 140.0].map(|x| rect(&mut s, f, x, 25.0, 50.0, 50.0));
+    let before = boxes(&s, &sq);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert!(warnings(&result).is_empty(), "{result}");
+    assert_eq!(mode(&s, f), Some(LayoutMode::Horizontal));
+    assert_eq!(kids(&s, f), sq, "the squares are the frame's own layers");
+    assert_eq!(boxes(&s, &sq), before);
+}
+
+#[test]
+fn three_squares_in_a_column_get_one_vertical_layout_without_nesting() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 20.0, 30.0, 100.0, 200.0);
+    let sq = [0.0, 70.0, 140.0].map(|y| rect(&mut s, f, 25.0, y, 50.0, 50.0));
+    let before = boxes(&s, &sq);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert!(warnings(&result).is_empty(), "{result}");
+    assert_eq!(mode(&s, f), Some(LayoutMode::Vertical));
+    assert_eq!(kids(&s, f), sq);
+    assert_eq!(boxes(&s, &sq), before);
+}
+
+#[test]
+fn a_header_above_two_columns_of_squares_gives_a_row_per_line() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 0.0, 0.0, 200.0, 200.0);
+    let header = rect(&mut s, f, 0.0, 0.0, 200.0, 50.0);
+    let sq = [(0.0, 60.0), (0.0, 120.0), (110.0, 60.0), (110.0, 120.0)].map(|(x, y)| rect(&mut s, f, x, y, 50.0, 50.0));
+    let all = [vec![header], sq.to_vec()].concat();
+    let before = boxes(&s, &all);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert!(warnings(&result).is_empty(), "{result}");
+    // The squares line up in two rows, so the gaps between rows win over the gap between columns.
+    assert_eq!(mode(&s, f), Some(LayoutMode::Vertical));
+    let top = kids(&s, f);
+    assert_eq!(top.len(), 3);
+    assert_eq!(top.first(), Some(&header));
+    assert_band(&s, top[1], LayoutMode::Horizontal);
+    assert_eq!(kids(&s, top[1]), vec![sq[0], sq[2]]);
+    assert_band(&s, top[2], LayoutMode::Horizontal);
+    assert_eq!(kids(&s, top[2]), vec![sq[1], sq[3]]);
+    assert_eq!(boxes(&s, &all), before);
+}
+
+#[test]
+fn a_header_above_a_tall_layer_beside_a_column_nests_three_levels() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 40.0, 10.0, 200.0, 200.0);
+    let header = rect(&mut s, f, 0.0, 0.0, 200.0, 40.0);
+    let tall = rect(&mut s, f, 0.0, 60.0, 50.0, 110.0);
+    let sq = [60.0, 120.0].map(|y| rect(&mut s, f, 110.0, y, 50.0, 50.0));
+    let all = [header, tall, sq[0], sq[1]];
+    let before = boxes(&s, &all);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert!(warnings(&result).is_empty(), "{result}");
+    assert_eq!(mode(&s, f), Some(LayoutMode::Vertical));
+    let top = kids(&s, f);
+    assert_eq!(top.len(), 2);
+    assert_eq!(top.first(), Some(&header));
+    let band = top[1];
+    assert_band(&s, band, LayoutMode::Horizontal);
+    let cols = kids(&s, band);
+    assert_eq!(cols.len(), 2);
+    assert_eq!(cols.first(), Some(&tall));
+    assert_band(&s, cols[1], LayoutMode::Vertical);
+    assert_eq!(kids(&s, cols[1]), sq);
+    assert_eq!(boxes(&s, &all), before);
+}
+
+#[test]
+fn unequal_gaps_use_the_smallest_and_say_so() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 0.0, 0.0, 300.0, 100.0);
+    let sq = [0.0, 60.0, 130.0].map(|x| rect(&mut s, f, x, 10.0, 50.0, 50.0));
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert_eq!(mode(&s, f), Some(LayoutMode::Horizontal));
+    let w = warnings(&result);
+    assert_eq!(w.len(), 1, "{result}");
+    assert!(w[0].contains("gaps"), "{}", w[0]);
+    let b = boxes(&s, &sq);
+    assert_eq!(b[0], [0.0, 10.0, 50.0, 60.0]);
+    assert_eq!(b[1], [60.0, 10.0, 110.0, 60.0]);
+    assert_eq!(b[2], [120.0, 10.0, 170.0, 60.0], "the last square moves along the row only");
+}
+
+#[test]
+fn overlapping_layers_leave_the_frame_without_auto_layout_and_say_so() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 0.0, 0.0, 200.0, 200.0);
+    let a = rect(&mut s, f, 0.0, 0.0, 100.0, 100.0);
+    let b = rect(&mut s, f, 50.0, 50.0, 100.0, 100.0);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert_eq!(mode(&s, f), None);
+    assert_eq!(kids(&s, f), vec![a, b]);
+    assert_eq!(warnings(&result).len(), 1, "{result}");
+    assert_eq!(boxes(&s, &[a, b]), vec![[0.0, 0.0, 100.0, 100.0], [50.0, 50.0, 150.0, 150.0]]);
+}
+
+#[test]
+fn a_group_becomes_a_frame_in_place_and_follows_the_rules() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let (a, b, c, d) = (
+        rect(&mut s, page, 10.0, 20.0, 40.0, 40.0),
+        rect(&mut s, page, 70.0, 20.0, 40.0, 40.0),
+        rect(&mut s, page, 10.0, 80.0, 40.0, 40.0),
+        rect(&mut s, page, 70.0, 80.0, 40.0, 40.0),
+    );
+    let group = id(&ex(&mut s, "object.group", json!({"ids": [a, b, c, d]})));
+    let before = boxes(&s, &[group, a, b, c, d]);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [group]}));
+    assert_eq!(result["ids"], json!([group]), "the group keeps its identity");
+    assert!(matches!(s.doc().unwrap().node(group).unwrap().kind, NodeKind::Frame));
+    assert_eq!(mode(&s, group), Some(LayoutMode::Vertical));
+    let rows = kids(&s, group);
+    assert_eq!(rows.len(), 2);
+    assert_band(&s, rows[0], LayoutMode::Horizontal);
+    assert_eq!(kids(&s, rows[0]), vec![a, b]);
+    assert_eq!(kids(&s, rows[1]), vec![c, d]);
+    assert_eq!(boxes(&s, &[group, a, b, c, d]), before);
+}
+
+#[test]
+fn several_layers_are_wrapped_in_a_frame_that_is_then_split() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let sq = [(0.0, 0.0), (80.0, 0.0), (0.0, 80.0), (80.0, 80.0)].map(|(x, y)| rect(&mut s, page, x, y, 50.0, 50.0));
+    let before = boxes(&s, &sq);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": sq}));
+    let wrapper = id_of(&result["ids"][0]).unwrap();
+    assert!(s.doc().unwrap().node(wrapper).unwrap().fills.is_empty());
+    assert_eq!(mode(&s, wrapper), Some(LayoutMode::Vertical));
+    assert_eq!(kids(&s, wrapper).len(), 2);
+    assert_eq!(boxes(&s, &sq), before);
+}
+
+#[test]
+fn a_direction_forces_the_top_level_and_nested_frames_follow_the_gaps() {
+    let (mut s, f, sq) = squares();
+    let before = boxes(&s, &sq);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f], "direction": "horizontal"}));
+    assert!(warnings(&result).is_empty(), "{result}");
+    assert_eq!(mode(&s, f), Some(LayoutMode::Horizontal));
+    let cols = kids(&s, f);
+    assert_eq!(cols.len(), 2, "two columns");
+    assert_band(&s, cols[0], LayoutMode::Vertical);
+    assert_eq!(kids(&s, cols[0]), vec![sq[0], sq[2]]);
+    assert_band(&s, cols[1], LayoutMode::Vertical);
+    assert_eq!(kids(&s, cols[1]), vec![sq[1], sq[3]]);
+    assert_eq!(boxes(&s, &sq), before);
+}
+
+#[test]
+fn a_frame_with_one_layer_is_laid_out_like_add_auto_layout() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 0.0, 0.0, 200.0, 100.0);
+    let a = rect(&mut s, f, 20.0, 20.0, 60.0, 40.0);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert!(warnings(&result).is_empty(), "{result}");
+    assert_eq!(mode(&s, f), Some(LayoutMode::Horizontal));
+    assert_eq!(kids(&s, f), vec![a]);
+}
+
+#[test]
+fn add_auto_layout_still_makes_a_single_row() {
+    let (mut s, f, sq) = squares();
+    ex(&mut s, "layout.add", json!({"ids": [f]}));
+    let mut got = kids(&s, f);
+    got.sort();
+    assert_eq!(got, sq.to_vec(), "no nested frames");
+}
+
+#[test]
+fn a_centred_title_above_a_card_is_lined_up_at_the_card_edge_with_a_warning() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 0.0, 0.0, 200.0, 200.0);
+    let title = rect(&mut s, f, 60.0, 0.0, 80.0, 30.0);
+    let card = rect(&mut s, f, 0.0, 40.0, 200.0, 100.0);
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [f]}));
+    assert_eq!(mode(&s, f), Some(LayoutMode::Vertical));
+    assert_eq!(kids(&s, f), vec![title, card]);
+    let w = warnings(&result);
+    assert_eq!(w.len(), 1, "{result}");
+    assert!(w[0].contains("different offsets"), "{}", w[0]);
+    assert_eq!(page_box(&s, title), [0.0, 0.0, 80.0, 30.0], "the title's left edge is the card's now");
+    assert_eq!(page_box(&s, card), [0.0, 40.0, 200.0, 140.0], "the rest stays");
+}
+
+#[test]
+fn instances_and_layers_inside_them_are_refused_and_a_main_component_works() {
+    let mut s = Session::new();
+    let f = frame(&mut s, 0.0, 0.0, 200.0, 200.0);
+    rect(&mut s, f, 0.0, 0.0, 50.0, 50.0);
+    rect(&mut s, f, 0.0, 60.0, 50.0, 30.0);
+    let nested = id(&ex(&mut s, "frame.create", json!({"parent": f, "x": 0, "y": 100, "width": 100, "height": 50})));
+    rect(&mut s, nested, 0.0, 0.0, 20.0, 20.0);
+    rect(&mut s, nested, 40.0, 0.0, 20.0, 20.0);
+    let comp = id(&ex(&mut s, "component.create", json!({"ids": [f]})));
+    let inst = id(&ex(&mut s, "instance.create", json!({"component": comp, "x": 400, "y": 0})));
+    let inside: Vec<NodeId> = kids(&s, inst).into_iter().filter(|k| matches!(s.doc().unwrap().node(*k).unwrap().kind, NodeKind::Frame)).collect();
+    assert!(!inside.is_empty(), "the instance has a frame of its own");
+    let page = s.page().unwrap();
+    let snapshot = |s: &Session| (kids(s, page), kids(s, inst), kids(s, inside[0]));
+    let before = snapshot(&s);
+    let steps = s.ds().unwrap().history.undo.len();
+    for target in [inst, inside[0]] {
+        let e = s.execute("layout.suggest", &json!({"ids": [target]})).unwrap_err().to_string();
+        assert!(e.contains("instance"), "{e}");
+    }
+    assert_eq!(snapshot(&s), before, "nothing changed");
+    assert_eq!(s.ds().unwrap().history.undo.len(), steps, "no history step");
+    assert!(s.doc().unwrap().node(inst).unwrap().layout.is_none());
+    // The main component is a frame and works.
+    let result = ex(&mut s, "layout.suggest", json!({"ids": [comp]}));
+    assert_eq!(result["ids"], json!([comp]));
+}

crates/engine/src/lib.rs

@@ -393,6 +393,8 @@ mod jpg_export_tests;
 #[cfg(test)]
 mod keymap_tests;
 #[cfg(test)]
+mod layout_suggest_tests;
+#[cfg(test)]
 mod library_beacon_tests;
 #[cfg(test)]
 mod library_path_tests;
@@ -589,6 +591,8 @@ mod text_style_picker_tests;
 #[cfg(test)]
 mod text_tail_tests;
 #[cfg(test)]
+mod text_weight_step_tests;
+#[cfg(test)]
 mod textfit_tests;
 #[cfg(test)]
 mod theme_pages_tests;

crates/engine/src/live_tests.rs

@@ -17,7 +17,9 @@ pub(crate) struct Script {
     pub(crate) events: Vec<Event>,
     pub(crate) sent: Vec<Presence>,
     pub(crate) hosted: Vec<HostOptions>,
-    joined: Vec<String>,
+    pub(crate) joined: Vec<String>,
+    /// The sessions told to reconnect now, in order.
+    pub(crate) retried: Vec<u64>,
     pub(crate) left: usize,
     pub(crate) msgs: Vec<ClientMsg>,
     pub(crate) published: Vec<PublishOptions>,
@@ -46,6 +48,10 @@ impl LiveLink for Mock {
         i.url = format!("ws://{}/?file=f&token=t", i.address);
         Ok(i)
     }
+    fn retry(&mut self, session: u64) {
+        self.0.lock().unwrap().retried.push(session);
+    }
+
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
         if !link.starts_with("figcraft://") {
             return Err("not an invite".into());
@@ -231,7 +237,7 @@ fn events_build_who_is_here() {
     assert_eq!(s.live_summary()["attempt"], 1);
     push(&script, vec![Event::Status(Status::Failed { reason: "Lost the connection".into() })]);
     s.live_poll();
-    assert!(s.live().info.is_none());
+    assert!(s.live().peers.is_empty() && !s.live().syncing());
     assert_eq!(s.live_summary()["reason"], "Lost the connection");
     assert_eq!(s.message.as_deref(), Some("Lost the connection"));
     assert!(!s.live_poll(), "nothing new");

crates/engine/src/online_tests.rs

@@ -592,4 +592,7 @@ fn same_server_ignores_the_default_port_before_a_path() {
     assert!(same_server("wss://share.example:443/figcraft/", "wss://share.example/figcraft/"));
     assert!(same_server("ws://host:80/x", "ws://host/x"));
     assert!(!same_server("wss://share.example:8443/figcraft/", "wss://share.example/figcraft/"));
+    // The path is a route: owner tokens for /Team/ must never be sent to /team/.
+    assert!(same_server("WSS://Share.Example/team/", "wss://share.example/team"));
+    assert!(!same_server("wss://share.example/Team/", "wss://share.example/team/"));
 }

crates/engine/src/sharing/live.rs

@@ -140,6 +140,18 @@ pub struct Live {
     /// The branches of the session's file made or last updated from main in this session: every
     /// layer of their base was in it (see [`crate::branches`]).
     branch_bases: BTreeSet<String>,
+    /// You were in this session and aren't now: what joining it again takes (`collab.reconnect`).
+    stranded: Option<Stranded>,
+}
+
+/// What's kept of a session you joined once it can't go on by itself. The tab stays yours to work
+/// in, and says so.
+#[derive(Clone)]
+struct Stranded {
+    /// The invite link you joined with (it holds the token: never shown).
+    link: String,
+    /// The server's state when it stopped: what's different from it in the tab is your own work.
+    confirmed: Box<figcraft_collab::Replica>,
 }
 
 impl Live {
@@ -170,6 +182,41 @@ impl Live {
         *self = Live { id: self.id, tab: self.tab, ..Live::default() };
     }
 
+    /// Keep this session on its tab for joining again (see [`Stranded`]): a session you joined, or
+    /// one that already is; any other goes back to no session.
+    fn strand(&mut self) {
+        let joined = self.info.as_ref().filter(|i| i.role == Role::Guest && !i.link.is_empty());
+        let held = self.stranded.take().or_else(|| {
+            let (client, info) = (self.client.as_ref()?, joined?);
+            Some(Stranded { link: info.link.clone(), confirmed: Box::new(client.confirmed().clone()) })
+        });
+        if held.is_none() {
+            return self.reset();
+        }
+        *self = Live {
+            id: self.id,
+            tab: self.tab,
+            doc_uid: self.doc_uid,
+            info: self.info.take(),
+            server: std::mem::take(&mut self.server),
+            published: self.published.take(),
+            share: self.share.take(),
+            stranded: held,
+            ..Live::default()
+        };
+    }
+
+    /// You were in this session and aren't now: the connection dropped and it is trying again, or
+    /// it can't go on by itself. What you do in its tab isn't reaching anyone.
+    pub fn disconnected(&self) -> bool {
+        matches!(self.status, Status::Reconnecting { .. }) || self.stranded.is_some()
+    }
+
+    /// The session can be joined again in its tab (`collab.reconnect`).
+    pub fn rejoinable(&self) -> bool {
+        self.stranded.is_some() && !self.status.active()
+    }
+
     /// The document sync client (once the welcome arrived): peers, pending batches, the user's
     /// undo history.
     pub fn client(&self) -> Option<&Client> {

crates/engine/src/sharing/live/events.rs

@@ -214,8 +214,15 @@ impl Session {
             // order.
             Event::Sync(msg) => live.deferred.push(msg),
             Event::Ended { reason } => {
-                self.message = Some(if behind.is_empty() { reason } else { format!("{}: {reason}", behind.trim_start()) });
-                self.live.end(id);
+                let joined = live.syncing() && live.role() == Some(Role::Guest);
+                let text = if behind.is_empty() { reason.clone() } else { format!("{}: {reason}", behind.trim_start()) };
+                if joined {
+                    // The tab says so and stays yours: it doesn't pass for a file of your own.
+                    self.live_fail(id, reason);
+                } else {
+                    self.live.end(id);
+                }
+                self.message = Some(text);
             }
             Event::Published(p) => {
                 // Shared with a code: the popover shows it, nothing more to say.
@@ -389,6 +396,7 @@ impl Session {
             }
             (Some(Role::Guest), Some(uid)) => {
                 // Joining again in this tab, or the file you published arriving from the server.
+                self.live_keep_offline_work(id, uid);
                 let doc = Arc::new(client.document().clone());
                 let was_dirty = self.docs.iter().find(|d| d.uid == uid).is_some_and(DocState::is_dirty);
                 self.apply_remote(uid, doc.clone());
@@ -435,15 +443,53 @@ impl Session {
         live.synced = synced;
         live.client = Some(client);
         live.deferred.clear();
+        live.stranded = None;
     }
 
-    /// Session `id` is over with a message: it couldn't be joined, the connection was lost for
-    /// good or sync broke. Its tab shows why.
+    /// Session `id` is back on document `uid` after it couldn't go on, and the server's version is
+    /// about to replace the tab's: what you did since opens beside it, unsaved, so nothing is lost.
+    fn live_keep_offline_work(&mut self, id: SessionId, uid: u64) {
+        let Some(held) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()) else { return };
+        let Some(local) = self.docs.iter().find(|d| d.uid == uid).map(|d| d.doc.clone()) else { return };
+        let name = local.name.clone();
+        // A document that can't be compared is kept too.
+        if figcraft_collab::diff(&held.confirmed, &local).is_ok_and(|d| d.changes.is_empty()) {
+            self.message = Some(format!("Reconnected to {name}"));
+            return;
+        }
+        let mut copy = DocState::new((*local).clone(), None);
+        let copy_name = format!("{name} (offline copy)");
+        Arc::make_mut(&mut copy.doc).name.clone_from(&copy_name);
+        self.docs.push(copy);
+        self.message = Some(format!("Reconnected to {name}. What you changed while disconnected is open beside it as “{copy_name}”"));
+    }
+
+    /// Join session `id` again in its tab (see [`Live::strand`]), as someone new: a fresh join needs
+    /// nothing from the connection that was lost.
+    pub(super) fn live_rejoin(&mut self, cmd: &str, id: SessionId) -> Result<()> {
+        let name = display_name(&self.prefs);
+        let Some(link) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()).map(|s| s.link.clone()) else {
+            return Err(crate::bad(cmd, "this file has no live session to join again"));
+        };
+        self.live.leave(id);
+        if let Some(why) = crate::file_access::network_refused() {
+            return Err(EngineError::Disabled(cmd.to_string(), why));
+        }
+        let Some(net) = self.live.link() else { return Err(super::unavailable(cmd)) };
+        net.join_resuming(id, &link, &name, None).map_err(|e| crate::bad(cmd, e))?;
+        if let Some(live) = self.live.sessions.get_mut(&id) {
+            live.status = Status::Connecting;
+        }
+        Ok(())
+    }
+
+    /// Session `id` is over with a message: it couldn't be joined, it was refused or ended for
+    /// good, or sync broke. Its tab shows why, and a session you were in can be joined again there.
     pub(super) fn live_fail(&mut self, id: SessionId, reason: String) {
         log::warn!("live session: {reason}");
         self.live.leave(id);
         if let Some(live) = self.live.sessions.get_mut(&id) {
-            live.reset();
+            live.strand();
             live.status = Status::Failed { reason: reason.clone() };
         }
         self.message = Some(reason);
@@ -456,7 +502,7 @@ impl Session {
         let live = self.live.doc(uid)?;
         match &live.client {
             Some(c) => limited_by(c.access()),
-            None if live.status.active() && live.role() != Some(Role::Host) => Some(PUBLISHING),
+            None if live.status.active() && live.role() != Some(Role::Host) && !live.disconnected() => Some(PUBLISHING),
             None => None,
         }
     }

crates/engine/src/sharing/live/join.rs

@@ -42,12 +42,38 @@ fn leave(s: &mut Session, p: &Value) -> Result<Value> {
         None => s.live.shown(s.tab()),
     };
     let ended = id.and_then(|id| s.live.end(id));
-    if ended.as_ref().is_some_and(|l| l.syncing() && l.role() == Some(Role::Guest)) {
-        s.message = Some("You left the session; your copy stays open here".into());
+    if let Some(l) = ended.as_ref().filter(|l| l.syncing() && l.role() == Some(Role::Guest)) {
+        // What was still on its way may be held back for what's before it (an undo waits for its edit).
+        s.message = Some(if l.client().is_some_and(|c| c.pending() > 0) {
+            "You left before your last changes were confirmed: others may not see them all, and your copy stays open here".into()
+        } else {
+            "You left the session; your copy stays open here".into()
+        });
     }
     Ok(json!({"ended": ended.is_some_and(|l| l.status.active())}))
 }
 
+/// Back into the open file's session now: a reconnect that is waiting tries at once, and a session
+/// that couldn't go on is joined again in its tab.
+fn reconnect(s: &mut Session, _: &Value) -> Result<Value> {
+    const CMD: &str = "collab.reconnect";
+    let live = s.live();
+    let (id, reconnecting, rejoinable) = (live.id, matches!(live.status, Status::Reconnecting { .. }), live.rejoinable());
+    if reconnecting {
+        if let Some(why) = crate::file_access::network_refused() {
+            return Err(EngineError::Disabled(CMD.to_string(), why));
+        }
+        if let Some(net) = s.live.link() {
+            net.retry(id);
+        }
+    } else if rejoinable {
+        s.live_rejoin(CMD, id)?;
+    } else {
+        return Err(bad(CMD, "this file has no lost live session to reconnect"));
+    }
+    Ok(json!({"status": s.live().status.id()}))
+}
+
 fn stop(s: &mut Session, p: &Value) -> Result<Value> {
     // A file shared online stays its owner's on the server: stopping takes the others' links (and
     // their codes) away, which disconnects whoever joined with them, and the owner stays in the
@@ -193,10 +219,17 @@ pub fn specs() -> Vec<CommandSpec> {
             false,
             join
         ),
+        spec!(
+            "collab.reconnect",
+            "Reconnect live session",
+            "{} → {status}: for the open file's session when it is disconnected: a reconnect that is waiting tries now, and a session that couldn't go on (`failed`, the file open in its tab) is joined again there, what you changed since opening beside it. Refused when nothing was lost",
+            false,
+            reconnect
+        ),
         spec!(
             "collab.leave",
             "Leave live session",
-            "{session? (a session's id from `collab.peers`'s `sessions`, e.g. a join still on its way; default: the open file's session)} → {ended}: the synced file stays open as a local copy",
+            "{session? (a session's id from `collab.peers`'s `sessions`, e.g. a join still on its way; default: the open file's session)} → {ended}: the synced file stays open as a local copy (also how a tab stops showing a session that couldn't go on)",
             false,
             leave
         ),

crates/engine/src/sharing/live/sync.rs

@@ -118,7 +118,14 @@ impl Session {
         for m in std::mem::take(&mut live.deferred) {
             match client.receive(m, &EngineRecompute) {
                 Ok(more) => out.extend(more),
-                Err(e) => return self.live_fail(id, format!("The live session got out of step ({e}); join again")),
+                Err(e) => {
+                    self.live_fail(id, format!("The live session got out of step ({e})"));
+                    // A fresh join has nothing to get out of step with.
+                    if let Err(e) = self.live_rejoin("collab.reconnect", id) {
+                        log::warn!("live session: couldn't join again: {e}");
+                    }
+                    return;
+                }
             }
         }
         let doc = Arc::new(client.document().clone());

crates/engine/src/sharing/live/types.rs

@@ -523,6 +523,8 @@ pub trait LiveLink: Send {
     /// End session `session` (stop hosting or leave); the others go on. Nothing for a session
     /// that is over already.
     fn leave(&mut self, session: SessionId);
+    /// Session `session` is waiting to reconnect: try now.
+    fn retry(&mut self, _session: SessionId) {}
     /// Your latest presence in `session` (the link throttles and coalesces).
     fn presence(&mut self, session: SessionId, p: &Presence);
     /// A message for `session`'s server (document changes), sent in order.

crates/engine/src/sharing/online.rs

@@ -117,14 +117,17 @@ pub(crate) fn plain_server(server: &str) -> String {
 /// Two addresses name the same server (case, a closing slash and the scheme's own port aside).
 pub fn same_server(a: &str, b: &str) -> bool {
     let norm = |s: &str| {
-        let s = plain_server(s).to_ascii_lowercase();
+        let s = plain_server(s);
         let s = s.trim_end_matches('/');
-        let port = if s.starts_with("wss://") { ":443" } else { ":80" };
         let start = s.find("://").map_or(0, |i| i + 3);
         let end = s[start..].find('/').map_or(s.len(), |i| start + i);
-        match s[start..end].strip_suffix(port) {
-            Some(host) => format!("{}{}{}", &s[..start], host, &s[end..]),
-            None => s.to_string(),
+        // The scheme and host compare without case; the path routes (a proxy may send
+        // `/Team/` and `/team/` to different servers), so it keeps its case.
+        let head = s[..end].to_ascii_lowercase();
+        let port = if head.starts_with("wss://") { ":443" } else { ":80" };
+        match head[start..].strip_suffix(port) {
+            Some(host) => format!("{}{}{}", &head[..start], host, &s[end..]),
+            None => format!("{head}{}", &s[end..]),
         }
     };
     norm(a) == norm(b)

crates/engine/src/text_weight_step_tests.rs

@@ -0,0 +1,190 @@
+//! Increase and decrease font weight step through the styles the family has, by weight with the
+//! same slant and width (#1831), not by 100 to a canonical name no face provides.
+
+use figcraft_doc::{NodeId, TextStyle};
+use serde_json::json;
+
+use crate::Session;
+use crate::cmd::text::{name_weight, next_style};
+
+/// A family's styles listed by the weights their names say, as for faces not read yet.
+fn styles(names: &[&str]) -> Vec<(String, u16)> {
+    names.iter().map(|s| ((*s).to_string(), name_weight(s))).collect()
+}
+
+/// A family's styles with the faces' own weights.
+fn weighed(faces: &[(&str, u16)]) -> Vec<(String, u16)> {
+    faces.iter().map(|(s, w)| ((*s).to_string(), *w)).collect()
+}
+
+fn at(style: &str) -> TextStyle {
+    let mut st = TextStyle::default();
+    st.set_font_style(style);
+    st
+}
+
+/// Walk `from` heavier (`up`) or lighter until the family has nothing further.
+fn walk(family: &[(String, u16)], from: &str, up: bool) -> Vec<String> {
+    let mut st = at(from);
+    let mut out = Vec::new();
+    while let Some(next) = next_style(family, &st, up) {
+        st.set_font_style(next.clone());
+        out.push(next);
+    }
+    out
+}
+
+#[test]
+fn the_steps_follow_the_family_with_the_same_slant_and_width() {
+    let arial = styles(&["Narrow", "Regular", "Italic", "Narrow Italic", "Bold", "Narrow Bold", "Bold Italic", "Narrow Bold Italic", "Black"]);
+    assert_eq!(walk(&arial, "Regular", true), ["Bold", "Black"]);
+    assert_eq!(walk(&arial, "Black", false), ["Bold", "Regular"]);
+    assert_eq!(walk(&arial, "Italic", true), ["Bold Italic"]);
+    assert_eq!(walk(&arial, "Narrow", true), ["Narrow Bold"]);
+    assert_eq!(walk(&arial, "Narrow Bold Italic", false), ["Narrow Italic"]);
+    let segoe = styles(&["Light", "Semilight", "Regular", "Italic", "Semibold", "Bold", "Black", "Bold Italic"]);
+    assert_eq!(walk(&segoe, "Regular", true), ["Semibold", "Bold", "Black"]);
+    assert_eq!(walk(&segoe, "Regular", false), ["Semilight", "Light"]);
+    // A style the family doesn't have (as the old steps stored) moves to the next real one.
+    assert_eq!(next_style(&segoe, &at("Medium"), true).as_deref(), Some("Semibold"));
+}
+
+#[test]
+fn extra_and_semi_before_a_width_keep_the_width() {
+    let family = styles(&["Extra Condensed Regular", "Condensed Regular", "Condensed Bold", "Extra Condensed Bold", "Semi Condensed Extra Bold"]);
+    assert_eq!(walk(&family, "Extra Condensed Regular", true), ["Extra Condensed Bold"]);
+    assert_eq!(walk(&family, "Condensed Bold", false), ["Condensed Regular"]);
+    assert_eq!(walk(&family, "Semi Condensed Extra Bold", false), Vec::<String>::new());
+}
+
+#[test]
+fn oblique_names_step_to_oblique_faces() {
+    let dejavu = styles(&["Book", "Oblique", "Bold", "Bold Oblique"]);
+    assert_eq!(walk(&dejavu, "Oblique", true), ["Bold Oblique"]);
+    assert_eq!(walk(&dejavu, "Bold Oblique", false), ["Oblique"]);
+    assert_eq!(walk(&dejavu, "Book", true), ["Bold"]);
+}
+
+#[test]
+fn hairline_and_w_numbers_are_weights() {
+    let family = styles(&["Hairline", "Thin", "Regular", "Bold"]);
+    assert_eq!(walk(&family, "Regular", false), ["Thin", "Hairline"]);
+    // Off the list (a stored style the family lacks): by weight, the nearer of two equal ones.
+    assert_eq!(next_style(&family, &at("Extra Light"), false).as_deref(), Some("Thin"));
+    assert_eq!(next_style(&family, &at("Extra Light"), true).as_deref(), Some("Regular"));
+    let hiragino = styles(&["W3", "W6"]);
+    assert_eq!(walk(&hiragino, "W3", true), ["W6"]);
+    assert_eq!(next_style(&hiragino, &at("Bold"), false).as_deref(), Some("W6"));
+}
+
+#[test]
+fn number_weights_count_after_a_width_but_other_numbers_dont() {
+    // An off-list "Condensed 600" is 600, as "600" alone is: between Condensed 500 and 700.
+    let condensed = weighed(&[("Condensed 300", 300), ("Condensed 500", 500), ("Condensed 700", 700)]);
+    assert_eq!(next_style(&condensed, &at("Condensed 600"), true).as_deref(), Some("Condensed 700"));
+    assert_eq!(next_style(&condensed, &at("Condensed 600"), false).as_deref(), Some("Condensed 500"));
+    assert_eq!((name_weight("Condensed 600"), name_weight("600 Italic"), name_weight("Condensed 1000")), (600, 600, 1000));
+    // A number that isn't a weight (a width grade, an optical size) is part of the width.
+    assert_eq!((name_weight("Condensed 2"), name_weight("Caption 12 Bold"), name_weight("Condensed +600")), (400, 700, 400));
+    let optical = styles(&["Caption 12 Regular", "Caption 24 Regular", "Caption 12 Bold", "Caption 24 Bold"]);
+    assert_eq!(walk(&optical, "Caption 12 Regular", true), ["Caption 12 Bold"]);
+    assert_eq!(walk(&optical, "Caption 24 Bold", false), ["Caption 24 Regular"]);
+}
+
+#[test]
+fn univers_numbers_step_by_weight_within_their_width() {
+    // Helvetica Neue LT, Univers, Frutiger: the first digit grades the weight, the second the width.
+    let hn = weighed(&[
+        ("45 Light", 300),
+        ("46 Light Italic", 300),
+        ("55 Roman", 400),
+        ("56 Italic", 400),
+        ("57 Condensed", 400),
+        ("65 Medium", 500),
+        ("67 Medium Condensed", 500),
+        ("75 Bold", 700),
+        ("76 Bold Italic", 700),
+        ("77 Bold Condensed", 700),
+    ]);
+    assert_eq!(walk(&hn, "55 Roman", true), ["65 Medium", "75 Bold"]);
+    assert_eq!(walk(&hn, "65 Medium", false), ["55 Roman", "45 Light"]);
+    assert_eq!(walk(&hn, "57 Condensed", true), ["67 Medium Condensed", "77 Bold Condensed"]);
+    assert_eq!(walk(&hn, "67 Medium Condensed", false), ["57 Condensed"]);
+    assert_eq!(walk(&hn, "46 Light Italic", true), ["56 Italic", "76 Bold Italic"]);
+    // Faces not read yet: the words after the number give the weight.
+    let univers = styles(&["45 Light", "55 Roman", "65 Bold", "75 Black", "57 Condensed", "67 Bold Condensed"]);
+    assert_eq!(walk(&univers, "45 Light", true), ["55 Roman", "65 Bold", "75 Black"]);
+    assert_eq!(walk(&univers, "67 Bold Condensed", false), ["57 Condensed"]);
+    assert_eq!((name_weight("45 Light"), name_weight("75 Black"), name_weight("57 Condensed")), (300, 900, 400));
+    // Other leading numbers stay part of the width: before another word, or not a width digit.
+    let other = styles(&["12 Regular", "12 Bold", "55 Rounded", "55 Rounded Bold", "Regular", "Bold"]);
+    assert_eq!(walk(&other, "12 Regular", true), ["12 Bold"]);
+    assert_eq!(walk(&other, "55 Rounded", true), ["55 Rounded Bold"]);
+    assert_eq!(walk(&other, "Regular", true), ["Bold"]);
+}
+
+#[test]
+fn a_custom_weight_axis_value_steps_from_where_it_is() {
+    let family = styles(&["Light", "Regular", "Medium", "Bold"]);
+    let mut st = at("Regular");
+    st.variations.insert("wght".into(), 550.0);
+    assert_eq!(next_style(&family, &st, true).as_deref(), Some("Bold"));
+    assert_eq!(next_style(&family, &st, false).as_deref(), Some("Medium"));
+}
+
+#[test]
+fn off_the_list_the_faces_own_weights_decide() {
+    // From 500 between 400 and 700 faces: the neighbours, under their own names (the axis value goes).
+    let family = weighed(&[("Light", 300), ("Regular", 400), ("Bold", 700)]);
+    let mut st = at("Regular");
+    st.variations.insert("wght".into(), 500.0);
+    assert_eq!(next_style(&family, &st, true).as_deref(), Some("Bold"));
+    assert_eq!(next_style(&family, &st, false).as_deref(), Some("Regular"));
+    st.set_font_style("Bold");
+    assert_eq!((st.weight(), st.variations.get("wght")), (700, None));
+    // Segoe UI Variable's Semilight is 350, not the 300 its name says: from a `wght` of 325 it is
+    // the next heavier style, and from 375 the next lighter.
+    let segoe = weighed(&[("Light", 300), ("Semilight", 350), ("Regular", 400), ("Semibold", 600), ("Bold", 700)]);
+    st.variations.insert("wght".into(), 325.0);
+    assert_eq!(next_style(&segoe, &st, true).as_deref(), Some("Semilight"));
+    assert_eq!(next_style(&segoe, &st, false).as_deref(), Some("Light"));
+    st.variations.insert("wght".into(), 375.0);
+    assert_eq!(next_style(&segoe, &st, false).as_deref(), Some("Semilight"));
+    assert_eq!(next_style(&segoe, &st, true).as_deref(), Some("Regular"));
+    // A W-numbered name with a slant after it is still that weight ("W7 Italic" is 700).
+    let hiragino = weighed(&[("W3 Italic", 300), ("W6 Italic", 600), ("W8 Italic", 800)]);
+    assert_eq!(next_style(&hiragino, &at("W7 Italic"), false).as_deref(), Some("W6 Italic"));
+    assert_eq!(next_style(&hiragino, &at("W7 Italic"), true).as_deref(), Some("W8 Italic"));
+    // And after a width ("Condensed W7 Italic" is 700 too).
+    let condensed = weighed(&[("Condensed W3 Italic", 300), ("Condensed W6 Italic", 600), ("Condensed W8 Italic", 800)]);
+    assert_eq!(next_style(&condensed, &at("Condensed W7 Italic"), true).as_deref(), Some("Condensed W8 Italic"));
+    assert_eq!(next_style(&condensed, &at("Condensed W7 Italic"), false).as_deref(), Some("Condensed W6 Italic"));
+}
+
+fn font_style(s: &Session, t: NodeId) -> String {
+    s.doc().unwrap().node(t).unwrap().kind.text().unwrap().spans()[0].2.font_style.clone()
+}
+
+#[test]
+fn the_commands_land_on_styles_the_family_has() {
+    figcraft_text::scan_system_fonts();
+    // Any installed family with a Regular face and a style the step takes it to (CI machines differ).
+    let pick = figcraft_text::family_names().into_iter().find_map(|f| {
+        let st = figcraft_text::family_style_weights(&f);
+        let up = next_style(&st, &at("Regular"), true).filter(|_| st.iter().any(|(x, _)| x == "Regular"))?;
+        Some((f, st, up))
+    });
+    let Some((family, styles, heavier)) = pick else { return };
+    let mut s = Session::new();
+    let r = s.execute("node.create", &json!({"type": "text", "text": "Hi", "props": {"fontFamily": family, "fontStyle": "Regular"}})).unwrap();
+    let t = crate::params::id_of(&r["id"]).unwrap();
+    s.execute("text.weightUp", &json!({"ids": [t]})).unwrap();
+    let up = font_style(&s, t);
+    assert_eq!(up, heavier, "{family}: {styles:?}");
+    s.execute("text.weightDown", &json!({"ids": [t]})).unwrap();
+    assert_eq!(font_style(&s, t), "Regular", "{family}: {styles:?}");
+    // A family that isn't installed still steps by 100 under the canonical names.
+    s.execute("node.set", &json!({"ids": [t], "props": {"fontFamily": "No Such Family 7f3a", "fontStyle": "Regular"}})).unwrap();
+    s.execute("text.weightUp", &json!({"ids": [t]})).unwrap();
+    assert_eq!(font_style(&s, t), "Medium");
+}

crates/format/src/fig/kiwi.rs

@@ -191,9 +191,13 @@ impl<'b> Reader<'b> {
         let mut shift = 0;
         loop {
             let b = self.byte()?;
-            value |= u32::from(b & 127).checked_shl(shift).unwrap_or(0);
+            let part = b & 127;
+            if shift == 28 && (part > 0x0f || b & 128 != 0) {
+                return err("u32 varint overflow");
+            }
+            value |= u32::from(part) << shift;
             shift += 7;
-            if b & 128 == 0 || shift >= 35 {
+            if b & 128 == 0 {
                 return Ok(value);
             }
         }
@@ -670,3 +674,17 @@ fn numbered(token: &str, default: u32) -> Result<(String, u32), KiwiError> {
         Some((name, n)) => Ok((name.to_string(), n.parse().map_err(|_| KiwiError(format!("schema text: bad number in `{token}`")))?)),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::Reader;
+
+    #[test]
+    fn overflowing_u32_varint_is_rejected() {
+        let mut boundary = Reader { data: &[0xff, 0xff, 0xff, 0xff, 0x0f], pos: 0 };
+        assert_eq!(boundary.var_uint(), Ok(u32::MAX));
+
+        let mut overflowing = Reader { data: &[0xff, 0xff, 0xff, 0xff, 0x7f], pos: 0 };
+        assert!(overflowing.var_uint().is_err(), "overflowing u32 varint was accepted");
+    }
+}

crates/format/src/fig/map/connector.rs

@@ -2,7 +2,7 @@ use super::layer::{cap_name, own_text, svg_path, valid_size};
 use super::paint::{paint, stroke};
 use super::{Affine, Kv, Mapper, NO_STYLE, Obj, Point, Value, View, generated_record, guid, json, matrix, network, num, rows};
 use figcraft_doc::geom::kurbo::{BezPath, PathEl, Rect, Shape};
-use figcraft_doc::{RouteEnd, Routing, Side, route_points};
+use figcraft_doc::{ConnectorPath, MAX_RUNS, RouteEnd, Routing, Side, attach_points, attached_sides, route_along};
 
 /// How a connector imports: from its saved snapshot (`terminal`: as one vector, no room for its
 /// label), or drawn from its ends, as a frame with its line and `label` when it has one.
@@ -48,7 +48,8 @@ impl<'a> Mapper<'a> {
 
     /// A connector's end caps, and when it has no saved outline or network its line between its
     /// ends (free points, or a sibling layer): straight to the point given on the layer (its
-    /// centre unless given), or elbowed or curved from a side of it, as a board connector runs.
+    /// centre unless given), or elbowed or curved from a side of it, as a board connector runs;
+    /// an elbow saved with its path (FigJam's control points) runs along it (#1910).
     /// Returns the middle of that line by length, in the connector's own coordinates.
     pub(super) fn connector(&mut self, o: &mut Obj, v: &View<'a>, space: Affine) -> Option<Point> {
         for (from, to) in [("connectorStartCap", "strokeCapStart"), ("connectorEndCap", "strokeCapEnd")] {
@@ -94,11 +95,13 @@ impl<'a> Mapper<'a> {
             };
             ok.then_some(end)
         };
-        let Some(pts) = end("connectorStart").zip(end("connectorEnd")).and_then(|(a, b)| route_points(a, b, routing)) else {
+        let ends = end("connectorStart").zip(end("connectorEnd"));
+        let path = ends.filter(|_| routing == Routing::Elbow).and_then(|(a, b)| saved_runs(v, a, b));
+        let Some(pts) = ends.and_then(|(a, b)| route_along(a, b, routing, path.as_ref())) else {
             self.warn("connectors whose ends can't be placed are empty");
             return None;
         };
-        if routing != Routing::Straight {
+        if routing != Routing::Straight && path.is_none() {
             self.warn("elbowed and curved connectors without a saved path follow FigCraft's own routing");
         }
         // A curved route is one curve: its ends and the two control points between them.
@@ -407,6 +410,49 @@ pub(super) fn connector_has_saved_label(v: &View<'_>) -> bool {
             .is_some_and(|s| !s.trim().is_empty())
 }
 
+/// The path a FigJam elbow connector was saved with: its `connectorControlPoints`, one per run
+/// between the first and the last, each a point on its run (in the connector's parent's
+/// coordinates, like its ends) with the run's axis; the first run leaves the start's side and the
+/// last arrives at the end's, so neither is saved. `None` without any, or when they don't make
+/// such a path: a point off both axes, two runs in a row the same way, a first or last run that
+/// would leave or arrive sideways to its side, or more runs than a hand could make here.
+fn saved_runs(v: &View<'_>, from: RouteEnd, to: RouteEnd) -> Option<ConnectorPath> {
+    let saved = v.list("connectorControlPoints");
+    if saved.is_empty() || saved.len() + 2 > MAX_RUNS {
+        return None;
+    }
+    let (p0, p1) = attach_points(from, to);
+    let mid = p0.midpoint(p1);
+    let mut at = Vec::with_capacity(saved.len());
+    let (mut first, mut last) = (None, None);
+    for p in saved {
+        let pos = p.get("position").and_then(|q| Some(Point::new(num(q, "x")?, num(q, "y")?)))?;
+        let (ax, ay) = p.get("axis").and_then(|q| Some((num(q, "x")?, num(q, "y")?)))?;
+        let sideways = match (ax != 0.0, ay != 0.0) {
+            (true, false) => true,
+            (false, true) => false,
+            _ => return None,
+        };
+        if last == Some(sideways) {
+            return None;
+        }
+        first.get_or_insert(!sideways);
+        last = Some(sideways);
+        at.push(if sideways { pos.y - mid.y } else { pos.x - mid.x });
+    }
+    // The run through each end goes the way its side faces, out of the object: the first leaves
+    // the start's side for the first saved run, the last arrives at the end's from the last saved
+    // run. One along the side, or back into the object, doesn't.
+    let (across, last) = (first?, last?);
+    let (&a0, &a1) = (at.first()?, at.last()?);
+    // Where the run from `p` (`sideways`: going across) meets the saved run at `v`.
+    let onto = |sideways: bool, p: Point, v: f64| if sideways { Point::new(mid.x + v, p.y) } else { Point::new(p.x, mid.y + v) };
+    let out_of = |s: Option<Side>, p: Point, q: Point| s.is_none_or(|s| (q - p).dot(s.normal()) > 0.0);
+    let (s0, s1) = attached_sides(from, to);
+    let fits = out_of(s0, p0, onto(across, p0, a0)) && out_of(s1, p1, onto(!last, p1, a1));
+    fits.then_some(ConnectorPath::Runs { across, at })
+}
+
 /// The side of its layer a connector end leaves from: the `magnet` the file names, else the edge
 /// its point on the layer (`relativePosition`, 0–1) lies on, else the side facing the other end.
 fn side(e: &Kv<'_>, at: Option<(f64, f64)>) -> Side {

crates/format/src/fig/tail_tests.rs

@@ -863,3 +863,85 @@ fn write_fixture() {
         std::fs::write(out, zip_file(&tail_canvas())).unwrap();
     }
 }
+
+/// An elbow connector saved with its path (#1910): FigJam's control points, one per run between
+/// the first and the last, each on its run with the run's axis, give the path the connector keeps;
+/// the first run leaves the start's side and the last arrives at the end's.
+#[test]
+fn an_elbow_connector_saved_with_its_path_keeps_it() {
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let box_at = |id, name: &str, x, y| node(id, Some((1, "*")), "RECTANGLE", name, vec![("size", xy(100.0, 100.0)), ("transform", at(x, y))]);
+    let point = |x, y, ax, ay| o(vec![("position", xy(x, y)), ("axis", xy(ax, ay))]);
+    // From A's bottom, across at y 740, down at x 200, into B's left: four runs.
+    let saved = node(
+        66,
+        Some((1, "+")),
+        "CONNECTOR",
+        "Saved",
+        vec![
+            ("strokePaints", arr(vec![solid(0.0, 0.0, 0.0)])),
+            ("connectorStart", o(vec![("endpointNodeID", g(64)), ("relativePosition", xy(0.5, 1.0))])),
+            ("connectorEnd", o(vec![("endpointNodeID", g(65)), ("relativePosition", xy(0.0, 0.5))])),
+            ("connectorLineStyle", e("ELBOWED")),
+            ("connectorControlPoints", arr(vec![point(150.0, 740.0, 1.0, 0.0), point(200.0, 800.0, 0.0, 1.0)])),
+        ],
+    );
+    nodes.extend([box_at(64, "A", 0.0, 600.0), box_at(65, "B", 300.0, 800.0), saved]);
+    let (doc, warnings) = import(&canvas(&schema(), &message), "Saved path").unwrap();
+    let world = doc.world_transform(named(&doc, "Saved").id);
+    let line: Vec<_> =
+        network_of(&doc, "Saved").vertices.iter().map(|v| world * figcraft_doc::geom::Point::new(v.x, v.y)).map(|p| (p.x, p.y)).collect();
+    // Each end starts `END_GAP` (4) outside its side's border.
+    assert_eq!(line, [(50.0, 704.0), (50.0, 740.0), (200.0, 740.0), (200.0, 850.0), (296.0, 850.0)]);
+    // The fixture's own Link, saved without a path, is routed here: the note counts it alone.
+    let routed: Vec<_> = warnings.iter().filter(|w| w.contains("FigCraft's own routing")).collect();
+    assert_eq!(routed.len(), 1, "{warnings:?}");
+    assert!(!routed[0].contains('×'), "a connector with its path isn't counted among those routed here: {routed:?}");
+}
+
+/// Saved control points that don't make a path from the connector's sides (#1910): a first run
+/// that would leave the bottom sideways, a point off both axes, or two runs in a row the same way
+/// leave the connector to FigCraft's routing, as one saved without a path is.
+#[test]
+fn an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here() {
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let box_at = |id, name: &str, x, y| node(id, Some((1, "*")), "RECTANGLE", name, vec![("size", xy(100.0, 100.0)), ("transform", at(x, y))]);
+    let point = |x, y, ax, ay| o(vec![("position", xy(x, y)), ("axis", xy(ax, ay))]);
+    let elbow = |id, name: &str, points: Vec<Kv<'static>>| {
+        let mut fields = vec![
+            ("strokePaints", arr(vec![solid(0.0, 0.0, 0.0)])),
+            ("connectorStart", o(vec![("endpointNodeID", g(64)), ("relativePosition", xy(0.5, 1.0))])),
+            ("connectorEnd", o(vec![("endpointNodeID", g(65)), ("relativePosition", xy(0.0, 0.5))])),
+            ("connectorLineStyle", e("ELBOWED")),
+        ];
+        if !points.is_empty() {
+            fields.push(("connectorControlPoints", arr(points)));
+        }
+        node(id, Some((1, "+")), "CONNECTOR", name, fields)
+    };
+    nodes.extend([
+        box_at(64, "A", 0.0, 600.0),
+        box_at(65, "B", 300.0, 800.0),
+        elbow(66, "Plain", vec![]),
+        elbow(67, "Sideways", vec![point(100.0, 650.0, 0.0, 1.0)]),
+        elbow(68, "Askew", vec![point(150.0, 740.0, 1.0, 1.0)]),
+        elbow(69, "Repeated", vec![point(150.0, 740.0, 1.0, 0.0), point(150.0, 760.0, 1.0, 0.0)]),
+        // The first run would go up from A's bottom, through A; the last would arrive at B's left
+        // from inside B. Each run is at right angles to its side, so only the way it goes is wrong.
+        elbow(70, "Backwards", vec![point(100.0, 650.0, 1.0, 0.0), point(200.0, 740.0, 0.0, 1.0)]),
+        elbow(71, "Inside", vec![point(150.0, 740.0, 1.0, 0.0), point(350.0, 800.0, 0.0, 1.0)]),
+    ]);
+    let (doc, warnings) = import(&canvas(&schema(), &message), "Unfit paths").unwrap();
+    let line = |name: &str| -> Vec<(f64, f64)> {
+        let world = doc.world_transform(named(&doc, name).id);
+        network_of(&doc, name).vertices.iter().map(|v| world * figcraft_doc::geom::Point::new(v.x, v.y)).map(|p| (p.x, p.y)).collect()
+    };
+    let plain = line("Plain");
+    assert!(plain.len() >= 3, "routed in right angles: {plain:?}");
+    for name in ["Sideways", "Askew", "Repeated", "Backwards", "Inside"] {
+        assert_eq!(line(name), plain, "{name} is routed as one without a path");
+    }
+    assert!(warnings.iter().any(|w| w.contains("FigCraft's own routing")), "{warnings:?}");
+}

crates/format/src/fig/tests.rs

@@ -51,6 +51,7 @@ message VariableSetID GUID guid, AssetRef assetRef
 message ConditionalActions Action[] actions, VariableData condition
 message VectorData uint vectorNetworkBlob, Vector normalizedSize, NodeChange[] styleOverrideTable
 message ConnectorEndpoint GUID endpointNodeID, Vector position, Vector relativePosition
+message ConnectorControlPoint Vector position, Vector axis
 message VariableData AnyValue value, DataType dataType
 message Paint PaintType type, Color color, float opacity, bool visible, Image image, Matrix transform, ColorStop[] stops, VariableData colorVar, ImageScaleMode imageScaleMode
 message ParentIndex GUID guid, string position
@@ -74,7 +75,7 @@ message Event InteractionType interactionType
 message Action GUID transitionNodeID, TransitionType transitionType, float transitionDuration, EasingType easingType, ConnectionType connectionType, NavigationType navigationType, VariableTarget targetVariable, VariableData targetVariableData, VariableSetID targetVariableSetID, GUID targetVariableModeID, ConditionalActions[] conditionalActions
 message Interaction Event event, Action[] actions
 message StartingPoint string name, string position
-message NodeChange GUID guid, ParentIndex parentIndex, NodeType type, string name, bool visible, float opacity, Vector size, Matrix transform, Paint[] fillPaints, Paint[] strokePaints, float strokeWeight, float cornerRadius, bool resizeToFit, bool internalOnly, float fontSize, FontName fontName, TextData textData, uint styleID, Path[] fillGeometry, Path[] strokeGeometry, StyleType styleType, StyleId styleIdForFill, SymbolData symbolData, PropDef[] componentPropDefs, PropAssignment[] componentPropAssignments, VariableDataMap parameterConsumptionMap, SetMode[] variableSetModes, VariableID variableSetID, ResolvedType variableResolvedType, Values variableDataValues, ModeMap variableModeBySetMap, Interaction[] prototypeInteractions, StartingPoint prototypeStartingPoint, GUIDPath guidPath, StackMode stackMode, float stackSpacing, float stackHorizontalPadding, float stackVerticalPadding, uint count, float starInnerScale, VectorData vectorData, StrokeCap strokeCap, StrokeJoin strokeJoin, VectorMirror handleMirroring, ShapeWithTextType shapeWithTextType, ConnectorEndpoint connectorStart, ConnectorEndpoint connectorEnd, StrokeCap connectorStartCap, StrokeCap connectorEndCap, ConnectorLineStyle connectorLineStyle, ConstraintType horizontalConstraint, ConstraintType verticalConstraint, NodeChange[] derivedSymbolData, string key, string version, LeadingTrim leadingTrim, float[] dashPattern
+message NodeChange GUID guid, ParentIndex parentIndex, NodeType type, string name, bool visible, float opacity, Vector size, Matrix transform, Paint[] fillPaints, Paint[] strokePaints, float strokeWeight, float cornerRadius, bool resizeToFit, bool internalOnly, float fontSize, FontName fontName, TextData textData, uint styleID, Path[] fillGeometry, Path[] strokeGeometry, StyleType styleType, StyleId styleIdForFill, SymbolData symbolData, PropDef[] componentPropDefs, PropAssignment[] componentPropAssignments, VariableDataMap parameterConsumptionMap, SetMode[] variableSetModes, VariableID variableSetID, ResolvedType variableResolvedType, Values variableDataValues, ModeMap variableModeBySetMap, Interaction[] prototypeInteractions, StartingPoint prototypeStartingPoint, GUIDPath guidPath, StackMode stackMode, float stackSpacing, float stackHorizontalPadding, float stackVerticalPadding, uint count, float starInnerScale, VectorData vectorData, StrokeCap strokeCap, StrokeJoin strokeJoin, VectorMirror handleMirroring, ShapeWithTextType shapeWithTextType, ConnectorEndpoint connectorStart, ConnectorEndpoint connectorEnd, StrokeCap connectorStartCap, StrokeCap connectorEndCap, ConnectorLineStyle connectorLineStyle, ConstraintType horizontalConstraint, ConstraintType verticalConstraint, NodeChange[] derivedSymbolData, string key, string version, LeadingTrim leadingTrim, float[] dashPattern, ConnectorControlPoint[] connectorControlPoints
 message Blob byte[] bytes
 message Message NodeChange[] nodeChanges, Blob[] blobs
 ";

crates/geom/src/tests.rs

@@ -210,6 +210,13 @@ fn set_rotation_keeps_center() {
     }
 }
 
+#[test]
+fn round_to_handles_large_precision_without_changing_finite_values() {
+    assert_eq!(round_to(1.25, 400), 1.25);
+    assert_eq!(round_to(-1.25, 400), -1.25);
+    assert_eq!(round_to(1.23456, 2), 1.23);
+}
+
 #[test]
 fn reverse_subpaths_preserves_open_and_closed() {
     let mut open = BezPath::new();

crates/geom/src/transform.rs

@@ -57,6 +57,9 @@ pub fn rotate_about(xf: Affine, pivot: Point, degrees: f64) -> Affine {
 /// Round a value to `digits` decimals for display (avoids `-0` and float noise).
 pub fn round_to(v: f64, digits: i32) -> f64 {
     let f = 10f64.powi(digits);
+    if v.is_finite() && !f.is_finite() {
+        return v;
+    }
     let r = (v * f).round() / f;
     if r == 0.0 { 0.0 } else { r }
 }

crates/render/src/dots.rs

@@ -57,7 +57,7 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) {
     let strong = |k: i64| k.rem_euclid(major) == 0;
     // The device-pixel span of the mark on line `k` along an axis `len` pixels long from `o`.
     let span = |k: i64, o: f64, len: i64| {
-        let a = ((k as f64 * d.step * s - o).round() as i64).saturating_sub(lead);
+        let a = (nearest_px(k as f64 * d.step * s, o) as i64).saturating_sub(lead);
         (a.max(0), a.saturating_add(side).min(len))
     };
     let row = w as usize * 4;
@@ -92,6 +92,22 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) {
     }
 }
 
+/// The first device pixel of a mark whose edge is `at` pixels from the page origin, in a view whose
+/// top-left is `o` pixels from it: the pixel whose left (or top) edge is nearest, and the right (or
+/// lower) one when two are as near. A view a whole number of pixels off (a pan, a band, a patch)
+/// gets `o` back from its origin with a rounding error, so `at` and `o` are each rounded to
+/// 1/65536 px first: the mark's own position decides the pixel, and the view only counts it out
+/// from its corner. The mark's halves go up and the origin's down: far out, where the origin's
+/// error is half a step, it still comes back to the whole pixel. Past 2³⁷ px the step is finer
+/// than `f64` and values are used as they are.
+fn nearest_px(at: f64, o: f64) -> f64 {
+    const STEPS: f64 = 65_536.0;
+    const EXACT: f64 = 137_438_953_472.0; // 2³⁷
+    let up = |v: f64| if v.abs() < EXACT { (v * STEPS + 0.5).floor() / STEPS } else { v };
+    let down = |v: f64| if v.abs() < EXACT { (v * STEPS - 0.5).ceil() / STEPS } else { v };
+    (up(at) - down(o) + 0.5).floor()
+}
+
 /// Which line covers each device pixel along an axis: 0 none, 1 a faded one, 2 a strong one.
 type Cover = Vec<u8>;
 

crates/render/src/dots_tests.rs

@@ -134,3 +134,103 @@ fn graph_paper_is_strong_every_major_line() {
         assert_eq!(at(x, -195), strong, "a strong line at {x}");
     }
 }
+
+/// At a zoom of 1.0625, a step of 24 is 25.5 pixels: every second dot falls halfway between two
+/// pixels. A view a whole number of pixels on (a pan, a band, a patch) has to put it on the same
+/// one, on whichever side of that view's origin it is.
+#[test]
+fn dots_halfway_between_pixels_stay_put() {
+    let (d, page) = page_with_square();
+    for lines in [false, true] {
+        let opts = Options { dots: Some(Dots { lines, ..dots() }), ..Default::default() };
+        let s = 1.0625;
+        let full = View { origin: (0.0, 0.0), scale: s, width: 400, height: 300 };
+        let a = render_view_single(&d, page, &full, &opts).unwrap();
+        for dx in 1..100u32 {
+            let dy = (dx * 37) % 100;
+            let v = View { origin: (f64::from(dx) / s, f64::from(dy) / s), scale: s, width: 250, height: 180 };
+            let b = render_view_single(&d, page, &v, &opts).unwrap();
+            for y in 0..180 {
+                for x in 0..250 {
+                    assert_eq!(rgba(&b, x, y), rgba(&a, x + dx, y + dy), "lines {lines}, a pan by ({dx}, {dy}), at {x}, {y}");
+                }
+            }
+        }
+    }
+}
+
+/// A mark that rounds to a half step of 1/65536 px goes the same way on both sides of a view's
+/// origin too: at a step of 25.5 − 2⁻¹⁷ px, the first mark is where 1/65536 px rounds up.
+#[test]
+fn dots_on_the_rounding_step_stay_put() {
+    let (d, page) = page_with_square();
+    let step = 25.5 - 2f64.powi(-17);
+    for lines in [false, true] {
+        let opts = Options { dots: Some(Dots { step, lines, ..dots() }), ..Default::default() };
+        let full = View { origin: (0.0, 0.0), scale: 1.0, width: 300, height: 200 };
+        let a = render_view_single(&d, page, &full, &opts).unwrap();
+        for pan in 1..60u32 {
+            let v = View { origin: (f64::from(pan), f64::from(pan)), scale: 1.0, width: 200, height: 120 };
+            let b = render_view_single(&d, page, &v, &opts).unwrap();
+            for y in 0..120 {
+                for x in 0..200 {
+                    assert_eq!(rgba(&b, x, y), rgba(&a, x + pan, y + pan), "lines {lines}, a pan by {pan}, at {x}, {y}");
+                }
+            }
+        }
+    }
+}
+
+/// The view's origin is quantized apart from the marks: converted to pixels, a whole-pixel origin
+/// comes back a hair off, and taken together with a mark one step short of a half it would push the
+/// mark across.
+#[test]
+fn dots_one_rounding_step_short_of_a_half_stay_put() {
+    let (d, page) = page_with_square();
+    let s = (75.5 - 2f64.powi(-17)) / 24.0;
+    for lines in [false, true] {
+        let opts = Options { dots: Some(Dots { lines, ..dots() }), ..Default::default() };
+        let a = render_view_single(&d, page, &View { origin: (0.0, 0.0), scale: s, width: 300, height: 200 }, &opts).unwrap();
+        for pan in 1..100u32 {
+            let v = View { origin: (f64::from(pan) / s, f64::from(pan) / s), scale: s, width: 200, height: 100 };
+            let b = render_view_single(&d, page, &v, &opts).unwrap();
+            for y in 0..100 {
+                for x in 0..200 {
+                    assert_eq!(rgba(&b, x, y), rgba(&a, x + pan, y + pan), "lines {lines}, a pan by {pan}, at {x}, {y}");
+                }
+            }
+        }
+    }
+}
+
+/// Far out (some 4 × 10¹⁰ pixels), a whole-pixel origin comes back from page units exactly half a
+/// rounding step off: rounded up, it would move the marks that fall halfway between pixels.
+#[test]
+fn far_out_dots_stay_put() {
+    let (d, page) = page_with_square();
+    let s = 0.3;
+    let at = 42_536_140_695.0;
+    let opts = Options { dots: Some(Dots { step: 5.0, ..dots() }), ..Default::default() };
+    let a = render_view_single(&d, page, &View { origin: (at / s, 0.0), scale: s, width: 420, height: 40 }, &opts).unwrap();
+    for dx in 1..200u32 {
+        let v = View { origin: ((at + f64::from(dx)) / s, 0.0), scale: s, width: 200, height: 40 };
+        let b = render_view_single(&d, page, &v, &opts).unwrap();
+        for y in 0..40 {
+            for x in 0..200 {
+                assert_eq!(rgba(&b, x, y), rgba(&a, x + dx, y), "a pan by {dx}, at {x}, {y}");
+            }
+        }
+    }
+}
+
+/// Positions too far out to quantize draw nothing rather than a mark at the corner.
+#[test]
+fn dots_out_past_any_page_draw_nothing() {
+    let (d, page) = page_with_square();
+    let plain = render_view_single(&d, page, &View { origin: (1e304, 0.0), scale: 1.0, width: 40, height: 40 }, &Options::default()).unwrap();
+    for (step, x) in [(1e290, 1e304), (1e299, 1e305), (3e303, 1.5e308)] {
+        let opts = Options { dots: Some(Dots { step, ..dots() }), ..Default::default() };
+        let p = render_view_single(&d, page, &View { origin: (x, 0.0), scale: 1.0, width: 40, height: 40 }, &opts).unwrap();
+        assert_eq!(p.data(), plain.data(), "a step of {step} at {x}");
+    }
+}

crates/render/src/spread_tests.rs

@@ -192,3 +192,58 @@ fn arc_stroke_mitres_are_not_cut_off() {
         assert!(worst <= 2, "{align:?}: {worst} levels cut off");
     }
 }
+
+/// A dashed stroke is cut into separate dashes with square ends, a width profile can step its
+/// width and a brush lays down shapes of its own: round a whole ellipse or a rounded box, a spread
+/// mitres out at their corners, past the box grown by the spread, and keeps its whole shadow.
+#[test]
+fn stroke_corners_spread_mitres_are_not_cut_off() {
+    use figcraft_doc::{Brush, Node, StrokeAlign, StrokeCap, WidthProfile};
+    type Style = fn(&mut Node);
+    let strokes: [(&str, Style); 4] = [
+        ("dashed", |n| n.stroke.dashes = vec![30.0, 30.0]),
+        ("dashed with square caps", |n| (n.stroke.dashes, n.stroke.dash_cap) = (vec![30.0, 30.0], Some(StrokeCap::Square))),
+        ("stepped", |n| n.stroke.width_profile = Some(WidthProfile::new([(0.0, 1.0), (0.25, 4.0), (0.26, 0.2), (0.75, 4.0)]))),
+        ("starry", |n| n.stroke.brush = Some(Brush::new("stars"))),
+    ];
+    let shapes = [(NodeKind::Ellipse { start: 0.0, sweep: std::f64::consts::TAU, inner: 0.0 }, 0.0), (NodeKind::Rectangle, 100.0)];
+    for (kind, radius) in shapes {
+        for (name, style) in strokes {
+            for align in [StrokeAlign::Outside, StrokeAlign::Center] {
+                let make = |effects: Vec<EffectKind>| {
+                    let (mut d, n) = shape(kind.clone(), effects);
+                    let node = d.get_mut(n).unwrap();
+                    node.corners.radii = [radius; 4];
+                    node.strokes = vec![Paint::solid(Color::WHITE)];
+                    (node.stroke.weight, node.stroke.align) = (20.0, align);
+                    style(node);
+                    (d, n)
+                };
+                let (d, n) = make(vec![EffectKind::DropShadow(shadow(30.0))]);
+                let clear = Shadow { color: Color::new(0.0, 0.0, 0.0, 0.0), ..shadow(120.0) };
+                let (roomy, m) = make(vec![EffectKind::DropShadow(shadow(30.0)), EffectKind::DropShadow(clear)]);
+                let (a, b) = (render(&d, n), render(&roomy, m));
+                let worst = a.data().chunks(4).zip(b.data().chunks(4)).map(|(p, q)| p[3].abs_diff(q[3])).max().unwrap_or(0);
+                // The stroke lands a little differently on a layer of another size, even when
+                // both have room to spare: up to 16 levels at a pixel or two. Cut off is 255.
+                assert!(worst <= 16, "{kind:?} radius {radius}, {name} {align:?}: {worst} levels cut off");
+            }
+        }
+    }
+}
+
+/// Without a spread, a dashed stroke reaches no further than a solid one: the bounds an export
+/// goes by stay the box grown by the stroke.
+#[test]
+fn a_dashed_stroke_without_a_spread_keeps_its_bounds() {
+    use figcraft_doc::StrokeAlign;
+    for kind in [NodeKind::Rectangle, NodeKind::Ellipse { start: 0.0, sweep: std::f64::consts::TAU, inner: 0.0 }] {
+        let (mut d, n) = shape(kind.clone(), vec![]);
+        let node = d.get_mut(n).unwrap();
+        node.strokes = vec![Paint::solid(Color::WHITE)];
+        (node.stroke.weight, node.stroke.align) = (20.0, StrokeAlign::Outside);
+        node.stroke.dashes = vec![30.0, 30.0];
+        let b = crate::export_bounds(&d, n).unwrap();
+        assert_eq!((b.x0, b.y0, b.x1, b.y1), (80.0, 80.0, 320.0, 320.0), "{kind:?}");
+    }
+}

crates/text/src/fontdb.rs

@@ -755,6 +755,12 @@ impl FontDb {
 
     /// Style names of a family, by weight then italic.
     pub fn styles(&mut self, family: &str) -> Vec<String> {
+        self.style_weights(family).into_iter().map(|(name, _)| name).collect()
+    }
+
+    /// [`styles`](Self::styles) with the weight each is listed by: the face's own (Segoe UI
+    /// Semilight is 350), a named instance's `wght`, or for a face not read yet its name's.
+    pub fn style_weights(&mut self, family: &str) -> Vec<(String, u16)> {
         self.load_family(family, None);
         let key = self.key(family);
         // (weight, italic, order in the font, name): named instances keep the font's order.
@@ -773,14 +779,29 @@ impl FontDb {
                 v.push((w, f.italic || italic_name(&inst.name), k, inst.name.clone()));
             }
         }
-        // A family installed as one family per weight offers those weights too.
-        for (_, style) in self.split_families(&key) {
-            v.push((pending_weight(&style).clamp(1, 1000) as u16, italic_name(&style), 0, style));
+        // A family installed as one family per weight offers those weights too, upright and italic
+        // as that family's faces are ("Foo Bold" with Regular and Italic faces: Bold and Bold
+        // Italic, the names `resolve` finds them by). A face read gives its own weight, one not
+        // read the name's; the families aren't read for this.
+        for (k, style) in self.split_families(&key) {
+            let named = pending_weight(&style).clamp(1, 1000) as u16;
+            let italic = italic_name(&style);
+            let read = self.families.get(&k).map(|(_, idx)| idx.as_slice()).unwrap_or_default().iter().filter_map(|i| self.faces.get(*i));
+            let unread = self.pending.get(&k).into_iter().flat_map(|(_, entries)| entries).map(|e| (named, italic_name(&e.style)));
+            let faces: Vec<(u16, bool)> = read.map(|f| (f.weight, f.italic)).chain(unread).collect();
+            if faces.is_empty() {
+                v.push((named, italic, 0, style));
+                continue;
+            }
+            for (w, slanted) in faces {
+                let name = if slanted && !italic { format!("{style} Italic") } else { style.clone() };
+                v.push((w, slanted || italic, 0, name));
+            }
         }
         v.sort();
         let mut seen = std::collections::HashSet::new();
         v.retain(|x| seen.insert(norm_style(&x.3)));
-        v.into_iter().map(|x| x.3).collect()
+        v.into_iter().map(|x| (x.3, x.0)).collect()
     }
 
     /// The key `family` is known under: itself in any case; for a name designs use for Apple's
@@ -1514,6 +1535,11 @@ pub fn family_styles(family: &str) -> Vec<String> {
     db().write().unwrap_or_else(std::sync::PoisonError::into_inner).styles(family)
 }
 
+/// [`family_styles`] with the weight each is listed by (see [`FontDb::style_weights`]).
+pub fn family_style_weights(family: &str) -> Vec<(String, u16)> {
+    db().write().unwrap_or_else(std::sync::PoisonError::into_inner).style_weights(family)
+}
+
 /// Scan system fonts into the global db (desktop; a no-op on the web, or with
 /// `FIGCRAFT_NO_SYSTEM_FONTS` set). Runs once per process: a concurrent caller waits for that scan.
 /// The directory walk runs without holding the database lock; results are merged in one short write.

crates/text/src/fontdb_names_tests.rs

@@ -5,9 +5,10 @@
 //! case; the picker lists what is installed. Synthetic family names only, over pending entries
 //! (no files) and the embedded faces when the build has them.
 
+use std::collections::BTreeMap;
 use std::sync::Arc;
 
-use super::{CRAFT_FONTS, Face, FontBytes, FontDb, Pending, style_words};
+use super::{CRAFT_FONTS, Face, FontBytes, FontDb, LocalFont, Pending, scan_dir, style_words, system_font_dirs};
 
 fn entry(style: &str) -> Pending {
     Pending { path: format!("no-such-dir/{style}.ttf").into(), index: 0, style: style.into(), postscript: None, local: None }
@@ -104,3 +105,43 @@ fn faces_are_found_and_listed_under_either_name() {
     assert!(Arc::ptr_eq(&db.find("Synthetic Text SemiBold", "Regular").unwrap(), &semibold));
     assert!(Arc::ptr_eq(&db.find("synthetictext", "Semibold").unwrap(), &semibold));
 }
+
+#[test]
+fn a_family_per_weight_offers_its_italics_too() {
+    // Listed by name before anything is read: Synthetic Slab Bold's Italic face is Bold Italic.
+    let local = |id: usize, family: &str, style: &str| LocalFont { id, family: family.into(), style: style.into(), postscript: String::new() };
+    let mut db = FontDb::default();
+    db.add_local(vec![
+        local(0, "Synthetic Slab", "Regular"),
+        local(1, "Synthetic Slab", "Italic"),
+        local(2, "Synthetic Slab Bold", "Regular"),
+        local(3, "Synthetic Slab Bold", "Italic"),
+    ]);
+    let listed = |db: &mut FontDb| db.style_weights("Synthetic Slab");
+    let want = |v: &[(&str, u16)]| v.iter().map(|(s, w)| ((*s).to_string(), *w)).collect::<Vec<_>>();
+    assert_eq!(listed(&mut db), want(&[("Regular", 400), ("Italic", 400), ("Bold", 700), ("Bold Italic", 700)]));
+    assert_eq!(resolved(&db, "Synthetic Slab", "Bold Italic"), pair("synthetic slab bold", "Italic"), "the style drawn by that face");
+    // Faces read give their own weights: Synthetic Slab Semi Light's are 350, not the name's 300.
+    let stand_in = CRAFT_FONTS.first().map(|f| f.bytes.to_vec()).or_else(|| {
+        let mut installed = BTreeMap::new();
+        for dir in system_font_dirs() {
+            scan_dir(&dir, 0, &mut installed);
+        }
+        installed.values().flat_map(|(_, v)| v).find_map(|p| std::fs::read(&p.path).ok())
+    });
+    let Some(bytes) = stand_in.map(Arc::new) else {
+        eprintln!("skipping the read faces: no font to stand in");
+        return;
+    };
+    let face = |family: &str, style: &str, weight: u16, italic: bool| {
+        let mut f = Face::from_bytes(FontBytes::Shared(bytes.clone()), 0, Some(family), Some(style)).unwrap();
+        f.instances.clear();
+        (f.weight, f.italic) = (weight, italic);
+        f
+    };
+    let mut db = FontDb::default();
+    db.add(face("Synthetic Slab", "Regular", 400, false));
+    db.add(face("Synthetic Slab Semi Light", "Regular", 350, false));
+    db.add(face("Synthetic Slab Semi Light", "Italic", 350, true));
+    assert_eq!(listed(&mut db), want(&[("Semi Light", 350), ("Semi Light Italic", 350), ("Regular", 400)]));
+}

crates/text/src/lib.rs

@@ -17,8 +17,8 @@ pub use breaks::{backspace_step, grapheme_step};
 pub use color::{ColorBitmap, ColorInk, ColorLayer};
 pub use fontdb::{
     Axis, CRAFT_FONTS, Coords, Face, FontDb, LocalFont, NamedInstance, Rescan, add_local_fonts, axis_label, db, face_with_char, family_names,
-    family_styles, find_face, has_family, installed_fonts_known, load_font_bytes, load_local_font, local_only, no_coords, opt_out_of_system_fonts,
-    rescan_system_fonts, scan_system_fonts, scan_system_fonts_on_demand, system_fonts_scanned, take_wanted_local_fonts,
+    family_style_weights, family_styles, find_face, has_family, installed_fonts_known, load_font_bytes, load_local_font, local_only, no_coords,
+    opt_out_of_system_fonts, rescan_system_fonts, scan_system_fonts, scan_system_fonts_on_demand, system_fonts_scanned, take_wanted_local_fonts,
 };
 pub use layout::{Decoration, Glyph, Line, TextLayout, layout};
 pub use onpath::OnPath;

crates/ui-egui/locales/en.toml

@@ -413,6 +413,12 @@ name = "English"
 "Scope: all supported properties" = "Scope: all supported properties"
 "Scope: hidden from pickers" = "Scope: hidden from pickers"
 "Scope: only {scope}" = "Scope: only {scope}"
+"Disconnected. Reconnecting…" = "Disconnected. Reconnecting…"
+"Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…" = "Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…"
+"Dismiss" = "Dismiss"
+"Not connected: {reason}. Your work is still in this tab." = "Not connected: {reason}. Your work is still in this tab."
+"Retry now" = "Retry now"
+"Save a copy…" = "Save a copy…"
 "Wrap style" = "Wrap style"
 "Text direction" = "Text direction"
 "Auto: by the first letter with a direction" = "Auto: by the first letter with a direction"
@@ -426,6 +432,7 @@ name = "English"
 "Set hug contents" = "Set hug contents"
 "Set fill container" = "Set fill container"
 "Double-click an edge of an auto layout frame" = "Double-click an edge of an auto layout frame"
+"{name}, disconnected from its live session" = "{name}, disconnected from its live session"
 "⌥ double-click an edge of an auto layout child" = "⌥ double-click an edge of an auto layout child"
 "Alt+double-click an edge of an auto layout child" = "Alt+double-click an edge of an auto layout child"
 "Default" = "Default"

crates/ui-egui/locales/es.toml

@@ -1971,6 +1971,7 @@ status = "draft — needs native review"
 "collab.openFile" = "Abrir archivo en línea"
 "collab.peers" = "Personas en este archivo"
 "collab.publish" = "Publicar en el servidor"
+"collab.reconnect" = "Reconectar"
 "collab.recoverFile" = "Recuperar archivo en línea"
 "collab.registerLinks" = "Abrir enlaces de invitación en FigCraft"
 "collab.removePerson" = "Quitar de la sesión"

crates/ui-egui/src/canvas.rs

@@ -328,11 +328,13 @@ pub fn show(app: &mut FigApp, ui: &mut Ui, worker: &mut Worker) {
     crate::live::draw(app, &painter, &ctx);
     crate::live::agent::draw(app, &painter, &ctx);
     crate::live::chat_box(app, &ctx);
-    crate::live::spotlight_banner(app, &ctx, rect);
+    // The other banners float below the strip that says the session is disconnected.
+    let banners = rect.with_min_y(rect.min.y + crate::live::connection_banner(app, &ctx, rect));
+    crate::live::spotlight_banner(app, &ctx, banners);
     crate::comments::popovers(app, &ctx);
-    crate::versions::preview_banner(app, &ctx, rect);
-    crate::branch_ui::banner(app, &ctx, rect);
-    crate::dev_mode::focus_bar(app, &ctx, rect);
+    crate::versions::preview_banner(app, &ctx, banners);
+    crate::branch_ui::banner(app, &ctx, banners);
+    crate::dev_mode::focus_bar(app, &ctx, banners);
     // The cursor: the tool's, unless something on the canvas with its own has the pointer.
     app.canvas.cursor = None;
     if let (true, Some(at)) = (own_cursor && resp.hovered(), ctx.input(|i| i.pointer.hover_pos())) {

crates/ui-egui/src/icons.rs

@@ -207,6 +207,8 @@ icons! {
     Online,
     /// In a live session others get into: a point sending waves to both sides.
     LiveShared,
+    /// Disconnected from a live session: the point and its waves, struck through.
+    LiveDisconnected,
     /// A file of yours on a server that only you get into: a point inside a closed ring.
     LivePrivate,
     /// A design file: a pen nib leaning to the left, its grip filled.

crates/ui-egui/src/icons/draw.rs

@@ -834,6 +834,14 @@ fn draw(p: &P, icon: Icon) {
                 p.arc(8.0, 8.0, r, PI - FRAC_PI_4, PI + FRAC_PI_4);
             }
         }
+        LiveDisconnected => {
+            p.dot(8.0, 8.0, 1.6);
+            for r in [3.6, 6.0] {
+                p.arc(8.0, 8.0, r, -FRAC_PI_4, FRAC_PI_4);
+                p.arc(8.0, 8.0, r, PI - FRAC_PI_4, PI + FRAC_PI_4);
+            }
+            p.line(3.0, 13.0, 13.0, 3.0);
+        }
         LivePrivate => {
             p.dot(8.0, 8.0, 1.6);
             p.circle(8.0, 8.0, 5.0);

crates/ui-egui/src/live.rs

@@ -439,6 +439,67 @@ pub fn chat_box(app: &mut FigApp, ctx: &egui::Context) {
     app.ui.live.chat = Some(chat);
 }
 
+/// While the active document's live session is disconnected: a thin strip across the top of the
+/// canvas that says so, with what can be done about it. Returns how much of the canvas it takes.
+pub fn connection_banner(app: &mut FigApp, ctx: &egui::Context, canvas: Rect) -> f32 {
+    const H: f32 = 30.0;
+    let live = app.session.live();
+    if !app.session.docs.get(app.session.active).is_some_and(|d| crate::tabs::live_lost(app, d.uid)) {
+        return 0.0;
+    }
+    let (text, retry, gone) = match &live.status {
+        Status::Failed { reason } => {
+            (trf("Not connected: {reason}. Your work is still in this tab.", &[("reason", &failure_text(reason))]), Some(tr("Try again")), true)
+        }
+        Status::Reconnecting { .. } => {
+            (tr("Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…").to_string(), Some(tr("Retry now")), false)
+        }
+        _ => (tr("Disconnected. Reconnecting…").to_string(), None, false),
+    };
+    let t = Tokens::get(ctx);
+    let ink = text_on(t.danger);
+    let (mut try_now, mut save, mut dismiss) = (false, false, false);
+    let strip = Rect::from_min_size(canvas.min, vec2(canvas.width(), H));
+    egui::Area::new(egui::Id::unique("live_connection_banner")).order(egui::Order::Foreground).fixed_pos(strip.min).show(ctx, |ui| {
+        ui.set_min_size(strip.size());
+        ui.set_max_size(strip.size());
+        ui.painter().rect_filled(strip, egui::CornerRadius::ZERO, t.danger);
+        let button = |ui: &mut Ui, label: &str| {
+            ui.add(
+                egui::Button::new(egui::RichText::new(label).font(regular(11.0)).color(ink))
+                    .fill(Color32::TRANSPARENT)
+                    .stroke(Stroke::new(1.0, ink))
+                    .corner_radius(egui::CornerRadius::same(4)),
+            )
+            .clicked()
+        };
+        let inner = strip.shrink2(vec2(12.0, 0.0));
+        ui.scope_builder(egui::UiBuilder::new().max_rect(inner).layout(egui::Layout::right_to_left(egui::Align::Center)), |ui| {
+            ui.spacing_mut().item_spacing.x = 8.0;
+            if gone {
+                dismiss = button(ui, tr("Dismiss"));
+                save = button(ui, tr("Save a copy…"));
+            }
+            if let Some(label) = retry {
+                try_now = button(ui, label);
+            }
+            ui.with_layout(egui::Layout::left_to_right(egui::Align::Center), |ui| {
+                ui.add(egui::Label::new(egui::RichText::new(text).font(regular(11.0)).color(ink)).truncate());
+            });
+        });
+    });
+    if try_now {
+        app.run("collab.reconnect", json!({}));
+    }
+    if save {
+        app.save_as_dialog();
+    }
+    if dismiss {
+        app.run("collab.leave", json!({}));
+    }
+    H
+}
+
 /// While you spotlight, or someone does and you stopped following them: a banner on the canvas to
 /// stop, or to follow again.
 pub fn spotlight_banner(app: &mut FigApp, ctx: &egui::Context, canvas: Rect) {

crates/ui-egui/src/live_joining_tests.rs

@@ -97,3 +97,52 @@ fn leave_takes_a_session_id() {
     assert_eq!(h.app.session.execute("collab.leave", &json!({"session": id})).unwrap()["ended"], true);
     assert!(h.app.session.live.get(id).is_none());
 }
+
+/// Joined, with the file in its tab.
+fn joined(h: &mut Harness) -> u64 {
+    join(h);
+    h.welcome();
+    h.sync();
+    h.app.session.docs[h.app.session.active].uid
+}
+
+const STRIP: &str = "Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…";
+
+#[test]
+fn a_dropped_connection_shows_on_the_tab_and_across_the_canvas_with_retry() {
+    let (mut h, _) = Harness::new();
+    let uid = joined(&mut h);
+    assert!(!crate::tabs::live_lost(&h.app, uid));
+    assert!(!has_text(&h.frames(2), STRIP), "not while connected");
+    h.send(vec![LiveEvent::Status(Status::Reconnecting { attempt: 3 })]);
+    let shapes = h.frames(2);
+    assert!(crate::tabs::live_lost(&h.app, uid));
+    assert!(has_text(&shapes, STRIP));
+    h.click(text_center(&shapes, "Retry now"));
+    assert!(h.app.ui.last_error.is_none(), "{:?}", h.app.ui.last_error);
+    assert_eq!(h.app.session.live().status, Status::Reconnecting { attempt: 3 });
+    // Back: the strip goes.
+    h.welcome();
+    assert!(!has_text(&h.frames(2), STRIP));
+    assert!(!crate::tabs::live_lost(&h.app, uid));
+}
+
+#[test]
+fn a_session_that_ended_stays_on_its_tab_until_dismissed() {
+    let (mut h, _) = Harness::new();
+    let uid = joined(&mut h);
+    h.send(vec![LiveEvent::Status(Status::Failed { reason: "The host refused: this link isn't valid".into() })]);
+    let shapes = h.frames(2);
+    assert!(crate::tabs::live_lost(&h.app, uid));
+    assert!(has_text(&shapes, "Not connected: The host refused: this link isn't valid. Your work is still in this tab."));
+    assert!(has_text(&shapes, "Save a copy…"));
+    h.click(text_center(&shapes, "Try again"));
+    assert_eq!(h.app.session.live().status, Status::Connecting);
+    assert!(crate::tabs::live_lost(&h.app, uid), "still disconnected while it tries");
+    h.send(vec![LiveEvent::Status(Status::Failed { reason: "no".into() })]);
+    let shapes = h.frames(2);
+    h.click(text_center(&shapes, "Dismiss"));
+    assert!(!has_text(&h.frames(2), "Try again"));
+    assert!(!crate::tabs::live_lost(&h.app, uid));
+    assert_eq!(h.app.session.live().status, Status::Off);
+}

crates/ui-egui/src/live_tests.rs

@@ -126,7 +126,7 @@ impl Harness {
             color: "#14AE5C".into(),
             file_name: "Shared".into(),
             pages: vec![],
-            link: String::new(),
+            link: "figcraft://join?host=127.0.0.1:47900&file=f&token=t".into(),
             url: String::new(),
             address: "127.0.0.1:47900".into(),
             network: false,

crates/ui-egui/src/tabs.rs

@@ -149,6 +149,7 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) {
             let name = &d.doc.name;
             // In a live session: a mark after the name says whether others get in.
             let live = live_mark(app, d.uid);
+            let lost = live_lost(app, d.uid);
             let dirty = d.is_dirty();
             let r = tab_rects[slot];
             let body_r = Rect::from_min_max(r.min, pos2(r.max.x - 32.0, r.max.y));
@@ -171,8 +172,8 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) {
                     }
                 });
             }
-            let label = tab_label(name, live);
-            let resp = if live.is_some() { resp.on_hover_text(&label) } else { resp };
+            let label = if lost { trf("{name}, disconnected from its live session", &[("name", name)]) } else { tab_label(name, live) };
+            let resp = if live.is_some() || lost { resp.on_hover_text(&label) } else { resp };
             crate::a11y::tab(&resp, &label, active);
             let progress = open_progress(&opening, d.uid, now);
             let tab = TabPaint {
@@ -182,6 +183,7 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) {
                 width: w,
                 state: [active, resp.hovered(), cresp.hovered(), dirty],
                 live,
+                lost,
                 progress,
             };
             paint_tab(ui, &t, &tab);
@@ -429,7 +431,7 @@ fn detach_tab(app: &mut FigApp, ui: &Ui, i: usize, at: Option<egui::Pos2>) {
 /// How wide document tab `i` wants to be: its name, the live mark and the unsaved dot.
 fn preferred_width(app: &FigApp, i: usize) -> f32 {
     let d = &app.session.docs[i];
-    let mark_w = if live_mark(app, d.uid).is_some() { 18.0 } else { 0.0 };
+    let mark_w = if live_mark(app, d.uid).is_some() || live_lost(app, d.uid) { 18.0 } else { 0.0 };
     let dot_w = if d.is_dirty() && mark_w > 0.0 { 12.0 } else { 0.0 };
     (regular(12.0).size * 0.6 * d.doc.name.chars().count() as f32 + 64.0 + mark_w + dot_w).clamp(120.0, 220.0)
 }
@@ -454,14 +456,16 @@ struct TabPaint<'a> {
     state: [bool; 4],
     /// In a live session: whether others get in.
     live: Option<bool>,
+    /// Disconnected from its live session.
+    lost: bool,
     /// How far the opening animation is (0..=1).
     progress: f32,
 }
 
 /// Draws a document tab: background, icon, name, live mark, unsaved dot and close button.
 fn paint_tab(ui: &Ui, t: &Tokens, tab: &TabPaint) {
-    let TabPaint { name, kind, rects: [r, close_r], width: w, state: [active, hovered, close_hovered, dirty], live, progress } = *tab;
-    let mark_w = if live.is_some() { 18.0 } else { 0.0 };
+    let TabPaint { name, kind, rects: [r, close_r], width: w, state: [active, hovered, close_hovered, dirty], live, lost, progress } = *tab;
+    let mark_w = if live.is_some() || lost { 18.0 } else { 0.0 };
     let paint_r = r.translate(vec2(-28.0 * (1.0 - progress).powi(2), 0.0));
     let painter = ui.painter().with_clip_rect(r);
     if active {
@@ -484,8 +488,10 @@ fn paint_tab(ui: &Ui, t: &Tokens, tab: &TabPaint) {
         t.text.linear_multiply(progress),
         (w - mark_w - if dirty { 72.0 } else { 60.0 }).max(0.0),
     );
-    if let Some(shared) = live {
-        let at = Rect::from_center_size(pos2(paint_r.max.x - 38.0, paint_r.center().y), vec2(14.0, 14.0));
+    let at = Rect::from_center_size(pos2(paint_r.max.x - 38.0, paint_r.center().y), vec2(14.0, 14.0));
+    if lost {
+        icons::paint(&painter, at, Icon::LiveDisconnected, t.danger.linear_multiply(progress));
+    } else if let Some(shared) = live {
         icons::paint(&painter, at, crate::online::mark(shared), if shared { t.success } else { t.icon_secondary }.linear_multiply(progress));
     }
     if dirty {
@@ -669,6 +675,12 @@ pub fn live_mark(app: &FigApp, uid: u64) -> Option<bool> {
     live.shared().filter(|_| live.doc_uid == Some(uid))
 }
 
+/// Document `uid` is a live session's whose connection is gone: what happens in it reaches no one.
+pub fn live_lost(app: &FigApp, uid: u64) -> bool {
+    let live = app.session.live_of(uid);
+    live.disconnected() && live.doc_uid == Some(uid)
+}
+
 /// Minimise, maximise/restore and close at the right end of the title bar; returns their width.
 fn window_buttons(app: &mut FigApp, ui: &mut Ui, bar: Rect) -> f32 {
     const W: f32 = 46.0;

crates/vectordrawable/src/warnings.rs

@@ -63,27 +63,53 @@ const NAMED: usize = 3;
 
 #[derive(Default)]
 pub(crate) struct Warnings {
-    seen: std::collections::BTreeMap<Warn, Vec<String>>,
+    /// Per warning: the distinct names so far (a set, so a document with many distinct names
+    /// doesn't make each check a scan of all before it), and the first few in order.
+    seen: std::collections::BTreeMap<Warn, (std::collections::BTreeSet<String>, Vec<String>)>,
 }
 
 impl Warnings {
     pub fn add(&mut self, w: Warn, layer: &str) {
-        let names = self.seen.entry(w).or_default();
-        if !names.iter().any(|n| n == layer) {
-            names.push(layer.to_string());
+        let (distinct, first) = self.seen.entry(w).or_default();
+        if distinct.insert(layer.to_string()) && first.len() < NAMED {
+            first.push(layer.to_string());
         }
     }
 
     pub fn finish(self) -> Vec<String> {
         self.seen
             .into_iter()
-            .map(|(w, names)| {
+            .map(|(w, (distinct, names))| {
                 let shown: Vec<String> =
                     names.iter().take(NAMED).map(|n| if n.is_empty() { "unnamed layer".to_string() } else { n.clone() }).collect();
-                let more = names.len().saturating_sub(NAMED);
+                let more = distinct.len().saturating_sub(NAMED);
                 let more = if more > 0 { format!(", {more} more") } else { String::new() };
                 format!("{} ({}{more})", w.message(), shown.join(", "))
             })
             .collect()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn names_are_counted_once_each_and_the_first_three_shown() {
+        let mut w = Warnings::default();
+        for name in ["a", "b", "a", "c", "d", "b", "e"] {
+            w.add(Warn::NothingDrawn, name);
+        }
+        let lines = w.finish();
+        assert_eq!(lines.len(), 1);
+        assert!(lines[0].ends_with("(a, b, c, 2 more)"), "{}", lines[0]);
+        // Many distinct names: each is one set insertion, not a scan of all before it.
+        let mut w = Warnings::default();
+        let start = std::time::Instant::now();
+        for i in 0..200_000 {
+            w.add(Warn::TooLarge, &format!("layer {i}"));
+        }
+        assert!(w.finish()[0].ends_with("199997 more)"));
+        assert!(start.elapsed() < std::time::Duration::from_secs(5), "{:?}", start.elapsed());
+    }
+}

docs/auto-layout-parity.md

@@ -1,6 +1,6 @@
 # Auto layout and constraints parity
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-11-03 · **Change:** patch (baseline alignment puts a layer without text with its bottom on the line, as the help center's figure shows an icon next to text (#1825); fill children share the free space by their content area, border-box fashion, as the Flexbox article says (#1824); double-click an edge of an auto layout frame's box for Hug contents, Alt+double-click an edge of a child's box for Fill container, as the Guide to auto layout says (#1838); a child resized to the full available space of its auto layout frame becomes Fill container on that axis, as the Guide to auto layout says; a text keeps a max height or a number of max lines, not both, as the Guide to auto layout says: a max height sets max lines to Auto and max lines remove the max height; Remove all auto layout, as the help center's More layout options has it: `layout.removeAll` takes the auto layout off a frame and every frame nested in it in one undo step; grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); Layout sidebar: Add auto layout (+) is available for groups and converts a single group to a frame in place, with mask order, flow-only inference and Fill sizing preserved; adding auto layout to an empty frame keeps its size (#369); `node.set` applies auto layout keys only to frames, with warnings (#603); core editor leftovers: auto gap handles, wrapped-line alignment; behaviour suite written from the public documentation, every rule's status; fixes and the missing settings it found) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-11-03 · **Change:** patch (Suggest auto layout is its own command, as the help center says: it adds as many auto layout frames as needed, splitting a frame's layers into rows or columns by the gaps between them, and keeps the placement of the design where the gaps are even (#1823); baseline alignment puts a layer without text with its bottom on the line, as the help center's figure shows an icon next to text (#1825); fill children share the free space by their content area, border-box fashion, as the Flexbox article says (#1824); double-click an edge of an auto layout frame's box for Hug contents, Alt+double-click an edge of a child's box for Fill container, as the Guide to auto layout says (#1838); a child resized to the full available space of its auto layout frame becomes Fill container on that axis, as the Guide to auto layout says; a text keeps a max height or a number of max lines, not both, as the Guide to auto layout says: a max height sets max lines to Auto and max lines remove the max height; Remove all auto layout, as the help center's More layout options has it: `layout.removeAll` takes the auto layout off a frame and every frame nested in it in one undo step; grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); Layout sidebar: Add auto layout (+) is available for groups and converts a single group to a frame in place, with mask order, flow-only inference and Fill sizing preserved; adding auto layout to an empty frame keeps its size (#369); `node.set` applies auto layout keys only to frames, with warnings (#603); core editor leftovers: auto gap handles, wrapped-line alignment; behaviour suite written from the public documentation, every rule's status; fixes and the missing settings it found) · **Target:** Figma Design (desktop app 126.10.7)
 
 Auto layout is the most used layout feature in Figma and the one where small differences (a
 hugging frame one pixel off, text wrapping at another width) break real files. **Breadth ~98%,
@@ -92,7 +92,8 @@ Status: **pass** (a case in the suite holds), **fixed** (the suite found a diver
 | Arrow keys move children one place (flows, rows, columns, grid cells, into neighbours) | done | `al_keys_tests.rs` |
 | Constraints: left, right, left and right, centre, scale; top/bottom likewise | done | |
 | Layout grids: columns, rows, grid; stretch/left/centre/right; variables bound | done | |
-| Suggest auto layout / "Add auto layout" on a selection | done | the Layout sidebar exposes Add auto layout (+) for groups and frames using the same `layout.add` command as the context menu; a single group becomes a frame in place, keeping its id, name and direct children; adding auto layout to an empty frame keeps its size, Fixed (it collapsed to 20×20); a frame with content still hugs it, as does a new frame wrapped around a selection (#369). `node.set` with auto layout keys on a mix of layers applies them to the frames and warns about the rest instead of failing the whole call (#603) |
+| Suggest auto layout | done | The target works out which layers belong together and adds as many auto layout frames as the design needs, in one step, keeping the placement. `layout.suggest` used to run `layout.add` and made one row of everything (#1823). Now it splits a frame's layers, by their boxes in the frame, along the vertical axis first: sorted by top edge, a layer joins the current row while it starts above the row's bottom (or together with it), and a gap, even a zero one, between the row and the next layer starts a new row. With two or more rows the frame becomes a Vertical auto layout whose items are the rows; otherwise the same split by columns gives a Horizontal one; if the layers overlap along both axes the frame gets no auto layout and the result carries a warning. A row or column of several layers goes into a new frame without fill or clipping, sized to it and inserted in its place (it hugs its content once the split gives it auto layout; a band whose own layers overlap along both axes gets none, with a warning, and stays a Fixed frame that cannot reflow those layers), and the split repeats inside it, to a depth of 16 and for up to 1,000 layers per frame (past that, or when a mask is among the layers, the layers are laid out in one list as Add auto layout does, with a warning). The frame keeps its size, Fixed: the gap is the distance between the bands, the padding along the flow is the first band's offset and the room left after the last, across the flow the smallest offset (alignment start), so with equal gaps and bands that start at the same offset every layer keeps its box exactly. When the gaps differ by more than 0.5 px the smallest is used and `warnings` says the later bands move; when the bands start at different offsets across the flow (a centred title above a card) they line up at the smallest, which moves the others, and `warnings` says so. Instances and layers inside them are refused with the error Convert to group gives, before anything changes; a main component works. `direction` sets the top level only. A single group becomes a frame in place and several layers are wrapped in a frame (both hug), as Add auto layout does; a frame with fewer than two layers is laid out as Add auto layout does. One undo step. Tests in `crates/engine/src/layout_suggest_tests.rs`: `two_rows_of_two_squares_become_a_vertical_frame_of_two_horizontal_rows`, `suggesting_auto_layout_is_one_undo_step`, `three_squares_in_a_row_get_one_horizontal_layout_without_nesting`, `three_squares_in_a_column_get_one_vertical_layout_without_nesting`, `a_header_above_two_columns_of_squares_gives_a_row_per_line`, `a_header_above_a_tall_layer_beside_a_column_nests_three_levels`, `unequal_gaps_use_the_smallest_and_say_so`, `overlapping_layers_leave_the_frame_without_auto_layout_and_say_so`, `a_group_becomes_a_frame_in_place_and_follows_the_rules`, `several_layers_are_wrapped_in_a_frame_that_is_then_split`, `a_direction_forces_the_top_level_and_nested_frames_follow_the_gaps`, `a_frame_with_one_layer_is_laid_out_like_add_auto_layout`, `add_auto_layout_still_makes_a_single_row`, `a_centred_title_above_a_card_is_lined_up_at_the_card_edge_with_a_warning`, `instances_and_layers_inside_them_are_refused_and_a_main_component_works`. Not attempted: overlapping layers, keeping uneven offsets across the flow (they line up at the smallest, with a warning), grids |
+| "Add auto layout" on a selection | done | the Layout sidebar exposes Add auto layout (+) for groups and frames using the same `layout.add` command as the context menu; a single group becomes a frame in place, keeping its id, name and direct children; adding auto layout to an empty frame keeps its size, Fixed (it collapsed to 20×20); a frame with content still hugs it, as does a new frame wrapped around a selection (#369). `node.set` with auto layout keys on a mix of layers applies them to the frames and warns about the rest instead of failing the whole call (#603) |
 | Real Figma files laid out identically | **not checked** | needs `.fig` or REST import of real files ([gaps](gaps.md) #1, #3) |
 | Performance: re-flow only where sizes or places changed | done | measured in `cargo xtask bench` (components at scale) |
 
@@ -100,6 +101,7 @@ Status: **pass** (a case in the suite holds), **fixed** (the suite found a diver
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-05 | patch | M2, #1823: Suggest auto layout is no longer Add auto layout under another name: `layout.suggest` splits a frame's layers into rows (Vertical) or else columns (Horizontal) by the gaps between their boxes, wraps each band of several layers in a new frame without fill or clipping that hugs it, and repeats inside it (16 levels, 1,000 layers per frame at most). The frame keeps its size; gap and padding come from the bands, so layers keep their boxes where the gaps are even and the bands start at the same offset; instances and layers inside them are refused; uneven gaps (smallest used), bands that start at different offsets across the flow (lined up at the smallest) and layers that overlap along both axes come back as `warnings`. A band frame hugs only when its own split succeeds: a band whose layers overlap along both axes gets no auto layout and stays Fixed, so it cannot reflow those children. `direction` sets the top level only; one undo step; `layout.add` is unchanged. Tests in `layout_suggest_tests.rs` |
 | 2026-11-03 | patch | M2, #1825: baseline alignment of a layer without text (an icon next to a text) puts its bottom on the line's baseline, as the help center's figure shows ("the bottoms of the icon and the word home are aligned on the red line"); it kept to the top of the line. A layer reaching below the text's baseline moves the text down, and a line with no text lines the layers' bottoms up (the documentation is silent; CSS baseline alignment does the same). Tests: `alignment_rules` (three cases), engine `baseline_alignment_puts_an_icons_bottom_on_the_text_baseline`. Numbers unchanged. |
 | 2026-11-02 | patch | M2, #1824: fill container children share the free space by their content area: each one's own insets (padding and an included inside stroke, from the same `insets` the frame uses) come off the free space before the equal split and go back on its share, so a child with more padding or a thicker inside stroke takes a little more and the content areas match ("Figma distributes space amongst fill container children by the children's content area instead of by their size, matching the CSS border-box model", Use auto layout with CSS Flexbox in mind). Min and max still clamp the outer sizes and the frozen-share loop is as it was; children without insets split as before. Test: `nested_tests::fill_children_share_by_content_area` |
 | 2026-11-02 | patch | M2, #1838: a double-click on an edge of an auto layout frame's bounding box sets Hug contents on that axis, Alt+double-click on an edge of a child's Fill container ("Double-click the vertical or horizontal edge of an auto layout object's bounding box to set it to Hug contents", "Hold ⌥ Option or Alt and double-click ... to set it to Fill container", Guide to auto layout); a vertical edge sizes the width, a horizontal one the height; the Keyboard shortcuts panel lists both gestures. Test: `double_click_tests::a_double_click_on_an_auto_layout_edge_hugs_and_with_alt_fills`. Numbers unchanged. |

docs/boards-parity.md

@@ -1,6 +1,6 @@
 # Boards parity
 
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-04 · **Change:** minor (a "+" handle dragged carries the preview: the next shape is made where it is let go, or a connector joins the object it is let go on (#1919); a connector attached to a side starts 4 pt outside the border, so its stroke never lies on the fill (#1916); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-04 · **Change:** minor (a `.jam` elbowed connector saved with its path keeps it on import instead of being routed again (#1910); a "+" handle dragged carries the preview: the next shape is made where it is let go, or a connector joins the object it is let go on (#1919); a connector attached to a side starts 4 pt outside the border, so its stroke never lies on the fill (#1916); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre)
 
 **Breadth ~47%, ready ~29% (estimated, erring low).** A board is a FigCraft file of its own kind
 (`file.newBoard`) with a dot grid on the page, sticky notes, shapes with text, connectors that
@@ -66,7 +66,7 @@ all end with the same geometry.
 | Audio and huddles | missing | |
 | AI features (summaries, sorting stickies, generating boards) | missing | |
 | Grid on the page | done | the canvas render draws it after the page colour and before the layers (`figcraft_render::Dots`), so objects cover it. Dots by default, or lines, graph paper (a strong line every 2–12 cells over fainter ones, like Japanese section paper) or none; spacing (4–512), mark size and contrast are settings kept with the preferences (`board.grid`; Preferences ▸ Board grid). Zoomed out it thins out (dots and lines by halves, graph paper down to its strong lines) until the marks are at least 14 points apart (10 for lines), the marks the next step drops fading out first; dots stay about a point and a half across on screen (1 to 3 points), scaled by the size setting. Dark marks on a light page, light ones on a dark page, from the theme's ink; written straight into the image, no allocation per mark, a crossing of two lines blended once; never in exports. FigCraft's own settings: the incumbent's board grid has none |
-| `.jam` import and export | **partial**: a `.jam` opens as a board, best effort (#1342): its stickies and shapes with text come in as frames with their generated layers and its connectors as vectors, not as native board objects; no export | see [`file-format-parity.md`](file-format-parity.md) |
+| `.jam` import and export | **partial**: a `.jam` opens as a board, best effort (#1342): its stickies and shapes with text come in as frames with their generated layers and its connectors as vectors, not as native board objects (an elbowed connector keeps the path it was saved with, #1910); no export | see [`file-format-parity.md`](file-format-parity.md) |
 
 ## Revision history
 
@@ -74,6 +74,7 @@ all end with the same geometry.
 |---|---|---|
 | 2026-11-03 | minor | M12, #1919: as the quick create help says ("Click to select and create the next shape in that direction, or drag the preview to any location on your board"; "A new shape is created with a connector and its text field active"), a "+" beside the selected sticky or shape can be dragged: the preview follows the pointer and, let go on empty board, the next one is made there, centred on the pointer, and joined by a connector leaving by the handle's side and arriving by the side facing it (`board.addConnected` gains `at: [x, y]`, a point of the page placed in the parent's coordinates); let go on another sticky or shape, inside a section or frame too (`board::sticky_or_shape_at`), a connector joins the two instead (`board.connector`), that object outlined while the pointer is over it; let go off the canvas or over the toolbar, nothing, and the bar above the selection stays away meanwhile, as for any drag. The click is as before. A shape picker on drop and choosing the connector type are not done (the help doesn't describe them). Tests: `board_connect_tests` (the drag ones), engine `board_connected_tests::the_next_one_goes_where_it_is_dropped`. Numbers unchanged. |
 | 2026-11-04 | minor | M12, #1916: a connector end attached to a side starts 4 pt outside the border (`board_route::END_GAP`), as FigJam's do (the issue's screenshots: the line starts a few pixels outside, with a round cap), so the stroke never lies on the fill; elbows leaving one side share their first run along its normal, curves leave tangent to it and straight ones fan out from the same point; the `.jam` importer's routes, re-attached ends, path handles and labels follow the route's points; an end placed by hand with Cmd/Ctrl held keeps its exact point. Tests: `board_route_tests` (three). Numbers unchanged. |
+| 2026-11-04 | patch | M6, #1910: a `.jam` elbowed connector saved with its path (FigJam's `connectorControlPoints`) keeps it on import: the points become the `ConnectorPath::Runs` a connector reshaped by hand has and the line is walked along them, so a connector drawn around a layer stays around it; one whose points don't make a path from its ends' sides is routed as before. Still a vector, not a native board object. Details in [`file-format-parity.md`](file-format-parity.md). |
 | 2026-10-31 | minor | M12: as the help describes, holding Cmd/Ctrl while moving a connector's end places it on any part of an object instead of snapping to a side. It keeps that spot as a fraction of the object's box, so it follows the object when it moves or resizes, and without the key an end snaps as before. `board.connector {fromAt, toAt}` and `board.reattach {at}` take it; saved only when set. Numbers unchanged |
 | 2026-10-31 | patch | M12, #1708: a connector end dropped on the outer half of a shape takes the side it is towards, instead of only within 10 px of a side's middle, so a drop anywhere along an edge chooses that edge (dragging a selected connector's end and with the connector tool, ring included); a drop in the middle of a shape still takes the facing side. |
 | 2026-10-31 | minor | M12, #1710: a selected elbow or curved connector shows path handles. Dragging a run moves it and a first or last run gains an extra run to stay on its end; a curve's middle goes where it is dragged (`board.reshape`, one undo step). The shape travels with what the connector joins, is saved with the file, and goes back to routing itself when the style changes or an end moves to something else. |

docs/collab-protocol.md

@@ -535,9 +535,21 @@ resuming with its offline edits, and leaving the session going back to snapshot
   `ws://<ip:port>/` and sends the token only inside its `Hello`. Links are pasted into the Join
   dialog (its field has the keyboard when it opens; Escape closes it), or opened from anywhere:
   see *Opening invite links* below.
-- Reconnect: a connection that drops after it was live reconnects with growing pauses (0.5 s,
-  doubling up to 10 s, 12 attempts); a refusal (wrong token, full) or the host ending the session
-  is final; a first join that can't reach the host fails at once. A reconnect resumes as the same
+- Reconnect: a connection that drops after it was live reconnects until you leave, with growing
+  pauses (0.5 s, doubling up to 10 s, 12 attempts), then a minute's pause and as many again. A
+  server turning a live session away is taken as passing (busy, a limit, a file it couldn't read
+  just now) unless it says why in words that are for good: the link, the file or your place in it
+  is gone, or the versions can't talk (`FINAL_REFUSALS` in `crates/collab-net/src/join.rs`). Those
+  and the host ending the session are final; a first join that can't reach the host fails at once.
+  Messages queued while offline go out paced, so they stay within what a server takes from a
+  connection.
+- Disconnected: while it reconnects, and after it can't go on, the tab shows a red mark and a strip
+  across the top of the canvas says so, with **Retry now** (`collab.reconnect`). The tab can still
+  be edited. A session you joined that ended stays on its tab with **Try again**, **Save a copy…**
+  and **Dismiss** (`collab.leave`). **Try again** joins it in the same tab as someone new; if the
+  tab changed since it lost the server, what changed opens beside it as an unsaved
+  "offline copy" and the tab shows the server's version. A session that gets out of step does the
+  same by itself. A reconnect resumes as the same
   client: the guest's connection keeps the session id, client id and last sequence number from
   the messages it read and sends them in its next `Hello` (see Offline and reconnect).
 - The browser build joins and publishes to a server (see *Built (the browser client)*); hosting

docs/collaboration-parity.md

@@ -12,7 +12,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 
 | Feature | Figma | FigCraft | Hours |
 |---|---|---|---|
-| Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, reconnect with backoff), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/<key>` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 |
+| Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, a live connection reconnecting until you leave), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/<key>` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 |
 | Live cursors, selections, viewports; follow / observation mode; spotlight | yes | **done, in live sessions**: named cursors (one name for live sessions and comments: Preferences ▸ Your name, also in the Share popover and the Join dialog, kept in the browser too; a rename shows at once in the sessions you're in, #1380), selection outlines, avatars (an AI agent attached over MCP also shows its avatar and an outline around the layers it last edited or selected while it works, in or out of a session, #1416), follow (click an avatar), others' text carets and selected characters with their names, a note when two people type in one layer; spotlight (your avatar's menu, `collab.spotlight`): everyone follows your view and page, people who join later too, anyone who moves their view stops following and a banner offers to follow again, a newer spotlight takes over. Left: polish (no accounts, so anyone in the session can spotlight) | 2–4 |
 | Cursor chat, audio, high-fives | yes | **partial, in live sessions**: cursor chat (`/` opens a bubble at your pointer; everyone sees it as you type, it fades a few seconds after the last change, Enter sends and Escape takes it back, 100 characters; `collab.cursorChat` for agents); sent as ephemeral presence the host checks and rate-limits, never stored. No audio, high-fives or emote reactions | 2–5 |
 | Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address, with an edit code and a view-only code, picked before or while sharing, whose holders see every change and can't make one; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 |
@@ -28,6 +28,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 |---|---|---|
 | 2026-11-06 | patch | M9, #2026: one conflicting auto layout edit added a conflict for every size and place it moved (a padding changed on both sides of a file with one instance gave 10, with 15 instances 138), and a `layout` conflict took all auto layout fields together, so a gap changed only on the branch was lost if main won the padding. `merge::plan` now leaves out values both sides work out for themselves: a hugging frame's or a filling child's size, text sizing to its characters, an auto layout child's place (when both sides turn it the same way) and a value a layer in an instance takes from its main; merging keeps the file merged into's own value and normalising lays it out from the merged inputs. `layout` and `childLayout` merge field by field: a field changed on one side merges, each field changed both ways is its own conflict (`<id>/layout.padding`, shown as auto layout padding with both sides' values). Tests: `branch_tests::one_conflicting_auto_layout_edit_is_one_conflict`, `branch_tests::auto_layout_fields_changed_one_way_survive_a_conflict`, `branch_tests::sizes_auto_layout_works_out_never_conflict`; the merge fuzz test leaves worked-out values out of what each side must show |
 | 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same (its `link` and `url`, like its `code`, are the view-only way in), and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
+| 2026-11-04 | minor | M9: a session you joined no longer turns into a local file by itself. A dropped connection reconnects until you leave (a minute's pause after each 12 attempts, a pause Retry now skips); only the host ending the session and refusals that are for good stop it; queued messages go out paced. While disconnected the tab shows a red mark and a strip across the canvas says so; a session that ended stays on its tab with Try again, Save a copy and Dismiss, and what changed offline opens beside it when it joins again |
 | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. |
 | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`<web_url>#join=…`). A browser build served beside its server names it with `<meta name="figcraft-server">`, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged |
 | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. |

docs/file-format-parity.md

@@ -1,6 +1,6 @@
 # File format parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (JPG exports take a quality, 1 to 100 with 90 the default, and embed the file's colour profile when it is sRGB too (#2004); a FigJam connector without a saved snapshot took no stroke and was invisible; its line's paint, weight, cap and dashes now come from the file's generated line record (#1807); a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); imported and pasted text finds an installed family under the other names its fonts give it, and with other case and spacing (#1292); `.fig` export writes colour calculations as the colour they show in each mode and leaves out, with a warning, one that resolves to nothing (#1280); `.fig` import budgets four decoded values per compressed byte instead of one, still within 20M–128M, so dense files within that budget open instead of being refused as having too many values (#574); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; folders, devices and pipes are refused before anything is read (#1114); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); a FigJam `.jam` file opens as a board (#1342); FigJam `.jam` files open like `.fig` files: File ▸ Open, drag and drop, `file.import` and the command line (#1342); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); SVG import draws each pattern tile once per scale, within the layer budget (#1080); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); offline Penpot 2.x import/export (#1143); `.sketch` import checked against Sketch's renders: master backgrounds, symbol clipping, tints before Sketch 64, mask opacity, bitmap fills, image overrides on shapes, stretching stacks, blur radii, colour adjustments, OKLab gradients, text growth, shape group borders (#1389); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); image member names are checked on read, and REST image placeholders get archive-safe keys (#1086); Android Vector Drawable (XML) export; `.fig` export: files the incumbent imports, with component set properties, and grid track sizes at its field ids; Save and auto-save don't replace changes another app made to the open file (#1330); `.sketch` import, best effort, Sketch 48 and newer; the PNG row names ignore overlapping layers and where include bounding box is offered; the Fonts table's missing-font row describes the Missing fonts window; `.figcraft` carries the file kind (boards); `.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732)) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (a FigJam elbow connector saved with its path (`connectorControlPoints`) keeps it on import, as a board connector reshaped by hand does, instead of being routed again (#1910); JPG exports take a quality, 1 to 100 with 90 the default, and embed the file's colour profile when it is sRGB too (#2004); a FigJam connector without a saved snapshot took no stroke and was invisible; its line's paint, weight, cap and dashes now come from the file's generated line record (#1807); a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); imported and pasted text finds an installed family under the other names its fonts give it, and with other case and spacing (#1292); `.fig` export writes colour calculations as the colour they show in each mode and leaves out, with a warning, one that resolves to nothing (#1280); `.fig` import budgets four decoded values per compressed byte instead of one, still within 20M–128M, so dense files within that budget open instead of being refused as having too many values (#574); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; folders, devices and pipes are refused before anything is read (#1114); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); a FigJam `.jam` file opens as a board (#1342); FigJam `.jam` files open like `.fig` files: File ▸ Open, drag and drop, `file.import` and the command line (#1342); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); SVG import draws each pattern tile once per scale, within the layer budget (#1080); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); offline Penpot 2.x import/export (#1143); `.sketch` import checked against Sketch's renders: master backgrounds, symbol clipping, tints before Sketch 64, mask opacity, bitmap fills, image overrides on shapes, stretching stacks, blur radii, colour adjustments, OKLab gradients, text growth, shape group borders (#1389); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); image member names are checked on read, and REST image placeholders get archive-safe keys (#1086); Android Vector Drawable (XML) export; `.fig` export: files the incumbent imports, with component set properties, and grid track sizes at its field ids; Save and auto-save don't replace changes another app made to the open file (#1330); `.sketch` import, best effort, Sketch 48 and newer; the PNG row names ignore overlapping layers and where include bounding box is offered; the Fonts table's missing-font row describes the Missing fonts window; `.figcraft` carries the file kind (boards); `.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732)) · **Target:** Figma Design (desktop app 126.10.7)
 
 Every format Figma reads or writes, with FigCraft's support. Sources: `Info.plist` of
 `/Applications/Figma.app` (document types only; nothing inside the bundle's code was read), Figma's
@@ -17,10 +17,10 @@ and prototype interactions are still unchecked there.
 
 | Format | Figma | FigCraft read | FigCraft write | Fidelity / testing | Hours |
 |---|---|---|---|---|---|
-| `.fig` (Figma Design, `com.figma.document`, `application/x-figma`) | native (cloud; "Save local copy") | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP) | **experimental** ([below](#export-to-fig-experimental)) | `.fig` files open (best effort): the zip, its deflate/zstd chunks and the kiwi schema are decoded generically and mapped by field name onto the REST importer, so pages, the layer tree, geometry, paints (styles resolved), strokes, effects, text with styled runs, vectors as editable vector networks with region-specific fill paints (points, curved segments, filled areas with their winding, per-point corner radius and handle mirroring, end caps; outlines when the network is missing or damaged), auto layout (grid included; a flow that records no primary-axis sizing hugs on that axis, an instance that records no auto layout has its main's), constraints, ellipse arcs, boolean operations, components, sets (with their descriptions), instances (expanded from their main with overrides, derived layout and property values; the size and resizing their layers override stay overrides), styles, variables with modes and bindings, prototyping (set-variable, set-variable-mode and conditional actions included) and image fills from the archive come across; sticky notes and shapes with text keep their generated backgrounds, styled text, text paints, saved child bounds and sticky author lines as editable frame children, including saved vector networks without geometry paths, outer fill/stroke outlines when generated geometry is damaged, and outer body text when its generated child is unusable even if an author survives (#1341, #1397); connectors, tables, code blocks, slides and similar layers come in as the closest frames, text layers and vectors, with a warning; anything else is a warning. Since 2026-10-17 (community batches #727, #728): an instance's own identity and the cached library components a file carries, overrides applied by key and order, local text values and instance overrides over a shared text style, grid track sizes (fixed, content-sized, fill), slot content, labels of connectors saved with their drawn path (a static snapshot; the ends aren't live), skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, editable text on a path, image adjustments and images carried in the message; since 2026-10-29, style links that name a library style by asset key and version (the file's own copy of it), with override rows above the linking one still winning, and override rows restating a nested level's overrides applied at that level, below the instance's own (#1234), and the line breaks the file saved with a text, followed until an edit or a resize could move one, or where a line would come out more than 3% wider than its box in the fonts at hand (#1236). Budgets come from the file's own size (four decoded values per compressed byte, 20M–128M, lower ceilings on 32-bit targets; the layer cap follows the file's size too), so a 15.4 MB synthetic file with 300,000 layers opens whole; ZIP image reads have a separate total budget of 4 GiB (1 GiB on 32-bit targets) of decompressed ZIP-member bytes containing encoded images, with the 256 MiB per-image cap kept: a member that cannot fit is skipped before its output buffer is allocated, and the import report names the budget and counts skipped images (#1076). Failed reads and invalid image contents still consume the bytes read; a reference used by several layers is read once. This is not a limit on decoded pixels or total import memory; images carried inside the message are unchanged. The file's bytes stay out of the command journal; an import report lists what was left out or changed once the file opens. Elbowed and curved connectors without a saved path are routed as FigCraft's board connectors are (right angles, or one curve, from the sides of the layers they join), and a connector routed here takes its line's paint, weight, cap and dashes from the file's generated line record, as one with a saved snapshot does (#1807). A connector's label without a saved snapshot is kept as text centred on its line, without its background. Not read: table cells beyond their own layers, live style and variable links for vector region fills, variables bound to fields the editor can't bind, video fills. Tested on fixtures generated in code (`crates/format/src/fig/tests.rs`, `tail_tests.rs` and the per-feature `*_tests.rs` beside them, fuzzed), `crates/engine/src/shapebuilder_region_paints_tests.rs`, and by reading back what the export writes; the FigJam report sample from #1341 checked locally only; no representative real-world corpus yet | read tail 5–10, write: checks against real files 5–15 |
+| `.fig` (Figma Design, `com.figma.document`, `application/x-figma`) | native (cloud; "Save local copy") | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP) | **experimental** ([below](#export-to-fig-experimental)) | `.fig` files open (best effort): the zip, its deflate/zstd chunks and the kiwi schema are decoded generically and mapped by field name onto the REST importer, so pages, the layer tree, geometry, paints (styles resolved), strokes, effects, text with styled runs, vectors as editable vector networks with region-specific fill paints (points, curved segments, filled areas with their winding, per-point corner radius and handle mirroring, end caps; outlines when the network is missing or damaged), auto layout (grid included; a flow that records no primary-axis sizing hugs on that axis, an instance that records no auto layout has its main's), constraints, ellipse arcs, boolean operations, components, sets (with their descriptions), instances (expanded from their main with overrides, derived layout and property values; the size and resizing their layers override stay overrides), styles, variables with modes and bindings, prototyping (set-variable, set-variable-mode and conditional actions included) and image fills from the archive come across; sticky notes and shapes with text keep their generated backgrounds, styled text, text paints, saved child bounds and sticky author lines as editable frame children, including saved vector networks without geometry paths, outer fill/stroke outlines when generated geometry is damaged, and outer body text when its generated child is unusable even if an author survives (#1341, #1397); connectors, tables, code blocks, slides and similar layers come in as the closest frames, text layers and vectors, with a warning; anything else is a warning. Since 2026-10-17 (community batches #727, #728): an instance's own identity and the cached library components a file carries, overrides applied by key and order, local text values and instance overrides over a shared text style, grid track sizes (fixed, content-sized, fill), slot content, labels of connectors saved with their drawn path (a static snapshot; the ends aren't live), skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, editable text on a path, image adjustments and images carried in the message; since 2026-10-29, style links that name a library style by asset key and version (the file's own copy of it), with override rows above the linking one still winning, and override rows restating a nested level's overrides applied at that level, below the instance's own (#1234), and the line breaks the file saved with a text, followed until an edit or a resize could move one, or where a line would come out more than 3% wider than its box in the fonts at hand (#1236). Budgets come from the file's own size (four decoded values per compressed byte, 20M–128M, lower ceilings on 32-bit targets; the layer cap follows the file's size too), so a 15.4 MB synthetic file with 300,000 layers opens whole; ZIP image reads have a separate total budget of 4 GiB (1 GiB on 32-bit targets) of decompressed ZIP-member bytes containing encoded images, with the 256 MiB per-image cap kept: a member that cannot fit is skipped before its output buffer is allocated, and the import report names the budget and counts skipped images (#1076). Failed reads and invalid image contents still consume the bytes read; a reference used by several layers is read once. This is not a limit on decoded pixels or total import memory; images carried inside the message are unchanged. The file's bytes stay out of the command journal; an import report lists what was left out or changed once the file opens. Elbowed and curved connectors without a saved path are routed as FigCraft's board connectors are (right angles, or one curve, from the sides of the layers they join); an elbowed one saved with its path (`connectorControlPoints`: a point and an axis per run between the first and the last) keeps that path when it leaves and arrives by the ends' sides (#1910), and a curved one's saved `connectorBezierControlPoints` are not read; a connector routed here takes its line's paint, weight, cap and dashes from the file's generated line record, as one with a saved snapshot does (#1807). A connector's label without a saved snapshot is kept as text centred on its line, without its background. Not read: table cells beyond their own layers, live style and variable links for vector region fills, variables bound to fields the editor can't bind, video fills. Tested on fixtures generated in code (`crates/format/src/fig/tests.rs`, `tail_tests.rs` and the per-feature `*_tests.rs` beside them, fuzzed), `crates/engine/src/shapebuilder_region_paints_tests.rs`, and by reading back what the export writes; the FigJam report sample from #1341 checked locally only; no representative real-world corpus yet | read tail 5–10, write: checLine truncated
 | `.penpot` (Penpot 2.x ZIP export) | — | **yes, offline** (open, import, drop, CLI, MCP) | **yes, offline** (export, CLI convert) | Editable layers, supported flex/grid layout, components, tokens and prototypes using the existing model. Unsupported layouts retain saved positions and bounded metadata; toggle-overlay and embedded font binaries are reported. Font references remain editable; no downloads. Synthetic regression coverage; live Penpot and cross-platform QA remain open. See [Penpot reference](penpot.md). | further live Penpot and cross-platform QA |
 | `.sketch` (Sketch 48 and newer) | import (file browser ▸ Import or drop, desktop app too; converted to a Figma file, symbols as components; per the help center) | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP; Open With from Finder, Explorer and Linux file managers once installed; recent files show its `previews/preview.png`) | no (out of scope) | zip + JSON read from the public format description; Sketch 43–47 (text as binary property lists) and older (SQLite) files are refused with a message to resave them in a newer Sketch. Pages, artboards as frames with their background, groups; Sketch 2025 and newer: frames (clipping or not) with their style, graphics, stacks as auto layout (direction, gap, alignment, padding, wrap, hug/fill sizing, stretching filling every item across, items ignoring the stack), corners in the style (rounded, smooth with its smoothing; angled, inside square and inside arc as paths), pins and sizing, per-side borders, lists of blurs (progressive background blurs, glass), inner shadows in the shadow list, tints (a graphic's, group's or instance's fill colouring its layers, and colour overrides; from Sketch 64, before which a group's fill draws nothing), text colour and visibility overrides, text sized by its sizing; rectangles with corner radii, ovals, stars and polygons while their points are the generated ones, paths as editable vector networks, shape groups as their shape, as one compound path (children without an operation, by the group's winding rule) or as boolean operations (mixed operations nested from the left); operands' own borders ignored as Sketch does; open paths filled as if closed, edited ovals and rectangles as paths, bitmaps (their image under their style's fills; colour adjustments as image filters with Sketch's tone curve, contrast and then brightness added), slices, hotspots; transforms (rotation, flips after it), resizing constraints; fills (solid, gradients with Sketch's geometry, gradients mixed in OKLab or OKLCH as sRGB stops along the same colours, image patterns), borders (the first enabled border's width and position), shadows, inner shadows, layer, motion and background blurs (Sketch's radius is the standard deviation), opacity and blend modes; clipping masks (an outline mask that shows its own style draws a copy under itself, as Sketch does, and its opacity fades it and what it clips together; alpha masks only mask; broken mask chains wrapped), progressive opacity (Fade) as an alpha mask of its gradient; text with styled runs (UTF-16 ranges), paragraph and vertical alignment, lines placed by Sketch's line spacing behaviour, box sizing, fonts found by their PostScript names among the installed ones (else the family read from the name), variable font axes, Sketch's natural line (ascent and descent rounded, no line gap, a fifth more for classic Mac fonts) for text without a fixed line height; symbols as components (library copies on a page of their own) and instances carrying their masters' layers with overrides (text, nested swaps and hiding, images, also on shapes' image fills, layer and text styles, nested paths), clipping only where the master clips (`clippingBehavior` 1), laid out for their size the way Sketch does it (proportional sharing per pins from format 110, scaling before) and still live; master backgrounds in instances only when the master includes them in both instances and exports, as on Sketch's canvas and renders; Apple's system fonts found under the names designs use, with the platform's tracking kept as letter spacing; shared layer styles as paint (fills, border colours) and effect styles, shared text styles as text styles; Color Variables (also library ones) as colour variables with bindings; prototype links, flow starts, export options, layout and square grids (hidden, as Sketch shows them only in its layout view). Instances of a stack laid out at their size and texts an override changed measured again on open, an auto-width one growing from its aligned edge. Warnings: noise fills, OKLab and OKLCH gradients, motion and zoom blurs (drawn as plain blurs), fonts embedded with their data (not used), Smart Layout (kept as laid out), locked overrides, scaled instances. Tested on fixtures built in code (`crates/format/src/sketch/*_tests.rs`, fuzzed) and locally (`FIGCRAFT_SKETCH_SAMPLES`) on one real Sketch 50 file and the public Apache-2.0 IBM Carbon Design Kit saved by Sketch 68 and 83 (70,000 layers open in ~3 s, debug build; its edition saved by Sketch 47 is refused, as it should be); compared artboard by artboard with Sketch 2026's own renders (`FIGCRAFT_SKETCHTOOL`, black-box): the Sketch 50 file's 73 artboards differ in at most 2.3% of their pixels (0.8% on average) (text metrics, fonts FigCraft doesn't find, antialiasing), Carbon 11's 69 1.1% on average and at most 4.4% (text in IBM Plex, which the file embeds and FigCraft doesn't use yet), a Sketch 64 file's 65 artboards 2.1% on average, a Sketch 2026 showcaseLine truncated
-| `.jam` (whiteboards) | native to FigJam | **yes, best effort** (`file.open`, `file.import`, File ▸ Open, drop, CLI, MCP) | no | the same archive as a `.fig` (its canvas header reads `fig-jam.`) through the same reader (#1342): it opens as a board (the file kind; a `.fig` stays a design file), with generated sticky and shape backgrounds and text kept (#1341) as ordinary layers rather than native board objects (see [boards-parity](boards-parity.md)); tables, stamps, code blocks and the like come in as frames with their text and connectors as vectors, with an import note; a layer type the reader doesn't know is left out with a note naming it; writing `.jam` is not supported | — |
+| `.jam` (whiteboards) | native to FigJam | **yes, best effort** (`file.open`, `file.import`, File ▸ Open, drop, CLI, MCP) | no | the same archive as a `.fig` (its canvas header reads `fig-jam.`) through the same reader (#1342): it opens as a board (the file kind; a `.fig` stays a design file), with generated sticky and shape backgrounds and text kept (#1341) as ordinary layers rather than native board objects (see [boards-parity](boards-parity.md)); tables, stamps, code blocks and the like come in as frames with their text and connectors as vectors (an elbowed connector keeps the path it was saved with, #1910), with an import note; a layer type the reader doesn't know is left out with a note naming it; writing `.jam` is not supported | — |
 | `.deck` (Slides) | native to other Figma products | no | no | out of scope | — |
 | REST API file JSON (`GET /v1/files/:key`) + local variables JSON + `images/` folder | the API's output | **yes** (`file.open`, `file.import`, CLI) | no | pages, layer tree, geometry, paints, strokes, effects, text runs, vectors, auto layout (sizing modes left out read as hug, as documented; grid track sizes from `gridColumnsSizing` / `gridRowsSizing`: px, fr, auto, `minmax(0, 1fr)`, `repeat()`), constraints, grids, components, sets, instances with overrides (sizes and resizing included), component properties, slots (`SLOT` layers bound to their slot property; an instance's slot keeps its content as the instance's own unless its property value is the main's default content; slot limits and preferred components are warnings), styles, prototyping (incl. conditionals and variable modes), variables with modes, aliases, scopes and bindings, image adjustments (the same tint sign as `.fig`); the import report after opening; warnings for what's skipped (video triggers and actions, modifier keys). Unit tests in `crates/format/src/rest/*_tests.rs` | — |
 | `.figcraft` (ours: zip of `document.json` + images, versions inside) | — | yes | yes | streamed JSON, 50k layers save ~0.09 s / load ~0.16 s (`cargo xtask bench`); old files keep opening (`large_tests.rs`); image members are `images/<key>`, and a key that can't be one — path text, a space, over 128 chars — is left out with a complaint instead of loaded (`image_tests`); saves write a unique staging file and rename it into place (#284); optional auto-save of files with a path (`pref.autoSave`, #305); Save and auto-save refuse to write over a file another app (figcraft-cli, say) changed since it was opened or saved here, judged by its size and modification time: Revert to saved loads those changes, Save as keeps both, `file.save {overwrite: true}` replaces them (#1330); `kind: "board"` marks a board (left out for design files, so files from before boards are design files; the home screen reads it for the file's mark); board objects keep their `board` metadata on the layer; Dev Mode measurements are kept on the layer they start from (`measurements: [{to} | {side}]`, left out when there are none, so older files open with none) | — |
@@ -188,6 +188,7 @@ source paint coordinates.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-11-04 | minor | JPG export: `quality` (1 to 100, default 90) on `file.export`, `export.add` / `export.update` and MCP `export`, kept in the export setting; an sRGB file's JPGs embed the sRGB ICC profile, as Display P3 files' JPGs already embedded theirs, since an untagged JPG is only assumed to be sRGB (#2004). |
+| 2026-11-04 | minor | `.fig` and `.jam` import, #1910: an elbowed connector saved with its path keeps it. FigJam stores `connectorControlPoints`, one per run between the first and the last, each a point on its run (in the connector's parent's coordinates) with the run's axis; the first run leaves the start's side and the last arrives at the end's. They become the `ConnectorPath::Runs` a board connector reshaped by hand has (`figcraft_doc::route_along`), so a connector drawn around a layer in FigJam stays around it instead of being routed through it. Points that don't make such a path (off both axes, two runs in a row the same way, a first or last run sideways to its side or going back into its object, more runs than a hand could make) leave the connector to the router as before, and only connectors routed here count in the "follow FigCraft's own routing" note. A curved connector's `connectorBezierControlPoints` are still not read. Tests: `tail_tests::an_elbow_connector_saved_with_its_path_keeps_it`, `tail_tests::an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here`. |
 | 2026-11-01 | patch | `.fig` and `.jam` import: a connector without a saved snapshot (elbowed and curved ones are routed here) took no stroke, so it was invisible (#1807); its line's paint, weight, cap and dashes now come from the file's generated line record, as a saved snapshot's do, and the connector's own values, when it has any, win. Test: `fig::connector_label_tests::a_routed_connector_takes_its_line_style_from_the_generated_record`. Numbers unchanged |
 | 2026-10-31 | patch | M4: Dash and Custom strokes have a Dash cap (None, Round, Square) in the advanced stroke settings and `node.set {dashCap}`, on both ends of every dash on the canvas and in PNG, PDF and SVG. Unset, dashes keep taking the end point caps, so older files look the same; the saved file writes it only when set. Numbers unchanged |
 | 2026-10-30 | minor | `.fig` import: a connector's label without a saved snapshot was skipped; now the connector imports as a frame holding its line and the label, as a connector with a saved snapshot does, the label centred on the line's middle by length (in a 200-wide box, laid out again with the fonts at hand), in the connector's fill paints or black. Its background isn't known without the snapshot and is left out. Not checked on real files. Test: `fig::tests::tail::a_labelled_connector_without_a_snapshot_keeps_its_label` |

docs/mcp.md

@@ -1492,7 +1492,10 @@ only: a host stops hosting it, a guest leaves it.
   see `FIGCRAFT_CA_FILE` in [`server.md`](server.md#behind-a-reverse-proxy-tls)). `collab.leave {}`
   leaves the active document's session (or ends a join started from it that is still on its way
   or failed), and `collab.leave {session}` the session with that id (from `sessions`), whichever
-  document is active; the synced document stays open as your copy.
+  document is active; the synced document stays open as your copy. `collab.reconnect {}` acts on
+  the active document's lost session: a reconnect that is waiting tries now, and a session you
+  joined that couldn't go on is joined again in its tab. A dropped connection keeps reconnecting
+  until you leave (see *Reconnect* in [`collab-protocol.md`](collab-protocol.md)).
 - `collab.publish {server, name?, key?}` puts the active document on a `figcraft-server`
   ([`server.md`](server.md)) and syncs it from there (as that document's session; others go on): `server` is the address
   `figcraft-server key` prints (`ws://host:47900/?key=…`; or give `key` separately), `name` the

docs/server.md

@@ -43,7 +43,7 @@ Releases also ship it ready-built for Linux (`figcraft-server-<version>-linux-x8
   tells everyone it is restarting. Every change it accepted is on disk before anyone is told about
   it, so even a hard kill loses nothing confirmed (a file's log is then folded into a new snapshot
   the next time everyone leaves it). Apps that were in a file keep editing and reconnect once the
-  server is back (for about a minute and a half), as the same participants.
+  server is back, as the same participants.
 
 ## Publishing a file
 
@@ -753,6 +753,18 @@ sudo -u figcraft figcraft-server --config /etc/figcraft-server/server.toml key
 The other commands ([Managing files and links](#managing-files-and-links)) run the same way, as
 the `figcraft` user with `--config /etc/figcraft-server/server.toml`.
 
+**Browser editor on the same hostname (optional).** The steps above install the collaboration
+server. To also serve the editor, copy the complete contents of the matching
+`figcraft-web-<version>/` release directory into `/srv/figcraft-web`, with `index.html` directly
+inside it; keep subdirectories such as `snippets/`. Use the commented browser-and-server block
+in [`packaging/server/Caddyfile`](../packaging/server/Caddyfile) in place of its active server-only
+block. Keep the loopback `listen`, `public_url` and `trusted_proxy` settings from steps 2 and 4.
+The editor opens at `https://figcraft.example.com/app/`; the hostname root remains the
+`wss://figcraft.example.com/` collaboration endpoint, not an editor homepage. Configure the
+browser's `figcraft-server` meta tag as described in the
+[web-hosting guide](../packaging/web/README.md#live-sessions), using the server address without a
+publishing key. That guide also covers browser requirements, fonts and static-file delivery.
+
 **In Docker instead of systemd.** [`packaging/server/Dockerfile`](../packaging/server/Dockerfile)
 builds a small image (the binary on a distroless base, no shell) that runs as an unprivileged
 user, keeps its files in the `/data` volume and stops gracefully on `docker stop`. Build it from

packaging/server/Caddyfile

@@ -16,3 +16,38 @@ figcraft.example.com {
 # 		reverse_proxy 127.0.0.1:47900
 # 	}
 # }
+
+# Browser editor and server on the same hostname instead. Use this block IN PLACE OF the
+# active block above. Copy the complete browser release into /srv/figcraft-web, with index.html
+# directly inside it and subdirectories such as snippets/ kept. See packaging/web/README.md for
+# the browser's figcraft-server meta tag; never put a publishing key in public HTML.
+# Open the editor at /app/. The hostname root remains the WSS endpoint, not an editor homepage.
+#
+# figcraft.example.com {
+# 	encode gzip
+#
+# 	redir /app /app/?{query} 308
+#
+# 	@entry path /app/ /app/index.html
+# 	header @entry Cache-Control "no-cache"
+#
+# 	@release_assets path /app/figcraft-web-*.js /app/figcraft-web-*_bg.wasm
+# 	# Defer so a missing asset does not receive the one-year cache header.
+# 	header @release_assets Cache-Control "public, max-age=31536000, immutable" {
+# 		defer
+# 	}
+#
+# 	# No root favicon is configured: do not forward its implicit request to the WS server.
+# 	handle /favicon.ico {
+# 		respond 204
+# 	}
+#
+# 	handle_path /app/* {
+# 		root * /srv/figcraft-web
+# 		file_server
+# 	}
+#
+# 	handle {
+# 		reverse_proxy 127.0.0.1:47900
+# 	}
+# }

packaging/server/caddy-test.sh

@@ -0,0 +1,119 @@
+#!/bin/sh
+# Exercise the optional browser/server example with synthetic files over loopback HTTP.
+# Requires caddy and nc; no backend, root access, public DNS or certificate is needed.
+# Usage: packaging/server/caddy-test.sh
+# Overrides: CADDY=/path/to/caddy CADDYFILE=/path/to/Caddyfile CADDY_TEST_PORT=18080
+set -eu
+
+HERE="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
+CADDY="${CADDY:-caddy}"
+CADDYFILE="${CADDYFILE:-$HERE/Caddyfile}"
+PORT="${CADDY_TEST_PORT:-18080}"
+case "$PORT" in ''|*[!0-9]*) echo 'CADDY_TEST_PORT must be a port number' >&2; exit 1 ;; esac
+[ "$PORT" -gt 1023 ] && [ "$PORT" -lt 65536 ] || exit 1
+command -v "$CADDY" >/dev/null
+command -v nc >/dev/null
+
+WORK="$(mktemp -d)"
+PID=''
+cleanup() {
+    status=$?
+    trap - 0
+    if [ -n "$PID" ]; then
+        kill "$PID" 2>/dev/null || true
+        wait "$PID" 2>/dev/null || true
+    fi
+    rm -rf "$WORK"
+    exit "$status"
+}
+trap cleanup 0
+trap 'exit 1' HUP INT TERM
+fail() { printf 'FAIL: %s\n' "$*" >&2; cat "$WORK/caddy.log" >&2; exit 1; }
+
+mkdir "$WORK/web"
+printf 'synthetic editor\n' >"$WORK/web/index.html"
+printf 'synthetic JavaScript asset\n' >"$WORK/web/figcraft-web-present.js"
+printf 'synthetic WebAssembly asset\n' >"$WORK/web/figcraft-web-present_bg.wasm"
+
+# Extract the real commented block, changing only the hostname and filesystem root.
+# The admin endpoint is disabled; state directories stay inside the temporary fixture.
+printf '{\n\tadmin off\n}\n' >"$WORK/Caddyfile"
+awk -v port="$PORT" -v root="$WORK/web" '
+    $0 == "# figcraft.example.com {" { active = 1; found++; print "http://127.0.0.1:" port " {"; next }
+    active {
+        if ($0 !~ /^#/) exit 1
+        if ($0 == "# }") { print "}"; active = 0; next }
+        sub(/^# ?/, "")
+        if ($1 == "root" && $2 == "*" && $3 == "/srv/figcraft-web") $0 = "\t\troot * \"" root "\""
+        print
+    }
+    END { if (found != 1 || active) exit 1 }
+' "$CADDYFILE" >>"$WORK/Caddyfile"
+
+XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" \
+    "$CADDY" validate --config "$WORK/Caddyfile" --adapter caddyfile >"$WORK/caddy.log" 2>&1 ||
+    fail 'extracted example did not validate'
+XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" \
+    "$CADDY" run --config "$WORK/Caddyfile" --adapter caddyfile >>"$WORK/caddy.log" 2>&1 &
+PID=$!
+
+request() {
+    printf '%s %s HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n' "$1" "$2" |
+        nc -w 2 127.0.0.1 "$PORT" >"$WORK/response" || return 1
+    tr -d '\r' <"$WORK/response" >"$WORK/clean"
+    awk 'BEGIN { headers = 1 } headers && /^$/ { headers = 0; next } !headers { print }' \
+        "$WORK/clean" >"$WORK/body"
+}
+status() { awk 'NR == 1 { print $2 }' "$WORK/clean"; }
+cache() {
+    awk '/^$/ { exit } tolower($0) ~ /^cache-control:/ { sub(/^[^:]*:[ \t]*/, ""); print }' "$WORK/clean"
+}
+
+attempt=0
+until request GET /app/ 2>/dev/null && [ "$(status)" = 200 ]; do
+    kill -0 "$PID" 2>/dev/null || fail 'Caddy did not start (port may be in use)'
+    attempt=$((attempt + 1))
+    [ "$attempt" -lt 30 ] || fail 'Caddy did not become ready'
+    sleep 0.1
+done
+kill -0 "$PID" 2>/dev/null || fail 'Caddy exited during startup'
+
+IMMUTABLE='public, max-age=31536000, immutable'
+checks=0
+check() {
+    method=$1
+    name=$2
+    expected=$3
+    request "$method" "/app/$name" || fail "$method $name request failed"
+    [ "$(status)" = "$expected" ] || fail "$method $name: expected HTTP $expected, got $(status)"
+    if [ "$expected" = 200 ]; then
+        [ "$(cache)" = "$IMMUTABLE" ] || fail "$method $name: successful asset lost its cache policy"
+        if [ "$method" = GET ]; then
+            cmp -s "$WORK/body" "$WORK/web/$name" || fail "$method $name: wrong file contents"
+        fi
+    else
+        [ -z "$(cache)" ] || fail "$method $name: a missing asset received Cache-Control: $(cache)"
+    fi
+    if [ "$method" = HEAD ]; then
+        [ ! -s "$WORK/body" ] || fail "$method $name: HEAD returned a body"
+    fi
+    checks=$((checks + 1))
+    printf 'PASS: %s %s -> %s\n' "$method" "$name" "$expected"
+}
+
+for method in GET HEAD; do
+    check "$method" figcraft-web-present.js 200
+    check "$method" figcraft-web-present_bg.wasm 200
+    check "$method" figcraft-web-later.js 404
+    check "$method" figcraft-web-later_bg.wasm 404
+done
+
+# The same URLs must work immediately when deployment supplies the previously missing files.
+printf 'new JavaScript asset\n' >"$WORK/web/figcraft-web-later.js"
+printf 'new WebAssembly asset\n' >"$WORK/web/figcraft-web-later_bg.wasm"
+for method in GET HEAD; do
+    check "$method" figcraft-web-later.js 200
+    check "$method" figcraft-web-later_bg.wasm 200
+done
+
+printf 'Caddy browser asset caching: %s checks passed (%s)\n' "$checks" "$("$CADDY" version)"