From f26226590ad579f0dcf9931d842050e915e6688e Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Sun, 1 Nov 2026 05:13:36 +0100
Subject: [PATCH 01/70] Reject negative and fractional index in
 variable.moveMode

Found while testing crates/engine/src/cmd/variables.rs:267 (move_mode)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/engine/src/cmd/variables.rs             |  6 +++---
 crates/engine/src/variables_behaviour_tests.rs | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/crates/engine/src/cmd/variables.rs b/crates/engine/src/cmd/variables.rs
index 59ad46ced..75607ae64 100644
--- a/crates/engine/src/cmd/variables.rs
+++ b/crates/engine/src/cmd/variables.rs
@@ -12,7 +12,7 @@ use serde_json::{Value, json};
 
 use super::lists::BoundList;
 use super::{CommandSpec, ok};
-use crate::params::{boolean, get, num, req_string, string};
+use crate::params::{boolean, get, req_index, req_string, string};
 use crate::{Result, Session, bad, spec};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -258,13 +258,13 @@ fn remove_mode(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn move_mode(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "variable.moveMode";
-    let to = num(p, "to").filter(|x| x.is_finite()).ok_or_else(|| bad(cmd, "`to` must be a number"))?;
+    let to = req_index(cmd, p, "to")?;
     let doc = s.doc_mut()?;
     let (ci, mode) = mode_of(doc, cmd, p)?;
     let coll = doc.variables.collections.get_mut(ci).ok_or_else(|| bad(cmd, "no such collection"))?;
     let from = coll.modes.iter().position(|m| m.id == mode).ok_or_else(|| bad(cmd, "no such mode"))?;
     let m = coll.modes.remove(from);
-    let at = (to.max(0.0) as usize).min(coll.modes.len());
+    let at = to.min(coll.modes.len());
     coll.modes.insert(at, m);
     ok()
 }
diff --git a/crates/engine/src/variables_behaviour_tests.rs b/crates/engine/src/variables_behaviour_tests.rs
index 306a8fba9..2717726f8 100644
--- a/crates/engine/src/variables_behaviour_tests.rs
+++ b/crates/engine/src/variables_behaviour_tests.rs
@@ -68,6 +68,20 @@ fn types_and_their_starting_values() {
     assert!(s.execute("variable.create", &json!({"collection": "C", "name": "y", "type": "number", "value": "wide"})).is_err());
 }
 
+#[test]
+fn move_mode_rejects_negative_and_fractional_indexes() {
+    let mut s = Session::new();
+    theme(&mut s);
+    run(&mut s, "variable.addMode", json!({"collection": "Theme", "name": "Dim"}));
+    let order =
+        |s: &Session| -> Vec<String> { s.doc().unwrap().variables.collection("Theme").unwrap().modes.iter().map(|m| m.name.clone()).collect() };
+    let before = order(&s);
+    for to in [json!(-1), json!(1.9)] {
+        assert!(s.execute("variable.moveMode", &json!({"collection": "Theme", "mode": "Dim", "to": to})).is_err(), "{to}");
+        assert_eq!(order(&s), before, "{to}");
+    }
+}
+
 #[test]
 fn modes_new_duplicated_reordered_and_the_default() {
     // Documented: a new mode starts with the default mode's values and a duplicated one with its

From 3ebf0641cb3b07440460ceb26f20c272fabe8eaf Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Mon, 2 Nov 2026 23:45:53 -0500
Subject: [PATCH 02/70] fix(collab): place keyed-list puts through an index
 within a batch (#1893)

* fix(collab): place keyed-list puts through an index within a batch

Each Put of a comment, style, variable or collection scanned the whole
list for its key (cloning String keys on the way) before appending, so a
batch of N new entries cost N squared comparisons on the hub every
session shares. Removing an image also rebuilt the document's image-use
set before checking the image existed.

Replica::apply now keeps a per-batch key index for each keyed list; it
is rebuilt when the list's length or the entry at a key no longer
matches, and dropped on whole-list sets, reorders and real removals.
Removing an absent entry or image returns without scanning.

* fix(collab): keep the keyed-list index current through removals

Build the index without dead code outside tests, drop the wall-clock
assertion from the large-batch test, and shift the index down after a
single-entry removal instead of discarding it, so a run of removals in
one batch does not index the list again each time. Staleness checks for
puts and removals share one helper. Tests cover removals, duplicate keys
from a whole-list set, and absent keys.
---
 crates/collab/src/docprops.rs         | 152 +++++++++++++++++++++-----
 crates/collab/src/keyed_list_tests.rs | 132 ++++++++++++++++++++++
 crates/collab/src/lib.rs              |   2 +
 crates/collab/src/replica.rs          |   7 +-
 4 files changed, 261 insertions(+), 32 deletions(-)
 create mode 100644 crates/collab/src/keyed_list_tests.rs

diff --git a/crates/collab/src/docprops.rs b/crates/collab/src/docprops.rs
index e203d2c3b..b590064df 100644
--- a/crates/collab/src/docprops.rs
+++ b/crates/collab/src/docprops.rs
@@ -54,18 +54,71 @@ struct List<T: Keyed> {
     entry: fn(T::Key) -> Entry,
     get: fn(&Document) -> &Vec<T>,
     get_mut: fn(&mut Document) -> &mut Vec<T>,
+    /// The list's slot in an [`Index`].
+    index: fn(&mut Index) -> &mut Option<KeyIndex<T::Key>>,
 }
 
-const STYLES: List<Style> =
-    List { whole: DocProp::Styles, order: DocProp::StyleOrder, entry: Entry::Style, get: |d| &d.styles, get_mut: |d| &mut d.styles };
-const COMMENTS: List<Comment> =
-    List { whole: DocProp::Comments, order: DocProp::CommentOrder, entry: Entry::Comment, get: |d| &d.comments, get_mut: |d| &mut d.comments };
+/// Where the entries of each keyed list sit, kept while one batch is applied: a batch can put
+/// hundreds of thousands of new entries, and finding each one's place by a scan of the growing
+/// list would cost the square of that on the thread every session shares.
+#[derive(Default)]
+pub(crate) struct Index {
+    styles: Option<KeyIndex<String>>,
+    comments: Option<KeyIndex<u64>>,
+    collections: Option<KeyIndex<String>>,
+    variables: Option<KeyIndex<String>>,
+}
+
+/// The position of the first entry with each key in one list, and the list's length when it was
+/// last brought up to date: a list whose length changed since is indexed again.
+struct KeyIndex<K> {
+    at: BTreeMap<K, usize>,
+    len: usize,
+}
+
+impl<K: Ord> KeyIndex<K> {
+    fn of<T: Keyed<Key = K>>(list: &[T]) -> Self {
+        let mut at = BTreeMap::new();
+        for (i, e) in list.iter().enumerate() {
+            at.entry(e.key()).or_insert(i);
+        }
+        KeyIndex { at, len: list.len() }
+    }
+
+    /// The index in `slot`, built again from `list` unless its length and its place for `key`
+    /// still match the list, so a list changed some other way is never trusted.
+    fn current<'a, T: Keyed<Key = K>>(slot: &'a mut Option<Self>, list: &[T], key: &K) -> &'a mut Self {
+        let stale = |ix: &Self| ix.len != list.len() || ix.at.get(key).is_some_and(|&i| list.get(i).is_none_or(|e| e.key() != *key));
+        if slot.as_ref().is_none_or(stale) {
+            *slot = Some(KeyIndex::of(list));
+        }
+        slot.get_or_insert_with(|| KeyIndex::of(list))
+    }
+}
+
+const STYLES: List<Style> = List {
+    whole: DocProp::Styles,
+    order: DocProp::StyleOrder,
+    entry: Entry::Style,
+    get: |d| &d.styles,
+    get_mut: |d| &mut d.styles,
+    index: |i| &mut i.styles,
+};
+const COMMENTS: List<Comment> = List {
+    whole: DocProp::Comments,
+    order: DocProp::CommentOrder,
+    entry: Entry::Comment,
+    get: |d| &d.comments,
+    get_mut: |d| &mut d.comments,
+    index: |i| &mut i.comments,
+};
 const COLLECTIONS: List<Collection> = List {
     whole: DocProp::Collections,
     order: DocProp::CollectionOrder,
     entry: Entry::Collection,
     get: |d| &d.variables.collections,
     get_mut: |d| &mut d.variables.collections,
+    index: |i| &mut i.collections,
 };
 const VARIABLES: List<Variable> = List {
     whole: DocProp::Variables,
@@ -73,6 +126,7 @@ const VARIABLES: List<Variable> = List {
     entry: Entry::Variable,
     get: |d| &d.variables.variables,
     get_mut: |d| &mut d.variables.variables,
+    index: |i| &mut i.variables,
 };
 
 impl<T: Keyed> List<T> {
@@ -111,25 +165,53 @@ impl<T: Keyed> List<T> {
         Ok(())
     }
 
-    fn put(&self, doc: &mut Document, key: T::Key, value: &Json) -> Result<(), Error> {
+    fn put(&self, doc: &mut Document, key: T::Key, value: &Json, index: &mut Index) -> Result<(), Error> {
         let t: T = value.read("entry")?;
         if t.key() != key {
             return Err(Error::Invalid("an entry's id must match the entry it is put at".into()));
         }
         let list = (self.get_mut)(doc);
-        match list.iter_mut().find(|e| e.key() == key) {
+        let ix = KeyIndex::current((self.index)(index), list, &key);
+        match ix.at.get(&key).copied().and_then(|i| list.get_mut(i)) {
             Some(e) => *e = t,
-            None => list.push(t),
+            None => {
+                list.push(t);
+                ix.at.insert(key, list.len() - 1);
+                ix.len = list.len();
+            }
         }
         Ok(())
     }
 
-    fn remove(&self, doc: &mut Document, key: &T::Key) {
-        (self.get_mut)(doc).retain(|e| e.key() != *key);
+    fn remove(&self, doc: &mut Document, key: &T::Key, index: &mut Index) {
+        let list = (self.get_mut)(doc);
+        let slot = (self.index)(index);
+        let ix = KeyIndex::current(slot, list, key);
+        // An absent entry leaves the list as it is, without a scan of it.
+        let Some(at) = ix.at.get(key).copied() else {
+            return;
+        };
+        let before = list.len();
+        list.retain(|e| e.key() != *key);
+        // One entry gone at `at`: the index is kept current by shifting the entries after it down,
+        // so the next removal in the batch need not index the list again. Duplicates of the key
+        // (more than one entry gone) leave it to be rebuilt.
+        if list.len() + 1 == before {
+            ix.at.remove(key);
+            for i in ix.at.values_mut() {
+                if *i > at {
+                    *i -= 1;
+                }
+            }
+            ix.len = list.len();
+        } else {
+            *slot = None;
+        }
     }
 
     /// Entries in `keys` order first, the rest after in their current order.
-    fn reorder(&self, doc: &mut Document, value: &Json) -> Result<(), Error> {
+    fn reorder(&self, doc: &mut Document, value: &Json, index: &mut Index) -> Result<(), Error> {
+        *(self.index)(index) = None;
         let keys: Vec<T::Key> = value.read("order")?;
         let list = (self.get_mut)(doc);
         let mut slots: Vec<Option<T>> = std::mem::take(list).into_iter().map(Some).collect();
@@ -150,7 +232,8 @@ impl<T: Keyed> List<T> {
         Ok(())
     }
 
-    fn set_whole(&self, doc: &mut Document, value: &Json) -> Result<(), Error> {
+    fn set_whole(&self, doc: &mut Document, value: &Json, index: &mut Index) -> Result<(), Error> {
+        *(self.index)(index) = None;
         *(self.get_mut)(doc) = value.read("list")?;
         Ok(())
     }
@@ -313,31 +396,38 @@ pub(crate) fn diff(a: &Document, b: &Document, out: &mut Vec<Change>) -> Result<
     diff_map(&a.votes, &b.votes, |x, y| x == y, |k| Entry::Ballot(k.clone()), Json::of, out)
 }
 
-/// Apply a document-level change. Returns whether it can change which pages are listed (the
-/// library store page is never listed).
+/// [`apply_indexed`] for one change on its own.
+#[cfg(test)]
 pub(crate) fn apply(doc: &mut Document, change: &Change) -> Result<bool, Error> {
+    apply_indexed(doc, change, &mut Index::default())
+}
+
+/// Apply a document-level change, with the keyed lists' positions kept in `index` between the
+/// changes of one batch. Returns whether it can change which pages are listed (the library store
+/// page is never listed).
+pub(crate) fn apply_indexed(doc: &mut Document, change: &Change, index: &mut Index) -> Result<bool, Error> {
     match change {
         Change::SetDoc { prop, value } => {
             if set_scalar(doc, *prop, value)? {
                 return Ok(*prop == DocProp::Libraries);
             }
             match prop {
-                DocProp::Styles => STYLES.set_whole(doc, value),
-                DocProp::StyleOrder => STYLES.reorder(doc, value),
-                DocProp::Comments => COMMENTS.set_whole(doc, value),
-                DocProp::CommentOrder => COMMENTS.reorder(doc, value),
-                DocProp::Collections => COLLECTIONS.set_whole(doc, value),
-                DocProp::CollectionOrder => COLLECTIONS.reorder(doc, value),
-                DocProp::Variables => VARIABLES.set_whole(doc, value),
-                DocProp::VariableOrder => VARIABLES.reorder(doc, value),
+                DocProp::Styles => STYLES.set_whole(doc, value, index),
+                DocProp::StyleOrder => STYLES.reorder(doc, value, index),
+                DocProp::Comments => COMMENTS.set_whole(doc, value, index),
+                DocProp::CommentOrder => COMMENTS.reorder(doc, value, index),
+                DocProp::Collections => COLLECTIONS.set_whole(doc, value, index),
+                DocProp::CollectionOrder => COLLECTIONS.reorder(doc, value, index),
+                DocProp::Variables => VARIABLES.set_whole(doc, value, index),
+                DocProp::VariableOrder => VARIABLES.reorder(doc, value, index),
                 _ => Err(Error::Invalid(format!("{prop:?} is not a list"))),
             }?;
         }
         Change::Put { entry, value } => match entry {
-            Entry::Style(k) => STYLES.put(doc, k.clone(), value)?,
-            Entry::Comment(k) => COMMENTS.put(doc, *k, value)?,
-            Entry::Collection(k) => COLLECTIONS.put(doc, k.clone(), value)?,
-            Entry::Variable(k) => VARIABLES.put(doc, k.clone(), value)?,
+            Entry::Style(k) => STYLES.put(doc, k.clone(), value, index)?,
+            Entry::Comment(k) => COMMENTS.put(doc, *k, value, index)?,
+            Entry::Collection(k) => COLLECTIONS.put(doc, k.clone(), value, index)?,
+            Entry::Variable(k) => VARIABLES.put(doc, k.clone(), value, index)?,
             Entry::DevSnapshot(k) => {
                 let snap: DevSnapshot = value.read("dev snapshot")?;
                 doc.dev_snapshots.insert(*k, Arc::new(snap));
@@ -351,14 +441,18 @@ pub(crate) fn apply(doc: &mut Document, change: &Change) -> Result<bool, Error>
             }
         },
         Change::Remove { entry } => match entry {
-            Entry::Style(k) => STYLES.remove(doc, k),
-            Entry::Comment(k) => COMMENTS.remove(doc, k),
-            Entry::Collection(k) => COLLECTIONS.remove(doc, k),
-            Entry::Variable(k) => VARIABLES.remove(doc, k),
+            Entry::Style(k) => STYLES.remove(doc, k, index),
+            Entry::Comment(k) => COMMENTS.remove(doc, k, index),
+            Entry::Collection(k) => COLLECTIONS.remove(doc, k, index),
+            Entry::Variable(k) => VARIABLES.remove(doc, k, index),
             Entry::DevSnapshot(k) => {
                 doc.dev_snapshots.remove(k);
             }
             Entry::Image(k) => {
+                // Nothing to remove: no need to look through the document for what shows it.
+                if !doc.images.contains_key(k) {
+                    return Ok(false);
+                }
                 // An image a layer or style shows stays: removing it would let other bytes go
                 // under its key, swapping the picture that layer shows ([`image_for`]).
                 if figcraft_doc::used_images(doc).contains(k) {
diff --git a/crates/collab/src/keyed_list_tests.rs b/crates/collab/src/keyed_list_tests.rs
new file mode 100644
index 000000000..6f0f9857b
--- /dev/null
+++ b/crates/collab/src/keyed_list_tests.rs
@@ -0,0 +1,132 @@
+//! Keyed document lists (comments, styles, variables, collections) applied in large batches: a
+//! batch of new entries is placed through an index, not a scan of the growing list per entry, and
+//! puts, removes and reorders in one batch still leave the list a scan would.
+
+use figcraft_doc::{Comment, Document, Message};
+
+use crate::change::{Change, DocProp, Entry, Json};
+use crate::{Mode, Replica};
+
+fn comment(id: u64, text: &str, doc: &Document) -> Comment {
+    let page = doc.first_page().unwrap();
+    Comment { id, page, x: 1.0, y: 2.0, anchor: None, first: Message::new("A", text, 0), resolved: false, replies: Vec::new(), read_by: None }
+}
+
+fn put(c: &Comment) -> Change {
+    Change::Put { entry: Entry::Comment(c.id), value: Json::of(c).unwrap() }
+}
+
+#[test]
+fn a_large_batch_of_new_comments_lands_whole_and_in_order() {
+    let doc = Document::new("t");
+    let changes: Vec<Change> = (1..=100_000).map(|i| put(&comment(i, "hi", &doc))).collect();
+    let mut r = Replica::new(doc);
+    // A scan per put took minutes here; indexed it takes well under a second, even unoptimised.
+    r.apply(&changes, Mode::Strict).unwrap();
+    assert_eq!(r.document().comments.len(), 100_000);
+    assert!(r.document().comments.iter().zip(1..).all(|(c, i)| c.id == i));
+}
+
+#[test]
+fn puts_removes_and_reorders_in_one_batch_match_one_by_one() {
+    let doc = Document::new("t");
+    let c = |i, t| comment(i, t, &doc);
+    let batch = vec![
+        put(&c(1, "a")),
+        put(&c(2, "b")),
+        put(&c(3, "c")),
+        // Replaced in place.
+        put(&c(2, "B")),
+        Change::Remove { entry: Entry::Comment(1) },
+        // Absent: nothing changes.
+        Change::Remove { entry: Entry::Comment(9) },
+        put(&c(4, "d")),
+        put(&c(6, "f")),
+        // Two removals in a row: the second goes through the index the first kept current.
+        Change::Remove { entry: Entry::Comment(2) },
+        Change::Remove { entry: Entry::Comment(6) },
+        put(&c(2, "B")),
+        put(&c(3, "C")),
+        Change::SetDoc { prop: DocProp::CommentOrder, value: Json::of(&[4u64, 3, 2]).unwrap() },
+        put(&c(2, "BB")),
+        put(&c(1, "again")),
+        Change::SetDoc { prop: DocProp::Comments, value: Json::of(&vec![c(7, "x"), c(8, "y")]).unwrap() },
+        put(&c(8, "Y")),
+        put(&c(5, "e")),
+    ];
+    let mut together = Replica::new(doc.clone());
+    together.apply(&batch, Mode::Strict).unwrap();
+    let mut one_by_one = Replica::new(doc.clone());
+    for ch in &batch {
+        one_by_one.apply(std::slice::from_ref(ch), Mode::Strict).unwrap();
+    }
+    assert_eq!(together.document().comments, one_by_one.document().comments);
+    let got: Vec<(u64, &str)> = together.document().comments.iter().map(|c| (c.id, c.first.text.as_str())).collect();
+    assert_eq!(got, vec![(7, "x"), (8, "Y"), (5, "e")]);
+}
+
+#[test]
+fn removing_an_absent_image_does_not_fail() {
+    let mut doc = Document::new("t");
+    let remove = Change::Remove { entry: Entry::Image("missing".into()) };
+    assert!(!crate::docprops::apply(&mut doc, &remove).unwrap());
+}
+
+#[test]
+fn removals_in_one_batch_keep_the_index_current() {
+    let doc = Document::new("t");
+    let c = |i, t| comment(i, t, &doc);
+    let batch = vec![
+        put(&c(1, "a")),
+        put(&c(2, "b")),
+        put(&c(3, "c")),
+        put(&c(4, "d")),
+        put(&c(5, "e")),
+        Change::Remove { entry: Entry::Comment(2) },
+        Change::Remove { entry: Entry::Comment(9) },
+        Change::Remove { entry: Entry::Comment(4) },
+        // Replaced where the shifted index says they now are.
+        put(&c(5, "E")),
+        put(&c(3, "C")),
+        put(&c(1, "A")),
+        Change::Remove { entry: Entry::Comment(1) },
+        put(&c(2, "B")),
+        put(&c(5, "EE")),
+    ];
+    let mut together = Replica::new(doc.clone());
+    together.apply(&batch, Mode::Strict).unwrap();
+    let mut one_by_one = Replica::new(doc.clone());
+    for ch in &batch {
+        one_by_one.apply(std::slice::from_ref(ch), Mode::Strict).unwrap();
+    }
+    assert_eq!(together.document().comments, one_by_one.document().comments);
+    let got: Vec<(u64, &str)> = together.document().comments.iter().map(|c| (c.id, c.first.text.as_str())).collect();
+    assert_eq!(got, vec![(3, "C"), (5, "EE"), (2, "B")]);
+}
+
+#[test]
+fn duplicate_keys_from_a_whole_list_match_one_by_one() {
+    let doc = Document::new("t");
+    let c = |i, t| comment(i, t, &doc);
+    let batch = vec![
+        Change::SetDoc { prop: DocProp::Comments, value: Json::of(&vec![c(1, "a"), c(2, "b"), c(2, "b2"), c(3, "c"), c(4, "d")]).unwrap() },
+        // The first entry with the key is the one replaced, as a scan finds it.
+        put(&c(2, "B")),
+        put(&c(4, "D")),
+        // Both entries with the key go: the index is built again for what follows.
+        Change::Remove { entry: Entry::Comment(2) },
+        put(&c(3, "C")),
+        Change::Remove { entry: Entry::Comment(1) },
+        put(&c(2, "again")),
+        put(&c(4, "DD")),
+    ];
+    let mut together = Replica::new(doc.clone());
+    together.apply(&batch, Mode::Lenient).unwrap();
+    let mut one_by_one = Replica::new(doc.clone());
+    for ch in &batch {
+        one_by_one.apply(std::slice::from_ref(ch), Mode::Lenient).unwrap();
+    }
+    assert_eq!(together.document().comments, one_by_one.document().comments);
+    let got: Vec<(u64, &str)> = together.document().comments.iter().map(|c| (c.id, c.first.text.as_str())).collect();
+    assert_eq!(got, vec![(3, "C"), (4, "DD"), (2, "again")]);
+}
diff --git a/crates/collab/src/lib.rs b/crates/collab/src/lib.rs
index 8954b20ad..ec40b101d 100644
--- a/crates/collab/src/lib.rs
+++ b/crates/collab/src/lib.rs
@@ -148,6 +148,8 @@ mod image_tests;
 #[cfg(test)]
 mod journal_tests;
 #[cfg(test)]
+mod keyed_list_tests;
+#[cfg(test)]
 mod merge_list_tests;
 #[cfg(test)]
 mod merge_tests;
diff --git a/crates/collab/src/replica.rs b/crates/collab/src/replica.rs
index 34508296e..d14676a01 100644
--- a/crates/collab/src/replica.rs
+++ b/crates/collab/src/replica.rs
@@ -192,8 +192,9 @@ impl Replica {
         self.doc.take_dirty();
         let mut out = Applied::default();
         let (mut relist, mut relist_all) = (BTreeSet::new(), false);
+        let mut index = docprops::Index::default();
         for c in changes {
-            match self.apply_one(c, &mut out) {
+            match self.apply_one(c, &mut out, &mut index) {
                 Ok(Relist::No) => {}
                 Ok(Relist::Page(p)) => {
                     relist.insert(p);
@@ -214,7 +215,7 @@ impl Replica {
     }
 
     /// Apply one change. Returns what of the page list needs rebuilding.
-    fn apply_one(&mut self, c: &Change, out: &mut Applied) -> Result<Relist, Error> {
+    fn apply_one(&mut self, c: &Change, out: &mut Applied, index: &mut docprops::Index) -> Result<Relist, Error> {
         match c {
             Change::Create { id, kind, parent, position, props } => {
                 frac::validate(position).map_err(|e| Error::Invalid(e.to_string()))?;
@@ -297,7 +298,7 @@ impl Replica {
                 Ok(if page { Relist::Page(*id) } else { Relist::No })
             }
             Change::SetDoc { .. } | Change::Put { .. } | Change::Remove { .. } => {
-                Ok(if docprops::apply(&mut self.doc, c)? { Relist::All } else { Relist::No })
+                Ok(if docprops::apply_indexed(&mut self.doc, c, index)? { Relist::All } else { Relist::No })
             }
         }
     }

From 033e943dc75a549d7ad604b45184ffd8904265d3 Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Tue, 3 Nov 2026 06:12:29 +0100
Subject: [PATCH 03/70] Reject fractional index in proto.interaction.remove and
 set (#1874)

* Reject fractional index in proto.interaction.remove and set

Found while testing crates/engine/src/cmd/proto.rs:37 (proto.interaction.remove) and :412 (set)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Name the upper bound in the interaction index error (review)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/engine/src/cmd/proto.rs | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/crates/engine/src/cmd/proto.rs b/crates/engine/src/cmd/proto.rs
index dc30e933b..a39f7d036 100644
--- a/crates/engine/src/cmd/proto.rs
+++ b/crates/engine/src/cmd/proto.rs
@@ -31,8 +31,8 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("proto.interaction.remove", "Remove interaction", "{id?, index}", true, |s, p| {
             let cmd = "proto.interaction.remove";
             let k = req_num(cmd, p, "index")?;
-            if k < 0.0 {
-                return Err(bad(cmd, "`index` must be ≥ 0"));
+            if !(0.0..1e9).contains(&k) || k.fract() != 0.0 {
+                return Err(bad(cmd, "`index` must be a whole number in 0..1e9"));
             }
             let k = k as usize;
             let mut hit = false;
@@ -406,8 +406,8 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "proto.interaction.set";
     let p = &super::proto_actions::with_expressions(cmd, &s.doc()?.variables, p)?;
     let k = req_num(cmd, p, "index")?;
-    if k < 0.0 {
-        return Err(bad(cmd, "`index` must be ≥ 0"));
+    if !(0.0..1e9).contains(&k) || k.fract() != 0.0 {
+        return Err(bad(cmd, "`index` must be a whole number in 0..1e9"));
     }
     let k = k as usize;
     let whole: Option<Interaction> = parse(cmd, p, "interaction")?;
@@ -536,6 +536,20 @@ mod tests {
         assert_eq!(s.doc().unwrap().node(a).unwrap().interactions.len(), 2);
     }
 
+    #[test]
+    fn fractional_index_is_rejected() {
+        let mut s = Session::new();
+        let a = frame(&mut s, 0.0);
+        let b = frame(&mut s, 200.0);
+        s.execute("proto.interaction.add", &json!({"id": a, "dest": b})).unwrap();
+        s.execute("proto.interaction.add", &json!({"id": a, "dest": b})).unwrap();
+        assert!(s.execute("proto.interaction.remove", &json!({"id": a, "index": 0.5})).is_err());
+        assert_eq!(s.doc().unwrap().node(a).unwrap().interactions.len(), 2);
+        let before = s.doc().unwrap().node(a).unwrap().interactions[0].clone();
+        assert!(s.execute("proto.interaction.set", &json!({"id": a, "index": 0.5, "easing": "linear"})).is_err());
+        assert_eq!(s.doc().unwrap().node(a).unwrap().interactions[0], before);
+    }
+
     #[test]
     fn flows_add_rename_remove() {
         let mut s = Session::new();

From 7d9d2bda50b699c9234a4d152dbf2e44a9c0f593 Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Tue, 3 Nov 2026 06:12:39 +0100
Subject: [PATCH 04/70] Reject fractional index in layout.setTrack (#1892)

Found while testing crates/engine/src/cmd/layout.rs:46-48 (set_track)

Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/engine/src/cmd/layout.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crates/engine/src/cmd/layout.rs b/crates/engine/src/cmd/layout.rs
index 1d9ae3256..6972a6780 100644
--- a/crates/engine/src/cmd/layout.rs
+++ b/crates/engine/src/cmd/layout.rs
@@ -42,8 +42,8 @@ fn set_track(s: &mut Session, p: &Value) -> Result<Value> {
             return Err(bad(CMD, format!("node {id} is not a grid auto layout frame")));
         };
         let count = tracks_now.len().max(if columns { l.grid_columns } else { l.grid_rows } as usize).min(MAX_TRACKS);
-        if !(0.0..count as f64).contains(&index) {
-            return Err(bad(CMD, format!("`index` must be 0..{count}")));
+        if index.fract() != 0.0 || !(0.0..count as f64).contains(&index) {
+            return Err(bad(CMD, format!("`index` must be an integer in 0..{count}")));
         }
         let i = index as usize;
         let track = match kind {
@@ -256,6 +256,7 @@ mod tests {
             json!({"ids": [f], "axis": "diagonal", "index": 0, "sizing": "fixed"}),
             json!({"ids": [f], "axis": "columns", "index": 9, "sizing": "fixed"}),
             json!({"ids": [f], "axis": "columns", "index": -1, "sizing": "hug"}),
+            json!({"ids": [f], "axis": "columns", "index": 1.5, "sizing": "fixed", "value": 50}),
             json!({"ids": [f], "axis": "columns", "index": 0, "sizing": "stretchy"}),
             json!({"ids": [kids[1]], "axis": "columns", "index": 0, "sizing": "hug"}),
         ] {

From ad20c568747a81d1c48d0cc5581161c283e1028c Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Tue, 3 Nov 2026 06:12:49 +0100
Subject: [PATCH 05/70] Reject invalid dashes in node.set instead of dropping
 entries (#1899)

* Reject invalid dashes in node.set instead of dropping entries

Found while testing crates/engine/src/cmd/props.rs:580

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Reject boolean dash entries in node.set (review)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/engine/src/cmd/props.rs      | 10 +++++++++-
 crates/engine/src/dash_cap_tests.rs | 15 +++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/cmd/props.rs b/crates/engine/src/cmd/props.rs
index 01f83bc85..96c9fa922 100644
--- a/crates/engine/src/cmd/props.rs
+++ b/crates/engine/src/cmd/props.rs
@@ -623,7 +623,15 @@ fn apply_look(cmd: &str, doc: &mut Document, id: NodeId, k: &str, v: &Value) ->
             doc.get_mut(id)?.stroke.miter_limit = StrokeProps::miter_limit_for(deg);
         }
         "dashes" => {
-            let d: Vec<f64> = v.as_array().map(|a| a.iter().filter_map(f64_of).map(|x| x.max(0.0)).collect()).unwrap_or_default();
+            let d: Vec<f64> = if v.is_null() {
+                Vec::new()
+            } else {
+                let a = v.as_array().ok_or_else(|| bad(cmd, "`dashes` must be an array of numbers"))?;
+                a.iter()
+                    .map(|x| if x.is_boolean() { None } else { f64_of(x).map(|n| n.max(0.0)) })
+                    .collect::<Option<_>>()
+                    .ok_or_else(|| bad(cmd, "`dashes` must be an array of numbers"))?
+            };
             doc.get_mut(id)?.stroke.dashes = d;
         }
         "dashCap" => {
diff --git a/crates/engine/src/dash_cap_tests.rs b/crates/engine/src/dash_cap_tests.rs
index e9c8e04bc..48ac9e012 100644
--- a/crates/engine/src/dash_cap_tests.rs
+++ b/crates/engine/src/dash_cap_tests.rs
@@ -69,3 +69,18 @@ fn inspect_shows_it_and_copied_properties_carry_it() {
     s.execute("edit.pasteProperties", &json!({"ids": [b]})).unwrap();
     assert_eq!(cap(&s, b), None);
 }
+
+#[test]
+fn node_set_rejects_bad_dashes_and_keeps_the_stroke() {
+    let mut s = Session::new();
+    let l = line(&mut s);
+    let dashes = |s: &Session| s.doc().unwrap().node(l).unwrap().stroke.dashes.clone();
+    for bad in [json!([5, "x", 20]), json!([5, true, 20]), json!([5, false, 20]), json!("abc"), json!(5)] {
+        assert!(s.execute("node.set", &json!({"id": l, "props": {"dashes": bad}})).is_err());
+        assert_eq!(dashes(&s), vec![20.0, 20.0], "a rejected value changes nothing");
+    }
+    s.execute("node.set", &json!({"id": l, "props": {"dashes": [5, 20]}})).unwrap();
+    assert_eq!(dashes(&s), vec![5.0, 20.0]);
+    s.execute("node.set", &json!({"id": l, "props": {"dashes": null}})).unwrap();
+    assert!(dashes(&s).is_empty());
+}

From 8717728a876f8bac3192a6ea204ee4e229253334 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 00:12:58 -0500
Subject: [PATCH 06/70] perf(color): sort gradient stops once per diamond
 texture (#1894)

Gradient::sample cloned, sanitised and sorted every stop on each call,
and the diamond texture sampled it for each of its 65 536 pixels, so a
file's gradient with many stops cost that sort 65 536 times.

sample_sorted samples stops already sorted, finding the segment by binary
search; sample delegates to it and the diamond texture sorts once.

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/color/src/lib.rs    | 42 ++++++++++++++++++++++----------------
 crates/color/src/tests.rs  | 38 ++++++++++++++++++++++++++++++++++
 crates/render/src/paint.rs |  4 +++-
 3 files changed, 65 insertions(+), 19 deletions(-)

diff --git a/crates/color/src/lib.rs b/crates/color/src/lib.rs
index 190fdbb9c..d47f035b3 100644
--- a/crates/color/src/lib.rs
+++ b/crates/color/src/lib.rs
@@ -376,26 +376,32 @@ impl Gradient {
         s
     }
 
-    /// The colour at `t` (0..1) along the gradient.
+    /// The colour at `t` (0..1) along the gradient. Sorts the stops on every call: to sample one
+    /// gradient many times, sort once with [`Self::sorted_stops`] and use [`sample_sorted`].
     pub fn sample(&self, t: f32) -> Color {
-        let stops = self.sorted_stops();
-        let t = clamp01(t);
-        let mut prev = match stops.first() {
-            Some(s) => *s,
-            None => return Color::BLACK,
-        };
-        if t <= prev.position {
-            return prev.color;
+        sample_sorted(&self.sorted_stops(), t)
+    }
+}
+
+/// The colour at `t` (0..1) along stops already sorted by [`Gradient::sorted_stops`]: found by a
+/// binary search, so a renderer sampling a file's gradient per pixel doesn't scan or sort its
+/// stops each time.
+pub fn sample_sorted(stops: &[ColorStop], t: f32) -> Color {
+    let t = clamp01(t);
+    let Some(first) = stops.first() else { return Color::BLACK };
+    if t <= first.position {
+        return first.color;
+    }
+    // The first stop after the first one at or past `t`, and the stop before it.
+    let rest = stops.get(1..).unwrap_or_default();
+    let i = rest.partition_point(|s| s.position < t);
+    match (rest.get(i), stops.get(i)) {
+        (Some(s), Some(prev)) => {
+            let span = s.position - prev.position;
+            let f = if span > 1e-6 { (t - prev.position) / span } else { 1.0 };
+            prev.color.lerp(s.color, f)
         }
-        for s in stops.iter().skip(1) {
-            if t <= s.position {
-                let span = s.position - prev.position;
-                let f = if span > 1e-6 { (t - prev.position) / span } else { 1.0 };
-                return prev.color.lerp(s.color, f);
-            }
-            prev = *s;
-        }
-        prev.color
+        _ => stops.last().map_or(Color::BLACK, |s| s.color),
     }
 }
 
diff --git a/crates/color/src/tests.rs b/crates/color/src/tests.rs
index a41d0dd2e..e28e1bb10 100644
--- a/crates/color/src/tests.rs
+++ b/crates/color/src/tests.rs
@@ -59,6 +59,44 @@ fn gradient_sampling() {
     assert_eq!(g.sample(0.5).to_hex(), "808080");
 }
 
+#[test]
+fn sampling_sorted_stops_matches_a_scan() {
+    // The scan `sample` used to make: the first stop at or past `t`, mixed with the one before.
+    fn scan(stops: &[ColorStop], t: f32) -> Color {
+        let t = if t.is_nan() { 0.0 } else { t.clamp(0.0, 1.0) };
+        let mut prev = stops[0];
+        if t <= prev.position {
+            return prev.color;
+        }
+        for s in &stops[1..] {
+            if t <= s.position {
+                let span = s.position - prev.position;
+                let f = if span > 1e-6 { (t - prev.position) / span } else { 1.0 };
+                return prev.color.lerp(s.color, f);
+            }
+            prev = *s;
+        }
+        prev.color
+    }
+    let grey = |v: f32| Color { r: v, g: v, b: v, a: 1.0 };
+    let positions = [0.3, 0.0, 0.3, 1.0, 0.7, f32::NAN, 0.5, 0.5, 0.9];
+    let g = Gradient {
+        kind: GradientKind::Diamond,
+        stops: positions.iter().enumerate().map(|(i, p)| ColorStop { position: *p, color: grey(i as f32 / 10.0) }).collect(),
+        from: (0.5, 0.5),
+        to: (1.0, 0.5),
+        width: (0.5, 1.0),
+    };
+    let sorted = g.sorted_stops();
+    for i in -10..=110 {
+        let t = i as f32 / 100.0;
+        assert_eq!(sample_sorted(&sorted, t), scan(&sorted, t), "t = {t}");
+        assert_eq!(g.sample(t), scan(&sorted, t), "t = {t}");
+    }
+    assert_eq!(sample_sorted(&sorted, f32::NAN), scan(&sorted, f32::NAN));
+    assert_eq!(sample_sorted(&[], 0.5), Color::BLACK);
+}
+
 #[test]
 fn paint_serde_shape() {
     let p = Paint::solid(Color::from_hex("FF0000").unwrap());
diff --git a/crates/render/src/paint.rs b/crates/render/src/paint.rs
index a6c059480..56de03464 100644
--- a/crates/render/src/paint.rs
+++ b/crates/render/src/paint.rs
@@ -79,11 +79,13 @@ fn diamond_pixmap(g: &Gradient, opacity: f32) -> Option<Arc<Pixmap>> {
     const N: u32 = 256;
     let mut p = Pixmap::new(N, N)?;
     let half = f64::from(N) / 2.0;
+    // Sorted once for the 65 536 samples below, not once per sample.
+    let stops = g.sorted_stops();
     for (i, px) in p.data_mut().as_chunks_mut::<4>().0.iter_mut().enumerate() {
         let x = ((i as u32 % N) as f64 + 0.5 - half) / half;
         let y = ((i as u32 / N) as f64 + 0.5 - half) / half;
         let t = (x.abs() + y.abs()) as f32;
-        let c = g.sample(t);
+        let c = figcraft_color::sample_sorted(&stops, t);
         let a = c.a * opacity;
         let q = |v: f32| (v * a * 255.0).round().clamp(0.0, 255.0) as u8;
         px.copy_from_slice(&[q(c.r), q(c.g), q(c.b), (a * 255.0).round().clamp(0.0, 255.0) as u8]);

From 0eec582805074d18e457b139fd3428698861e37b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 00:13:07 -0500
Subject: [PATCH 07/70] perf(format): drop dangling Penpot token aliases with a
 worklist (#1897)

drop_dangling_aliases rebuilt the id set and rescanned every token each
round, and an alias chain lost one link per round: quadratic in the
chain. Dependencies are now indexed once and invalidation propagates
through a queue, counting how many tokens make each variable id, so each
token is visited a bounded number of times with the same result.

Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/format/src/penpot.rs | 92 +++++++++++++++++++++++++++++++------
 1 file changed, 78 insertions(+), 14 deletions(-)

diff --git a/crates/format/src/penpot.rs b/crates/format/src/penpot.rs
index 6cd8fe53c..c182b4ee1 100644
--- a/crates/format/src/penpot.rs
+++ b/crates/format/src/penpot.rs
@@ -2030,27 +2030,51 @@ fn token_theme_groups<'a>(value: &'a Value, tokens: &BTreeMap<&str, BTreeMap<Str
 }
 
 /// Drops the resolved tokens that alias a variable which isn't being made, until none does; how
-/// many were dropped.
+/// many were dropped. Each token is looked at once to start with, and again only when a variable
+/// it aliases goes: a chain of aliases dropped one link per round would otherwise rescan every
+/// token per link.
 fn drop_dangling_aliases(
     resolved: &mut BTreeMap<&str, (usize, VariableType, BTreeMap<String, VariableValue>)>,
     var_id: &dyn Fn(&str) -> String,
 ) -> usize {
-    let mut dropped = 0;
-    loop {
-        let ids: BTreeSet<String> = resolved.keys().map(|p| var_id(p)).collect();
-        let dangling: Vec<&str> = resolved
-            .iter()
-            .filter(|(_, (_, _, values))| values.values().any(|v| matches!(v, VariableValue::Alias(target) if !ids.contains(target))))
-            .map(|(path, _)| *path)
-            .collect();
-        if dangling.is_empty() {
-            return dropped;
+    // How many tokens make each variable id, and the tokens aliasing each id.
+    let mut makers: BTreeMap<String, usize> = BTreeMap::new();
+    for path in resolved.keys() {
+        *makers.entry(var_id(path)).or_default() += 1;
+    }
+    let mut aliased_by: BTreeMap<&str, Vec<&str>> = BTreeMap::new();
+    let mut gone: Vec<&str> = Vec::new();
+    for (path, (_, _, values)) in resolved.iter() {
+        let mut dangling = false;
+        for v in values.values() {
+            if let VariableValue::Alias(target) = v {
+                dangling |= !makers.contains_key(target);
+                aliased_by.entry(target.as_str()).or_default().push(*path);
+            }
         }
-        dropped += dangling.len();
-        for path in dangling {
-            resolved.remove(path);
+        if dangling {
+            gone.push(*path);
         }
     }
+    let mut dropped: BTreeSet<&str> = gone.iter().copied().collect();
+    while let Some(path) = gone.pop() {
+        let id = var_id(path);
+        let Some(left) = makers.get_mut(&id) else { continue };
+        *left -= 1;
+        if *left > 0 {
+            continue;
+        }
+        makers.remove(&id);
+        for &by in aliased_by.get(id.as_str()).into_iter().flatten() {
+            if dropped.insert(by) {
+                gone.push(by);
+            }
+        }
+    }
+    for path in &dropped {
+        resolved.remove(path);
+    }
+    dropped.len()
 }
 
 /// Moves a base token whose expression refers to a themed token into that token's collection, so
@@ -6515,3 +6539,43 @@ mod tests {
         assert_eq!(button.interactions.len(), 1, "the prototype link survives the round trip");
     }
 }
+
+#[cfg(test)]
+mod dangling_alias_tests {
+    use super::*;
+
+    type Resolved<'a> = BTreeMap<&'a str, (usize, VariableType, BTreeMap<String, VariableValue>)>;
+
+    fn token(alias: Option<&str>) -> (usize, VariableType, BTreeMap<String, VariableValue>) {
+        let value = alias.map_or(VariableValue::Number(1.0), |a| VariableValue::Alias(format!("v:{a}")));
+        (0, VariableType::Number, [("m".to_string(), value)].into())
+    }
+
+    #[test]
+    fn a_chain_ending_in_a_missing_variable_is_dropped_whole() {
+        // t0 → t1 → … → t1999 → missing: every link goes, in one pass along the chain.
+        let names: Vec<String> = (0..2000).map(|i| format!("t{i}")).collect();
+        let mut resolved: Resolved = BTreeMap::new();
+        for (i, n) in names.iter().enumerate() {
+            let next = names.get(i + 1).map_or("missing", String::as_str);
+            resolved.insert(n, token(Some(next)));
+        }
+        resolved.insert("plain", token(None));
+        resolved.insert("to-plain", token(Some("plain")));
+        let var_id = |p: &str| format!("v:{p}");
+        assert_eq!(drop_dangling_aliases(&mut resolved, &var_id), 2000);
+        assert_eq!(resolved.keys().copied().collect::<Vec<_>>(), ["plain", "to-plain"]);
+    }
+
+    #[test]
+    fn a_variable_made_by_two_tokens_stays_while_one_does() {
+        // `a` and `b` both make `v:x`; `a` dangles, `b` doesn't, so `c` (aliasing `v:x`) stays.
+        let mut resolved: Resolved = BTreeMap::new();
+        resolved.insert("a", token(Some("missing")));
+        resolved.insert("b", token(None));
+        resolved.insert("c", token(Some("x")));
+        let var_id = |p: &str| if p == "a" || p == "b" { "v:x".to_string() } else { format!("v:{p}") };
+        assert_eq!(drop_dangling_aliases(&mut resolved, &var_id), 1);
+        assert_eq!(resolved.keys().copied().collect::<Vec<_>>(), ["b", "c"]);
+    }
+}

From c69eb55f3137887f6fb02a9659246964d81a95ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B9=80=EC=82=BC=ED=98=84?= <rnflal31@gmail.com>
Date: Tue, 3 Nov 2026 14:13:17 +0900
Subject: [PATCH 08/70] M8: an ellipse whose start has gone round many turns
 keeps its sweep in .fig (#1891)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M8: an ellipse whose start has gone round many turns keeps its sweep in .fig

The importer clamped the starting and ending angles to ±1000 rad each
before taking the sweep, so an arc starting near or past 1000 rad lost
its sweep: a whole ellipse starting at 999 came back sweeping 1 rad, one
starting at 1500 swept nothing. The sweep is now the difference of the
angles as written, and a start past a turn is brought into [0, 2π) the
way the renderer's sine and cosine see it. The .fig export writes the
start within a turn too, where a 32-bit angle still holds it and the
sweep.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M8: an arc far from zero keeps its sweep rather than closing into a whole ellipse

Review follow-up on #1891. The whole-turn tolerance grows with the
angles, so once a start can lie far from zero it swallowed real arcs: an
arc of 6.1 rad written at 1e6 rad read as a whole ellipse, and at 3e7 rad
even a sweep of nothing did. The tolerance now only applies while it is
at most 1e-3 rad (about 0.06°), which holds up to a start of about 4,000
rad; further out the sweep is kept as written.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M8: an arc with no end stays whole however far out it starts

Review follow-up on #1891. With no endingAngle the importer took the end
as start + 2π and the sweep as the difference, which far from zero
rounds away from a turn: from a start of 1e15 it came out 6.25, drawn as
an arc with its radius edges now that the snap to a whole turn is
bounded. No end now means a sweep of exactly 2π.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/format/src/fig/export/layer.rs |  5 +++-
 crates/format/src/fig/export_tests.rs | 24 +++++++++++++++
 crates/format/src/rest.rs             | 43 +++++++++++++++++++++++----
 crates/format/src/rest/tests.rs       | 41 +++++++++++++++++++++++++
 4 files changed, 106 insertions(+), 7 deletions(-)

diff --git a/crates/format/src/fig/export/layer.rs b/crates/format/src/fig/export/layer.rs
index 35b7f1fb0..b4fda9138 100644
--- a/crates/format/src/fig/export/layer.rs
+++ b/crates/format/src/fig/export/layer.rs
@@ -91,7 +91,10 @@ impl<'d> Exporter<'d> {
             NodeKind::Group => f.push(("resizeToFit", b(true))),
             NodeKind::Section { contents_hidden } => f.push(("sectionContentsHidden", b(*contents_hidden))),
             NodeKind::Ellipse { start, sweep, inner } => {
-                f.push(("arcData", o(vec![("startingAngle", fl(*start)), ("endingAngle", fl(start + sweep)), ("innerRadius", fl(*inner))])))
+                // Within a turn, where a 32-bit angle still holds the start and the sweep exactly
+                // enough; a start past a turn draws the same.
+                let start = crate::rest::start_within_a_turn(*start);
+                f.push(("arcData", o(vec![("startingAngle", fl(start)), ("endingAngle", fl(start + sweep)), ("innerRadius", fl(*inner))])))
             }
             NodeKind::Polygon { count } => f.push(("count", u(*count))),
             NodeKind::Star { count, inner_ratio } => f.extend([("count", u(*count)), ("starInnerScale", fl(*inner_ratio))]),
diff --git a/crates/format/src/fig/export_tests.rs b/crates/format/src/fig/export_tests.rs
index b1b31262a..f3d7ac06f 100644
--- a/crates/format/src/fig/export_tests.rs
+++ b/crates/format/src/fig/export_tests.rs
@@ -1611,3 +1611,27 @@ fn a_whole_ellipse_starting_anywhere_comes_back_whole() {
         }
     }
 }
+
+/// An ellipse whose start has gone round many times (a start typed in degrees past a few hundred
+/// turns) comes back drawn the same: the same sweep, and a start the same way round.
+#[test]
+fn an_ellipse_starting_many_turns_round_comes_back_the_same() {
+    let tau = std::f64::consts::TAU;
+    // Not all of them hold exactly as 32-bit floats, the way a start typed in degrees doesn't.
+    for start in [999.0, 1500.0, -5000.0, 1e6, 1e6 + 0.1, 1234.567] {
+        for sweep in [tau, -tau, 1.0, -2.5, 1.3, tau - 0.1] {
+            let mut doc = Document::new("turns");
+            let page = doc.first_page().unwrap();
+            doc.create(page, NodeKind::Ellipse { start, sweep, inner: 0.0 }, "Ellipse", 0.0, 0.0, 100.0, 100.0).unwrap();
+            let (bytes, _) = export(&doc, None).unwrap();
+            let (back, _) = import(&bytes, "x").unwrap();
+            let kinds: Vec<NodeKind> =
+                back.ids().filter_map(|id| back.node(id)).map(|n| n.kind.clone()).filter(|k| matches!(k, NodeKind::Ellipse { .. })).collect();
+            let Some(NodeKind::Ellipse { start: s, sweep: w, .. }) = kinds.first() else { panic!("start {start}: no ellipse") };
+            // Where the arc starts, the same way round (as close as a 32-bit angle holds it).
+            let off = (s - start).rem_euclid(tau);
+            assert!(off.min(tau - off) < 1e-5, "start {start}, sweep {sweep}: came back starting at {s}");
+            assert!((w - sweep).abs() < 1e-5, "start {start}, sweep {sweep}: came back sweeping {w}");
+        }
+    }
+}
diff --git a/crates/format/src/rest.rs b/crates/format/src/rest.rs
index 4604b73a6..03bcd8b6b 100644
--- a/crates/format/src/rest.rs
+++ b/crates/format/src/rest.rs
@@ -626,15 +626,27 @@ impl<'a> Ctx<'a> {
             "ELLIPSE" => {
                 let a = j.get("arcData");
                 let arc = |k: &str| a.and_then(|a| num(a, k));
-                let start = arc("startingAngle").unwrap_or(0.0).clamp(-1e3, 1e3);
-                let end = arc("endingAngle").map_or(start + std::f64::consts::TAU, |e| e.clamp(-1e3, 1e3));
                 let tau = std::f64::consts::TAU;
+                // Capped only so the difference stays finite: the sweep is the difference of the
+                // angles as written, wherever they lie.
+                let start = arc("startingAngle").unwrap_or(0.0).clamp(-1e15, 1e15);
+                // No end goes all the way round, however far out the start is.
+                let end = arc("endingAngle").map(|e| e.clamp(-1e15, 1e15));
                 // The angles are 32-bit floats: a whole turn from anywhere but zero comes out a
                 // hair short of 2π as often as not. Within their precision of a turn, it is one.
-                let precision = (start.abs() + end.abs() + tau) * f64::from(f32::EPSILON);
-                let sweep = end - start;
-                let sweep = if sweep.abs() >= tau - precision { tau.copysign(sweep) } else { sweep };
-                NodeKind::Ellipse { start, sweep: sweep.clamp(-tau, tau), inner: arc("innerRadius").unwrap_or(0.0).clamp(0.0, 1.0) }
+                // Far enough out (thousands of radians) that precision is too coarse to tell a
+                // whole turn from a nearly whole arc, the sweep is kept as written.
+                let sweep = end.map_or(tau, |end| {
+                    let precision = (start.abs() + end.abs() + tau) * f64::from(f32::EPSILON);
+                    let sweep = end - start;
+                    let whole = precision <= WHOLE_TURN_SLACK && sweep.abs() >= tau - precision;
+                    if whole { tau.copysign(sweep) } else { sweep }
+                });
+                NodeKind::Ellipse {
+                    start: start_within_a_turn(start),
+                    sweep: sweep.clamp(-tau, tau),
+                    inner: arc("innerRadius").unwrap_or(0.0).clamp(0.0, 1.0),
+                }
             }
             // Point counts aren't part of the documented JSON: the outline is exact when present.
             "REGULAR_POLYGON" | "STAR" if point_count().is_none() && has_geometry => NodeKind::Vector { network: VectorNetwork::default() },
@@ -1509,3 +1521,22 @@ pub fn missing_image_placeholder() -> Option<&'static [u8]> {
 pub fn is_missing_image(data: &ImageData) -> bool {
     missing_image_placeholder().is_some_and(|png| data.bytes.as_slice() == png)
 }
+
+/// The most a sweep may fall short of a turn and still be read as a whole one (radians, about
+/// 0.06°): far more than 32-bit angles round by within a few hundred turns of zero, and far less
+/// than any arc anyone draws.
+const WHOLE_TURN_SLACK: f64 = 1e-3;
+
+/// An ellipse's start brought within a turn, drawn the same: a start already within one is kept
+/// as it is, one past a turn comes to [0, 2π). It is reduced the way the renderer's sine and
+/// cosine see it, exactly, rather than by dividing by a rounded 2π, which drifts a little with
+/// every turn.
+pub(crate) fn start_within_a_turn(start: f64) -> f64 {
+    let tau = std::f64::consts::TAU;
+    if !start.is_finite() || start.abs() < tau {
+        return start;
+    }
+    // `rem_euclid` rounds a hair below zero up to 2π itself.
+    let within = start.sin().atan2(start.cos()).rem_euclid(tau);
+    if within < tau { within } else { 0.0 }
+}
diff --git a/crates/format/src/rest/tests.rs b/crates/format/src/rest/tests.rs
index 050dcbaa6..36c7bb5a0 100644
--- a/crates/format/src/rest/tests.rs
+++ b/crates/format/src/rest/tests.rs
@@ -756,3 +756,44 @@ fn the_fig_import_sets_its_own_layer_cap() {
     assert_eq!(doc.node_count(), 5);
     assert!(warnings.iter().any(|w| w.contains("more than 4 layers")), "{warnings:?}");
 }
+
+/// Angles written many turns round keep the arc they draw: the sweep is the difference as
+/// written, and the start comes within a turn of zero, the same way round.
+#[test]
+fn an_arc_written_many_turns_round_keeps_its_sweep() {
+    let tau = std::f64::consts::TAU;
+    for (start, end) in [
+        (999.0, 999.0 + tau),
+        (1500.0, 1501.0),
+        (-5000.0, -5000.0 - 2.5),
+        (1e6, 1e6 + tau),
+        (1e6, 1e6 + 5.9),
+        (1e6, 1e6 + 6.1),
+        (3e7, 3e7),
+        (-4e5, -4e5 + tau - 0.01),
+        (-182.212373908208, -182.212373908208 + tau),
+    ] {
+        let mut arc = json!({"id": "Arc", "name": "Arc", "type": "ELLIPSE", "relativeTransform": at(0.0, 0.0), "size": {"x": 10, "y": 10}});
+        arc["arcData"] = json!({"startingAngle": start, "endingAngle": end, "innerRadius": 0});
+        let (doc, _) = one(json!([arc]));
+        let NodeKind::Ellipse { start: s, sweep, .. } = named(&doc, "Arc").kind else { panic!("{start}: not an ellipse") };
+        let want = end - start;
+        let want = if (want.abs() - tau).abs() < 1e-6 { tau.copysign(want) } else { want };
+        assert!((sweep - want).abs() < 1e-9, "{start}..{end}: sweep {sweep}, not {want}");
+        assert!(s.abs() < tau, "{start}: start {s} left past a turn");
+        let off = (s - start).rem_euclid(tau);
+        assert!(off.min(tau - off) < 1e-6, "{start}: start {s} isn't the same way round");
+    }
+}
+
+/// An arc with a start but no end goes all the way round, however far out the start is.
+#[test]
+fn an_arc_without_an_end_is_whole_wherever_it_starts() {
+    for start in [0.0, 2.0, -5000.0, 1e8, 1e15] {
+        let mut arc = json!({"id": "Arc", "name": "Arc", "type": "ELLIPSE", "relativeTransform": at(0.0, 0.0), "size": {"x": 10, "y": 10}});
+        arc["arcData"] = json!({"startingAngle": start, "innerRadius": 0});
+        let (doc, _) = one(json!([arc]));
+        let NodeKind::Ellipse { sweep, .. } = named(&doc, "Arc").kind else { panic!("{start}: not an ellipse") };
+        assert_eq!(sweep, std::f64::consts::TAU, "start {start}");
+    }
+}

From a7a0d12a85a6e63d7b52d2f0e887946ca9e073c3 Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <72558888+aleksei-suholita@users.noreply.github.com>
Date: Tue, 3 Nov 2026 06:13:27 +0100
Subject: [PATCH 09/70] M7: a file tab's menu and the board bar's shape menu
 read in the light theme (#1890)

* M7: a file tab's menu and the board bar's shape menu read in the light theme

Both open on the theme's popup, white in the light theme, but painted what
is in them with `menu_text`, which is white in both themes because it
belongs to the dark in-app menus (#972 was the same mistake in the panel
dropdowns):

- A file tab's right-click menu drew Open in new window with the menu
  bar's row (`menus::item`), so it showed only while hovered. It now uses
  `right::context_popup` and `right::menu_item`, like the tab strip's
  overflow menus: the theme's text, white on the green highlight.
- The board bar's shape menu outlined every shape but the picked one in
  white. They now take the theme's icon colour, white only on the green
  highlight.

The in-app menus (main menu, right-click on the canvas) stay dark in both
themes, as decided on #843.

Tests (menu_contrast_tests.rs): a file tab's menu opened with a right
click and the board bar's shape menu opened from its button, headless in
both themes: the label at 4.5:1 and every shape's outline at 3:1 against
the popup. Without the fix both fail at 1.00:1 in the light theme.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M8: contributor credits: a real name for aleksei-suholita

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 contributors/people.toml                  |   3 +
 crates/ui-egui/src/canvas/board_bar.rs    |   7 +-
 crates/ui-egui/src/menu_contrast_tests.rs | 108 +++++++++++++++++++++-
 crates/ui-egui/src/tabs.rs                |   7 +-
 4 files changed, 118 insertions(+), 7 deletions(-)

diff --git a/contributors/people.toml b/contributors/people.toml
index db1f5ce59..c846d8725 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -98,3 +98,6 @@ sync_github_name = true
 
 [people.dylanmtaylor]
 sync_github_name = true
+
+[people.aleksei-suholita]
+real_name = "Oleksii Sukholita"
diff --git a/crates/ui-egui/src/canvas/board_bar.rs b/crates/ui-egui/src/canvas/board_bar.rs
index 3d5baf43e..f9a43935c 100644
--- a/crates/ui-egui/src/canvas/board_bar.rs
+++ b/crates/ui-egui/src/canvas/board_bar.rs
@@ -299,10 +299,13 @@ fn shape_part(app: &mut FigApp, ui: &mut Ui, shape: BoardShape, at: Pos2, t: &To
                 let (r, cell) = ui.allocate_exact_size(vec2(CELL, CELL), Sense::click());
                 let cell = cell.on_hover_text(tr(b.label()));
                 a11y::menu_item(&cell, tr(b.label()), "", Some(b == shape));
-                if b == shape || cell.hovered() {
+                let lit = b == shape || cell.hovered();
+                if lit {
                     ui.painter().rect_filled(r, CornerRadius::same(5), t.menu_hover);
                 }
-                paint_choice(ui.painter(), r.shrink(6.0), &Mark::Shape(b), t.menu_text);
+                // The menu is the theme's popup (white in the light theme): the theme's icon
+                // colour, white only on the green highlight.
+                paint_choice(ui.painter(), r.shrink(6.0), &Mark::Shape(b), if lit { t.menu_text } else { t.icon });
                 if cell.clicked() {
                     app.run("board.setStyle", json!({"shape": b.id()}));
                     ui.close();
diff --git a/crates/ui-egui/src/menu_contrast_tests.rs b/crates/ui-egui/src/menu_contrast_tests.rs
index f3a9b1bda..dcd3548f6 100644
--- a/crates/ui-egui/src/menu_contrast_tests.rs
+++ b/crates/ui-egui/src/menu_contrast_tests.rs
@@ -1,8 +1,15 @@
-//! Panel dropdowns (the prototype device picker, Preferences, blend modes…) draw on the theme's
-//! popup fill, so their rows' text must read on it in both themes (#972): drawn headless.
+//! Panel dropdowns (the prototype device picker, Preferences, blend modes…), a file tab's menu and
+//! the board bar's shape menu draw on the theme's popup fill, so what is in them must read on it
+//! in both themes (#972): drawn headless.
 
+use egui::accesskit::Node;
+use egui::epaint::ColorMode;
 use egui::{Color32, Event, Order, PointerButton, Pos2, RawInput, Rect, Shape, pos2, vec2};
+use figcraft_doc::BoardShape;
+use figcraft_engine::Session;
+use serde_json::json;
 
+use crate::present_tests::Ui;
 use crate::right::{menu_check, menu_item, menu_popup};
 use crate::theme::{self, Tokens};
 
@@ -82,3 +89,100 @@ fn dropdown_rows_read_on_the_popup_in_both_themes() {
         }
     }
 }
+
+/// The whole app headless on `s` in the `dark` or light theme, with windows of their own allowed
+/// (a tab offers Open in new window only then); the theme's tokens.
+fn app(mut s: Session, dark: bool) -> (Ui, Tokens) {
+    s.execute(if dark { "view.themeDark" } else { "view.themeLight" }, &json!({})).unwrap();
+    let mut u = Ui::new(s);
+    u.ctx.set_embed_viewports(false);
+    u.frame(vec![]);
+    let t = Tokens::get(&u.ctx);
+    assert_eq!(t.dark, dark, "the app took the theme");
+    (u, t)
+}
+
+fn click(u: &mut Ui, at: Pos2, button: PointerButton) {
+    for pressed in [true, false] {
+        u.frame(vec![Event::PointerMoved(at), Event::PointerButton { pos: at, button, pressed, modifiers: Default::default() }]);
+    }
+}
+
+/// The pointer away from the open menu until its fade-in is over: that frame's output.
+fn settle(u: &mut Ui) -> egui::FullOutput {
+    for _ in 0..30 {
+        u.frame(vec![Event::PointerMoved(pos2(1430.0, 600.0))]);
+    }
+    u.frame_output(vec![])
+}
+
+/// The AccessKit nodes on screen.
+fn nodes(u: &mut Ui) -> Vec<Node> {
+    u.ctx.enable_accesskit();
+    u.frame(vec![]);
+    u.frame_output(vec![]).platform_output.accesskit_update.expect("an AccessKit update").nodes.into_iter().map(|(_, n)| n).collect()
+}
+
+fn bounds(n: &Node) -> Rect {
+    let b = n.bounds().unwrap();
+    Rect::from_min_max(pos2(b.x0 as f32, b.y0 as f32), pos2(b.x1 as f32, b.y1 as f32))
+}
+
+/// The colours of the lines painted inside `r`.
+fn lines_in(out: &egui::FullOutput, r: Rect) -> Vec<Color32> {
+    fn walk(s: &Shape, r: Rect, out: &mut Vec<Color32>) {
+        match s {
+            Shape::Vec(v) => v.iter().for_each(|s| walk(s, r, out)),
+            Shape::Path(p) if r.contains_rect(s.visual_bounding_rect()) => {
+                if let ColorMode::Solid(c) = p.stroke.color {
+                    out.push(c);
+                }
+            }
+            _ => {}
+        }
+    }
+    let mut lines = Vec::new();
+    for c in &out.shapes {
+        walk(&c.shape, r, &mut lines);
+    }
+    lines
+}
+
+#[test]
+fn a_file_tabs_menu_reads_on_its_popup_in_both_themes() {
+    for dark in [false, true] {
+        let (mut u, t) = app(Session::new(), dark);
+        click(&mut u, pos2(100.0, 20.0), PointerButton::Secondary);
+        let texts = menu_texts(&settle(&mut u));
+        let Some((_, col)) = texts.iter().find(|(s, _)| s == "Open in new window") else { panic!("the tab's menu opened (dark {dark}): {texts:?}") };
+        let ratio = color(*col).contrast(color(t.panel));
+        assert!(ratio >= 4.5, "Open in new window at {ratio:.2}:1 on the popup (dark {dark})");
+    }
+}
+
+#[test]
+fn the_board_bars_shape_menu_shows_every_shape_in_both_themes() {
+    for dark in [false, true] {
+        let mut s = Session::new();
+        s.execute("file.newBoard", &json!({})).unwrap();
+        s.execute("board.shape", &json!({"shape": "rectangle", "x": 0, "y": 0})).unwrap();
+        let (mut u, t) = app(s, dark);
+        let all = nodes(&mut u);
+        let button = all.iter().find(|n| n.label() == Some("Shape")).expect("the board bar's Shape button");
+        click(&mut u, bounds(button).center(), PointerButton::Primary);
+        let all = nodes(&mut u);
+        let out = settle(&mut u);
+        // Every shape but the picked one (white on the green highlight) on the popup itself.
+        for b in BoardShape::ALL.into_iter().filter(|b| *b != BoardShape::Rectangle) {
+            let label = crate::i18n::tr(b.label());
+            let cell = all.iter().find(|n| n.label() == Some(label)).unwrap_or_else(|| panic!("{label} in the menu (dark {dark})"));
+            let lines = lines_in(&out, bounds(cell));
+            assert!(!lines.is_empty(), "{label}'s outline painted (dark {dark})");
+            for c in lines {
+                // Non-text contrast (WCAG 1.4.11): at least 3:1.
+                let ratio = color(c).contrast(color(t.panel));
+                assert!(ratio >= 3.0, "{label}'s outline at {ratio:.2}:1 on the popup (dark {dark})");
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/tabs.rs b/crates/ui-egui/src/tabs.rs
index 78193b011..e59552d12 100644
--- a/crates/ui-egui/src/tabs.rs
+++ b/crates/ui-egui/src/tabs.rs
@@ -162,9 +162,10 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) {
                 None => {}
             }
             if several {
-                resp.context_menu(|ui| {
-                    ui.set_width(200.0);
-                    if crate::menus::item(ui, tr("Open in new window"), "", true, false, &t) {
+                // The tab strip's own menu takes the theme like its overflow menus (the in-app
+                // menus stay dark, #843): its rows read on the white popup of the light theme.
+                crate::right::context_popup(&resp).show(|ui| {
+                    if crate::right::menu_item(ui, tr("Open in new window"), "") {
                         detach = Some((i, None));
                         ui.close();
                     }

From a579ba2d3c9f37b189a6c90230bda2f099da20e3 Mon Sep 17 00:00:00 2001
From: Trevor Brown <trevorbrown.dev@gmail.com>
Date: Tue, 3 Nov 2026 00:13:38 -0500
Subject: [PATCH 10/70] M8: a click with the Bend tool curves a sharp point,
 its handles along the line between its neighbours (#1875) (#1877)

* M8: a click with the Bend tool curves a sharp point, its handles along the line between its neighbours (#1875)

A release without movement on a sharp point between two segments runs ops::auto_smooth instead of cancelling; a curved point still sharpens, a drag still sets the handles by hand, an endpoint is left alone. Tests; docs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Vector edit hit test: the nearer of a handle's end and a point wins

A short path's handles end within the point's hit tolerance; a click on the point is on the point, one on the handle's end still takes the handle. Test short_handles_leave_their_point_clickable.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Vector edit hit test: the nearer of a handle's end and a point is judged on the page

Candidates stay within the tolerance as before; ranking by page distance keeps a non-uniform scale from favouring the wrong one. Test a_handle_and_a_point_are_compared_on_the_page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Vector edit hit test: a handle wins a tie with a point, as before

A handle snapped onto another point stays selectable there. Test a_handle_on_another_point_is_still_the_handles (fails with the strict comparison).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/engine/src/canvas/vectoredit.rs        |  40 ++++--
 .../engine/src/canvas/vectoredit/pointer.rs   |   8 +-
 crates/engine/src/canvas/vectoredit/tests.rs  | 127 ++++++++++++++++++
 docs/ui-parity.md                             |   5 +-
 4 files changed, 165 insertions(+), 15 deletions(-)

diff --git a/crates/engine/src/canvas/vectoredit.rs b/crates/engine/src/canvas/vectoredit.rs
index 078f0804e..f755171e2 100644
--- a/crates/engine/src/canvas/vectoredit.rs
+++ b/crates/engine/src/canvas/vectoredit.rs
@@ -403,7 +403,9 @@ fn visible_handles(net: &VectorNetwork, ve: &VectorEdit) -> Vec<(usize, bool)> {
 }
 
 /// Hit test in page coordinates with a tolerance in page units. Visible handles win, then
-/// vertices, then segments.
+/// vertices, then segments; between a handle and a point both within reach, the nearer one on
+/// the page, the handle on a tie (the handles of a short segment end a few pixels from their
+/// point, and a click on the point is on the point, #1875).
 pub fn hit(doc: &Document, ve: &VectorEdit, p: Point, tol: f64) -> Option<VHit> {
     let net = network(doc, ve.id)?;
     let w = doc.world_transform(ve.id);
@@ -414,17 +416,31 @@ pub fn hit(doc: &Document, ve: &VectorEdit, p: Point, tol: f64) -> Option<VHit>
     if !(lp.x.is_finite() && lp.y.is_finite()) {
         return None;
     }
-    for (si, start) in visible_handles(net, ve) {
-        let (Some(seg), Some(t)) = (net.segments.get(si), net.handle(si, start)) else { continue };
-        let Some(v) = net.vertices.get(if start { seg.a } else { seg.b }) else { continue };
-        if (Point::new(v.x + t.0, v.y + t.1) - lp).hypot() <= tl {
-            return Some(VHit::Handle { seg: si, start });
-        }
-    }
-    let nearest_vertex =
-        net.vertices.iter().enumerate().map(|(i, v)| (i, (v.point() - lp).hypot())).filter(|(_, d)| *d <= tl).min_by(|a, b| a.1.total_cmp(&b.1));
-    if let Some((index, _)) = nearest_vertex {
-        return Some(VHit::Vertex { index });
+    // Candidates are within the tolerance as before; the nearest is judged on the page, where a
+    // non-uniform scale doesn't distort it.
+    let on_page = |q: Point| (w * q - p).hypot();
+    let nearest_handle = visible_handles(net, ve)
+        .into_iter()
+        .filter_map(|(si, start)| {
+            let (seg, t) = (net.segments.get(si)?, net.handle(si, start)?);
+            let v = net.vertices.get(if start { seg.a } else { seg.b })?;
+            let end = Point::new(v.x + t.0, v.y + t.1);
+            ((end - lp).hypot() <= tl).then(|| ((si, start), on_page(end)))
+        })
+        .min_by(|a, b| a.1.total_cmp(&b.1));
+    let nearest_vertex = net
+        .vertices
+        .iter()
+        .enumerate()
+        .filter(|(_, v)| (v.point() - lp).hypot() <= tl)
+        .map(|(i, v)| (i, on_page(v.point())))
+        .min_by(|a, b| a.1.total_cmp(&b.1));
+    match (nearest_handle, nearest_vertex) {
+        // A tie (a handle's end on another point) goes to the handle, as handles always won before.
+        (Some(((seg, start), dh)), Some((_, dv))) if dh <= dv => return Some(VHit::Handle { seg, start }),
+        (Some(((seg, start), _)), None) => return Some(VHit::Handle { seg, start }),
+        (_, Some((index, _))) => return Some(VHit::Vertex { index }),
+        (None, None) => {}
     }
     use figcraft_geom::kurbo::ParamCurveNearest;
     let nearest_seg = (0..net.segments.len())
diff --git a/crates/engine/src/canvas/vectoredit/pointer.rs b/crates/engine/src/canvas/vectoredit/pointer.rs
index f5cd1b8dd..dadb1e3e8 100644
--- a/crates/engine/src/canvas/vectoredit/pointer.rs
+++ b/crates/engine/src/canvas/vectoredit/pointer.rs
@@ -1072,12 +1072,18 @@ impl Session {
                 }
             }
             VGesture::BendVertex { v, moved, smooth, .. } => {
+                let id = ve.id;
                 if moved {
                     self.commit_interaction()?;
                 } else if smooth {
-                    let id = ve.id;
                     self.preview(|doc, _| edit(doc, id, |net| ops::make_sharp(net, v)))?;
                     self.commit_interaction()?;
+                } else if network(self.doc()?, id).is_some_and(|n| n.incident(v).len() == 2) {
+                    // "Click on a point or path where you want to add a curve" (Edit vector
+                    // layers): a sharp point between two segments gets handles along the line
+                    // between its neighbours (#1875); an endpoint has nothing to curve.
+                    self.preview(|doc, _| edit(doc, id, |net| ops::auto_smooth(net, v)))?;
+                    self.commit_interaction()?;
                 } else {
                     self.cancel_interaction()?;
                 }
diff --git a/crates/engine/src/canvas/vectoredit/tests.rs b/crates/engine/src/canvas/vectoredit/tests.rs
index 07ebd56f7..30d62e1af 100644
--- a/crates/engine/src/canvas/vectoredit/tests.rs
+++ b/crates/engine/src/canvas/vectoredit/tests.rs
@@ -119,6 +119,16 @@ fn bend_tool_smooths_and_sharpens_points() {
     let n = net(&s, id);
     let v = vertex_at(&n, 100.0, 0.0);
     assert!(n.incident(v).iter().all(|(s, st)| n.handle(*s, *st) == Some((0.0, 0.0))), "a click sharpens it");
+    // Clicked again, the sharp corner curves: handles along the line between its neighbours
+    // (0,0) and (100,100), a third of the way to each (the box refits around the bulge, so the
+    // point is found by its index).
+    click(&mut s, 100.0, 0.0);
+    let n = net(&s, id);
+    assert_eq!(n.mirroring(v), HandleMirroring::Angle);
+    for (seg, st) in n.incident(v) {
+        let h = n.handle(seg, st).unwrap();
+        assert!((h.0.abs() - 100.0 / 3.0 / 2f64.sqrt()).abs() < 1e-6 && (h.0 - h.1).abs() < 1e-6, "along the neighbours' line: {h:?}");
+    }
     // ⌘-drag on a segment with the Move tool bends it.
     ex(&mut s, "vector.edit.tool", json!({"tool": "move"}));
     let mut down = ev(PointerKind::Down, 0.0, 50.0);
@@ -130,6 +140,123 @@ fn bend_tool_smooths_and_sharpens_points() {
     assert!(b.x0 < -25.0, "bent outwards: {b:?}");
 }
 
+/// #1875: a line whose middle point was moved off the line, clicked with the Bend tool, curves
+/// there ("Click on a point or path where you want to add a curve", Edit vector layers): the
+/// handles run along the line between the neighbours, a third of the way to each, in one undo
+/// step; an endpoint is left alone; a click on the curved point makes it sharp again.
+#[test]
+fn a_bend_click_curves_a_sharp_point_between_its_neighbours() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "vector.create", json!({"points": [[0, 0], [50, 30], [100, 0]], "closed": false}));
+    let id = crate::params::id_of(&r["id"]).unwrap();
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    ex(&mut s, "vector.edit.tool", json!({"tool": "bend"}));
+    let (v, end) = (vertex_at(&net(&s, id), 50.0, 30.0), vertex_at(&net(&s, id), 0.0, 0.0));
+    let before = s.undo_depth().0;
+    click(&mut s, 50.0, 30.0);
+    let n = net(&s, id);
+    let reach = (50f64.powi(2) + 30f64.powi(2)).sqrt() / 3.0;
+    for (seg, st) in n.incident(v) {
+        let h = n.handle(seg, st).unwrap();
+        assert!((h.0.abs() - reach).abs() < 1e-6 && h.1.abs() < 1e-6, "along the neighbours' line, a third of the way: {h:?}");
+    }
+    assert_eq!(n.mirroring(v), HandleMirroring::Angle);
+    assert_eq!(s.undo_depth().0, before + 1, "one undo step");
+    // An endpoint has nothing to curve: the click changes nothing and leaves no undo step.
+    click(&mut s, 0.0, 0.0);
+    let n = net(&s, id);
+    assert!(n.incident(end).iter().all(|(sg, st)| n.handle(*sg, *st) == Some((0.0, 0.0))));
+    assert_eq!(s.undo_depth().0, before + 1);
+    // The curved point clicked again is sharp again.
+    click(&mut s, 50.0, 30.0);
+    let n = net(&s, id);
+    assert!(n.incident(v).iter().all(|(sg, st)| n.handle(*sg, *st) == Some((0.0, 0.0))));
+}
+
+/// Between a handle's end and a point both within reach, the nearer on the page wins, also under a
+/// non-uniform scale (10× wide here), where local distances would pick the point.
+#[test]
+fn a_handle_and_a_point_are_compared_on_the_page() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "vector.create", json!({"points": [[0, 0], [5, 0]], "closed": false}));
+    let id = crate::params::id_of(&r["id"]).unwrap();
+    {
+        let node = s.doc_mut().unwrap().get_mut(id).unwrap();
+        let mut n = VectorNetwork::default();
+        n.vertices.push(figcraft_doc::Vertex::new(0.0, 0.0));
+        n.vertices.push(figcraft_doc::Vertex::new(5.0, 0.0));
+        let mut seg = figcraft_doc::Segment::line(0, 1);
+        seg.ta = (0.5, -0.9);
+        n.segments.push(seg);
+        node.kind = figcraft_doc::NodeKind::Vector { network: n };
+        node.transform = figcraft_geom::Affine::scale_non_uniform(10.0, 1.0);
+    }
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    ex(&mut s, "vector.edit.select", json!({"vertices": [0]}));
+    let doc = s.doc().unwrap().clone();
+    // On the page the point is at (0, 0) and its handle's end at (5, -0.9): from (4, 0) the
+    // handle's end is 1.3 away and the point 4, though locally the point is the nearer.
+    assert_eq!(hit(&doc, &ve(&s), pt(4.0, 0.0), 6.0), Some(VHit::Handle { seg: 0, start: true }));
+    assert_eq!(hit(&doc, &ve(&s), pt(0.0, 0.0), 6.0), Some(VHit::Vertex { index: 0 }));
+}
+
+/// A handle whose end lies exactly on another point (snapped there) can still be taken there: on a
+/// tie the handle wins, as handles always did.
+#[test]
+fn a_handle_on_another_point_is_still_the_handles() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "vector.create", json!({"points": [[0, 0], [10, 0]], "closed": false}));
+    let id = crate::params::id_of(&r["id"]).unwrap();
+    {
+        let node = s.doc_mut().unwrap().get_mut(id).unwrap();
+        let mut n = VectorNetwork::default();
+        n.vertices.push(figcraft_doc::Vertex::new(0.0, 0.0));
+        n.vertices.push(figcraft_doc::Vertex::new(10.0, 0.0));
+        let mut seg = figcraft_doc::Segment::line(0, 1);
+        seg.ta = (10.0, 0.0);
+        n.segments.push(seg);
+        node.kind = figcraft_doc::NodeKind::Vector { network: n };
+        node.transform = figcraft_geom::Affine::IDENTITY;
+    }
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    ex(&mut s, "vector.edit.select", json!({"vertices": [0]}));
+    let doc = s.doc().unwrap().clone();
+    // Where the points are on the page now (entering edit mode may refit the layer's box).
+    let n = net(&s, id);
+    let w = doc.world_transform(id);
+    let (p0, p1) = (w * n.vertices[0].point(), w * n.vertices[1].point());
+    // Point 0's handle ends on point 1: there the handle; on point 0, the point.
+    assert_eq!(hit(&doc, &ve(&s), p1, 6.0), Some(VHit::Handle { seg: 0, start: true }));
+    assert_eq!(hit(&doc, &ve(&s), p0, 6.0), Some(VHit::Vertex { index: 0 }));
+}
+
+/// A short path's handles end a few pixels from their point: a click on the point is still on the
+/// point (the nearer of the two wins), so the Bend tool can sharpen it again, while a click on the
+/// handle's end still takes the handle.
+#[test]
+fn short_handles_leave_their_point_clickable() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "vector.create", json!({"points": [[0, 0], [6, 10], [12, 0]], "closed": false}));
+    let id = crate::params::id_of(&r["id"]).unwrap();
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    ex(&mut s, "vector.edit.tool", json!({"tool": "bend"}));
+    let v = vertex_at(&net(&s, id), 6.0, 10.0);
+    click(&mut s, 6.0, 10.0);
+    let n = net(&s, id);
+    let curved = |n: &VectorNetwork| n.incident(v).iter().all(|(sg, st)| n.handle(*sg, *st).is_some_and(|h| h != (0.0, 0.0)));
+    assert!(curved(&n));
+    let reach = (6f64.powi(2) + 10f64.powi(2)).sqrt() / 3.0;
+    assert!(reach < 6.0, "the handles end within the 6 px hit tolerance: {reach}");
+    // A click on the handle's end takes the handle (nothing changes); one on the point sharpens it.
+    let (sg, st) = n.incident(v)[0];
+    let h = n.handle(sg, st).unwrap();
+    click(&mut s, 6.0 + h.0, 10.0 + h.1);
+    assert!(curved(&net(&s, id)), "the handle's end is the handle's");
+    click(&mut s, 6.0, 10.0);
+    let n = net(&s, id);
+    assert!(n.incident(v).iter().all(|(sg, st)| n.handle(*sg, *st) == Some((0.0, 0.0))), "the point is the point's: sharp again");
+}
+
 #[test]
 fn paint_bucket_fills_and_unfills_areas() {
     let mut s = Session::new();
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 1d3c01373..f5966f334 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI and interaction parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** patch (Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testing on the result, group drags, frame outlines and slices; outlines for the selection, mask outlines; arc fields, live boolean editing, shape builder on strokes, one-sided widths; fields select their text on focus; Typography spacing icons support scrubbing (#373); CSS colour names in hex fields; a rename selects the whole name, so typing replaces it; Escape or Enter after a pen path stays on the same vector (#760); IME composition kept on through idle frames of a text edit, candidates at the caret (#747); Selection colors for mixed selections and smart-selection spacing (#753); submenus with a hover delay and a safe triangle; the Actions palette's tabs, ranked search, highlight and recents; menu items that ask for a value; editor fixes from the community batches) · **Target:** Figma Design UI3 (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** patch (a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testing on the result, group drags, frame outlines and slices; outlines for the selection, mask outlines; arc fields, live boolean editing, shape builder on strokes, one-sided widths; fields select their text on focus; Typography spacing icons support scrubbing (#373); CSS colour names in hex fields; a rename selects the whole name, so typing replaces it; Escape or Enter after a pen path stays on the same vector (#760); IME composition kept on through idle frames of a text edit, candidates at the caret (#747); Selection colors for mixed selections and smart-selection spacing (#753); submenus with a hover delay and a safe triangle; the Actions palette's tabs, ranked search, highlight and recents; menu items that ask for a value; editor fixes from the community batches) · **Target:** Figma Design UI3 (desktop app 126.10.7)
 
 Fine canvas control is what Figma users feel first: handles, snapping, nudging, modifier keys,
 drag behaviour, numeric precision. This checklist covers the tools, gestures and panels. Status:
@@ -86,7 +86,7 @@ interaction feel not yet compared.
 | Rectangle, ellipse (arc handles and Design panel arc fields), polygon, star, line, arrow; Shift/Alt | done | Alt draws lines from the centre too (`shapes_behaviour_tests`) |
 | Corner radius handles (inside each corner of a rectangle or frame, a polygon's or star's top point; Alt: one corner), star ratio handle; Count and Ratio fields | done | handles hide under 48 px on screen; no count handle on the canvas (the Count field instead); corner smoothing rounds rectangles and frames only |
 | Pen: vector networks, branch, close, bend; pencil | done | pen pressure on Windows and from browser styluses only; outside edit mode the Pen closes on its first point, connects to its other points and continues a selected open path from an end point (`vector_multi_behaviour_tests`); Escape ends the path and keeps its layer in edit mode with the pen, so the next path joins the same vector and another Escape leaves edit mode (#760, `pen_end_tests`); Enter or a double-click ends the path (at the double-click's point, added once) and edits the vector with the Move tool, a double-click with the idle pen edits the layer under it, and in edit mode the pen's Enter or double-click takes the Move tool (#1430, `pen_vector_edit_tests`); switching from Design to Prototype or Inspect ends the path and returns to Move (#308) |
-| Vector edit mode: bend, paint bucket, lasso, cut, eraser, transform box, point snapping, mirroring | done | a double-click a few pixels off a thin stroke enters edit mode (#646); entering edit mode and picking a region keep the canvas still (#322); a point dropped on another point merges with it, and dropping one end of an open path on the other closes it (a 2-point line's end just moves, #401); Flatten keeps open paths open (#377); paint bucket drags across areas; cut drags divide a shape into layers; delete and heal follows the curve; rounded points are drawn; Shift-click deselects a point at a corner of the box (`vector_behaviour_tests`); several vectors edited at once, Shift-click handles to drag them together, a cap and join per point, rounded points beside curves (`vector_multi_behaviour_tests`); filled regions with the Move tool: the area under the pointer is hatched ("/" lines in the selection colour, clipped by the area's own fill rule, holes left out, gone 3.5 px from a point or 2 px from a segment at any zoom), the line spacing follows octave folding (fitted to measurements at several zoom levels: 8 px at every power-of-two zoom, growing with the zoom and stepping back at √2 · 2ⁿ) and stays fixed to the shape when panning; a click selects the area and its points (moved with it but drawn unselected), Shift adds or removes an area, a press on a selected area drags the whole selection, no hover hatch during drags, a click on an empty spot (a hole) clears it and stays in edit mode; `vector.edit.select {regions}` (`regions_tests`, `vector_regions_tests`). Not yet: areas of other layers edited at once |
+| Vector edit mode: bend, paint bucket, lasso, cut, eraser, transform box, point snapping, mirroring | done | a double-click a few pixels off a thin stroke enters edit mode (#646); entering edit mode and picking a region keep the canvas still (#322); a point dropped on another point merges with it, and dropping one end of an open path on the other closes it (a 2-point line's end just moves, #401); Flatten keeps open paths open (#377); paint bucket drags across areas; cut drags divide a shape into layers; delete and heal follows the curve; rounded points are drawn; Shift-click deselects a point at a corner of the box (`vector_behaviour_tests`); several vectors edited at once, Shift-click handles to drag them together, a cap and join per point, rounded points beside curves (`vector_multi_behaviour_tests`); filled regions with the Move tool: the area under the pointer is hatched ("/" lines in the selection colour, clipped by the area's own fill rule, holes left out, gone 3.5 px from a point or 2 px from a segment at any zoom), the line spacing follows octave folding (fitted to measurements at several zoom levels: 8 px at every power-of-two zoom, growing with the zoom and stepping back at √2 · 2ⁿ) and stays fixed to the shape when panning; a click selects the area and its points (moved with it but drawn unselected), Shift adds or removes an area, a press on a selected area drags the whole selection, no hover hatch during drags, a click on an empty spot (a hole) clears it and stays in edit mode; `vector.edit.select {regions}` (`regions_tests`, `vector_regions_tests`); a Bend click on a sharp point between two segments curves it (handles along the line between its neighbours, a third of the way to each, `ops::auto_smooth`), on a curved one sharpens it, a drag sets the handles by hand (#1875). Not yet: areas of other layers edited at once |
 | Shape builder (Shift+M) on fills, strokes and open paths; variable width (Shift+W), one side with Alt | done | |
 | Boolean groups: clicked where the result is, double-click or Cmd/Ctrl-click into operands, live results while dragging or editing points, per-operand operations | done | a group past the path operations' caps (250 000 segments, 2 million possible crossings, 4 million segments swept over a fold) draws without its result, with a warning, and Flatten refuses it (#1104) |
 | Text: point, auto height, fixed; caret, words, lines, IME | done | Backspace or Delete at the start of a list item takes its marker and keeps its level, the paragraph starting where the item's text did ("delete the counter, but keep the same level of indentation", Create bulleted and numbered lists; `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests`); max lines on auto-width text keep it auto width, hugging up to that many lines and growing with its longest line ("Text resizing is set to auto height or auto width", Explore text properties; `text_behaviour_tests::max_lines_on_auto_width_text_keeps_auto_width_and_hugs_that_many_lines`); Alt+Enter while editing opens the link at the caret, web and mail links only (`text.openLink`; "press ⌥Option Return/Alt Enter to activate a focused link", Accessibility at Figma; `text_link_tests`); the font picker previews a family on the canvas while hovered (no undo step; Escape restores, #653) and Up/Down step through it (#352); a selection highlight after a line break starts at that line's start and an empty last line shows its mark (#665); carets step over whole emoji and accented letters; colour emoji draw from their colour tables (#300); IME composition replayed in tests as macOS sends it, not yet checked on a Mac (#747); CJK words by script run (no dictionary); vertical trim in Type settings; no spell check |
@@ -177,6 +177,7 @@ in the table. `crates/ui-egui/src/shortcut_keys_tests.rs` drives the keys a look
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | patch | M8, #1875: a click with the Bend tool on a sharp point between two segments gives it handles along the line between its neighbours, a third of the way to each ("Click on a point or path where you want to add a curve", Edit vector layers); a click on a curved point still makes it sharp, a drag still sets the handles by hand, an endpoint is left alone. Between a handle's end and a point both within reach of the pointer, the nearer one on the page is hit (the handle on a tie), so a short path's point (its handles a few pixels long) can be clicked again. Before, only a drag curved a point, and a short one left two tiny handles in its direction. Tests: `vectoredit::tests::short_handles_leave_their_point_clickable`, `vectoredit::tests::a_bend_click_curves_a_sharp_point_between_its_neighbours`, `bend_tool_smooths_and_sharpens_points`. Numbers unchanged. |
 | 2026-11-02 | patch | M4: Backspace or Delete at the start of a list item takes its marker and keeps its level ("Use Backspace or Delete at the beginning of a list item to delete the counter, but keep the same level of indentation", Create bulleted and numbered lists): a plain paragraph may now carry a list level, and the text layout starts it where that level's item text starts (the gutters stay even when no list is left). Backspace used to drop the level too, and Delete at an item's start deleted the next character. Tab on such a paragraph types a tab, as outside a list. Tests: `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests::a_plain_paragraph_at_a_list_level_starts_where_the_items_text_does` |
 | 2026-11-02 | patch | M4: max lines on an auto-width text keep it auto width: the box hugs up to that many lines and still grows with its longest line ("Max lines is available only if truncate text is enabled, and: Text resizing is set to auto height or auto width", Explore text properties). `text.maxLines` turned such a text into a fixed truncating box with a stale height, so later typing no longer widened it; fixed-size text still becomes a truncating box, auto-height text hugs as before. Test: `text_behaviour_tests::max_lines_on_auto_width_text_keeps_auto_width_and_hugs_that_many_lines` |
 | 2026-11-02 | patch | M4, #1828: superscript and subscript synthesised where the font has no `sups` / `subs` glyphs (the standard glyph shrunk and shifted by the OS/2 metrics, the usual 0.65 em and 0.35 / 0.14 em offsets without them), and a run mixing available and unavailable glyphs synthesised whole, as Explore text properties says. Tests: `text::tests::superscript_native_or_synthesised_and_never_mixed`, `text_behaviour_tests::superscript_and_subscript_are_synthesised_without_glyphs_for_them`. |

From 0e86f3597a7443b15c93ec3ab2091202f8802c95 Mon Sep 17 00:00:00 2001
From: Trevor Brown <trevorbrown.dev@gmail.com>
Date: Tue, 3 Nov 2026 00:13:48 -0500
Subject: [PATCH 11/70] M4: wrap style on a text layer: Auto, Balance and
 Pretty decide where its lines break (#1827) (#1871)

* M4: wrap style on a text layer: Auto, Balance and Pretty decide where its lines break (#1827)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Docs: no table pipe inside the wrap-style row's code span

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Wrap styles: no new emergency breaks, hanging punctuation in Pretty's width, wrap style as an override

Balance and Pretty reject a re-break with more mid-word breaks than the greedy lines; Pretty narrows a line by its text less its hanging marks; wrapStyle joins the textStyle override group; docs wording. Tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
---
 crates/doc/src/text.rs                        |  20 ++
 crates/engine/src/assets/components/diff.rs   |   1 +
 .../engine/src/assets/components/instances.rs |   1 +
 crates/engine/src/automation/inspect.rs       |   4 +
 crates/engine/src/cmd/props.rs                |   5 +-
 crates/engine/src/cmd/text.rs                 |  11 +
 .../engine/src/components_behaviour_tests.rs  |   9 +
 crates/engine/src/dev/codegen/css.rs          |   5 +
 crates/engine/src/dev/tailwind.rs             |   2 +
 crates/engine/src/text_behaviour_tests.rs     |  66 +++++
 crates/text/src/layout.rs                     | 236 +++++++++++++++++-
 crates/ui-egui/locales/en.toml                |   6 +
 .../ui-egui/src/panels/typography/fields.rs   |  12 +
 docs/ui-parity.md                             |   4 +-
 14 files changed, 372 insertions(+), 10 deletions(-)

diff --git a/crates/doc/src/text.rs b/crates/doc/src/text.rs
index 0c41d3c9a..ba196edb3 100644
--- a/crates/doc/src/text.rs
+++ b/crates/doc/src/text.rs
@@ -234,6 +234,22 @@ pub enum LeadingTrim {
     CapHeight,
 }
 
+/// Where lines break when text wraps to more than one line ("Wrap style controls where lines
+/// break when text wraps to more than one line", Explore text properties).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub enum WrapStyle {
+    /// "Figma fits as many words as possible on each line before wrapping to the next."
+    #[default]
+    Auto,
+    /// "Figma distributes text as evenly as possible across every line, so each line is close to
+    /// the same length."
+    Balance,
+    /// "Figma keeps each line full, but adjusts the last four lines to avoid an orphan -- a single
+    /// word stranded alone on the last line."
+    Pretty,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
 pub enum ListStyle {
@@ -466,6 +482,10 @@ pub struct TextData {
     /// as fit).
     #[serde(skip_serializing_if = "crate::node::is_default")]
     pub max_lines: u32,
+    /// Where lines break when the text wraps: greedily (Auto), as evenly as the words allow
+    /// (Balance), or full with no one word alone on the last line (Pretty).
+    #[serde(skip_serializing_if = "crate::node::is_default")]
+    pub wrap_style: WrapStyle,
     /// OpenType feature toggles (e.g. "liga": false).
     #[serde(skip_serializing_if = "crate::node::is_default")]
     pub features: std::collections::BTreeMap<String, bool>,
diff --git a/crates/engine/src/assets/components/diff.rs b/crates/engine/src/assets/components/diff.rs
index 41c1a4246..5c6b7e4c5 100644
--- a/crates/engine/src/assets/components/diff.rs
+++ b/crates/engine/src/assets/components/diff.rs
@@ -132,6 +132,7 @@ fn text_style_differs(x: &TextData, y: &TextData) -> bool {
         || x.hanging_list != y.hanging_list
         || x.max_lines != y.max_lines
         || x.features != y.features
+        || x.wrap_style != y.wrap_style
 }
 
 /// Whether a geometry change of `id` comes from layout rather than the user: an ancestor was
diff --git a/crates/engine/src/assets/components/instances.rs b/crates/engine/src/assets/components/instances.rs
index e7b3114ad..9e596e8eb 100644
--- a/crates/engine/src/assets/components/instances.rs
+++ b/crates/engine/src/assets/components/instances.rs
@@ -160,6 +160,7 @@ pub(crate) fn copy_group(from: &Node, to: &mut Node, g: &str) {
                 b.hanging_list = a.hanging_list;
                 b.max_lines = a.max_lines;
                 b.features = a.features.clone();
+                b.wrap_style = a.wrap_style;
             }
             to.styles.text = from.styles.text.clone();
         }
diff --git a/crates/engine/src/automation/inspect.rs b/crates/engine/src/automation/inspect.rs
index ca3afa1ce..871dbea6f 100644
--- a/crates/engine/src/automation/inspect.rs
+++ b/crates/engine/src/automation/inspect.rs
@@ -103,6 +103,7 @@ pub const NODE_KEYS: &[&str] = &[
     "visible",
     "width",
     "widthProfile",
+    "wrapStyle",
     "x",
     "y",
 ];
@@ -442,6 +443,9 @@ fn text_props(t: &TextData, o: &mut serde_json::Map<String, Value>, options: &In
     if t.leading_trim != figcraft_doc::LeadingTrim::None {
         insert_prop(o, options, "leadingTrim", || json!(t.leading_trim));
     }
+    if t.wrap_style != figcraft_doc::WrapStyle::Auto {
+        insert_prop(o, options, "wrapStyle", || json!(t.wrap_style));
+    }
     if !t.runs.is_empty() {
         insert_prop(o, options, "styledRuns", || serde_json::to_value(&t.runs).unwrap_or(Value::Null));
     }
diff --git a/crates/engine/src/cmd/props.rs b/crates/engine/src/cmd/props.rs
index 96c9fa922..36e33dd79 100644
--- a/crates/engine/src/cmd/props.rs
+++ b/crates/engine/src/cmd/props.rs
@@ -961,6 +961,9 @@ fn apply_text(cmd: &str, doc: &mut Document, id: NodeId, props: &Map<String, Val
             *if k == "hangingList" { &mut t.hanging_list } else { &mut t.hanging_punctuation } = on;
         }
         "leadingTrim" => text_mut(cmd, doc.get_mut(id)?)?.leading_trim = enum_of(v).ok_or_else(|| bad(cmd, "leadingTrim: none|capHeight"))?,
+        "wrapStyle" | "textWrap" => {
+            text_mut(cmd, doc.get_mut(id)?)?.wrap_style = enum_of(v).ok_or_else(|| bad(cmd, "wrapStyle: auto|balance|pretty"))?
+        }
         "maxLines" => {
             let lines = f64_of(v).unwrap_or(0.0).clamp(0.0, 10_000.0) as u32;
             let n = doc.get_mut(id)?;
@@ -1205,7 +1208,7 @@ pub fn override_group(k: &str) -> &'static str {
         "name" => "name",
         "characters" | "text" => "characters",
         "features" | "fontFeatures" | "openTypeFeatures" | "listStyle" | "indentation" | "listSpacing" | "maxLines" | "variationSettings"
-        | "hangingPunctuation" | "hangingList" => "textStyle",
+        | "hangingPunctuation" | "hangingList" | "wrapStyle" | "textWrap" => "textStyle",
         "cornerRadius" | "cornerSmoothing" | "topLeftRadius" | "topRightRadius" | "bottomRightRadius" | "bottomLeftRadius" => "corners",
         "width" | "height" | "w" | "h" => "size",
         "sizingH" | "sizingV" | "layoutSizingHorizontal" | "layoutSizingVertical" | "minWidth" | "maxWidth" | "minHeight" | "maxHeight" => "resizing",
diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs
index f72f215ee..7914f259e 100644
--- a/crates/engine/src/cmd/text.rs
+++ b/crates/engine/src/cmd/text.rs
@@ -308,6 +308,17 @@ pub fn specs() -> Vec<CommandSpec> {
                 set_list(s, p, l, false)
             }
         ),
+        spec!(
+            "text.wrapStyle",
+            "Wrap style",
+            "{style: auto|balance|pretty, ids?}  where lines break when the text wraps: Auto fits as many words as fit on each line, Balance makes the lines close to the same length, Pretty keeps lines full but leaves no one word alone on the last",
+            true,
+            |s, p| {
+                let w: figcraft_doc::WrapStyle =
+                    get(p, "style").and_then(super::props::enum_of).ok_or_else(|| bad("text.wrapStyle", "`style`: auto|balance|pretty"))?;
+                para(s, p, |t| t.wrap_style = w)
+            }
+        ),
         spec!("text.paragraphIndent", "Paragraph indent", "{indent (px), ids?}", true, |s, p| {
             let v = finite(req_num("text.paragraphIndent", p, "indent")?).clamp(0.0, 10_000.0);
             para(s, p, |t| t.paragraph_indent = v)
diff --git a/crates/engine/src/components_behaviour_tests.rs b/crates/engine/src/components_behaviour_tests.rs
index 6d5a7ebcb..3458b0b22 100644
--- a/crates/engine/src/components_behaviour_tests.rs
+++ b/crates/engine/src/components_behaviour_tests.rs
@@ -338,6 +338,15 @@ fn overridable_properties_stay_through_main_edits_and_reset() {
             |n| text(n).paragraph_spacing.to_string(),
             "a text property like the others",
         ),
+        (
+            "wrap style",
+            Layer::Title,
+            "textStyle",
+            json!({"wrapStyle": "balance"}),
+            Some(json!({"wrapStyle": "pretty"})),
+            |n| format!("{:?}", text(n).wrap_style),
+            "a text property like the others (#1827)",
+        ),
         (
             "padding",
             Layer::Row,
diff --git a/crates/engine/src/dev/codegen/css.rs b/crates/engine/src/dev/codegen/css.rs
index eb9406f2a..2395c7873 100644
--- a/crates/engine/src/dev/codegen/css.rs
+++ b/crates/engine/src/dev/codegen/css.rs
@@ -302,6 +302,11 @@ fn text_decls(doc: &Document, n: &Node, tx: &figcraft_doc::TextData, t: &mut Tok
         TextAlignH::Right => put("text-align", "right".into()),
         TextAlignH::Justified => put("text-align", "justify".into()),
     }
+    match tx.wrap_style {
+        figcraft_doc::WrapStyle::Auto => {}
+        figcraft_doc::WrapStyle::Balance => put("text-wrap", "balance".into()),
+        figcraft_doc::WrapStyle::Pretty => put("text-wrap", "pretty".into()),
+    }
     match s.case {
         TextCase::Original => {}
         TextCase::Upper => put("text-transform", "uppercase".into()),
diff --git a/crates/engine/src/dev/tailwind.rs b/crates/engine/src/dev/tailwind.rs
index 70a562a9c..8279ef9ce 100644
--- a/crates/engine/src/dev/tailwind.rs
+++ b/crates/engine/src/dev/tailwind.rs
@@ -310,6 +310,8 @@ fn decl(key: &str, value: &str) -> Vec<(String, String)> {
         ("text-transform", "uppercase") => kw("uppercase"),
         ("text-transform", "lowercase") => kw("lowercase"),
         ("text-transform", "capitalize") => kw("capitalize"),
+        ("text-wrap", "balance") => kw("text-balance"),
+        ("text-wrap", "pretty") => kw("text-pretty"),
         ("text-decoration", "underline") => kw("underline"),
         ("text-decoration", "line-through") => kw("line-through"),
         _ => one(format!("[{key}:{}]", arb(value).trim_matches(['[', ']']))),
diff --git a/crates/engine/src/text_behaviour_tests.rs b/crates/engine/src/text_behaviour_tests.rs
index bed6b3d6b..1e700c688 100644
--- a/crates/engine/src/text_behaviour_tests.rs
+++ b/crates/engine/src/text_behaviour_tests.rs
@@ -371,6 +371,72 @@ fn max_lines_on_auto_height_text_hugs_that_many_lines() {
     assert_eq!(resize_mode(&s, fixed), TextAutoResize::Truncate);
 }
 
+#[test]
+fn balance_and_pretty_wrap_styles_break_lines_as_documented() {
+    // Explore text properties: "Auto: Figma fits as many words as possible on each line before
+    // wrapping to the next." "Balance: Figma distributes text as evenly as possible across every
+    // line, so each line is close to the same length." "Pretty: Figma keeps each line full, but
+    // adjusts the last four lines to avoid an orphan -- a single word stranded alone on the last
+    // line." The synthetic font: 8 px per character at 16 px.
+    let font = test_mono_font();
+    let mut s = Session::new();
+    let t = text(&mut s, "aaa bbb ccc ddd eee", json!({"fontFamily": font, "fontSize": 16, "lineHeight": 24}));
+    s.execute("node.set", &json!({"id": t, "props": {"textAutoResize": "height", "width": 136}})).unwrap();
+    let lines = |s: &Session| -> Vec<(usize, usize)> {
+        let (l, _) = figcraft_text::layout_node(s.doc().unwrap().node(t).unwrap()).unwrap();
+        l.lines.iter().map(|l| (l.char_start, l.char_end)).collect()
+    };
+    // 136 px holds 17 characters: Auto fills the first line with four words and strands the fifth.
+    assert_eq!(lines(&s), [(0, 16), (16, 19)]);
+    // Balance: as even as the words allow, three and two.
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "balance"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 12), (12, 19)]);
+    assert_eq!(crate::inspect::node_json(s.doc().unwrap(), t, 0)["wrapStyle"], json!("balance"));
+    // Pretty: the stranded word gets company from the line before.
+    s.execute("text.wrapStyle", &json!({"ids": [t], "style": "pretty"})).unwrap();
+    assert_eq!(lines(&s), [(0, 12), (12, 19)]);
+    // Three lines of two-letter words in a 72 px box (nine characters): Auto strands "gg"; Pretty
+    // narrows the line before it alone ("aa bb cc" / "dd ee" / "ff gg"); Balance's narrowest
+    // width that still gives three lines (64 px) fills the first two lines as Auto does.
+    s.execute("node.set", &json!({"id": t, "props": {"characters": "aa bb cc dd ee ff gg", "width": 72, "wrapStyle": "auto"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 9), (9, 18), (18, 20)]);
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "pretty"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 9), (9, 15), (15, 20)]);
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "balance"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 9), (9, 18), (18, 20)]);
+    // A last line of two words is no orphan: Pretty leaves Auto's lines; a text on one line is
+    // left alone whatever the style.
+    s.execute("node.set", &json!({"id": t, "props": {"characters": "aa bb cc dd ee ff gg hh", "wrapStyle": "pretty"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 9), (9, 18), (18, 23)]);
+    s.execute("node.set", &json!({"id": t, "props": {"width": 400, "wrapStyle": "balance"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 23)]);
+    // Dev Mode's CSS says `text-wrap` for Balance and Pretty and nothing for Auto; junk is refused.
+    let css = |s: &mut Session| s.execute("inspect.code", &json!({"id": t})).unwrap()["code"].as_str().unwrap().to_string();
+    assert!(css(&mut s).contains("text-wrap: balance;"), "{}", css(&mut s));
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "pretty"}})).unwrap();
+    assert!(css(&mut s).contains("text-wrap: pretty;"));
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "auto"}})).unwrap();
+    assert!(!css(&mut s).contains("text-wrap"));
+    assert!(s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "zigzag"}})).is_err());
+    assert!(s.execute("text.wrapStyle", &json!({"ids": [t], "style": "even"})).is_err());
+    // A word as wide as the box is never broken in two by Balance or Pretty: 80 px holds the ten
+    // letters, and every narrower width Balance could try would have to split them.
+    s.execute("node.set", &json!({"id": t, "props": {"characters": "abcdefghij klm", "width": 80, "wrapStyle": "balance"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 11), (11, 14)]);
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "pretty"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 11), (11, 14)]);
+    // Hanging punctuation: a line starting with an opening mark has that much more room, and
+    // Pretty narrows it by as much, so the line before the orphan still gives a word away.
+    s.execute(
+        "node.set",
+        &json!({"id": t, "props": {"characters": "aa bb cc (dd ee ff gg", "width": 72, "hangingPunctuation": true, "wrapStyle": "auto"}}),
+    )
+    .unwrap();
+    assert_eq!(lines(&s), [(0, 9), (9, 19), (19, 21)]);
+    s.execute("node.set", &json!({"id": t, "props": {"wrapStyle": "pretty"}})).unwrap();
+    assert_eq!(lines(&s), [(0, 9), (9, 16), (16, 21)]);
+}
+
 #[test]
 fn max_lines_on_auto_width_text_keeps_auto_width_and_hugs_that_many_lines() {
     // "Max lines is available only if truncate text is enabled, and: Text resizing is set to
diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs
index 7305dac15..f2c587206 100644
--- a/crates/text/src/layout.rs
+++ b/crates/text/src/layout.rs
@@ -6,7 +6,7 @@ use std::sync::Arc;
 
 use figcraft_doc::{
     DecorationLength, DecorationStyle, LeadingTrim, LetterSpacing, LineHeight, ListStyle, ParaList, TextAlignH, TextAutoResize, TextCase, TextData,
-    TextDecoration, TextStyle, color::PaintKind, valid_feature_tag,
+    TextDecoration, TextStyle, WrapStyle, color::PaintKind, valid_feature_tag,
 };
 use figcraft_geom::{Affine, BezPath, Rect};
 use harfrust::{Direction, Feature, ShapeOptions, ShaperInstance, Tag, UnicodeBuffer, Variation};
@@ -630,7 +630,8 @@ impl SavedStarts<'_> {
     }
 }
 
-/// The lines (item range, paragraph end, paragraph), wrapped by measure or at `saved` line starts;
+/// The lines (item range, paragraph end, paragraph), wrapped to `wrap_of` (the width for each line
+/// of each paragraph; None: no wrapping) or at `saved` line starts;
 /// None when a saved line would overflow its box by more than [`SAVED_LINE_SLACK`]. Lines break
 /// where [`crate::breaks::break_between`] allows, and between the words `word_breaks` marks.
 fn break_lines(
@@ -638,7 +639,7 @@ fn break_lines(
     chars: &[char],
     cluster_start: &[bool],
     word_breaks: &[bool],
-    wrap: Option<f64>,
+    wrap_of: &WidthOf<'_>,
     line_indent_of: &impl Fn(usize, bool, usize) -> f64,
     rtl_para_at: &impl Fn(usize) -> bool,
     hang_start: bool,
@@ -652,6 +653,7 @@ fn break_lines(
     let mut last_break: Option<usize> = None;
     let mut para_first_line = true;
     let mut para = 0;
+    let mut line_in_para = 0;
     while i < items.len() {
         let Some(it) = items.get(i) else { break };
         if it.ch == '\n' {
@@ -662,6 +664,7 @@ fn break_lines(
             last_break = None;
             para_first_line = true;
             para += 1;
+            line_in_para = 0;
             continue;
         }
         // A line separator (a soft break) breaks the line inside its paragraph: no
@@ -673,6 +676,7 @@ fn break_lines(
             x = 0.0;
             last_break = None;
             para_first_line = false;
+            line_in_para += 1;
             continue;
         }
         let line_indent = line_indent_of(para, para_first_line, it.char_start);
@@ -681,7 +685,7 @@ fn break_lines(
         let ltr = !rtl_para_at(it.char_start);
         let hung = items.get(line_start).filter(|f| hang_start && ltr && opens(f.ch)).map_or(0.0, |f| f.adv)
             + if hang_end && ltr && closes(it.ch) { w } else { 0.0 };
-        if let Some(maxw) = wrap
+        if let Some(maxw) = wrap_of(para, line_in_para)
             && i > line_start
             && !it.is_space()
         {
@@ -702,6 +706,7 @@ fn break_lines(
                 x = 0.0;
                 last_break = None;
                 para_first_line = false;
+                line_in_para += 1;
                 continue;
             }
         }
@@ -721,6 +726,220 @@ fn break_lines(
     Some(lines)
 }
 
+/// A line as [`break_lines`] gives it: item range, paragraph end, paragraph.
+type LineRange = (usize, usize, bool, usize);
+
+/// The width a line wraps to (its paragraph, the line's index in it); None: no wrapping.
+type WidthOf<'a> = dyn Fn(usize, usize) -> Option<f64> + 'a;
+
+/// [`break_lines`] with the widths and the saved starts to follow, the rest bound.
+type Breaker<'a> = dyn Fn(&WidthOf<'_>, Option<SavedStarts<'_>>) -> Option<Vec<LineRange>> + 'a;
+
+/// What a paragraph's lines wrap to under Balance or Pretty: the paragraph's width, and a
+/// narrower one for a single line (the line Pretty has give a word away).
+#[derive(Clone, Copy)]
+struct ParaWidth {
+    width: f64,
+    line: Option<(usize, f64)>,
+}
+
+/// Whether the line's text is one word: no break opportunity between its items, its trailing
+/// spaces and the paragraph's line break aside.
+fn single_word(items: &[Item], word_breaks: &[bool], (start, end, _, _): LineRange) -> bool {
+    let Some(last) = (start..end).rev().find(|&k| items.get(k).is_some_and(|it| !it.is_space() && !is_line_break(it.ch))) else {
+        return false;
+    };
+    !(start..last).any(|k| {
+        let (Some(a), Some(b)) = (items.get(k), items.get(k + 1)) else { return false };
+        crate::breaks::break_between(a.ch, b.ch) || (a.char_end <= b.char_start && word_breaks.get(b.char_start).copied().unwrap_or(false))
+    })
+}
+
+/// How many of `lines` end inside a word: emergency breaks, made where no word boundary fitted
+/// the width. Balance and Pretty never add one (a word that fits the box stays whole).
+fn emergency_breaks(items: &[Item], word_breaks: &[bool], lines: &[LineRange]) -> usize {
+    lines
+        .iter()
+        .filter(|&&(_, end, para_end, _)| {
+            if para_end {
+                return false;
+            }
+            let (Some(a), Some(b)) = (end.checked_sub(1).and_then(|k| items.get(k)), items.get(end)) else { return false };
+            !(a.is_space()
+                || is_line_break(a.ch)
+                || crate::breaks::break_between(a.ch, b.ch)
+                || (a.char_end <= b.char_start && word_breaks.get(b.char_start).copied().unwrap_or(false)))
+        })
+        .count()
+}
+
+/// What a line's hanging punctuation adds to the room [`break_lines`] gives it (its opening mark
+/// at the start, its closing one at the end), so Pretty narrows a line by its text as the breaker
+/// measures it.
+fn hung_width(items: &[Item], (s, e, _, _): LineRange, hang_start: bool, hang_end: bool, rtl_para_at: &dyn Fn(usize) -> bool) -> f64 {
+    let ltr = items.get(s).is_none_or(|it| !rtl_para_at(it.char_start));
+    let first = items.get(s).filter(|it| hang_start && ltr && opens(it.ch)).map_or(0.0, |it| it.adv);
+    let last = e.checked_sub(1).filter(|k| *k > s).and_then(|k| items.get(k)).filter(|it| hang_end && ltr && closes(it.ch)).map_or(0.0, |it| it.adv);
+    first + last
+}
+
+/// The width of the line's text, its trailing spaces and line break aside, as the breaker
+/// measures it.
+fn line_width(items: &[Item], (start, end, _, _): LineRange) -> f64 {
+    let mut x = 0.0;
+    let mut width = 0.0;
+    for it in items.get(start..end).unwrap_or(&[]) {
+        if is_line_break(it.ch) {
+            break;
+        }
+        x += it.adv;
+        if !it.is_space() {
+            width = x - it.spacing;
+        }
+    }
+    width
+}
+
+/// Balance and Pretty: the greedy `lines` of a box `w` wide, re-broken paragraph by paragraph.
+/// Balance narrows a paragraph as far as it goes without another line, so its lines come out
+/// close to the same length ("distributes text as evenly as possible across every line, so each
+/// line is close to the same length"; what browsers do for `text-wrap: balance`). Pretty leaves
+/// lines full but, when the last line is one word, narrows one of the last four lines just enough
+/// to give a word to the lines after it ("keeps each line full, but adjusts the last four lines to
+/// avoid an orphan"). `rebreak` lays the text out again with a width per paragraph and line.
+fn restyle_breaks(
+    style: WrapStyle,
+    w: f64,
+    lines: Vec<LineRange>,
+    items: &[Item],
+    word_breaks: &[bool],
+    line_indent_of: &dyn Fn(usize, bool, usize) -> f64,
+    hung_of: &dyn Fn(LineRange) -> f64,
+    rebreak: &dyn Fn(&WidthOf<'_>) -> Vec<LineRange>,
+) -> Vec<LineRange> {
+    let paragraphs = lines.last().map_or(0, |l| l.3 + 1);
+    // Every pass lays the whole text out again: a very long text keeps its greedy lines.
+    if items.len().saturating_mul(paragraphs) > 2_000_000 {
+        return lines;
+    }
+    let mut plan = vec![ParaWidth { width: w, line: None }; paragraphs];
+    // The lines with paragraph `p` wrapped to `pw` and the others as planned.
+    let with = |plan: &[ParaWidth], p: usize, pw: ParaWidth| {
+        let width_of = move |q: usize, li: usize| {
+            let pw = if q == p { pw } else { plan.get(q).copied().unwrap_or(ParaWidth { width: w, line: None }) };
+            Some(match pw.line {
+                Some((j, narrow)) if li == j => narrow,
+                _ => pw.width,
+            })
+        };
+        rebreak(&width_of)
+    };
+    let of = |ls: &[LineRange], p: usize| -> Vec<LineRange> { ls.iter().copied().filter(|l| l.3 == p).collect() };
+    let mut current = lines;
+    for p in 0..paragraphs {
+        let para = of(&current, p);
+        let n = para.len();
+        if n < 2 {
+            continue;
+        }
+        // Words wider than the box break where they must; the re-breaking adds no such break.
+        let base = emergency_breaks(items, word_breaks, &para);
+        match style {
+            WrapStyle::Auto => {}
+            WrapStyle::Balance => {
+                // The narrowest width that still gives `n` lines, to half a pixel.
+                let (mut lo, mut hi) = (0.0, w);
+                while hi - lo > 0.5 {
+                    let mid = (lo + hi) / 2.0;
+                    let ls = of(&with(&plan, p, ParaWidth { width: mid, line: None }), p);
+                    if ls.len() == n && emergency_breaks(items, word_breaks, &ls) <= base {
+                        hi = mid;
+                    } else {
+                        lo = mid;
+                    }
+                }
+                let pw = ParaWidth { width: hi, line: None };
+                current = with(&plan, p, pw);
+                if let Some(slot) = plan.get_mut(p) {
+                    *slot = pw;
+                }
+            }
+            WrapStyle::Pretty => {
+                if !para.last().is_some_and(|l| single_word(items, word_breaks, *l)) {
+                    continue;
+                }
+                // The line before the last, back to the fourth from the end: narrowed to just under
+                // its text, its last word goes to the lines after it (which stay full); a word or
+                // two more if the last line is still alone. A line that would rather start another
+                // line can't give a word away.
+                'lines: for j in (n.saturating_sub(4)..n - 1).rev() {
+                    let Some(&line) = para.get(j) else { continue };
+                    let indent = line_indent_of(p, j == 0, items.get(line.0).map_or(0, |it| it.char_start));
+                    let mut narrow = line_width(items, line) - hung_of(line);
+                    for _ in 0..3 {
+                        narrow -= 0.5;
+                        if narrow <= 0.0 {
+                            break;
+                        }
+                        let pw = ParaWidth { width: w, line: Some((j, narrow + indent)) };
+                        let ls = with(&plan, p, pw);
+                        let after = of(&ls, p);
+                        if after.len() != n || emergency_breaks(items, word_breaks, &after) > base {
+                            break;
+                        }
+                        if !after.last().is_some_and(|l| single_word(items, word_breaks, *l)) {
+                            current = ls;
+                            if let Some(slot) = plan.get_mut(p) {
+                                *slot = pw;
+                            }
+                            break 'lines;
+                        }
+                        narrow = after.get(j).map_or(0.0, |l| line_width(items, *l) - hung_of(*l));
+                    }
+                }
+            }
+        }
+    }
+    current
+}
+
+/// Pins a breaking closure to the signature [`wrapped_lines`] takes: a closure whose parameter
+/// borrows a trait object is otherwise inferred for one lifetime, not any.
+fn breaker<F>(f: F) -> F
+where
+    F: Fn(&WidthOf<'_>, Option<SavedStarts<'_>>) -> Option<Vec<LineRange>>,
+{
+    f
+}
+
+/// The lines of a text wrapped to `wrap`: the file's saved breaks while they hold, else greedy
+/// ones, re-broken for Balance or Pretty. `breaks` runs [`break_lines`] with a width per line and
+/// the saved starts to follow.
+fn wrapped_lines(
+    text: &TextData,
+    wrap: Option<f64>,
+    items: &[Item],
+    word_breaks: &[bool],
+    line_indent_of: &dyn Fn(usize, bool, usize) -> f64,
+    hung_of: &dyn Fn(LineRange) -> f64,
+    breaks: &Breaker<'_>,
+) -> Vec<LineRange> {
+    // Where the file saved its line breaks, they win while the text and box are as saved.
+    let saved = wrap.and_then(|w| text.saved_breaks_for(w)).map(|starts| SavedStarts { starts, next: 0 });
+    let from_saved = saved.and_then(|s| breaks(&|_, _| wrap, Some(s)));
+    let followed = from_saved.is_some();
+    let lines = from_saved.or_else(|| breaks(&|_, _| wrap, None)).unwrap_or_default();
+    // Balance and Pretty re-break the paragraphs at narrower widths (never saved breaks).
+    match wrap {
+        Some(w) if !followed && text.wrap_style != WrapStyle::Auto => {
+            restyle_breaks(text.wrap_style, w, lines, items, word_breaks, line_indent_of, hung_of, &|wrap_of| {
+                breaks(wrap_of, None).unwrap_or_default()
+            })
+        }
+        _ => lines,
+    }
+}
+
 #[derive(Clone, Copy)]
 struct LayoutFinish<'a> {
     text: &'a TextData,
@@ -970,10 +1189,11 @@ pub fn layout(text: &TextData, box_width: Option<f64>, box_height: Option<f64>)
         TextAutoResize::WidthAndHeight => None,
         _ => box_width.filter(|w| w.is_finite() && *w > 0.0),
     };
-    let breaks = |saved| break_lines(&items, &chars, &cluster_start, &word_breaks, wrap, &line_indent_of, &rtl_para_at, hang_start, hang_end, saved);
-    // Where the file saved its line breaks, they win while the text and box are as saved.
-    let saved = wrap.and_then(|w| text.saved_breaks_for(w)).map(|starts| SavedStarts { starts, next: 0 });
-    let lines = saved.and_then(|s| breaks(Some(s))).or_else(|| breaks(None)).unwrap_or_default();
+    let breaks = breaker(|wrap_of, saved| {
+        break_lines(&items, &chars, &cluster_start, &word_breaks, wrap_of, &line_indent_of, &rtl_para_at, hang_start, hang_end, saved)
+    });
+    let hung_of = |l: LineRange| hung_width(&items, l, hang_start, hang_end, &rtl_para_at);
+    let lines = wrapped_lines(text, wrap, &items, &word_breaks, &line_indent_of, &hung_of, &breaks);
     // Line metrics and positions.
     let default_style = styles.first().cloned().unwrap_or_default();
     let default_face = faces.first().cloned().flatten();
diff --git a/crates/ui-egui/locales/en.toml b/crates/ui-egui/locales/en.toml
index a23c281ba..11f0bb4ac 100644
--- a/crates/ui-egui/locales/en.toml
+++ b/crates/ui-egui/locales/en.toml
@@ -406,6 +406,12 @@ name = "English"
 "Decoration style" = "Decoration style"
 "Decoration" = "Decoration"
 "Deep select" = "Deep select"
+"Wrap style" = "Wrap style"
+"Balance" = "Balance"
+"Pretty" = "Pretty"
+"Auto: as many words as fit on each line" = "Auto: as many words as fit on each line"
+"Balance: every line close to the same length" = "Balance: every line close to the same length"
+"Pretty: full lines, no one word alone on the last" = "Pretty: full lines, no one word alone on the last"
 "Set hug contents" = "Set hug contents"
 "Set fill container" = "Set fill container"
 "Double-click an edge of an auto layout frame" = "Double-click an edge of an auto layout frame"
diff --git a/crates/ui-egui/src/panels/typography/fields.rs b/crates/ui-egui/src/panels/typography/fields.rs
index cd3c485c3..20b9d8e90 100644
--- a/crates/ui-egui/src/panels/typography/fields.rs
+++ b/crates/ui-egui/src/panels/typography/fields.rs
@@ -385,6 +385,18 @@ fn type_settings(
         if let Some(i) = text_seg(ui, "trim", &items, trim, w) {
             app.set_props(ids, json!({"leadingTrim": if i == 1 { "capHeight" } else { "none" }}));
         }
+        // Where lines break when the text wraps (Explore text properties).
+        caption(ui, tr("Wrap style"));
+        let wrap = common(doc, ids, |n| n.kind.text().map(|t| t.wrap_style as usize)).flatten();
+        let items = [
+            (tr("Auto"), tr_noop("Auto: as many words as fit on each line")),
+            (tr("Balance"), tr_noop("Balance: every line close to the same length")),
+            (tr("Pretty"), tr_noop("Pretty: full lines, no one word alone on the last")),
+        ];
+        if let Some(i) = text_seg(ui, "wrap", &items, wrap, w) {
+            let style = ["auto", "balance", "pretty"].get(i).copied().unwrap_or("auto");
+            app.set_props(ids, json!({"wrapStyle": style}));
+        }
         let resize = common(doc, ids, |n| n.kind.text().map(|t| t.auto_resize)).flatten();
         // Auto-height text with a line limit truncates too.
         let truncating = common(doc, ids, |n| n.kind.text().map(TextData::truncates)).flatten();
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index f5966f334..cc0fc9db8 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI and interaction parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** patch (a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testing on the result, group drags, frame outlines and slices; outlines for the selection, mask outlines; arc fields, live boolean editing, shape builder on strokes, one-sided widths; fields select their text on focus; Typography spacing icons support scrubbing (#373); CSS colour names in hex fields; a rename selects the whole name, so typing replaces it; Escape or Enter after a pen path stays on the same vector (#760); IME composition kept on through idle frames of a text edit, candidates at the caret (#747); Selection colors for mixed selections and smart-selection spacing (#753); submenus with a hover delay and a safe triangle; the Actions palette's tabs, ranked search, highlight and recents; menu items that ask for a value; editor fixes from the community batches) · **Target:** Figma Design UI3 (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testing on the result, group drags, frame outlines and slices; outlines for the selection, mask outlines; arc fields, live boolean editing, shape builder on strokes, one-sided widths; fields select their text on focus; Typography spacing icons support scrubbing (#373); CSS colour names in hex fields; a rename selects the whole name, so typing replaces it; Escape or Enter after a pen path stays on the same vector (#760); IME composition kept on through idle frames of a text edit, candidates at the caret (#747); Selection colors for mixed selections and smart-selection spacing (#753); submenus with a hover delay and a safe triangle; the Actions palette's tabs, ranked search, highlight and recents; menu items that ask for a value; editor fixes from the community batches) · **Target:** Figma Design UI3 (desktop app 126.10.7)
 
 Fine canvas control is what Figma users feel first: handles, snapping, nudging, modifier keys,
 drag behaviour, numeric precision. This checklist covers the tools, gestures and panels. Status:
@@ -90,6 +90,7 @@ interaction feel not yet compared.
 | Shape builder (Shift+M) on fills, strokes and open paths; variable width (Shift+W), one side with Alt | done | |
 | Boolean groups: clicked where the result is, double-click or Cmd/Ctrl-click into operands, live results while dragging or editing points, per-operand operations | done | a group past the path operations' caps (250 000 segments, 2 million possible crossings, 4 million segments swept over a fold) draws without its result, with a warning, and Flatten refuses it (#1104) |
 | Text: point, auto height, fixed; caret, words, lines, IME | done | Backspace or Delete at the start of a list item takes its marker and keeps its level, the paragraph starting where the item's text did ("delete the counter, but keep the same level of indentation", Create bulleted and numbered lists; `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests`); max lines on auto-width text keep it auto width, hugging up to that many lines and growing with its longest line ("Text resizing is set to auto height or auto width", Explore text properties; `text_behaviour_tests::max_lines_on_auto_width_text_keeps_auto_width_and_hugs_that_many_lines`); Alt+Enter while editing opens the link at the caret, web and mail links only (`text.openLink`; "press ⌥Option Return/Alt Enter to activate a focused link", Accessibility at Figma; `text_link_tests`); the font picker previews a family on the canvas while hovered (no undo step; Escape restores, #653) and Up/Down step through it (#352); a selection highlight after a line break starts at that line's start and an empty last line shows its mark (#665); carets step over whole emoji and accented letters; colour emoji draw from their colour tables (#300); IME composition replayed in tests as macOS sends it, not yet checked on a Mac (#747); CJK words by script run (no dictionary); vertical trim in Type settings; no spell check |
+| Text: wrap style (Auto, Balance, Pretty) | done | per text layer (`wrapStyle` on `node.set`, `text.wrapStyle`, the Type settings control under Vertical trim, inspect, CSS `text-wrap: balance` or `pretty`): Auto breaks greedily; Balance narrows each paragraph as far as it goes without another line, so its lines come out close to the same length (what browsers do for `text-wrap: balance`); Pretty keeps lines full and, when the last line is one word, narrows one of the last four lines just enough to give a word to the lines after it (Explore text properties: "Auto: Figma fits as many words as possible on each line before wrapping to the next", "Balance: Figma distributes text as evenly as possible across every line, so each line is close to the same length", "Pretty: Figma keeps each line full, but adjusts the last four lines to avoid an orphan"). Saved line breaks from a file still win. Not yet included: per-paragraph settings, text-style support and the `.fig` import/export mapping (#1827). Test: `text_behaviour_tests::balance_and_pretty_wrap_styles_break_lines_as_documented` |
 | Text: superscript and subscript | done | `sups` / `subs` use the font's own glyphs where it has the feature and every letter or digit of the run gets one; otherwise the standard glyphs are drawn shrunk and raised or lowered by the font's OS/2 superscript and subscript metrics (0.65 em at 0.35 em up or 0.14 em down without them), and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says ("Figma draws a synthesized version by using the font's standard version of the character, shrinking it, and positioning it accordingly"; mixed glyphs "all update to the synthesized form for consistency"), #1828; tests `text::tests::superscript_native_or_synthesised_and_never_mixed`, `text_behaviour_tests::superscript_and_subscript_are_synthesised_without_glyphs_for_them` |
 | Eyedropper (I) | done | picks the colour seen under the pointer (opaque) into the selection's fill and the recent colours, one undo step (`fx_behaviour_tests`); with Cmd/Ctrl+Shift held it makes a colour style or variable of it instead, as the reference app's eyedropper does: a Create from color window asks which, its name (the next free "Color n") and a variable's collection (the file's first, or a new one made with it in the same undo step), and leaves the selection's fills alone (`eyedropper_create_tests`, `sampled_color_tests`) |
 | Comment (C), Shift+C to show/hide | done | local only |
@@ -178,6 +179,7 @@ in the table. `crates/ui-egui/src/shortcut_keys_tests.rs` drives the keys a look
 | Date | Change | Summary |
 |---|---|---|
 | 2026-11-02 | patch | M8, #1875: a click with the Bend tool on a sharp point between two segments gives it handles along the line between its neighbours, a third of the way to each ("Click on a point or path where you want to add a curve", Edit vector layers); a click on a curved point still makes it sharp, a drag still sets the handles by hand, an endpoint is left alone. Between a handle's end and a point both within reach of the pointer, the nearer one on the page is hit (the handle on a tie), so a short path's point (its handles a few pixels long) can be clicked again. Before, only a drag curved a point, and a short one left two tiny handles in its direction. Tests: `vectoredit::tests::short_handles_leave_their_point_clickable`, `vectoredit::tests::a_bend_click_curves_a_sharp_point_between_its_neighbours`, `bend_tool_smooths_and_sharpens_points`. Numbers unchanged. |
+| 2026-11-02 | minor | M4, #1827: wrap style on a text layer (`WrapStyle`: Auto, Balance, Pretty): Balance re-breaks each paragraph at the narrowest width that keeps its line count (bisection over the greedy breaker, as browsers balance), Pretty narrows one of the last four lines just enough so the last line isn't one word; `text.wrapStyle`, `node.set wrapStyle` (`textWrap` too), inspect `wrapStyle`, Dev Mode CSS `text-wrap` (Tailwind `text-balance` / `text-pretty`), the Type settings control under Vertical trim. Per-paragraph settings, text-style support and the `.fig` import/export mapping stay open. Test: `text_behaviour_tests::balance_and_pretty_wrap_styles_break_lines_as_documented`. |
 | 2026-11-02 | patch | M4: Backspace or Delete at the start of a list item takes its marker and keeps its level ("Use Backspace or Delete at the beginning of a list item to delete the counter, but keep the same level of indentation", Create bulleted and numbered lists): a plain paragraph may now carry a list level, and the text layout starts it where that level's item text starts (the gutters stay even when no list is left). Backspace used to drop the level too, and Delete at an item's start deleted the next character. Tab on such a paragraph types a tab, as outside a list. Tests: `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests::a_plain_paragraph_at_a_list_level_starts_where_the_items_text_does` |
 | 2026-11-02 | patch | M4: max lines on an auto-width text keep it auto width: the box hugs up to that many lines and still grows with its longest line ("Max lines is available only if truncate text is enabled, and: Text resizing is set to auto height or auto width", Explore text properties). `text.maxLines` turned such a text into a fixed truncating box with a stale height, so later typing no longer widened it; fixed-size text still becomes a truncating box, auto-height text hugs as before. Test: `text_behaviour_tests::max_lines_on_auto_width_text_keeps_auto_width_and_hugs_that_many_lines` |
 | 2026-11-02 | patch | M4, #1828: superscript and subscript synthesised where the font has no `sups` / `subs` glyphs (the standard glyph shrunk and shifted by the OS/2 metrics, the usual 0.65 em and 0.35 / 0.14 em offsets without them), and a run mixing available and unavailable glyphs synthesised whole, as Explore text properties says. Tests: `text::tests::superscript_native_or_synthesised_and_never_mixed`, `text_behaviour_tests::superscript_and_subscript_are_synthesised_without_glyphs_for_them`. |

From 35684eaa028e636d264073a666ef11881620fa0e Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 06:09:08 -0500
Subject: [PATCH 12/70] fix(format): index kiwi field lookups and bound schema
 and empty-array growth (#1896)

A .fig message looked up each tag's field with a linear scan of its
definition, so a wide schema and many tags cost their product. Schema
decoding capped fields per definition but not in total, and inflated the
schema chunk under the 512 MiB message cap. Empty non-byte arrays spent
nothing from the decoded-value budget while still growing the output.

Field ids (and enum values) are now found through a per-definition map
built on first use, keeping first-match semantics. A schema holds at most
200 000 fields together and its chunk may inflate to 16 MiB. Every array
field spends one value for itself before its elements.
---
 crates/format/src/fig.rs       | 26 ++++++++++------
 crates/format/src/fig/kiwi.rs  | 34 +++++++++++++++++----
 crates/format/src/fig/tests.rs | 54 ++++++++++++++++++++++++++++++++++
 3 files changed, 100 insertions(+), 14 deletions(-)

diff --git a/crates/format/src/fig.rs b/crates/format/src/fig.rs
index 55a5d7c34..7c81d0141 100644
--- a/crates/format/src/fig.rs
+++ b/crates/format/src/fig.rs
@@ -72,6 +72,9 @@ use kiwi::{Kv, Schema};
 /// Largest `canvas.fig` member read, and largest decompressed chunk.
 const MAX_CANVAS: u64 = 256 * 1024 * 1024;
 const MAX_CHUNK: u64 = 512 * 1024 * 1024;
+/// Largest decompressed schema chunk: Figma's schema unpacks to well under 1 MB, so a schema that
+/// inflates past this is refused before its definitions are decoded.
+const MAX_SCHEMA: u64 = 16 * 1024 * 1024;
 /// Largest image member read.
 const MAX_IMAGE: u64 = figcraft_doc::ImageData::MAX_BYTES;
 /// Total decompressed ZIP image bytes read per import: the native image budget (`IMAGE_BUDGET`) on
@@ -324,7 +327,7 @@ fn decode_canvas(canvas: &[u8]) -> Result<(Schema, Vec<u8>), FormatError> {
     let (Some(schema), Some(message)) = (it.next(), it.next()) else {
         return Err(corrupt("canvas.fig needs a schema and a message chunk"));
     };
-    let schema = Schema::decode(&inflate(schema)?).map_err(|e| corrupt(e.to_string()))?;
+    let schema = Schema::decode(&inflate_within(schema, MAX_SCHEMA)?).map_err(|e| corrupt(e.to_string()))?;
     Ok((schema, inflate(message)?))
 }
 
@@ -347,18 +350,23 @@ fn chunks(canvas: &[u8]) -> Result<Vec<&[u8]>, FormatError> {
 
 /// Decompress a chunk: zstd (by its magic number), else raw deflate, else zlib.
 fn inflate(data: &[u8]) -> Result<Vec<u8>, FormatError> {
-    fn capped(r: impl Read) -> Option<Vec<u8>> {
+    inflate_within(data, MAX_CHUNK)
+}
+
+/// [`inflate`] refusing a chunk that unpacks to more than `max` bytes.
+fn inflate_within(data: &[u8], max: u64) -> Result<Vec<u8>, FormatError> {
+    let capped = |r: &mut dyn Read| -> Option<Vec<u8>> {
         let mut out = Vec::new();
-        r.take(MAX_CHUNK + 1).read_to_end(&mut out).ok()?;
-        (out.len() as u64 <= MAX_CHUNK).then_some(out)
-    }
+        r.take(max.saturating_add(1)).read_to_end(&mut out).ok()?;
+        (out.len() as u64 <= max).then_some(out)
+    };
     if data.starts_with(&[0x28, 0xB5, 0x2F, 0xFD]) {
         let mut src = data;
-        let dec = ruzstd::decoding::StreamingDecoder::new(&mut src).map_err(|e| corrupt(format!("zstd: {e}")))?;
-        return capped(dec).ok_or_else(|| corrupt("damaged or oversized zstd chunk"));
+        let mut dec = ruzstd::decoding::StreamingDecoder::new(&mut src).map_err(|e| corrupt(format!("zstd: {e}")))?;
+        return capped(&mut dec).ok_or_else(|| corrupt("damaged or oversized zstd chunk"));
     }
-    capped(flate2::read::DeflateDecoder::new(data))
-        .or_else(|| capped(flate2::read::ZlibDecoder::new(data)))
+    capped(&mut flate2::read::DeflateDecoder::new(data))
+        .or_else(|| capped(&mut flate2::read::ZlibDecoder::new(data)))
         .ok_or_else(|| corrupt("damaged or oversized deflate chunk"))
 }
 
diff --git a/crates/format/src/fig/kiwi.rs b/crates/format/src/fig/kiwi.rs
index d34b3774d..909dad87c 100644
--- a/crates/format/src/fig/kiwi.rs
+++ b/crates/format/src/fig/kiwi.rs
@@ -6,6 +6,7 @@
 //! Everything here reads untrusted bytes: reads are bounds-checked, nesting is capped, array
 //! counts can't exceed the bytes left, and the total number of decoded values is capped.
 
+use std::collections::HashMap;
 use std::fmt;
 
 /// Deepest struct/message nesting decoded.
@@ -32,6 +33,9 @@ const MAX_VALUES: usize = 32 << 20;
 /// Most definitions in a schema, and fields in one definition.
 const MAX_DEFS: usize = 10_000;
 const MAX_FIELDS: usize = 10_000;
+/// Most fields in a schema, every definition together: Figma's own schema has a few thousand, and
+/// without a total a schema of [`MAX_DEFS`] wide definitions could hold 100 million field records.
+const MAX_SCHEMA_FIELDS: usize = 200_000;
 
 #[derive(Debug, PartialEq, Eq)]
 pub struct KiwiError(pub String);
@@ -252,6 +256,7 @@ impl Schema {
         }
         let mut defs = Vec::with_capacity(count);
         let mut raw_types = Vec::new();
+        let mut total_fields = 0usize;
         for _ in 0..count {
             let name = r.string()?;
             let kind = match r.byte()? {
@@ -261,7 +266,8 @@ impl Schema {
                 k => return err(format!("schema: unknown definition kind {k}")),
             };
             let n = r.var_uint()? as usize;
-            if n > MAX_FIELDS || n > r.left() {
+            total_fields = total_fields.saturating_add(n);
+            if n > MAX_FIELDS || n > r.left() || total_fields > MAX_SCHEMA_FIELDS {
                 return err("schema: too many fields");
             }
             let mut fields = Vec::with_capacity(n);
@@ -308,7 +314,7 @@ impl Schema {
 
     /// [`Self::decode_message`] within `budget` values (see [`value_budget`]).
     pub fn decode_message_within<'s>(&'s self, root: usize, data: &[u8], budget: usize) -> Result<Kv<'s>, KiwiError> {
-        let mut d = Decoder { schema: self, r: Reader { data, pos: 0 }, budget };
+        let mut d = Decoder { schema: self, r: Reader { data, pos: 0 }, budget, ids: vec![None; self.defs.len()] };
         d.def(root, 0)
     }
 }
@@ -322,6 +328,10 @@ struct Decoder<'s, 'b> {
     schema: &'s Schema,
     r: Reader<'b>,
     budget: usize,
+    /// Per definition, the index of the first field with each id (message field ids, enum
+    /// values), built the first time the definition is decoded: a message can carry many tags
+    /// against a wide definition, and a scan per tag would multiply the two.
+    ids: Vec<Option<HashMap<u32, usize>>>,
 }
 
 impl<'s> Decoder<'s, '_> {
@@ -330,6 +340,19 @@ impl<'s> Decoder<'s, '_> {
         Ok(())
     }
 
+    /// The first field of definition `i` with id (or enum value) `id`.
+    fn field_by_id(&mut self, i: usize, id: u32) -> Option<&'s Field> {
+        let fields = &self.schema.defs.get(i)?.fields;
+        let ids = self.ids.get_mut(i)?.get_or_insert_with(|| {
+            let mut m = HashMap::with_capacity(fields.len());
+            for (j, f) in fields.iter().enumerate() {
+                m.entry(f.value).or_insert(j);
+            }
+            m
+        });
+        fields.get(*ids.get(&id)?)
+    }
+
     fn def(&mut self, i: usize, depth: usize) -> Result<Kv<'s>, KiwiError> {
         if depth > MAX_DEPTH {
             return err("message: nested too deeply");
@@ -340,7 +363,7 @@ impl<'s> Decoder<'s, '_> {
         match d.kind {
             Kind::Enum => {
                 let v = self.r.var_uint()?;
-                Ok(d.fields.iter().find(|f| f.value == v).map_or(Kv::Uint(u64::from(v)), |f| Kv::Enum(f.name.as_str())))
+                Ok(self.field_by_id(i, v).map_or(Kv::Uint(u64::from(v)), |f| Kv::Enum(f.name.as_str())))
             }
             Kind::Struct => {
                 let mut out = Vec::with_capacity(d.fields.len());
@@ -358,7 +381,7 @@ impl<'s> Decoder<'s, '_> {
                         out.shrink_to_fit();
                         return Ok(Kv::Object(out));
                     }
-                    let f = d.fields.iter().find(|f| f.value == id).ok_or_else(|| KiwiError(format!("message: {} has no field {id}", d.name)))?;
+                    let f = self.field_by_id(i, id).ok_or_else(|| KiwiError(format!("message: {} has no field {id}", d.name)))?;
                     out.push((f.name.as_str(), self.field(f, depth)?));
                 }
             }
@@ -379,8 +402,9 @@ impl<'s> Decoder<'s, '_> {
         if n > self.r.left() {
             return err("message: array longer than the data");
         }
+        // The field itself counts, so empty arrays can't pile up for free.
+        self.spend(1)?;
         if ty == Type::Byte {
-            self.spend(1)?;
             return Ok(Kv::Bytes(self.r.take(n)?.to_vec()));
         }
         self.spend(n)?;
diff --git a/crates/format/src/fig/tests.rs b/crates/format/src/fig/tests.rs
index 657f2f81d..2d4a1f7d6 100644
--- a/crates/format/src/fig/tests.rs
+++ b/crates/format/src/fig/tests.rs
@@ -1179,6 +1179,60 @@ fn scalar_fields_count_against_the_value_budget() {
     assert!(sc.decode_message_within(0, &data, 1001).is_ok());
 }
 
+#[test]
+fn empty_arrays_count_against_the_value_budget() {
+    // 1000 empty `uint[]` fields: each field is a value even with no elements, so a small budget
+    // can't be outgrown by piling up empty containers.
+    let fields = vec![Field { name: "a".into(), ty: Some(Type::Uint), array: true, value: 1 }];
+    let sc = Schema { defs: vec![Def { name: "Message".into(), kind: Kind::Message, fields }] };
+    let mut data = [1u8, 0].repeat(1000);
+    data.push(0);
+    let e = sc.decode_message_within(0, &data, 10).unwrap_err();
+    assert_eq!(e.0, "message: too many values");
+    assert!(sc.decode_message_within(0, &data, 1001).is_ok());
+}
+
+#[test]
+fn message_tags_find_their_field_by_id_in_a_wide_definition() {
+    // A wide definition: every tag is looked up by id, and the first field with an id wins, as
+    // before the lookup was indexed.
+    let mut fields: Vec<Field> = (1..=5000).map(|i| Field { name: format!("f{i}"), ty: Some(Type::Bool), array: false, value: i }).collect();
+    fields.push(Field { name: "shadow".into(), ty: Some(Type::Bool), array: false, value: 7 });
+    let sc = Schema { defs: vec![Def { name: "Message".into(), kind: Kind::Message, fields }] };
+    let mut w = encode::Writer::default();
+    for _ in 0..20_000 {
+        w.var_uint(5000);
+        w.byte(1);
+    }
+    w.var_uint(7);
+    w.byte(0);
+    w.var_uint(0);
+    let Kv::Object(out) = sc.decode_message(0, &w.0).unwrap() else { panic!() };
+    assert_eq!(out.len(), 20_001);
+    assert!(out.iter().take(20_000).all(|(n, v)| *n == "f5000" && *v == Kv::Bool(true)));
+    assert_eq!(out.last().map(|(n, _)| *n), Some("f7"));
+}
+
+#[test]
+fn a_schema_is_refused_past_its_total_field_count() {
+    // 25 definitions of 10 000 fields each: every one is within the per-definition cap, but
+    // together they pass the schema's total.
+    let mut w = encode::Writer::default();
+    w.var_uint(25);
+    for d in 0..25 {
+        w.string(&format!("D{d}"));
+        w.byte(0);
+        w.var_uint(10_000);
+        for i in 0..10_000u32 {
+            w.string("");
+            w.var_int(0);
+            w.byte(0);
+            w.var_uint(i);
+        }
+    }
+    assert_eq!(Schema::decode(&w.0).unwrap_err().0, "schema: too many fields");
+}
+
 #[test]
 fn hostile_input_is_refused() {
     // A message that contains itself, nested past the depth cap.

From 53ebf1f39c51361282ca55e18c83fbffed2f9a34 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 14:40:54 -0500
Subject: [PATCH 13/70] fix(pathops): sanitize a brush's width profile once
 before sampling (#1948)

---
 crates/pathops/src/brush.rs       |  4 +++-
 crates/pathops/src/brush_tests.rs | 11 +++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/crates/pathops/src/brush.rs b/crates/pathops/src/brush.rs
index bfd7f9212..b5875d4a2 100644
--- a/crates/pathops/src/brush.rs
+++ b/crates/pathops/src/brush.rs
@@ -131,7 +131,9 @@ pub fn outline(path: &BezPath, width: f64, props: &StrokeProps, brush: &Brush) -
     let p = preset(&brush.preset)?;
     let unit = shape(p.id)?;
     let lines = polylines(path)?;
-    let scale = |t: f64| width * props.profile().map_or(1.0, |pr| pr.scale_at(t));
+    // Sanitized once: at most 64 points, so each sample's symmetry scan stays cheap.
+    let profile = props.profile().map(|pr| pr.sanitized());
+    let scale = |t: f64| width * profile.as_ref().map_or(1.0, |pr| pr.scale_at(t));
     let mut out = BezPath::new();
     match p.kind {
         BrushKind::Stretch => {
diff --git a/crates/pathops/src/brush_tests.rs b/crates/pathops/src/brush_tests.rs
index 403935ddd..81cc55e10 100644
--- a/crates/pathops/src/brush_tests.rs
+++ b/crates/pathops/src/brush_tests.rs
@@ -72,3 +72,14 @@ fn a_width_profile_scales_the_brush() {
     let (first, last) = (parts.first().unwrap().bounding_box(), parts.last().unwrap().bounding_box());
     assert!(last.width() > first.width() * 3.0, "{first:?} {last:?}");
 }
+
+#[test]
+fn an_unsanitized_profile_is_bounded_before_sampling() {
+    // 100k points, all past the 64-point cap and out of range: the brush reads the clamped profile.
+    let raw = WidthProfile { points: (0..100_000).map(|i| figcraft_doc::WidthPoint::new(f64::from(i), 1e300)).collect() };
+    let b = brush("taper");
+    let mut p = props(1.0, &b);
+    p.width_profile = Some(raw);
+    let out = outline(&line(50.0), 1.0, &p, &b).unwrap();
+    assert!(out.bounding_box().height() <= 2.0 * WidthProfile::MAX_SCALE);
+}

From cfb29a4a9617b75f9072188c15ad1e24307850f8 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 17:58:09 -0500
Subject: [PATCH 14/70] perf(text): compute each glyph's cluster end once per
 run (#1963)

---
 crates/text/src/layout.rs | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs
index f2c587206..dd728916b 100644
--- a/crates/text/src/layout.rs
+++ b/crates/text/src/layout.rs
@@ -1698,11 +1698,22 @@ fn shape_segment(chars: &[char], seg: &Segment, face: &Arc<Face>, features: &[Fe
     }
     let (script_scale, script_shift) = synth.map_or((1.0, 0.0), |(_, up)| if up { face.superscript } else { face.subscript });
     let n = raw.len();
+    // Cluster end: the next larger cluster value, else the segment end. A glyph in the same
+    // cluster as the next one shares its end, so many glyphs of one cluster aren't rescanned.
+    let mut cends = vec![0usize; n];
+    for gi in (0..n).rev() {
+        let Some(&(_, cl, ..)) = raw.get(gi) else { continue };
+        let cl = cl as usize;
+        let shared = raw.get(gi + 1).filter(|r| r.1 as usize == cl).and_then(|_| cends.get(gi + 1).copied());
+        let cend = shared.unwrap_or_else(|| raw.iter().skip(gi + 1).map(|r| r.1 as usize).find(|c| *c > cl).unwrap_or(end).max(cl + 1));
+        if let Some(slot) = cends.get_mut(gi) {
+            *slot = cend;
+        }
+    }
     for gi in 0..n {
         let Some(&(gid, cl, xa, xo, yo)) = raw.get(gi) else { continue };
         let cl = cl as usize;
-        // Cluster end: the next larger cluster value, else the segment end.
-        let cend = raw.iter().skip(gi + 1).map(|r| r.1 as usize).find(|c| *c > cl).unwrap_or(end).max(cl + 1);
+        let cend = cends.get(gi).copied().unwrap_or(cl + 1);
         let last_in_cluster = raw.get(gi + 1).is_none_or(|r| r.1 as usize != cl);
         let ch = chars.get(cl).copied().unwrap_or(' ');
         let scale = if small_at(cl) { SMALL_CAP_SCALE } else { 1.0 } * script_scale;

From fb4d0b50352e97debc98b212ba6e2795a6c3d4b6 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 17:58:27 -0500
Subject: [PATCH 15/70] perf(doc,engine): rebuild a widget by removing its
 children in one pass (#1967)

---
 crates/doc/src/lib.rs                   | 13 +++++++++++++
 crates/doc/src/tests.rs                 | 14 ++++++++++++++
 crates/engine/src/extensions/widgets.rs |  4 +---
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs
index 89eb97269..0181ffd21 100644
--- a/crates/doc/src/lib.rs
+++ b/crates/doc/src/lib.rs
@@ -574,6 +574,19 @@ impl Document {
         Ok(())
     }
 
+    /// Remove every child of `id` with its subtree, in one pass over `id`'s child list (removing
+    /// them one by one would search that list once per child).
+    pub fn remove_children(&mut self, id: NodeId) -> DocResult<()> {
+        let kids = std::mem::take(&mut self.get_mut(id)?.children);
+        for c in kids {
+            for d in self.subtree(c) {
+                self.nodes.remove(&d);
+                self.dirty.touch(d);
+            }
+        }
+        Ok(())
+    }
+
     /// Whether sections may go in `parent`: a page or another section (never a frame or a group).
     pub fn takes_sections(&self, parent: NodeId) -> bool {
         self.node(parent).is_some_and(|p| p.is_page() || matches!(p.kind, NodeKind::Section { .. }))
diff --git a/crates/doc/src/tests.rs b/crates/doc/src/tests.rs
index a0e3e17b0..a5c8e8e7a 100644
--- a/crates/doc/src/tests.rs
+++ b/crates/doc/src/tests.rs
@@ -846,3 +846,17 @@ fn the_colour_walker_visits_calculation_literals() {
     let ColorOperand::Literal { literal } = from else { panic!("literal operand") };
     assert_eq!(literal.a, 0.5, "the mix's stored literal was converted like every other colour");
 }
+
+#[test]
+fn remove_children_removes_every_subtree_and_keeps_the_parent() {
+    let mut doc = Document::new("T");
+    let page = doc.first_page().unwrap();
+    let frame = doc.create(page, NodeKind::Frame, "F", 0.0, 0.0, 100.0, 100.0).unwrap();
+    let inner = doc.create(frame, NodeKind::Frame, "Inner", 0.0, 0.0, 10.0, 10.0).unwrap();
+    let leaf = doc.create(inner, NodeKind::Rectangle, "Leaf", 0.0, 0.0, 5.0, 5.0).unwrap();
+    let other = doc.create(page, NodeKind::Rectangle, "Other", 0.0, 0.0, 5.0, 5.0).unwrap();
+    doc.remove_children(frame).unwrap();
+    assert!(doc.contains(frame) && doc.contains(other));
+    assert!(!doc.contains(inner) && !doc.contains(leaf));
+    assert!(doc.get(frame).unwrap().children.is_empty());
+}
diff --git a/crates/engine/src/extensions/widgets.rs b/crates/engine/src/extensions/widgets.rs
index 6386ceab4..498fbeb8a 100644
--- a/crates/engine/src/extensions/widgets.rs
+++ b/crates/engine/src/extensions/widgets.rs
@@ -243,9 +243,7 @@ fn build(s: &mut Session, plugin: &str, w: NodeId, r: &WidgetRender) -> Result<(
     if !is_widget(n) || n.plugin_data.get(PLUGIN).map(String::as_str) != Some(plugin) {
         return Err(bad(cmd, "the layer is no longer this plugin's widget"));
     }
-    for c in n.children.clone() {
-        doc.remove(c)?;
-    }
+    doc.remove_children(w)?;
     crate::cmd::props::apply(cmd, doc, w, &props(&r.root, true))?;
     let n = doc.get_mut(w)?;
     n.locked = false;

From 3265cbca404644c70fb08035536882960d9f15c3 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 17:58:39 -0500
Subject: [PATCH 16/70] perf(engine): look up a component's asset root once per
 usage report, and skip mode migration without instances (#1966)

---
 crates/engine/src/assets/components.rs     | 4 ++++
 crates/engine/src/assets/library_server.rs | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/assets/components.rs b/crates/engine/src/assets/components.rs
index cee9b0bb2..7ddb22427 100644
--- a/crates/engine/src/assets/components.rs
+++ b/crates/engine/src/assets/components.rs
@@ -147,6 +147,10 @@ pub fn inside_instance(doc: &Document, id: NodeId) -> bool {
 /// main layer's, for files from before `modes` was an override group. Copies follow their main
 /// layer's modes, so a layer on other modes chose them itself.
 pub fn mark_layer_modes(doc: &mut Document) {
+    // Without an instance nothing can be inside one: skip the per-layer ancestry lookups.
+    if !doc.nodes().any(|n| matches!(n.kind, NodeKind::Instance { .. })) {
+        return;
+    }
     let chose: Vec<NodeId> = doc
         .nodes()
         .filter(|n| !n.overrides.contains("modes") && n.source.and_then(|s| doc.node(s)).is_some_and(|m| m.var_modes != n.var_modes))
diff --git a/crates/engine/src/assets/library_server.rs b/crates/engine/src/assets/library_server.rs
index 47d15a954..81889be5d 100644
--- a/crates/engine/src/assets/library_server.rs
+++ b/crates/engine/src/assets/library_server.rs
@@ -79,10 +79,13 @@ pub fn usage(doc: &Document, library: &str) -> Usage {
     let records: std::collections::BTreeMap<NodeId, NodeId> =
         doc.libraries.components.iter().filter(|r| r.library == library).map(|r| (r.root, r.key)).collect();
     if !records.is_empty() {
+        // One component's asset root is looked up once, however many instances use it.
+        let mut roots = std::collections::BTreeMap::<NodeId, Option<NodeId>>::new();
         for n in doc.nodes() {
             if let NodeKind::Instance { component, .. } = &n.kind
                 && store.is_none_or(|st| doc.page_of(n.id) != Some(st))
-                && let Some(key) = crate::library::asset_root(doc, *component).and_then(|r| records.get(&r))
+                && let Some(key) =
+                    roots.entry(*component).or_insert_with(|| crate::library::asset_root(doc, *component)).and_then(|r| records.get(&r))
             {
                 let c = counts.entry(*key).or_default();
                 *c = c.saturating_add(1);

From 4bb35d5266aae4dfb156cd85561c4d81198cddd9 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 17:58:51 -0500
Subject: [PATCH 17/70] perf(collab): check a replaced list's entries against
 sets, not a scan per entry (#1962)

---
 crates/collab/src/change.rs | 11 +++++++++++
 crates/collab/src/server.rs | 14 ++++++++++----
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/crates/collab/src/change.rs b/crates/collab/src/change.rs
index bcc09ad86..442376f37 100644
--- a/crates/collab/src/change.rs
+++ b/crates/collab/src/change.rs
@@ -333,6 +333,17 @@ impl Change {
 }
 
 impl Entry {
+    /// The synced list this entry belongs to (`None` for entries kept in maps).
+    pub(crate) fn family(&self) -> Option<Family> {
+        match self {
+            Entry::Style(_) => Some(Family::Styles),
+            Entry::Comment(_) => Some(Family::Comments),
+            Entry::Collection(_) => Some(Family::Collections),
+            Entry::Variable(_) => Some(Family::Variables),
+            Entry::DevSnapshot(_) | Entry::Image(_) | Entry::Ballot(_) => None,
+        }
+    }
+
     /// The client id space the entry's id lies in ([`figcraft_doc::ids`]): ids made during a live
     /// session carry their creator's client id, ids from before and ids of other forms are in
     /// space 0. `None` for entries keyed by something else (dev snapshots by layer, images by
diff --git a/crates/collab/src/server.rs b/crates/collab/src/server.rs
index b94cb5726..d5af681b2 100644
--- a/crates/collab/src/server.rs
+++ b/crates/collab/src/server.rs
@@ -6,7 +6,7 @@ use std::collections::{BTreeMap, BTreeSet, VecDeque};
 use figcraft_doc::{Document, NodeId};
 use serde::{Deserialize, Serialize};
 
-use crate::change::{Change, Entry, Prop, Target};
+use crate::change::{Change, Entry, Family, Prop, Target};
 use crate::message::{
     Accepted, Access, CatchUp, ClientMsg, Hello, PROTOCOL, Peer, Presence, Processed, Resume, ServerMsg, Signal, reads_comments, reads_signals,
 };
@@ -557,6 +557,7 @@ impl Server {
     fn check_entries(&self, from: u32, changes: &[Change], after: &Document) -> Result<Vec<(Entry, bool)>, Error> {
         let before = self.state.document();
         let mut touched: BTreeSet<Entry> = BTreeSet::new();
+        let mut listed: BTreeMap<Family, (BTreeSet<Entry>, BTreeSet<Entry>)> = BTreeMap::new();
         for c in changes {
             match c {
                 Change::Put { entry, .. } | Change::Remove { entry } if entry.id_space().is_some() => {
@@ -565,8 +566,10 @@ impl Server {
                 // A whole list replaced (the fallback for lists whose ids aren't unique).
                 Change::SetDoc { prop, .. } => {
                     if let Some(Ok(family)) = prop.list() {
-                        touched.extend(docprops::entries(before, family));
-                        touched.extend(docprops::entries(after, family));
+                        let (b, a) = (docprops::entries(before, family), docprops::entries(after, family));
+                        touched.extend(b.iter().chain(&a).cloned());
+                        // Looked up in sets below: a linear search per entry would be quadratic.
+                        listed.entry(family).or_insert_with(|| (b.into_iter().collect(), a.into_iter().collect()));
                     }
                 }
                 _ => {}
@@ -574,7 +577,10 @@ impl Server {
         }
         let mut out = Vec::new();
         for entry in touched {
-            let (was, now) = (docprops::has(before, &entry), docprops::has(after, &entry));
+            let (was, now) = match entry.family().and_then(|f| listed.get(&f)) {
+                Some((b, a)) => (b.contains(&entry), a.contains(&entry)),
+                None => (docprops::has(before, &entry), docprops::has(after, &entry)),
+            };
             if was == now {
                 continue;
             }

From 88851996a0932c2bc436550b2416524289044c40 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:22:03 -0500
Subject: [PATCH 18/70] fix(format): a saved file replaces its predecessor with
 the same permissions (#1957)

---
 crates/format/src/lib.rs           |  5 +++++
 crates/format/src/staging_tests.rs | 14 ++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/crates/format/src/lib.rs b/crates/format/src/lib.rs
index 3a69ca848..e2880a3ca 100644
--- a/crates/format/src/lib.rs
+++ b/crates/format/src/lib.rs
@@ -1028,6 +1028,11 @@ pub fn write_file_atomic(path: &std::path::Path, bytes: &[u8]) -> std::io::Resul
         let tmp = std::path::PathBuf::from(name);
         match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
             Ok(mut file) => {
+                // The replacement keeps the destination's permissions from the start, so a private
+                // file's content is never readable under default ones (the open handle still writes).
+                if let Ok(old) = std::fs::metadata(path) {
+                    let _ = file.set_permissions(old.permissions());
+                }
                 if let Err(e) = file.write_all(bytes) {
                     let _ = std::fs::remove_file(&tmp);
                     return Err(e);
diff --git a/crates/format/src/staging_tests.rs b/crates/format/src/staging_tests.rs
index 1bc199e20..abf8eacdc 100644
--- a/crates/format/src/staging_tests.rs
+++ b/crates/format/src/staging_tests.rs
@@ -123,3 +123,17 @@ fn a_failed_write_leaves_the_destination_alone_and_cleans_up() {
     }
     let _ = std::fs::remove_dir_all(&d);
 }
+
+#[cfg(unix)]
+#[test]
+fn a_replaced_file_keeps_its_permissions() {
+    use std::os::unix::fs::PermissionsExt;
+    let d = dir("mode");
+    let path = d.join("a.figcraft");
+    std::fs::write(&path, b"old").unwrap();
+    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
+    write_file_atomic(&path, b"new").unwrap();
+    assert_eq!(std::fs::read(&path).unwrap(), b"new");
+    assert_eq!(std::fs::metadata(&path).unwrap().permissions().mode() & 0o777, 0o600);
+    let _ = std::fs::remove_dir_all(&d);
+}

From df07ac2d09f0e29d40170a58f70e4bf88a659790 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:23:03 -0500
Subject: [PATCH 19/70] fix(engine): never let document text close the
 generated HTML style element (#1955)

---
 crates/engine/src/dev/codegen/html.rs   |  5 ++++-
 crates/engine/src/html_codegen_tests.rs | 13 +++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/dev/codegen/html.rs b/crates/engine/src/dev/codegen/html.rs
index d1b144cae..ac23e6a5b 100644
--- a/crates/engine/src/dev/codegen/html.rs
+++ b/crates/engine/src/dev/codegen/html.rs
@@ -90,7 +90,10 @@ pub(super) fn html(doc: &Document, id: NodeId) -> String {
     let ctx = Ctx::new(doc, id);
     let mut out = Markup::new(&ctx, CodeLang::Html);
     out.node(id, None, 0, "");
-    format!("{}\n<style>\n{}{}</style>\n", out.markup, out.tokens.root_rule(), out.styles)
+    // Document text can reach the stylesheet through any property: `<\/` reads back as `</` inside a CSS
+    // string and can never close the element early.
+    let css = format!("{}{}", out.tokens.root_rule(), out.styles).replace("</", "<\\/");
+    format!("{}\n<style>\n{css}</style>\n", out.markup)
 }
 
 /// Markup being built for a layer tree: HTML (`class`), React JSX (`className`), Vue
diff --git a/crates/engine/src/html_codegen_tests.rs b/crates/engine/src/html_codegen_tests.rs
index cd1318ee0..ab7115554 100644
--- a/crates/engine/src/html_codegen_tests.rs
+++ b/crates/engine/src/html_codegen_tests.rs
@@ -163,3 +163,16 @@ fn rem_preserves_text_property_default() {
         }
     }
 }
+
+#[test]
+fn the_stylesheet_never_contains_a_closing_style_tag_from_document_text() {
+    let mut s = Session::new();
+    let f = id(s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 100, "height": 100})).unwrap());
+    let t = id(s.execute("text.create", &json!({"text": "x", "x": 0, "y": 0})).unwrap());
+    s.execute("node.set", &json!({"id": t, "props": {"fontFamily": "a</style><script>alert(1)</script>"}})).unwrap();
+    s.execute("node.reparent", &json!({"ids": [t], "parent": f})).unwrap();
+    let code = code_for(s.doc().unwrap(), f, CodeLang::Html);
+    let (_, css) = code.split_once("<style>").unwrap();
+    assert_eq!(css.matches("</style>").count(), 1, "{code}");
+    assert!(!code.contains("<script>"), "{code}");
+}

From 417ad412a29642585573f29c13851e8d40c3f8f0 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:23:52 -0500
Subject: [PATCH 20/70] perf(engine): keep each events.poll topic once (#1935)

The topic list was validated but not deduplicated, and it is scanned for
every retained event while the log's lock is held, so a request repeating
one topic thousands of times multiplied that work. Repeats collapse and a
list naming all is just all.
---
 crates/engine/src/events.rs       | 7 +++++--
 crates/engine/src/events_tests.rs | 4 ++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/crates/engine/src/events.rs b/crates/engine/src/events.rs
index fbc1b9b6c..05433412c 100644
--- a/crates/engine/src/events.rs
+++ b/crates/engine/src/events.rs
@@ -127,12 +127,15 @@ pub fn topics(v: Option<&Value>) -> Result<Vec<String>, String> {
     for t in list {
         let Some(s) = t.as_str() else { return Err("`topics` must be an array of strings".into()) };
         match s {
+            // Each once: the list is scanned for every retained event under the log's lock, so
+            // a long list of repeats would multiply that work.
+            "comments" | "document" | "all" if out.iter().any(|t| t == s) => {}
             "comments" | "document" | "all" => out.push(s.to_string()),
             other => return Err(format!("unknown topic `{other}` (comments, document, all)")),
         }
     }
-    if out.is_empty() {
-        out.push("all".into());
+    if out.is_empty() || out.iter().any(|t| t == "all") {
+        out = vec!["all".into()];
     }
     Ok(out)
 }
diff --git a/crates/engine/src/events_tests.rs b/crates/engine/src/events_tests.rs
index 36b118a79..9cdef52ca 100644
--- a/crates/engine/src/events_tests.rs
+++ b/crates/engine/src/events_tests.rs
@@ -193,6 +193,10 @@ fn topics_parse_and_reject_unknown_names() {
     assert_eq!(events::topics(Some(&json!([]))).unwrap(), vec!["all".to_string()]);
     assert_eq!(events::topics(Some(&json!(["comments", "document"]))).unwrap(), vec!["comments".to_string(), "document".to_string()]);
     assert!(events::topics(Some(&json!(["nope"]))).is_err());
+    // Repeats collapse (the list is scanned per event under the log's lock), and `all` is all.
+    let many: Vec<&str> = std::iter::repeat_n("comments", 10_000).chain(["document"]).collect();
+    assert_eq!(events::topics(Some(&json!(many))).unwrap(), vec!["comments".to_string(), "document".to_string()]);
+    assert_eq!(events::topics(Some(&json!(["comments", "all", "document"]))).unwrap(), vec!["all".to_string()]);
     assert!(events::topics(Some(&json!("comments"))).is_err());
 }
 

From 3b4de34efea0b433f63aa8ec85991d378c41b35f Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:24:44 -0500
Subject: [PATCH 21/70] fix(doc): list a page once however often a file lists
 it (#1927)

Loading accepted a page id repeated in the pages list and repair kept the
repeats, so import, Fig and Penpot export and every page walk visited and
retained that page's subtree once per listing. validate now reports a
repeated page and repair drops the repeats.
---
 crates/doc/src/lib.rs   |  8 ++++++--
 crates/doc/src/tests.rs | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs
index 0181ffd21..1349aac1d 100644
--- a/crates/doc/src/lib.rs
+++ b/crates/doc/src/lib.rs
@@ -1098,6 +1098,9 @@ impl Document {
         // lookups: a wide parent or a long page list doesn't make validation quadratic.
         let edges: std::collections::BTreeSet<(NodeId, NodeId)> = self.nodes.iter().flat_map(|(p, n)| n.children.iter().map(|c| (*p, *c))).collect();
         let page_ids: std::collections::BTreeSet<NodeId> = self.pages.iter().copied().collect();
+        if page_ids.len() != self.pages.len() {
+            note(&mut issues, || "a page is listed twice".to_string());
+        }
         for (id, n) in self.nodes.iter() {
             if n.id != *id {
                 note(&mut issues, || format!("node key {id} has id {}", n.id));
@@ -1191,9 +1194,10 @@ impl Document {
         if store != self.libraries.store {
             Arc::make_mut(&mut self.libraries).store = store;
         }
-        self.pages.retain(|p| self.nodes.get(p).is_some_and(|n| n.is_page()) && Some(*p) != store);
+        // A page listed twice would be imported, exported and walked once per listing.
+        let mut listed = std::collections::BTreeSet::new();
+        self.pages.retain(|p| self.nodes.get(p).is_some_and(|n| n.is_page()) && Some(*p) != store && listed.insert(*p));
         // Unlisted pages join the list; a set keeps many pages from making this quadratic (#1078).
-        let mut listed: std::collections::BTreeSet<NodeId> = self.pages.iter().copied().collect();
         for (k, n) in self.nodes.iter() {
             if n.is_page() && Some(*k) != store && listed.insert(*k) {
                 self.pages.push(*k);
diff --git a/crates/doc/src/tests.rs b/crates/doc/src/tests.rs
index a5c8e8e7a..6ac6f455b 100644
--- a/crates/doc/src/tests.rs
+++ b/crates/doc/src/tests.rs
@@ -348,6 +348,20 @@ fn repair_drops_cycles_and_repeated_children() {
     assert_eq!(bad.subtree(p), vec![p, r]);
 }
 
+#[test]
+fn repair_lists_a_page_once_however_often_the_file_lists_it() {
+    let mut d = Document::new("x");
+    let p = page(&d);
+    let q = d.add_page("Two");
+    let mut v = serde_json::to_value(&d).unwrap();
+    v["pages"] = serde_json::json!([p, q, p, q, p]);
+    let mut bad: Document = serde_json::from_value(v).unwrap();
+    assert!(bad.validate().iter().any(|i| i.contains("listed twice")), "{:?}", bad.validate());
+    bad.repair();
+    assert!(bad.validate().is_empty(), "{:?}", bad.validate());
+    assert_eq!(bad.pages, vec![p, q]);
+}
+
 #[test]
 fn validate_caps_the_issue_list() {
     let mut d = Document::new("x");

From 9475a815daf0365cb7ae7b32af8a54de80ebe522 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:25:33 -0500
Subject: [PATCH 22/70] fix(layout): end the fill distribution loop when no
 child can freeze (#1926)

Each iteration froze the children whose clamping passed a 1e-9 tolerance,
but it compared the aggregate violation against the same tolerance: several
clampings each under it could add up past it, so no child froze, the
pending set never shrank and the loop never ended. An iteration that
freezes nothing now settles the remaining children as clamped.
---
 crates/layout/src/lib.rs   | 12 ++++++++++++
 crates/layout/src/tests.rs | 21 +++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/crates/layout/src/lib.rs b/crates/layout/src/lib.rs
index 19de84afb..33ad233ff 100644
--- a/crates/layout/src/lib.rs
+++ b/crates/layout/src/lib.rs
@@ -629,14 +629,26 @@ fn distribute(items: &mut [Item], mut open: Vec<usize>, free: f64) {
             .collect();
         let violation: f64 = sized.iter().map(|(_, want, v)| v - want).sum();
         let frozen = |want: f64, v: f64| violation.abs() < 1e-9 || (violation > 0.0 && v > want + 1e-9) || (violation < 0.0 && v < want - 1e-9);
+        let mut progressed = false;
         for (i, want, v) in &sized {
             if frozen(*want, *v)
                 && let Some(it) = items.get_mut(*i)
             {
                 it.main = *v;
                 free -= *v;
+                progressed = true;
             }
         }
+        if !progressed {
+            // Several clampings each under the tolerance added up past it, so none froze: settle
+            // them all as clamped rather than go round again with nothing changed.
+            for (i, _, v) in &sized {
+                if let Some(it) = items.get_mut(*i) {
+                    it.main = *v;
+                }
+            }
+            break;
+        }
         free = free.max(0.0);
         open = sized.into_iter().filter(|(_, want, v)| !frozen(*want, *v)).map(|(i, _, _)| i).collect();
     }
diff --git a/crates/layout/src/tests.rs b/crates/layout/src/tests.rs
index 0af9861b8..d48c1fb8d 100644
--- a/crates/layout/src/tests.rs
+++ b/crates/layout/src/tests.rs
@@ -447,3 +447,24 @@ fn grid_hostile_values() {
         assert!(x.is_finite() && y.is_finite() && w.is_finite() && h.is_finite());
     }
 }
+
+#[test]
+fn fill_children_whose_tiny_clampings_add_up_past_the_tolerance_still_settle() {
+    // Three fill children sharing 300 px, each with a minimum 5e-10 over its 100 px share: no
+    // single clamping passes the 1e-9 tolerance, but together they do, so no child froze and the
+    // distribution loop went round forever without changing anything.
+    let mut d = Document::new("t");
+    let p = d.first_page().unwrap();
+    let f = d.create(p, NodeKind::Frame, "F", 0.0, 0.0, 300.0, 100.0).unwrap();
+    d.get_mut(f).unwrap().layout = Some(AutoLayout { mode: LayoutMode::Horizontal, gap: 0.0, padding: [0.0; 4], ..Default::default() });
+    let kids: Vec<NodeId> = (0..3).map(|i| d.create(f, NodeKind::Rectangle, "K", 0.0, 0.0, 10.0, 20.0 + i as f64).unwrap()).collect();
+    for k in &kids {
+        let n = d.get_mut(*k).unwrap();
+        n.child_layout.sizing_h = Sizing::Fill;
+        n.child_layout.min_w = Some(100.0 + 5e-10);
+    }
+    layout_frame(&mut d, f, &NoMeasure);
+    for k in &kids {
+        assert!((pos(&d, *k).2 - 100.0).abs() < 1e-6, "{:?}", pos(&d, *k));
+    }
+}

From 6da4c30cae91c32e8cd5932533d32151c2d5b4b4 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:26:21 -0500
Subject: [PATCH 23/70] fix(svg): refuse a document compressed twice and charge
 a refused embedded one (#1924)

One gzip layer is unpacked within the import budget, but usvg gunzips what
it is handed again with no limit, so a doubly compressed document or
embedded image expanded outside the budget. A compressed embedded image
that failed its budget also left the shared allowance untouched, so every
sibling image could repeat the work; a refusal now spends what was left.
---
 crates/svg/src/import/budget.rs       | 15 +++++++++++++-
 crates/svg/src/import/budget_tests.rs | 28 +++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/crates/svg/src/import/budget.rs b/crates/svg/src/import/budget.rs
index 75a5e6731..7de080af4 100644
--- a/crates/svg/src/import/budget.rs
+++ b/crates/svg/src/import/budget.rs
@@ -44,6 +44,11 @@ fn inflate(data: &[u8], limit: usize) -> Result<Vec<u8>, String> {
     if out.len() > limit {
         return Err(format!("compressed SVG expands past {} MiB", limit >> 20));
     }
+    // usvg gunzips what it is handed, with no limit: one layer is unpacked here, within the
+    // budget, and what comes out must be the document itself.
+    if gzipped(&out) {
+        return Err("compressed SVG holds another compressed file, not a document".into());
+    }
     Ok(out)
 }
 
@@ -72,7 +77,15 @@ fn embedded(used: &Used, limits: &Limits, data: &[u8], opts: &Options) -> Option
         return None;
     }
     let left = limits.embedded.saturating_sub(used.bytes.load(Ordering::Relaxed));
-    let plain = inflate(data, left).ok()?;
+    let plain = match inflate(data, left) {
+        Ok(plain) => plain,
+        // What a refused document unpacked before it was refused was work too: it uses up what is
+        // left, so the next image can't repeat it.
+        Err(_) => {
+            used.bytes.fetch_add(left, Ordering::Relaxed);
+            return None;
+        }
+    };
     used.bytes.fetch_add(plain.len(), Ordering::Relaxed);
     if super::too_deep(&plain) {
         return None;
diff --git a/crates/svg/src/import/budget_tests.rs b/crates/svg/src/import/budget_tests.rs
index d3dcd2dea..d8740f901 100644
--- a/crates/svg/src/import/budget_tests.rs
+++ b/crates/svg/src/import/budget_tests.rs
@@ -111,3 +111,31 @@ fn linked_files_and_other_mime_types_stay_unresolved() {
     );
     assert_eq!(layers(data.as_bytes(), Limits::default()).unwrap(), layers(svg("").as_bytes(), Limits::default()).unwrap());
 }
+
+#[test]
+fn a_document_compressed_twice_is_refused_not_unpacked_again() {
+    // One gzip layer is unpacked within the budget; usvg would unpack a second one without any.
+    let twice = gzip(&gzip(svg(&" ".repeat(1 << 20)).as_bytes()));
+    let e = layers(&twice, Limits { document: 4 << 20, ..Limits::default() }).unwrap_err();
+    assert!(e.contains("another compressed file"), "{e}");
+    // Embedded, the same is dropped.
+    let inner = svg(r##"<rect width="10" height="10"/>"##);
+    let data = svg(&format!(
+        r##"<image width="10" height="10" xlink:href="data:image/svg+xml;base64,{}"/>"##,
+        base64::engine::general_purpose::STANDARD.encode(gzip(&gzip(inner.as_bytes())))
+    ))
+    .into_bytes();
+    assert_eq!(layers(&data, Limits::default()).unwrap(), layers(svg("").as_bytes(), Limits::default()).unwrap());
+}
+
+#[test]
+fn a_refused_embedded_bomb_uses_up_the_budget_for_the_images_after_it() {
+    let bomb = gzip(svg(&" ".repeat(1 << 20)).as_bytes());
+    let inner = svg(r##"<rect width="10" height="10"/>"##);
+    let image = |href: String| format!(r##"<image width="10" height="10" xlink:href="{href}"/>"##);
+    let bomb_uri = format!("data:image/svg+xml;base64,{}", base64::engine::general_purpose::STANDARD.encode(&bomb));
+    let data = svg(&format!("{}{}", image(bomb_uri).repeat(8), image(uri(inner.as_bytes())))).into_bytes();
+    let limits = Limits { embedded: 4096, ..Limits::default() };
+    let empty = layers(svg("").as_bytes(), limits).unwrap();
+    assert_eq!(layers(&data, limits).unwrap(), empty, "the first bomb spends the allowance; nothing after it unpacks");
+}

From f54e099a4804bf565e38387f05d98c200a708a72 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:27:10 -0500
Subject: [PATCH 24/70] fix(mcp): render prompt placeholders in one pass over
 the template (#1922)

Each argument was substituted into the already rendered text, so a value
holding placeholders was expanded again by every later replacement and a
short request could grow the prompt without bound. The template is now
scanned once and argument text is never read as syntax.
---
 crates/mcp/src/prompts.rs | 46 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 44 insertions(+), 2 deletions(-)

diff --git a/crates/mcp/src/prompts.rs b/crates/mcp/src/prompts.rs
index b9be1728a..59b4ee818 100644
--- a/crates/mcp/src/prompts.rs
+++ b/crates/mcp/src/prompts.rs
@@ -128,7 +128,7 @@ pub fn get(name: &str, args: &Value) -> Result<Value, String> {
     if !(args.is_object() || args.is_null()) {
         return Err("`arguments` must be an object of strings".into());
     }
-    let mut text = p.template.replace("{verify}", VERIFY);
+    let mut values: Vec<(&str, String)> = vec![("verify", VERIFY.to_string())];
     for a in p.args {
         let v = match args.get(a.name) {
             Some(Value::String(s)) if !s.trim().is_empty() => s.clone(),
@@ -142,7 +142,49 @@ pub fn get(name: &str, args: &Value) -> Result<Value, String> {
             Some(Value::String(_)) => p.defaults.iter().find(|(k, _)| *k == a.name).map(|(_, d)| (*d).to_string()).unwrap_or_default(),
             Some(_) => return Err(format!("argument `{}` must be a string", a.name)),
         };
-        text = text.replace(&format!("{{{}}}", a.name), &v);
+        values.push((a.name, v));
     }
+    // One pass over the template, so an argument's text is never read as `{…}` syntax itself (a
+    // value holding placeholders used to be expanded again by every later replacement).
+    let mut text = String::with_capacity(p.template.len());
+    let mut rest = p.template;
+    while let Some(open) = rest.find('{') {
+        text.push_str(rest.get(..open).unwrap_or_default());
+        let after = rest.get(open..).unwrap_or_default();
+        let found = after.find('}').and_then(|close| {
+            let key = after.get(1..close)?;
+            values.iter().find(|(k, _)| *k == key).map(|(_, v)| (close, v.as_str()))
+        });
+        match found {
+            Some((close, v)) => {
+                text.push_str(v);
+                rest = after.get(close + 1..).unwrap_or_default();
+            }
+            None => {
+                text.push('{');
+                rest = after.get(1..).unwrap_or_default();
+            }
+        }
+    }
+    text.push_str(rest);
     Ok(json!({"description": p.description, "messages": [{"role": "user", "content": {"type": "text", "text": text}}]}))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn arguments_are_text_not_template_syntax() {
+        let text = |args: Value| get("mobile_screen", &args).unwrap()["messages"][0]["content"]["text"].as_str().unwrap().to_string();
+        let plain = text(json!({"screen": "login"}));
+        assert!(plain.contains("Design a login screen") && plain.contains("iPhone 16") && plain.ends_with(VERIFY), "{plain}");
+        assert!(!plain.contains("{screen}") && !plain.contains("{verify}"), "{plain}");
+        // A value made of placeholders stays as typed, however many there are: it is never
+        // expanded again by the replacements after it (that multiplied the output without bound).
+        let bomb = "{device}{brand_color}{verify}".repeat(1000);
+        let out = text(json!({"screen": bomb.clone()}));
+        assert!(out.contains(&bomb));
+        assert!(out.len() < 3 * bomb.len(), "{}", out.len());
+    }
+}

From b9b64a875557765962ed65ae21121ec221a13424 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:56:28 -0500
Subject: [PATCH 25/70] fix(render): check the nesting limit for mask content
 and bound GIF frame buffers (#1925)

* fix(render): check the nesting limit for mask content and bound GIF frame buffers

A mask's content is drawn straight from mask_pixels, not through
draw_layer, so masks nested inside masks recursed past the 256-level limit
and down the stack. GIF decoding budgeted frames by the logical canvas but
left the decoder's allocation limits off, so one frame descriptor could ask
for a gigabyte before the frame came back to be checked.

* address review: give the GIF decoder one frame of working room beyond the animation cap
---
 crates/render/src/draw.rs              |  5 +++++
 crates/render/src/gif_tests.rs         | 27 ++++++++++++++++++++++++++
 crates/render/src/images.rs            | 11 ++++++++++-
 crates/render/src/mask_bounds_tests.rs | 21 ++++++++++++++++++++
 4 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/crates/render/src/draw.rs b/crates/render/src/draw.rs
index f0af6b6d0..5110b9dc0 100644
--- a/crates/render/src/draw.rs
+++ b/crates/render/src/draw.rs
@@ -1031,6 +1031,11 @@ fn masked_area(ctx: &Ctx, pix: &Pixmap, mask_id: NodeId, content: &[NodeId], xf:
 /// Mask `m` drawn as if it weren't a mask into a `w` × `h` pixmap at `xf` (a vector mask: its
 /// outline, fully opaque).
 fn mask_pixels(ctx: &Ctx, m: &Node, (w, h): (u32, u32), xf: Affine, depth: usize) -> Option<Pixmap> {
+    // A mask's content is drawn here, not through `draw_layer`, so a chain of masks inside
+    // masks needs the nesting limit checked here too, or it runs down the stack.
+    if depth > crate::MAX_EXPORT_DEPTH {
+        return None;
+    }
     let mut mask_px = Pixmap::new(w, h)?;
     let mut m2 = m.clone();
     m2.is_mask = false;
diff --git a/crates/render/src/gif_tests.rs b/crates/render/src/gif_tests.rs
index 8ac509c06..948d28821 100644
--- a/crates/render/src/gif_tests.rs
+++ b/crates/render/src/gif_tests.rs
@@ -78,6 +78,20 @@ fn decoding_is_capped() {
     assert!(images::decode_frames(&huge).is_none());
 }
 
+#[test]
+fn a_large_partial_frame_plays_when_two_whole_frames_fit() {
+    // Canvas 4000 x 3000 (48 MB a frame, two fit the cap) with a 3500 x 2800 second frame: the
+    // decoder's canvas, composited output and partial frame together need more than the cap.
+    let mut out = Vec::new();
+    {
+        let mut enc = GifEncoder::new(&mut out);
+        enc.set_repeat(Repeat::Infinite).unwrap();
+        let frame = |w, h, c| Frame::from_parts(RgbaImage::from_pixel(w, h, image::Rgba(c)), 0, 0, Delay::from_numer_denom_ms(100, 1));
+        enc.encode_frames([frame(4000, 3000, RED), frame(3500, 2800, GREEN)]).unwrap();
+    }
+    assert_eq!(images::decode_frames(&out).map(|f| f.len()), Some(2));
+}
+
 #[test]
 fn the_first_frame_draws_unless_time_moves_on() {
     let mut d = Document::new("t");
@@ -98,3 +112,16 @@ fn the_first_frame_draws_unless_time_moves_on() {
     d.get_mut(id).unwrap().visible = false;
     assert!(images::animation_clock(&d, page, 0.15).is_none(), "hidden layers don't keep the presenter awake");
 }
+
+#[test]
+fn a_frame_descriptor_bigger_than_the_canvas_is_refused_before_it_is_allocated() {
+    // A 4 × 4 canvas whose first frame descriptor claims 16,383 × 16,383 (a gigabyte of RGBA):
+    // the decoder's limits refuse the frame buffer instead of allocating it.
+    let mut bytes = gif(&[(RED, 100), (GREEN, 100)], 4, 4);
+    let at = bytes.windows(9).position(|w| w == [0x2c, 0, 0, 0, 0, 4, 0, 4, 0]).expect("an image descriptor for a 4 × 4 frame");
+    let (w, h) = ((16_383u16).to_le_bytes(), (16_383u16).to_le_bytes());
+    bytes[at + 5..at + 9].copy_from_slice(&[w[0], w[1], h[0], h[1]]);
+    let start = std::time::Instant::now();
+    assert!(images::decode_frames(&bytes).is_none());
+    assert!(start.elapsed() < std::time::Duration::from_secs(5), "{:?}", start.elapsed());
+}
diff --git a/crates/render/src/images.rs b/crates/render/src/images.rs
index a4d8ead09..5eea7033d 100644
--- a/crates/render/src/images.rs
+++ b/crates/render/src/images.rs
@@ -293,12 +293,21 @@ pub fn decode_frames(bytes: &[u8]) -> Option<Vec<(Pixmap, f64)>> {
     if image::guess_format(bytes).ok()? != image::ImageFormat::Gif {
         return None;
     }
-    let dec = image::codecs::gif::GifDecoder::new(std::io::Cursor::new(bytes)).ok()?;
+    let mut dec = image::codecs::gif::GifDecoder::new(std::io::Cursor::new(bytes)).ok()?;
     let (w, h) = dec.dimensions();
     let frame_bytes = u64::from(w) * u64::from(h) * 4;
     if frame_bytes == 0 || w > MAX_SIDE || h > MAX_SIDE {
         return None;
     }
+    // A frame's own descriptor can ask for a far larger buffer than the canvas: the decoder
+    // reserves each frame and canvas buffer against these limits before allocating it.
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(MAX_SIDE);
+    limits.max_image_height = Some(MAX_SIDE);
+    // The decoder charges its canvas, its composited output and the partial frame against this
+    // together, besides the frames kept (capped by `most` below): one frame of working room.
+    limits.max_alloc = Some(MAX_ANIMATION_BYTES.saturating_add(frame_bytes));
+    dec.set_limits(limits).ok()?;
     let most = (MAX_ANIMATION_BYTES / frame_bytes).min(MAX_FRAMES as u64) as usize;
     let mut out = Vec::new();
     for f in dec.into_frames().take(most) {
diff --git a/crates/render/src/mask_bounds_tests.rs b/crates/render/src/mask_bounds_tests.rs
index 841542e1e..45615eff1 100644
--- a/crates/render/src/mask_bounds_tests.rs
+++ b/crates/render/src/mask_bounds_tests.rs
@@ -139,3 +139,24 @@ fn a_deep_nest_of_isolated_layers_stays_within_the_budget() {
     // The outer levels still draw (the innermost, past the budget, are left out).
     assert_ne!(&pix.data()[..4], &[255, 255, 255, 255]);
 }
+
+#[test]
+fn masks_nested_inside_masks_stop_at_the_nesting_limit() {
+    // A mask's content is drawn straight from `mask_pixels`, not through `draw_layer`, so a mask
+    // group inside a mask group inside… used to recurse past the limit and down the stack.
+    let mut d = Document::new("deep masks");
+    let p = d.first_page().unwrap();
+    let mut parent = p;
+    for _ in 0..2000 {
+        let g = d.create(parent, NodeKind::Group, "Masking group", 0.0, 0.0, 1.0, 1.0).unwrap();
+        let n = d.get_mut(g).unwrap();
+        n.is_mask = true;
+        n.mask_type = MaskType::Alpha;
+        parent = g;
+    }
+    shape(&mut d, parent, NodeKind::Rectangle, (0.0, 0.0, 100.0, 100.0), "2040E0");
+    shape(&mut d, p, NodeKind::Rectangle, (0.0, 0.0, 100.0, 100.0), "E04020");
+    let v = View { origin: (0.0, 0.0), scale: 1.0, width: 50, height: 50 };
+    let pix = render(&d, p, &v, false);
+    assert_eq!(pix.width(), 50);
+}

From 32b658fe717952197fef6da4d3a85f099fb63f79 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:57:03 -0500
Subject: [PATCH 26/70] perf(engine): list a few step names in a
 missing-reference error (#1941)

Every missing $ref rendered the batch's whole name table into its error,
and with onError: continue each such error was kept, so a compact batch
cost its name count per failed step. The hint names twelve steps and
counts the rest.
---
 crates/engine/src/automation/batch.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/crates/engine/src/automation/batch.rs b/crates/engine/src/automation/batch.rs
index 103177455..e0f22d870 100644
--- a/crates/engine/src/automation/batch.rs
+++ b/crates/engine/src/automation/batch.rs
@@ -156,14 +156,20 @@ impl BatchScope {
         lookup(result, path).cloned().map_err(|why| fail(format!("{who}'s result has no `{path}`{why}")))
     }
 
+    /// Most step names a missing-reference error lists.
+    const NAME_HINTS: usize = 12;
+
     fn known_names(&self) -> String {
         let mut names: Vec<_> = self.names.iter().collect();
         names.sort_by_key(|(_, i)| **i);
         if names.is_empty() {
             return "no step has an `as` name".into();
         }
-        let list: Vec<_> = names.iter().map(|(name, i)| format!("\"{name}\" is step {i}")).collect();
-        list.join(", ")
+        // A few of them: the list is built for every missing reference and, with `onError:
+        // continue`, kept for each, so a long table would cost its length per failed step.
+        let list: Vec<_> = names.iter().take(Self::NAME_HINTS).map(|(name, i)| format!("\"{name}\" is step {i}")).collect();
+        let more = names.len().saturating_sub(Self::NAME_HINTS);
+        if more > 0 { format!("{}, {more} more", list.join(", ")) } else { list.join(", ") }
     }
 }
 

From 16a79570f160679368b74db38030499a1eda053b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:57:28 -0500
Subject: [PATCH 27/70] perf(svg): hash an embedded image's bytes once per
 import (#1945)

Every shape painted with a raster pattern hashed the pattern's whole
encoded image again to find its document key, so one embedded image reused
by many shapes multiplied the hashing work without adding any image data.
The key is kept per buffer for the import.
---
 crates/svg/src/import.rs       | 27 +++++++++++++++++++++++++--
 crates/svg/src/import/paint.rs |  2 +-
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/crates/svg/src/import.rs b/crates/svg/src/import.rs
index e3d9d8523..9466b3c60 100644
--- a/crates/svg/src/import.rs
+++ b/crates/svg/src/import.rs
@@ -103,11 +103,34 @@ pub(crate) struct Ctx<'a> {
     pattern_depth: usize,
     /// Tiles drawn so far, by pattern and scale (see [`paint`]'s `render_tile`).
     tiles: HashMap<(*const usvg::Pattern, u64), Option<paint::Tile>>,
+    /// The document image key of each embedded image's bytes already added, so an image a
+    /// pattern paints on many shapes is hashed once, not once per shape.
+    image_keys: HashMap<*const Vec<u8>, String>,
 }
 
 impl<'a> Ctx<'a> {
     pub(crate) fn new(doc: &'a mut Document) -> Self {
-        Ctx { doc, count: 0, anonymous: HashSet::new(), notes: BTreeSet::new(), fonts: None, pattern_depth: 0, tiles: HashMap::new() }
+        Ctx {
+            doc,
+            count: 0,
+            anonymous: HashSet::new(),
+            notes: BTreeSet::new(),
+            fonts: None,
+            pattern_depth: 0,
+            tiles: HashMap::new(),
+            image_keys: HashMap::new(),
+        }
+    }
+
+    /// [`add_image`] for `bytes`, once per distinct buffer.
+    pub(crate) fn image(&mut self, bytes: std::sync::Arc<Vec<u8>>, w: f64, h: f64) -> String {
+        if let Some(k) = self.image_keys.get(&std::sync::Arc::as_ptr(&bytes)) {
+            return k.clone();
+        }
+        let ptr = std::sync::Arc::as_ptr(&bytes);
+        let key = add_image(self.doc, bytes, w, h);
+        self.image_keys.insert(ptr, key.clone());
+        key
     }
 
     pub(crate) fn full(&self) -> bool {
@@ -605,7 +628,7 @@ fn image(cx: &mut Ctx, img: &usvg::Image, id: &str, parent: NodeId, base: Affine
     let size = img.size();
     let (iw, ih) = (f64::from(size.width()), f64::from(size.height()));
     let (transform, w, h) = place(world, Point::ZERO, iw, ih).unwrap_or((world, iw, ih));
-    let hash = add_image(cx.doc, bytes, iw, ih);
+    let hash = cx.image(bytes, iw, ih);
     let mut n = Node::new(cx.doc.alloc_id(), NodeKind::Rectangle, layer_name(id, "Image"), w, h);
     n.transform = transform;
     let mut fill = Paint::image(hash, ImageScaleMode::Fill);
diff --git a/crates/svg/src/import/paint.rs b/crates/svg/src/import/paint.rs
index 6e6300cc3..2eed8aa44 100644
--- a/crates/svg/src/import/paint.rs
+++ b/crates/svg/src/import/paint.rs
@@ -133,7 +133,7 @@ fn pattern(cx: &mut Ctx, pat: &usvg::Pattern, t: Target) -> Option<Paint> {
         let s = img.size();
         let (iw, ih) = (f64::from(s.width()), f64::from(s.height()));
         let b = figcraft_geom::transform_rect_bbox(m, Rect::new(0.0, 0.0, iw, ih));
-        (tile_rect.contains(b.origin()) && tile_rect.contains(Point::new(b.x1, b.y1))).then(|| (add_image(cx.doc, bytes, iw, ih), iw, ih, m))
+        (tile_rect.contains(b.origin()) && tile_rect.contains(Point::new(b.x1, b.y1))).then(|| (cx.image(bytes, iw, ih), iw, ih, m))
     });
     let (hash, iw, ih, content) = match lone {
         Some(l) => l,

From 1be869793f7721acd914e9d118b599629b4a4bef Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:58:02 -0500
Subject: [PATCH 28/70] fix(doc): bound the string bytes an expression holds
 and stop concatenating at the cap (#1950)

* fix(doc): bound the string bytes an expression holds and stop concatenating at the cap

* address review: count only appended characters; keep validating operands past the cap
---
 crates/doc/src/proto_expr.rs       | 28 +++++++++++++++++++++++++---
 crates/doc/src/proto_expr_tests.rs | 16 ++++++++++++++++
 2 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/crates/doc/src/proto_expr.rs b/crates/doc/src/proto_expr.rs
index 1638c12ec..3b25c936d 100644
--- a/crates/doc/src/proto_expr.rs
+++ b/crates/doc/src/proto_expr.rs
@@ -12,6 +12,8 @@ use crate::{CollectionId, ModeId, VariableValue, Variables};
 pub const MAX_EXPR_DEPTH: usize = 32;
 /// Longest string an expression builds (characters).
 const MAX_STRING: usize = 10_000;
+/// The most string bytes one operation's operands may hold together (generous: results cap at `MAX_STRING`).
+const MAX_OPERAND_BYTES: usize = 1 << 20;
 
 /// An expression over variables.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -115,7 +117,19 @@ impl Expr {
             }
             Expr::Op { op, args } => (*op, args),
         };
-        let vals: Vec<VariableValue> = args.iter().map(|a| a.eval_at(vars, modes, depth + 1)).collect::<Option<_>>()?;
+        // Retained operands are bounded by bytes, so repeated references to one long string can't multiply it.
+        let mut text_bytes = 0usize;
+        let mut vals = Vec::with_capacity(args.len());
+        for a in args {
+            let v = a.eval_at(vars, modes, depth + 1)?;
+            if let VariableValue::String(s) = &v {
+                text_bytes = text_bytes.saturating_add(s.len());
+                if text_bytes > MAX_OPERAND_BYTES {
+                    return None;
+                }
+            }
+            vals.push(v);
+        }
         apply(op, &vals)
     }
 
@@ -259,10 +273,18 @@ fn apply(op: ExprOp, vals: &[VariableValue]) -> Option<VariableValue> {
     match op {
         Add if vals.iter().any(|v| matches!(v, VariableValue::String(_))) => {
             let mut s = String::new();
+            let mut chars = 0;
             for v in vals {
-                s.push_str(&as_text(v)?);
+                // Every operand is checked (a colour makes the whole expression None); only the
+                // characters it adds are counted, and appending stops at the cap.
+                let t = as_text(v)?;
+                if chars < MAX_STRING {
+                    let before = s.len();
+                    s.extend(t.chars().take(MAX_STRING - chars));
+                    chars += s[before..].chars().count();
+                }
             }
-            Some(VariableValue::String(s.chars().take(MAX_STRING).collect()))
+            Some(VariableValue::String(s))
         }
         Add => fold(|a, b| Some(a + b)),
         Subtract => fold(|a, b| Some(a - b)),
diff --git a/crates/doc/src/proto_expr_tests.rs b/crates/doc/src/proto_expr_tests.rs
index 436e97c19..9250a5d9d 100644
--- a/crates/doc/src/proto_expr_tests.rs
+++ b/crates/doc/src/proto_expr_tests.rs
@@ -124,6 +124,13 @@ fn deep_and_hostile_expressions_are_bounded() {
     let joined = Expr::op(ExprOp::Add, vec![s(&long), s(&long)]);
     let Some(VariableValue::String(t)) = eval(&joined) else { panic!() };
     assert_eq!(t.chars().count(), 10_000, "capped");
+    // Past the cap a colour operand still fails the expression, and empty operands add nothing.
+    let color = Expr::Value(VariableValue::Color(Color::BLACK));
+    let mut ops = vec![s(&"x".repeat(10_000))];
+    ops.extend((0..50).map(|_| s("")));
+    assert!(matches!(eval(&Expr::op(ExprOp::Add, ops.clone())), Some(VariableValue::String(t)) if t.chars().count() == 10_000));
+    ops.push(color);
+    assert_eq!(eval(&Expr::op(ExprOp::Add, ops)), None, "a colour past the cap is still a type error");
 }
 
 fn nav(id: u64) -> Action {
@@ -199,3 +206,12 @@ fn serde_round_trip_and_old_files() {
     let old: Action = serde_json::from_str(r#"{"type":"setVariable","variable":"n","value":2}"#).unwrap_or(Action::Back);
     assert_eq!(old, Action::SetVariable { variable: "n".into(), value: serde_json::json!(2), expr: None });
 }
+
+#[test]
+fn operands_holding_too_many_string_bytes_are_refused() {
+    let long = "x".repeat(300_000);
+    let few = Expr::op(ExprOp::Add, vec![s(&long), s(&long)]);
+    assert!(eval(&few).is_some());
+    let many = Expr::op(ExprOp::Add, (0..8).map(|_| s(&long)).collect());
+    assert_eq!(eval(&many), None);
+}

From bcc611b3a9c8c4127ccb0cc7cb3c3607eef00c9b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:58:27 -0500
Subject: [PATCH 29/70] fix(engine): hold a plugin's text.preview to the
 permissions of the command it previews (#1959)

* fix(engine): hold a plugin's text.preview to the permissions of the command it previews

* address review: check PREVIEWABLE before recursing into a preview's inner command
---
 crates/engine/src/extensions/plugins.rs | 10 ++++++++++
 crates/engine/src/plugins_tests.rs      | 24 ++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/crates/engine/src/extensions/plugins.rs b/crates/engine/src/extensions/plugins.rs
index 2b1094306..208efedd2 100644
--- a/crates/engine/src/extensions/plugins.rs
+++ b/crates/engine/src/extensions/plugins.rs
@@ -149,6 +149,16 @@ fn refusal(m: &Manifest, command: &str, params: &Value) -> Option<String> {
     if DENIED.iter().any(|p| command.starts_with(p)) && !ALLOWED.contains(&command) {
         return Some(format!("`{command}` isn't available to plugins"));
     }
+    // A preview runs its inner command, which the plugin's permissions and the denied list must cover too.
+    // An inner command that can't be previewed (a nested preview) is refused by the preview itself,
+    // before it runs: descending into its parameters first would only rescan them.
+    if command == "text.preview"
+        && let Some(inner) = get(params, "command").and_then(Value::as_str)
+        && crate::textpreview::PREVIEWABLE.contains(&inner)
+        && let Some(why) = refusal(m, inner, get(params, "params").unwrap_or(&Value::Null))
+    {
+        return Some(why);
+    }
     // A widget's own data is FigCraft's to write, so no plugin can forge or retarget a widget.
     if writes_widget_data(params, 0) {
         return Some(format!("plugins can't write `{}…` layer data", crate::widgets::DATA_PREFIX));
diff --git a/crates/engine/src/plugins_tests.rs b/crates/engine/src/plugins_tests.rs
index dd60f8344..84f233fc9 100644
--- a/crates/engine/src/plugins_tests.rs
+++ b/crates/engine/src/plugins_tests.rs
@@ -153,6 +153,30 @@ fn read_only_plugins_and_allowlists_are_enforced() {
     assert_eq!(node(&s, a).name, "Rectangle");
 }
 
+#[test]
+fn a_preview_is_held_to_the_permissions_of_the_command_it_shows() {
+    let mut s = Session::new();
+    let a = rect(&mut s, 0.0);
+    // Only text.preview is allowed: the node.set it would run is not.
+    install(
+        &mut s,
+        manifest("org.test.previewer", "write", &["text.preview"]),
+        &script(&[("text.preview", json!({"command": "node.set", "params": {"id": a, "props": {"name": "x"}}}))], OnRefusal::Fail, ""),
+    );
+    let e = run_err(&mut s, "org.test.previewer");
+    assert!(e.contains("`node.set` isn't in the commands"), "{e}");
+    assert_eq!(node(&s, a).name, "Rectangle");
+}
+
+#[test]
+fn a_nested_preview_is_refused_by_the_preview_itself() {
+    let mut s = Session::new();
+    let nested = json!({"command": "text.preview", "params": {"command": "node.set", "params": {"props": {"name": "x"}}}});
+    install(&mut s, manifest("org.test.nested", "write", &["text.preview"]), &script(&[("text.preview", nested)], OnRefusal::Fail, ""));
+    let e = run_err(&mut s, "org.test.nested");
+    assert!(e.contains("can't be previewed"), "{e}");
+}
+
 #[test]
 fn files_dialogs_history_and_plugins_are_off_limits() {
     let mut s = Session::new();

From c1dfa9eceef390cf0306bb00c9673fcb036d5e2c Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:59:02 -0500
Subject: [PATCH 30/70] fix(ui): write a plugin's offered file through the
 confined file helper (#1960)

---
 crates/ui-egui/src/dialogs/plugins_ui.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/ui-egui/src/dialogs/plugins_ui.rs b/crates/ui-egui/src/dialogs/plugins_ui.rs
index 350be2d6e..d335b277a 100644
--- a/crates/ui-egui/src/dialogs/plugins_ui.rs
+++ b/crates/ui-egui/src/dialogs/plugins_ui.rs
@@ -138,7 +138,7 @@ pub(crate) fn save_file(app: &mut FigApp, data: &Value) {
     let shown = name.clone();
     app.pick_save(tr("Save file"), &name, &exts, move |app, path| {
         let file = path.file_name().map(|f| f.to_string_lossy().to_string()).unwrap_or(shown);
-        match std::fs::write(&path, &bytes) {
+        match figcraft_engine::file_access::write(&path, &bytes) {
             Ok(()) => app.toast(trf("Saved {name}", &[("name", &file)])),
             Err(_) => app.toast(tr("Couldn't save the file")),
         }

From 975544b895852f61dec1c045c6e96e4376bf4340 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:59:27 -0500
Subject: [PATCH 31/70] perf(collab): memoise layer depths in diff and skip the
 sibling scan for a new child (#1961)

* perf(collab): memoise layer depths in diff and skip the sibling scan for a new child

* address review: bound the depth walk by the document's node count
---
 crates/collab/src/diff.rs       | 45 ++++++++++++++++++++++++++++-----
 crates/collab/src/diff_tests.rs | 11 ++++++++
 crates/collab/src/replica.rs    |  4 ++-
 3 files changed, 52 insertions(+), 8 deletions(-)

diff --git a/crates/collab/src/diff.rs b/crates/collab/src/diff.rs
index 016dc5dd0..91e156155 100644
--- a/crates/collab/src/diff.rs
+++ b/crates/collab/src/diff.rs
@@ -95,7 +95,8 @@ pub fn diff(from: &Replica, to: &Document) -> Result<Diff, Error> {
     let mut changes = fields;
     let new: BTreeSet<NodeId> = added.iter().copied().collect();
     // Creations, parents before children.
-    added.sort_by_cached_key(|id| (depth(to, *id), *id));
+    let mut memo = BTreeMap::new();
+    added.sort_by_cached_key(|id| (depth(to, *id, &mut memo), *id));
     for id in &added {
         if let Some(n) = to.node(*id) {
             changes.push(create_change(n, replica.key(*id))?);
@@ -121,18 +122,30 @@ pub fn diff(from: &Replica, to: &Document) -> Result<Diff, Error> {
     Ok(Diff { changes, replica })
 }
 
-/// Depth of `id` in `doc` (pages are 0).
-fn depth(doc: &Document, id: NodeId) -> usize {
-    let mut d = 0;
+/// Depth of `id` in `doc` (pages are 0). `memo` holds the depths found so far, so a deep chain of
+/// new layers is walked once rather than once per layer.
+fn depth(doc: &Document, id: NodeId, memo: &mut BTreeMap<NodeId, usize>) -> usize {
+    let mut chain = vec![id];
+    let mut base = 0;
     let mut cur = doc.node(id).and_then(|n| n.parent);
     while let Some(p) = cur {
-        d += 1;
-        if d > 100_000 {
+        if let Some(d) = memo.get(&p) {
+            base = *d + 1;
             break;
         }
+        // An acyclic chain is no longer than the document: this only stops a cycle.
+        if chain.len() > doc.node_count() {
+            break;
+        }
+        chain.push(p);
         cur = doc.node(p).and_then(|n| n.parent);
     }
-    d
+    // `chain` runs from `id` up; the last entry's depth is `base` when it ends at a root or a memo hit.
+    let top = chain.len();
+    for (i, c) in chain.iter().enumerate() {
+        memo.insert(*c, base + (top - 1 - i));
+    }
+    memo.get(&id).copied().unwrap_or(0)
 }
 
 /// New keys for the children `kids` (in their new order) whose `old` key no longer fits: the
@@ -196,3 +209,21 @@ fn increasing_run(keys: &[Option<&str>]) -> Vec<bool> {
     }
     kept
 }
+
+#[cfg(test)]
+mod depth_tests {
+    use super::*;
+    use figcraft_doc::NodeKind;
+
+    #[test]
+    fn a_chain_longer_than_a_fixed_bound_is_walked_whole() {
+        let mut doc = Document::new("File");
+        let mut parent = doc.first_page().unwrap();
+        let mut last = parent;
+        for i in 0..100_050 {
+            last = doc.create(parent, NodeKind::Frame, &format!("F{i}"), 0.0, 0.0, 1.0, 1.0).unwrap();
+            parent = last;
+        }
+        assert_eq!(depth(&doc, last, &mut BTreeMap::new()), 100_050);
+    }
+}
diff --git a/crates/collab/src/diff_tests.rs b/crates/collab/src/diff_tests.rs
index 8c6a1211c..bb81d0b1b 100644
--- a/crates/collab/src/diff_tests.rs
+++ b/crates/collab/src/diff_tests.rs
@@ -310,3 +310,14 @@ fn many_sibling_placements_keep_the_order_of_counting_them() {
         assert_eq!(r.document().node(p).unwrap().children, kids[&p], "children of {p}");
     }
 }
+
+#[test]
+fn a_chain_of_new_nested_layers_is_created_parents_first() {
+    let (a, _, frame, _) = setup();
+    let mut b = a.document().clone();
+    let mut parent = frame;
+    for i in 0..400 {
+        parent = b.create(parent, NodeKind::Frame, &format!("F{i}"), 0.0, 0.0, 10.0, 10.0).unwrap();
+    }
+    assert_eq!(round_trip(&a, &b).iter().filter(|c| matches!(c, Change::Create { .. })).count(), 400);
+}
diff --git a/crates/collab/src/replica.rs b/crates/collab/src/replica.rs
index d14676a01..547f0f59b 100644
--- a/crates/collab/src/replica.rs
+++ b/crates/collab/src/replica.rs
@@ -236,7 +236,9 @@ impl Replica {
                         self.doc.insert_page(node).map_err(doc_err)?;
                     }
                     (false, Some(p)) => {
-                        let at = self.slot(&self.doc.get(*p).map_err(doc_err)?.children, *id, position);
+                        // A new id sits in no sibling list yet: no scan for it, just the binary search.
+                        let siblings = &self.doc.get(*p).map_err(doc_err)?.children;
+                        let at = siblings.partition_point(|c| (self.key(*c), *c) < (position.as_str(), *id));
                         self.doc.insert(node, *p, Some(at)).map_err(doc_err)?;
                     }
                     _ => return Err(Error::Invalid("pages, and only pages, have no parent".into())),

From 3c7bae6a04828b40f6a62c82fda4feca1757a33b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 22:59:53 -0500
Subject: [PATCH 32/70] perf(vectordrawable): resume each repeated name's
 suffix search where it stopped (#1964)

* perf(vectordrawable): resume each repeated name's suffix search where it stopped

* address review: continue from a longer stem when the name suffix counter is exhausted
---
 crates/vectordrawable/src/walk.rs | 46 ++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/crates/vectordrawable/src/walk.rs b/crates/vectordrawable/src/walk.rs
index f085d340c..090cf4508 100644
--- a/crates/vectordrawable/src/walk.rs
+++ b/crates/vectordrawable/src/walk.rs
@@ -24,6 +24,8 @@ pub(crate) struct Walker<'a> {
     opts: &'a VdOptions,
     warn: Warnings,
     names: std::collections::BTreeSet<String>,
+    /// The next suffix to try for each base name (names only get taken, so none before it is free).
+    next_suffix: std::collections::BTreeMap<String, usize>,
 }
 
 /// Every coordinate of `p` finite and within [`MAX_COORD`].
@@ -54,7 +56,7 @@ fn normal(b: BlendMode) -> bool {
 
 impl<'a> Walker<'a> {
     pub fn new(doc: &'a Document, opts: &'a VdOptions) -> Self {
-        Self { doc, opts, warn: Warnings::default(), names: Default::default() }
+        Self { doc, opts, warn: Warnings::default(), names: Default::default(), next_suffix: Default::default() }
     }
 
     /// Reports that the export drew nothing at all (named after `layer`).
@@ -78,12 +80,25 @@ impl<'a> Walker<'a> {
     fn unique(&mut self, name: &str) -> String {
         let base: String = name.chars().take(200).collect();
         let base = if base.trim().is_empty() { "layer".to_string() } else { base };
-        // Bounded: a set of n names leaves one of the first n + 1 candidates free.
-        let tries = self.names.len().saturating_add(1);
-        let name = (1..=tries)
-            .map(|k| if k == 1 { base.clone() } else { format!("{base}_{k}") })
-            .find(|n| !self.names.contains(n))
-            .unwrap_or_else(|| format!("{base}_{}", tries.saturating_add(1)));
+        let mut k = self.next_suffix.get(&base).copied().unwrap_or(1);
+        let mut stem = base.clone();
+        // Bounded: a set of n names leaves one of the first n + 1 candidates free. A counter
+        // that has run out (`usize::MAX`) continues from a longer stem instead of repeating.
+        let name = loop {
+            let candidate = if k == 1 { stem.clone() } else { format!("{stem}_{k}") };
+            if !self.names.contains(&candidate) {
+                k = k.saturating_add(1);
+                break candidate;
+            }
+            if k == usize::MAX {
+                stem = candidate;
+                k = 2;
+            } else {
+                k += 1;
+            }
+        };
+        let longer = stem.len() > base.len();
+        self.next_suffix.insert(base, if longer { usize::MAX } else { k });
         self.names.insert(name.clone());
         name
     }
@@ -404,3 +419,20 @@ impl<'a> Walker<'a> {
         }
     }
 }
+
+#[cfg(test)]
+mod unique_tests {
+    use super::*;
+
+    #[test]
+    fn an_exhausted_suffix_counter_still_finds_a_free_name() {
+        let (doc, opts) = (Document::new("File"), VdOptions::default());
+        let mut w = Walker::new(&doc, &opts);
+        w.next_suffix.insert("a".into(), usize::MAX);
+        w.names.insert(format!("a_{}", usize::MAX));
+        let first = w.unique("a");
+        let second = w.unique("a");
+        assert_ne!(first, second);
+        assert!(w.names.len() == 3 && w.names.contains(&first) && w.names.contains(&second));
+    }
+}

From 898a08b0ce1ec019a392c5336dfe00847a76d085 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:00:28 -0500
Subject: [PATCH 33/70] perf(pdf): collect each text style's outlines and
 decorations in one pass (#1965)

* perf(pdf): collect each text style's outlines and decorations in one pass

* address review: build each style's paths inside the style loop
---
 crates/pdf/src/text.rs | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/crates/pdf/src/text.rs b/crates/pdf/src/text.rs
index abbb65b34..feb1f1a07 100644
--- a/crates/pdf/src/text.rs
+++ b/crates/pdf/src/text.rs
@@ -1,7 +1,7 @@
 //! Text: real, selectable text in embedded (subset) fonts, positioned glyph by glyph from the
 //! `figcraft_text` layout the renderer uses, with outline fallbacks.
 
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
 use std::ops::Range;
 use std::sync::Arc;
 
@@ -56,14 +56,24 @@ pub(crate) fn draw_text(ex: &mut Exporter, s: &mut Surface, n: &Node, xf: Affine
     let styles: BTreeSet<usize> = layout.glyphs.iter().map(|g| g.style).chain(layout.decorations.iter().map(|d| d.style)).collect();
     // Every run's fills, then the inner shadows over them, then the strokes on top.
     let mut stroked = Vec::new();
+    // Glyphs and decorations are grouped by style in one pass; each style's paths are built (and
+    // dropped) inside its own iteration, so only one style's paths are held at a time.
+    let mut decoration_of: BTreeMap<usize, Vec<usize>> = BTreeMap::new();
+    for (i, d) in layout.decorations.iter().enumerate() {
+        decoration_of.entry(d.style).or_default().push(i);
+    }
+    let mut glyph_of: BTreeMap<usize, Vec<usize>> = BTreeMap::new();
+    for (i, g) in layout.glyphs.iter().enumerate() {
+        glyph_of.entry(g.style).or_default().push(i);
+    }
     for k in styles {
         let fills = layout.styles.get(k).and_then(|st| st.fills.as_ref()).unwrap_or(&n.fills);
         let mut decorations = BezPath::new();
-        for d in layout.decorations.iter().filter(|d| d.style == k) {
+        for d in decoration_of.remove(&k).unwrap_or_default().into_iter().filter_map(|i| layout.decorations.get(i)) {
             decorations.extend(d.path());
         }
         let mut outlines = BezPath::new();
-        for g in layout.glyphs.iter().filter(|g| g.style == k) {
+        for g in glyph_of.remove(&k).unwrap_or_default().into_iter().filter_map(|i| layout.glyphs.get(i)) {
             outlines.extend(g.path());
         }
         outlines.extend(decorations.iter());

From 5f022aa8a9f16967fc76c10b541fcb061020061d Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:00:54 -0500
Subject: [PATCH 34/70] perf(engine): index variables once when following a
 library's alias chains (#1968)

* perf(engine): index variables once when following a library's alias chains

* address review: return before indexing variables for an empty seed set
---
 crates/engine/src/assets/library.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/assets/library.rs b/crates/engine/src/assets/library.rs
index 7e7e9b80d..01e8d3244 100644
--- a/crates/engine/src/assets/library.rs
+++ b/crates/engine/src/assets/library.rs
@@ -277,8 +277,16 @@ pub fn default_selection(doc: &Document, prev: Option<&LibraryManifest>) -> Sele
 fn alias_closure(vars: &Variables, seeds: impl IntoIterator<Item = VariableId>) -> BTreeSet<VariableId> {
     let mut out = BTreeSet::new();
     let mut stack: Vec<VariableId> = seeds.into_iter().collect();
+    if stack.is_empty() {
+        return out;
+    }
+    // Indexed once (the first of equal ids, as `get_by_id` finds it): a scan per step is quadratic on a long alias chain.
+    let mut by_id = std::collections::HashMap::new();
+    for v in &vars.variables {
+        by_id.entry(v.id.as_str()).or_insert(v);
+    }
     while let Some(cur) = stack.pop() {
-        let Some(v) = vars.get_by_id(&cur) else { continue };
+        let Some(v) = by_id.get(cur.as_str()).copied() else { continue };
         if out.len() >= MAX_ASSETS || !out.insert(v.id.clone()) {
             continue;
         }

From 519ffd4987ad30f702b824ab7a3ca6842c062254 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:01:19 -0500
Subject: [PATCH 35/70] fix(format): import a Sketch page once however often
 the file lists it (#1973)

---
 crates/format/src/sketch.rs       | 5 +++++
 crates/format/src/sketch/tests.rs | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/crates/format/src/sketch.rs b/crates/format/src/sketch.rs
index 8186ce26d..01b68e6c9 100644
--- a/crates/format/src/sketch.rs
+++ b/crates/format/src/sketch.rs
@@ -226,11 +226,16 @@ impl<'b> Archive<'b> {
         };
         let refs = document.get("pages").and_then(Value::as_array).map(Vec::as_slice).unwrap_or_default();
         let mut pages = Vec::new();
+        let mut seen = std::collections::HashSet::new();
         for r in refs.iter().take(MAX_PAGES) {
             let Some(id) = r.get("_ref").and_then(Value::as_str).and_then(|s| s.strip_prefix("pages/")).filter(|id| valid_id(id)) else {
                 warnings.push("pages the document lists without a valid reference were skipped".into());
                 continue;
             };
+            // A page listed twice is read once: a repeated reference must not repeat the unpacking.
+            if !seen.insert(id) {
+                continue;
+            }
             match json_member(&mut z, &format!("pages/{id}.json"), max_member, &mut total) {
                 Ok(page) if page.is_object() => pages.push((id.to_string(), page)),
                 Ok(_) => warnings.push("pages that aren't JSON objects were skipped".into()),
diff --git a/crates/format/src/sketch/tests.rs b/crates/format/src/sketch/tests.rs
index b4368de12..d8ace8be9 100644
--- a/crates/format/src/sketch/tests.rs
+++ b/crates/format/src/sketch/tests.rs
@@ -35,6 +35,13 @@ fn pages_become_pages_in_document_order() {
     assert_eq!(page_names(&doc), ["Beta", "Alpha"]);
 }
 
+#[test]
+fn a_page_listed_twice_is_imported_once() {
+    let z = sketch_zip("50.2", 103, document(&["A", "A", "A"]), &[page("A", "Alpha", vec![])], &[]);
+    let (doc, _) = import(&z, "f").unwrap();
+    assert_eq!(page_names(&doc), ["Alpha"]);
+}
+
 #[test]
 fn older_than_48_is_refused() {
     let z = sketch_zip("47.1", 95, document(&["P"]), &[page("P", "P", vec![])], &[]);

From 972ccc6a1741a1ab97f70f40ba2ebd7180c99d3b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:01:44 -0500
Subject: [PATCH 36/70] fix(engine): count each id Shape Builder is given once
 (#1974)

---
 crates/engine/src/canvas/shapebuilder.rs | 4 +++-
 crates/engine/src/shapebuilder_tests.rs  | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/crates/engine/src/canvas/shapebuilder.rs b/crates/engine/src/canvas/shapebuilder.rs
index b68f1e71d..fb4c3d699 100644
--- a/crates/engine/src/canvas/shapebuilder.rs
+++ b/crates/engine/src/canvas/shapebuilder.rs
@@ -109,7 +109,9 @@ pub fn eligible(doc: &Document, ids: &[NodeId]) -> Vec<NodeId> {
             out.push(id);
         }
     }
-    let ids: Vec<NodeId> = ids.iter().copied().filter(|i| doc.contains(*i)).collect();
+    // Each id counts once: a repeated group must not be walked once per repeat.
+    let mut seen = std::collections::BTreeSet::new();
+    let ids: Vec<NodeId> = ids.iter().copied().filter(|i| doc.contains(*i) && seen.insert(*i)).collect();
     let mut out = Vec::new();
     for id in roots(doc, &ids) {
         walk(doc, id, 0, &mut out);
diff --git a/crates/engine/src/shapebuilder_tests.rs b/crates/engine/src/shapebuilder_tests.rs
index 3b0cc7efb..a52bf1767 100644
--- a/crates/engine/src/shapebuilder_tests.rs
+++ b/crates/engine/src/shapebuilder_tests.rs
@@ -217,6 +217,15 @@ fn remove_mode_and_escape() {
     assert!(s.execute("shapeBuilder.mode", &json!({"mode": "sideways"})).is_err());
 }
 
+#[test]
+fn a_group_named_many_times_is_walked_once() {
+    let mut s = Session::new();
+    let (a, b) = squares(&mut s);
+    let g = id(&ex(&mut s, "object.group", json!({"ids": [a, b]})));
+    let r = ex(&mut s, "shapeBuilder.regions", json!({"ids": vec![g; 500]}));
+    assert_eq!(r["sources"], json!([a, b]));
+}
+
 #[test]
 fn groups_rotated_and_ineligible_layers() {
     let mut s = Session::new();

From ee4edc7364668404d6c61f0ff909fef2c49962b4 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:48:20 -0500
Subject: [PATCH 37/70] perf(engine): replace linear scans that made
 document-sized inputs quadratic (#1921)

* perf(engine): replace linear scans that made document-sized inputs quadratic

enum_of re-classified the whole string for every character; widget names,
comment mentions and devcompare's common siblings each searched a growing
Vec; data.fill's export names and codegen's class names retried every
suffix from 2 against a list, cubic in the number of copies of one name;
and a batch rename template had no length cap although it is expanded
again for every match.

* address review: report the pattern in its own length error
---
 crates/engine/src/cmd/comment.rs            |  7 +++--
 crates/engine/src/cmd/props.rs              |  4 ++-
 crates/engine/src/content/datafill.rs       | 15 +++++++---
 crates/engine/src/dev/codegen.rs            |  2 +-
 crates/engine/src/dev/codegen/html.rs       | 33 ++++++++++++++++-----
 crates/engine/src/dev/component_codegen.rs  | 14 +++++----
 crates/engine/src/dev/devcompare.rs         |  6 ++--
 crates/engine/src/extensions/widgets.rs     |  3 +-
 crates/engine/src/html_codegen_tests.rs     | 14 +++++++++
 crates/engine/src/panels_behaviour_tests.rs |  5 ++++
 crates/engine/src/selection/rename.rs       |  9 ++++++
 11 files changed, 87 insertions(+), 25 deletions(-)

diff --git a/crates/engine/src/cmd/comment.rs b/crates/engine/src/cmd/comment.rs
index c2eb69b12..388d56d88 100644
--- a/crates/engine/src/cmd/comment.rs
+++ b/crates/engine/src/cmd/comment.rs
@@ -373,10 +373,11 @@ fn listed<'s>(cmd: &str, s: &'s Session, p: &Value, who: &str, people: &[&str])
 
 /// Add the names `text` @mentions to `named` as `{name, known, you}`, each once.
 fn push_mentions(named: &mut Vec<Value>, text: &str, people: &[&str], user: &str) {
+    // `known` and `you` follow from the name, so the name alone tells a repeat.
+    let mut seen: std::collections::BTreeSet<String> = named.iter().filter_map(|v| v.get("name")?.as_str().map(str::to_string)).collect();
     for (name, known) in mentioned(text, people) {
-        let v = json!({"name": name, "known": known, "you": known && name.eq_ignore_ascii_case(user)});
-        if !named.contains(&v) {
-            named.push(v);
+        if seen.insert(name.to_string()) {
+            named.push(json!({"name": name, "known": known, "you": known && name.eq_ignore_ascii_case(user)}));
         }
     }
 }
diff --git a/crates/engine/src/cmd/props.rs b/crates/engine/src/cmd/props.rs
index 36e33dd79..abd380cfc 100644
--- a/crates/engine/src/cmd/props.rs
+++ b/crates/engine/src/cmd/props.rs
@@ -115,6 +115,8 @@ pub(crate) fn enum_of<T: serde::de::DeserializeOwned>(v: &Value) -> Option<T> {
     let norm: String = {
         let mut out = String::new();
         let mut up = false;
+        // Once, not per character: a long value made this quadratic before it was refused.
+        let no_lowercase = s.chars().all(|c| !c.is_lowercase() || !c.is_alphabetic());
         for (i, ch) in s.trim().chars().enumerate() {
             if ch == '_' || ch == '-' || ch == ' ' {
                 up = true;
@@ -125,7 +127,7 @@ pub(crate) fn enum_of<T: serde::de::DeserializeOwned>(v: &Value) -> Option<T> {
             } else if up {
                 out.extend(ch.to_uppercase());
                 up = false;
-            } else if s.chars().all(|c| !c.is_lowercase() || !c.is_alphabetic()) {
+            } else if no_lowercase {
                 out.extend(ch.to_lowercase());
             } else {
                 out.push(ch);
diff --git a/crates/engine/src/content/datafill.rs b/crates/engine/src/content/datafill.rs
index b93e5f591..910741994 100644
--- a/crates/engine/src/content/datafill.rs
+++ b/crates/engine/src/content/datafill.rs
@@ -189,14 +189,21 @@ fn fill_layers(s: &mut Session, copy: NodeId, (key, value): (&str, &Value), miss
 /// Export each copy into `dir` as `<name>.<format>` at `scale`, adding `files` (and `errors`) to
 /// `out`.
 fn export_copies(s: &mut Session, ids: &[(NodeId, String)], dir: &str, (format, scale): (&str, f64), out: &mut Value) {
-    let (mut files, mut errors, mut used) = (Vec::new(), Vec::new(), Vec::<String>::new());
+    let (mut files, mut errors) = (Vec::new(), Vec::new());
+    let mut used = std::collections::BTreeSet::<String>::new();
+    // The next number to try per base, so many copies of one name don't retry from 2 each time.
+    let mut next = std::collections::BTreeMap::<String, u64>::new();
     for (copy, name) in ids {
         // One file per copy: same or same-looking names get " 2", " 3"… (case-insensitively,
         // as macOS and Windows file systems compare names).
         let base = file_name(name);
-        let stem =
-            (1..).map(|k| if k == 1 { base.clone() } else { format!("{base} {k}") }).find(|n| !used.contains(&n.to_lowercase())).unwrap_or(base);
-        used.push(stem.to_lowercase());
+        let from = next.get(&base.to_lowercase()).copied().unwrap_or(1);
+        let (k, stem) = (from..)
+            .map(|k| (k, if k == 1 { base.clone() } else { format!("{base} {k}") }))
+            .find(|(_, n)| !used.contains(&n.to_lowercase()))
+            .unwrap_or((from, base.clone()));
+        next.insert(base.to_lowercase(), k + 1);
+        used.insert(stem.to_lowercase());
         let path = std::path::Path::new(dir).join(format!("{stem}.{format}")).to_string_lossy().to_string();
         match s.execute("file.export", &json!({"ids": [copy.0], "format": format, "scale": scale, "path": path})) {
             Ok(_) => files.push(path),
diff --git a/crates/engine/src/dev/codegen.rs b/crates/engine/src/dev/codegen.rs
index b9df04f12..202f7ef0f 100644
--- a/crates/engine/src/dev/codegen.rs
+++ b/crates/engine/src/dev/codegen.rs
@@ -34,7 +34,7 @@ pub use css::{CssNames, css_var_name, css_var_of};
 use css::{css, tok};
 pub(crate) use flutter::{FLUTTER_IMPORT, Place, flutter, flutter_indent};
 use html::html;
-pub(crate) use html::{Markup, class_name};
+pub(crate) use html::{Markup, Names, class_name};
 pub(crate) use swift::swift;
 
 pub fn specs() -> Vec<CommandSpec> {
diff --git a/crates/engine/src/dev/codegen/html.rs b/crates/engine/src/dev/codegen/html.rs
index ac23e6a5b..d1b287c2b 100644
--- a/crates/engine/src/dev/codegen/html.rs
+++ b/crates/engine/src/dev/codegen/html.rs
@@ -30,7 +30,7 @@ fn kind_word(n: &Node) -> &str {
 /// `rogeuin-hwamyeon`, кнопка → `knopka`, über → `uber` (per-codepoint transliteration, the slug
 /// libraries' way); a name left with nothing (symbols only) takes `kind`, and one starting with a
 /// digit keeps the `layer-` prefix.
-pub(crate) fn class_name(name: &str, kind: &str, used: &mut Vec<String>) -> String {
+pub(crate) fn class_name(name: &str, kind: &str, used: &mut Names) -> String {
     let mut base = String::new();
     for c in deunicode::deunicode(name).chars().flat_map(char::to_lowercase) {
         if c.is_ascii_alphanumeric() {
@@ -57,11 +57,30 @@ pub(crate) fn class_name(name: &str, kind: &str, used: &mut Vec<String>) -> Stri
     } else {
         base.to_string()
     };
-    let name = (1..).map(|k| if k == 1 { base.clone() } else { format!("{base}-{k}") }).find(|n| !used.contains(n)).unwrap_or(base);
-    used.push(name.clone());
+    let from = used.next.get(&base).copied().unwrap_or(1);
+    let (k, name) = (from..)
+        .map(|k| (k, if k == 1 { base.clone() } else { format!("{base}-{k}") }))
+        .find(|(_, n)| !used.used.contains(n))
+        .unwrap_or((from, base.clone()));
+    used.next.insert(base, k + 1);
+    used.insert(name.clone());
     name
 }
 
+/// The names [`class_name`] has given out, and the next suffix to try per base, so many layers
+/// sharing one name don't each retry every suffix from 2 (that was cubic in their number).
+#[derive(Default)]
+pub(crate) struct Names {
+    used: std::collections::BTreeSet<String>,
+    next: std::collections::BTreeMap<String, u64>,
+}
+
+impl Names {
+    pub fn insert(&mut self, name: String) {
+        self.used.insert(name);
+    }
+}
+
 fn html_escape(s: &str) -> String {
     s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('\n', "<br>")
 }
@@ -104,7 +123,7 @@ pub(crate) struct Markup<'c, 'a> {
     ctx: &'c Ctx<'a>,
     /// Html, React, Vue or Leptos.
     lang: CodeLang,
-    used: Vec<String>,
+    used: Names,
     pub markup: String,
     pub styles: String,
     pub tokens: Tokens,
@@ -161,7 +180,7 @@ impl<'c, 'a> Markup<'c, 'a> {
         Markup {
             ctx,
             lang,
-            used: Vec::new(),
+            used: Names::default(),
             markup: String::new(),
             styles: String::new(),
             tokens: Tokens::default(),
@@ -276,7 +295,7 @@ impl<'c, 'a> Markup<'c, 'a> {
         let root = n.id == self.ctx.root;
         let class = match self.root_class.take().filter(|_| root) {
             Some(c) => {
-                self.used.push(c.clone());
+                self.used.insert(c.clone());
                 c
             }
             None => {
@@ -332,7 +351,7 @@ impl<'c, 'a> Markup<'c, 'a> {
                 let open = open("div");
                 let slot_ident = slot.map(|p| match self.ctx.comp {
                     Some(c) => crate::component_codegen::slot_name(c, p),
-                    None => class_name(&p.ident, "slot", &mut Vec::new()),
+                    None => class_name(&p.ident, "slot", &mut Names::default()),
                 });
                 if let Some(p) = slot.filter(|_| kids.is_empty()) {
                     let content = if leptos {
diff --git a/crates/engine/src/dev/component_codegen.rs b/crates/engine/src/dev/component_codegen.rs
index bf7f442d1..11b380b73 100644
--- a/crates/engine/src/dev/component_codegen.rs
+++ b/crates/engine/src/dev/component_codegen.rs
@@ -11,7 +11,9 @@ use figcraft_doc::{Document, NodeId, NodeKind, PropDef};
 use serde_json::{Value, json};
 
 use crate::cmd::CommandSpec;
-use crate::codegen::{CodeLang, Ctx, FLUTTER_IMPORT, Markup, Place, arkui, class_name, compose, flutter, flutter_indent, indent, literal, swift};
+use crate::codegen::{
+    CodeLang, Ctx, FLUTTER_IMPORT, Markup, Names, Place, arkui, class_name, compose, flutter, flutter_indent, indent, literal, swift,
+};
 use crate::components::{prop_default_value, slot_edited, slots_of, variant_options, variant_props, variant_set};
 use crate::params::{id_of, string, targets};
 use crate::{bad, spec};
@@ -616,14 +618,14 @@ pub(crate) fn value_expr(doc: &Document, c: &Component, p: &Param, value: &Value
 /// The `<slot name="…">` of a slot parameter: unique among the component's slot parameters, unlike
 /// `class_name` called with a fresh list per parameter (two idents can lowercase alike).
 pub(crate) fn slot_name(c: &Component, p: &Param) -> String {
-    let mut used = Vec::new();
+    let mut used = Names::default();
     for q in c.params.iter().filter(|q| matches!(q.kind, ParamKind::Slot)) {
         let name = class_name(&q.ident, "slot", &mut used);
         if q.ident == p.ident {
             return name;
         }
     }
-    class_name(&p.ident, "slot", &mut Vec::new())
+    class_name(&p.ident, "slot", &mut Names::default())
 }
 
 /// The values an instance sets for `c`'s parameters, in order (`None` for other layers): variant
@@ -720,7 +722,7 @@ pub(crate) fn usage_with_styles(doc: &Document, id: NodeId, lang: CodeLang, dept
                 .filter(|(name, _, _)| is_slot(name))
                 .map(|(name, expr, _)| {
                     let slot = c.params.iter().find(|q| q.ident == *name);
-                    let name = slot.map(|p| slot_name(&c, p)).unwrap_or_else(|| class_name(name, "slot", &mut Vec::new()));
+                    let name = slot.map(|p| slot_name(&c, p)).unwrap_or_else(|| class_name(name, "slot", &mut Names::default()));
                     format!("{pad}  <template #{name}>\n{expr}{pad}  </template>\n")
                 })
                 .collect();
@@ -823,7 +825,7 @@ pub fn definition(doc: &Document, c: &Component, lang: CodeLang) -> String {
 
 /// `data-*` attribute names for variant parameters, unique among them (in order).
 fn data_attrs(variants: &[&Param]) -> Vec<String> {
-    let mut used = Vec::new();
+    let mut used = Names::default();
     variants.iter().map(|p| format!("data-{}", class_name(&p.prop, "prop", &mut used))).collect()
 }
 
@@ -832,7 +834,7 @@ fn data_attrs(variants: &[&Param]) -> Vec<String> {
 fn web(doc: &Document, c: &Component, lang: CodeLang) -> (String, String, String) {
     let ctx = Ctx { doc, root: c.comp, comp: Some(c), base: 2 };
     let root_name = c.set.and_then(|s| doc.node(s)).or_else(|| doc.node(c.comp)).map(|n| n.name.clone()).unwrap_or_default();
-    let root_class = class_name(&root_name, "component", &mut Vec::new());
+    let root_class = class_name(&root_name, "component", &mut Names::default());
     let variants: Vec<&Param> = c.params.iter().filter(|p| matches!(p.kind, ParamKind::Variant(_))).collect();
     let attr_names = data_attrs(&variants);
     let pass = |root: NodeId| {
diff --git a/crates/engine/src/dev/devcompare.rs b/crates/engine/src/dev/devcompare.rs
index 6804f1aa4..6d5e39e19 100644
--- a/crates/engine/src/dev/devcompare.rs
+++ b/crates/engine/src/dev/devcompare.rs
@@ -288,8 +288,10 @@ pub fn layer_changes(before: &Document, now: &Document, id: NodeId) -> Vec<PropC
 fn order(before: &Document, now: &Document, id: NodeId) -> Option<(usize, usize)> {
     let parent = now.node(id)?.parent?;
     let (pb, pa) = (before.node(parent)?, now.node(parent)?);
-    let common_b: Vec<NodeId> = pb.children.iter().rev().copied().filter(|c| pa.children.contains(c)).collect();
-    let common_a: Vec<NodeId> = pa.children.iter().rev().copied().filter(|c| pb.children.contains(c)).collect();
+    let (in_b, in_a): (std::collections::BTreeSet<NodeId>, std::collections::BTreeSet<NodeId>) =
+        (pb.children.iter().copied().collect(), pa.children.iter().copied().collect());
+    let common_b: Vec<NodeId> = pb.children.iter().rev().copied().filter(|c| in_a.contains(c)).collect();
+    let common_a: Vec<NodeId> = pa.children.iter().rev().copied().filter(|c| in_b.contains(c)).collect();
     let (ib, ia) = (common_b.iter().position(|c| *c == id)?, common_a.iter().position(|c| *c == id)?);
     (ib != ia).then_some((ib + 1, ia + 1))
 }
diff --git a/crates/engine/src/extensions/widgets.rs b/crates/engine/src/extensions/widgets.rs
index 498fbeb8a..13c6088c4 100644
--- a/crates/engine/src/extensions/widgets.rs
+++ b/crates/engine/src/extensions/widgets.rs
@@ -157,8 +157,9 @@ fn state_of(doc: &Document, w: NodeId) -> Map<String, Value> {
 /// fields), each once, in layer order.
 fn names(doc: &Document, w: NodeId, key: &str) -> Vec<String> {
     let mut out: Vec<String> = Vec::new();
+    let mut seen = std::collections::BTreeSet::new();
     for t in doc.subtree(w).into_iter().filter_map(|i| doc.node(i)?.plugin_data.get(key).cloned()) {
-        if !out.contains(&t) {
+        if seen.insert(t.clone()) {
             out.push(t);
         }
     }
diff --git a/crates/engine/src/html_codegen_tests.rs b/crates/engine/src/html_codegen_tests.rs
index ab7115554..d0de94dba 100644
--- a/crates/engine/src/html_codegen_tests.rs
+++ b/crates/engine/src/html_codegen_tests.rs
@@ -73,6 +73,20 @@ fn non_ascii_layer_names_transliterate_into_readable_classes() {
     assert!(code.contains("<p class=\"rogeuin\">") && code.contains("<p class=\"rogeuin-2\">"), "{code}");
 }
 
+#[test]
+fn many_layers_with_one_name_get_numbered_in_linear_time() {
+    // Each name used to retry every suffix from 2 against a list: cubic in their number.
+    let mut used = crate::codegen::Names::default();
+    let start = std::time::Instant::now();
+    let names: Vec<String> = (0..20_000).map(|_| crate::codegen::class_name("Card / Title", "frame", &mut used)).collect();
+    assert!(start.elapsed() < std::time::Duration::from_secs(5), "{:?}", start.elapsed());
+    assert_eq!(names[0], "card-title");
+    assert_eq!(names[1], "card-title-2");
+    assert_eq!(names[19_999], "card-title-20000");
+    let distinct: std::collections::BTreeSet<&String> = names.iter().collect();
+    assert_eq!(distinct.len(), names.len());
+}
+
 #[test]
 fn other_scripts_and_symbol_names_transliterate_or_fall_back_to_the_kind() {
     let mut s = Session::new();
diff --git a/crates/engine/src/panels_behaviour_tests.rs b/crates/engine/src/panels_behaviour_tests.rs
index d97d25075..0d9266f74 100644
--- a/crates/engine/src/panels_behaviour_tests.rs
+++ b/crates/engine/src/panels_behaviour_tests.rs
@@ -277,6 +277,11 @@ fn renaming_several_layers_by_the_documented_codes() {
     assert_eq!(r(None, "$n", Some(1e30), "a"), "1000000000000");
     assert_eq!(r(None, "$n", Some(f64::NAN), "a"), "1");
     assert_eq!(r(Some("é"), "e", None, "café é"), "cafe e");
+    // A template is expanded once per match, so its length is capped (1,000 characters).
+    let long = "$nn".repeat(400);
+    assert!(crate::rename::BatchRename::new(Some("a"), false, &long, None, None).is_err());
+    assert!(crate::rename::BatchRename::new(None, false, "x", Some(&long), None).is_err_and(|e| e.contains("pattern")));
+    assert!(crate::rename::BatchRename::new(Some("a"), false, &"$nn".repeat(300), None, None).is_ok());
 }
 
 #[test]
diff --git a/crates/engine/src/selection/rename.rs b/crates/engine/src/selection/rename.rs
index b49524759..8f75c6035 100644
--- a/crates/engine/src/selection/rename.rs
+++ b/crates/engine/src/selection/rename.rs
@@ -9,6 +9,9 @@ use figcraft_doc::{Document, NodeId};
 
 /// Longest match pattern accepted (characters).
 const MAX_FIND: usize = 1_000;
+/// Longest replacement or pattern template accepted (characters): each is expanded again for
+/// every match, so its length multiplies the work of a rename.
+const MAX_TEMPLATE: usize = 1_000;
 /// Longest name a rename produces (characters).
 const MAX_NAME: usize = 10_000;
 /// Widest zero padding of a number code.
@@ -50,6 +53,12 @@ impl BatchRename {
             }
             Some(f) => Some(Find::Text(f.to_string())),
         };
+        if replace.chars().count() > MAX_TEMPLATE {
+            return Err(format!("the replacement is longer than {MAX_TEMPLATE} characters"));
+        }
+        if pattern.is_some_and(|p| p.chars().count() > MAX_TEMPLATE) {
+            return Err(format!("the pattern is longer than {MAX_TEMPLATE} characters"));
+        }
         let start = start.filter(|s| s.is_finite()).map_or(1, |s| s.clamp(0.0, 1e12).round() as u64);
         Ok(Self { find, replace: replace.to_string(), pattern: pattern.map(str::to_string), start })
     }

From 6d1b5da863e4b599afe2122b19d99c17c23b63d7 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:48:46 -0500
Subject: [PATCH 38/70] fix: create test and benchmark temp directories fresh,
 never adopt an existing one (#1977)

---
 apps/figcraft-cli/src/perf.rs            | 3 ++-
 crates/svg/src/import/structure_tests.rs | 5 +++--
 crates/text/src/fontdb_tests.rs          | 5 ++++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/figcraft-cli/src/perf.rs b/apps/figcraft-cli/src/perf.rs
index 404724038..30c801207 100644
--- a/apps/figcraft-cli/src/perf.rs
+++ b/apps/figcraft-cli/src/perf.rs
@@ -498,7 +498,8 @@ fn measure_components(table: &mut Table, col: usize, instances: usize) -> CliRes
     static RUNS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
     let run = RUNS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
     let dir = std::env::temp_dir().join(format!("figcraft-perf-{}-{run}", std::process::id()));
-    std::fs::create_dir_all(&dir).map_err(failed)?;
+    // `create_dir`, not `create_dir_all`: a directory or link already at this predictable name is refused.
+    std::fs::create_dir(&dir).map_err(failed)?;
     let path = dir.join("design-system.figcraft").to_string_lossy().into_owned();
     let (lib_doc, lib_ds) = design_system_document(&spec).map_err(failed)?;
     let mut lib_s = Session::with_document(lib_doc);
diff --git a/crates/svg/src/import/structure_tests.rs b/crates/svg/src/import/structure_tests.rs
index f16abb66a..f5726f896 100644
--- a/crates/svg/src/import/structure_tests.rs
+++ b/crates/svg/src/import/structure_tests.rs
@@ -153,8 +153,9 @@ fn an_image_stretched_into_its_box_stays_stretched() {
 
 #[test]
 fn linked_files_are_never_read() {
-    let dir = std::env::temp_dir().join("figcraft-svg-linked");
-    std::fs::create_dir_all(&dir).unwrap();
+    let dir = std::env::temp_dir().join(format!("figcraft-svg-linked-{}", std::process::id()));
+    // `create_dir` refuses a directory or link someone else planted at this name.
+    std::fs::create_dir(&dir).unwrap();
     let png = dir.join("secret.png");
     std::fs::write(&png, base64::Engine::decode(&base64::engine::general_purpose::STANDARD, PNG).unwrap()).unwrap();
     let href = png.to_string_lossy().replace('\\', "/");
diff --git a/crates/text/src/fontdb_tests.rs b/crates/text/src/fontdb_tests.rs
index 5f0fa522b..cb0930e8a 100644
--- a/crates/text/src/fontdb_tests.rs
+++ b/crates/text/src/fontdb_tests.rs
@@ -139,7 +139,10 @@ fn macos_font_assets_are_found_in_the_asset_store() {
             let _ = std::fs::remove_dir_all(&self.0);
         }
     }
-    let tmp = TempDir(std::env::temp_dir().join(format!("figcraft-font-assets-{}", std::process::id())));
+    // Created fresh: a directory or link already at this predictable name is refused, and not removed.
+    let root = std::env::temp_dir().join(format!("figcraft-font-assets-{}", std::process::id()));
+    std::fs::create_dir(&root).unwrap();
+    let tmp = TempDir(root);
     let store = tmp.0.join("AssetsV2");
     let fonts = store.join("com_apple_MobileAsset_Font7");
     let data = |kind: &std::path::Path| kind.join("0f1e2d.asset").join("AssetData");

From 25d2a201a998b7da404063f3ba3d03257879b509 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:49:12 -0500
Subject: [PATCH 39/70] fix(server): clean a published file's name when it is
 taken from the file (#1978)

---
 apps/figcraft-server/src/admin_budget_tests.rs | 8 ++++++++
 apps/figcraft-server/src/store/files.rs        | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/apps/figcraft-server/src/admin_budget_tests.rs b/apps/figcraft-server/src/admin_budget_tests.rs
index 71c62897c..10acdabff 100644
--- a/apps/figcraft-server/src/admin_budget_tests.rs
+++ b/apps/figcraft-server/src/admin_budget_tests.rs
@@ -75,3 +75,11 @@ fn codes_are_found_through_the_index_as_before() {
     assert_eq!(store.resolve_code(who(105), &codes[2]).unwrap_err(), CODE_GONE);
     assert_eq!(store.resolve_code(who(106), &codes[3]).unwrap().0, files[3].0);
 }
+
+#[test]
+fn a_name_taken_from_the_file_is_cleaned_like_a_given_one() {
+    let dir = TempDir::new("embedded-name");
+    let mut store = Store::open(dir.path(), config(dir.path()).store()).unwrap();
+    let (file, ..) = store.publish("", &snapshot("Bad\u{1b}[2Jname\u{202E}")).unwrap();
+    assert_eq!(file.name, "Bad[2Jname");
+}
diff --git a/apps/figcraft-server/src/store/files.rs b/apps/figcraft-server/src/store/files.rs
index dba351861..fcc0fd109 100644
--- a/apps/figcraft-server/src/store/files.rs
+++ b/apps/figcraft-server/src/store/files.rs
@@ -95,8 +95,9 @@ impl Store {
             return Err(format!("the file has more than {} layers", self.cfg.core.max_nodes));
         }
         let mut doc = replica.document().clone();
+        // The name the file keeps, whichever one it comes from, is cleaned.
         let name = match clean_name(name) {
-            n if n.is_empty() => doc.name.clone(),
+            n if n.is_empty() => clean_name(&doc.name),
             n => n,
         };
         doc.name = name.clone();

From 6f780211dda0706aa474bcc9be4cec99149acef3 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:49:39 -0500
Subject: [PATCH 40/70] fix(collab): build no repair for a batch refused for
 lack of permission (#1980)

---
 crates/collab/src/server.rs       | 10 ++++++++--
 crates/collab/src/server_tests.rs | 20 ++++++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/crates/collab/src/server.rs b/crates/collab/src/server.rs
index d5af681b2..0f11792b7 100644
--- a/crates/collab/src/server.rs
+++ b/crates/collab/src/server.rs
@@ -413,10 +413,14 @@ impl Server {
             // client learned what happened to it from the catch-up.
             ClientMsg::Changes { batch_id, .. } if self.issued.get(&from).is_some_and(|p| batch_id <= p.last_batch) => Vec::new(),
             ClientMsg::Changes { base_seq, batch_id, changes } => {
+                let mut denied = true;
                 let result = match self.limited.get(&from) {
                     Some(Access::View) => Err(Error::Invalid(VIEW_ONLY.into())),
                     Some(Access::Comment) if !changes.iter().all(Change::is_comment) => Err(Error::Invalid(COMMENT_ONLY.into())),
-                    _ => self.accept(from, base_seq, &changes),
+                    _ => {
+                        denied = false;
+                        self.accept(from, base_seq, &changes)
+                    }
                 };
                 if let Some(p) = self.issued.get_mut(&from) {
                     p.note(batch_id, result.is_err());
@@ -430,7 +434,9 @@ impl Server {
                     }
                     Err(e) => {
                         self.note(Journal::Refused { client: from, batch_id });
-                        let fixes = self.fixes(&changes).unwrap_or_default();
+                        // A refusal for lack of permission costs no repair: the client's confirmed copy
+                        // already is the server's state, so the fixes would only repeat it.
+                        let fixes = if denied { Vec::new() } else { self.fixes(&changes).unwrap_or_default() };
                         vec![Outgoing::To(from, ServerMsg::Reject { batch_id, reason: reason(&e), fixes })]
                     }
                 }
diff --git a/crates/collab/src/server_tests.rs b/crates/collab/src/server_tests.rs
index da12f7f35..aafff946d 100644
--- a/crates/collab/src/server_tests.rs
+++ b/crates/collab/src/server_tests.rs
@@ -182,6 +182,26 @@ fn deleted_nodes_can_come_back_but_ids_are_never_handed_out_twice() {
     assert_eq!(s.document(), gone.document());
 }
 
+#[test]
+fn a_viewers_refused_deletion_gets_no_repair() {
+    let (d, _, frame) = doc();
+    let mut s = Server::new(d, "tok", Limits::default());
+    let (id, out) = s.join_as(hello("tok"), crate::message::Access::View).unwrap();
+    let Some(Outgoing::To(_, welcome)) = out.into_iter().next() else { panic!() };
+    let mut v = Client::join(welcome).unwrap();
+    let del = edit(&mut v, |d| d.remove(frame).unwrap());
+    let (reason, fixes) = rejected(
+        &mut s,
+        id,
+        match del {
+            ClientMsg::Changes { changes, .. } => changes,
+            _ => panic!(),
+        },
+    );
+    assert_eq!(reason, crate::VIEW_ONLY);
+    assert!(fixes.is_empty(), "{fixes:?}");
+}
+
 #[test]
 fn fixes_roll_a_rejected_client_back_to_the_server_state() {
     let (d, _, frame) = doc();

From f05e5684987ce2501dbfada35afff41283505229 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 4 Nov 2026 17:45:24 -0500
Subject: [PATCH 41/70] Pass the Linux signing key to the release workflow
 (#2001)

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 68a705399..975d54114 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,3 +48,4 @@ jobs:
       AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
       AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
       AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}

From 2b74d22b0f42853da43c009cea30e29b3d34daed Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:35:20 +1030
Subject: [PATCH 42/70] Contributors: credit helenkwok as Helen Kwok

---
 contributors/people.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/contributors/people.toml b/contributors/people.toml
index c846d8725..f7ee0420e 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -101,3 +101,6 @@ sync_github_name = true
 
 [people.aleksei-suholita]
 real_name = "Oleksii Sukholita"
+
+[people.helenkwok]
+real_name = "Helen Kwok"

From fc3679047e0618110c7153339be7bbb103d95acb Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:35:21 +1030
Subject: [PATCH 43/70] feat(web): a host bridge for embedding pages,
 ?host=parent and data-host="page" (#1356)

A page that embeds the web build can hand it a file and get every save back instead of a browser download, and hears about unsaved changes: ?host=parent for a same-origin iframe (postMessage, the protocol the GridCraft, PdfCraft, WordCraft and CADCraft bridges use) and data-host="page" on the canvas for a page that loads the module into its own document (non-bubbling CustomEvents on the canvas). The bridge holds a Transport (Parent or Page) with one send; the pure rules are unit-tested; the hosting guide documents both modes.
---
 ROADMAP.md                        |   3 +
 apps/figcraft-web/Cargo.toml      |   1 +
 apps/figcraft-web/src/host.rs     | 273 ++++++++++++++++++++++++++++++
 apps/figcraft-web/src/hostmode.rs | 109 ++++++++++++
 apps/figcraft-web/src/main.rs     |  14 +-
 apps/figcraft-web/src/web.rs      |  62 ++++++-
 packaging/web/README.md           |  88 ++++++++++
 7 files changed, 544 insertions(+), 6 deletions(-)
 create mode 100644 apps/figcraft-web/src/host.rs
 create mode 100644 apps/figcraft-web/src/hostmode.rs

diff --git a/ROADMAP.md b/ROADMAP.md
index 410705919..2a5fa6fff 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -3,6 +3,7 @@
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (web host bridge: `?host=parent` in an iframe or `data-host="page"` on the canvas hands a page the app's files instead of downloads and reports unsaved changes, documented in the hosting guide; colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -143,6 +144,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 - **2026-10-27** · Batch continue-on-error (M0.9, #1386): `command.batch` and MCP `batch` accept `onError: "continue"`, roll back failed steps individually and return one outcome per step. References to failed steps fail with both step numbers; successful edits stay one undo step, and the default abort mode is unchanged. Engine and MCP regression tests. Numbers unchanged.
 - **2026-10-26** · Non-ASCII layer names transliterate in code export (M6, #1235): `class_name` runs the name through `deunicode` before its ASCII filter, so 로그인 화면 → `rogeuin-hwamyeon`, кнопка → `knopka`, über → `uber` in the HTML/CSS/React/Leptos class names, component roots and `data-*` variant attributes (SwiftUI/Compose type names unchanged); a name left with nothing (symbols only) takes the node's kind (`.text`, `.frame`) instead of `layer-`, and the 40-character cut lands on a word boundary. New dependency: deunicode (pure Rust tables, zero deps, BSD-3-Clause, the `slug` crate's base). `html_codegen_tests`. Numbers unchanged.
 - **2026-10-25** · M6, #1143: offline Penpot 2.x open/import/export through the editor, CLI and MCP using the existing document model. Unsupported layout settings retain saved positions and bounded source metadata with warnings; font binaries and toggle-overlay are reported, and provider fonts are never downloaded. Shared ZIP/JSON/token budgets guard untrusted input. Figma parity numbers unchanged.
+- **2026-10-26** · Web host bridge: `?host=parent` (a same-origin page embedding FigCraft in an iframe) or `data-host="page"` on the canvas (the page's own document, over non-bubbling `CustomEvent`s) opens the host's file like File ▸ Open (over the browser open limit of 512 MB refused) and takes every file the app would otherwise download (`figcraft:save` with the `saveAs` rule), plus `figcraft:dirty`, `figcraft:ready` and `figcraft:failed`; `?author=` names the user for comments and board notes; host mode starts with no document. Unit tests cover the opt-in rule (only the exact `page` value), the `saveAs` rule and the open-name fallback. Numbers unchanged.
 - **2026-10-25** · egui 0.37 capture lifecycle: screenshots with hidden or unknown visibility queue, request a hidden paint, and expire after 60 seconds if no capture arrives (headless-tested contract). Logic-only edits, saves and inspection continue while hidden. Native visible GUI and forced hidden-window paint, browser and Wayland behavior remain unqualified; parity percentages are unchanged.
 - **2026-10-24** · Open, Save and the folder dialogs start in the folder of the last file or folder picked in the run (#1290): the Linux portal does not remember it between dialogs as the macOS and Windows panels do. A folder deleted since falls back to the system's choice. No numbers change.
 - **2026-10-24** · Boards (M12): board pages get a dot grid under their layers (drawn by the canvas render after the page colour, thinned out when zoomed out); a selected connector shows its ends as handles, and dragging one onto another object re-attaches it there, onto empty canvas leaves it free (`board.reattach`, one undo step, also over MCP); connectors can be curved, and elbows go around the objects they join when the short way would cross them. Checked in the app, through MCP and in the web build ([boards-parity](docs/boards-parity.md)).
@@ -492,6 +494,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 | 2026-10-27 | minor | Placed images keep their own size (M7, #1360): dropping, Place image, paste and `image.place` put an image at its pixel size and fit only a side past 4096 px (they fitted it into 1000 px); a PNG whose `pHYs` records a whole 2x–4x multiple of 72 dpi (macOS screenshots record 144 dpi) is placed at its point size, so an 800 × 600 px capture comes in at 400 × 300; other densities, such as 300 dpi scans, keep their pixel size; the image data stays at full resolution and an explicit width or height still wins. On macOS, paste reads the clipboard's PNG as is (its density and colour profile kept) and falls back to the decoded image. Numbers unchanged |
 | 2026-10-26 | minor | Non-ASCII layer names transliterate in code export (M6, #1235): `class_name` transliterates through the new `deunicode` dependency (pure Rust tables, zero deps, BSD-3-Clause), so Korean, Cyrillic, Latin-diacritic and CJK names become readable ASCII classes (`rogeuin-hwamyeon`, `knopka`, `uber`, `an-niu`) in HTML/CSS/React/Leptos output, component roots and `data-*` variant attributes; symbols-only names take the node's kind (`.text`) instead of `layer-`, and the 40-character cut lands on a word boundary. `html_codegen_tests` updated and extended. Numbers unchanged |
 | 2026-10-25 | minor | M6, #1143: offline Penpot 2.x open/import/export through the editor, CLI and MCP using the existing document model. Unsupported layout settings retain saved positions and bounded source metadata with warnings; font binaries and toggle-overlay are reported, and provider fonts are never downloaded. Shared ZIP/JSON/token budgets guard untrusted input. Figma parity numbers unchanged. |
+| 2026-10-26 | minor | Web host bridge: `?host=parent` (a same-origin page embedding FigCraft in an iframe) or `data-host="page"` on the canvas (the page's own document, over non-bubbling `CustomEvent`s) opens the host's file like File ▸ Open and takes every file the app would otherwise download, with `figcraft:ready`, `figcraft:open`, `figcraft:save` (a `saveAs` rule), `figcraft:dirty` and `figcraft:failed`; `?author=` names the user for comments and board notes; documented in the hosting guide. Numbers unchanged |
 | 2026-10-25 | minor | egui 0.37 capture lifecycle: screenshots with hidden or unknown visibility queue, request a hidden paint, and expire after 60 seconds if no capture arrives (headless-tested contract). Logic-only edits, saves and inspection continue while hidden. Native visible GUI and forced hidden-window paint, browser and Wayland behavior remain unqualified; parity percentages are unchanged. |
 | 2026-10-24 | minor | Server memory (#1134): when the last person leaves a file nobody edited, figcraft-server keeps the client ids it issued in the log instead of rewriting the snapshot (compaction still follows `compact_after`/`compact_mb` and edits), and a snapshot is encoded straight into its file buffer, without a second copy of the body; the file format is unchanged. Numbers unchanged |
 | 2026-10-24 | minor | Boards (M12): a dot grid on board pages under the layers, connector ends dragged onto other objects or empty canvas (`board.reattach`), curved connectors, elbows that go around what they join. Boards row ~35% → ~37%, ~20% → ~21%, 30–60 h → 28–56 h; headline numbers unchanged (boards are outside the weighted sum) |
diff --git a/apps/figcraft-web/Cargo.toml b/apps/figcraft-web/Cargo.toml
index 09eca5d0f..75f7e312c 100644
--- a/apps/figcraft-web/Cargo.toml
+++ b/apps/figcraft-web/Cargo.toml
@@ -31,3 +31,4 @@ wasm-bindgen = "0.2"
 js-sys = "0.3"
 wasm-bindgen-futures = "0.4"
 web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "Event", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "MessageEvent", "UrlSearchParams", "CustomEvent", "CustomEventInit"] }
diff --git a/apps/figcraft-web/src/host.rs b/apps/figcraft-web/src/host.rs
new file mode 100644
index 000000000..d08bdf45b
--- /dev/null
+++ b/apps/figcraft-web/src/host.rs
@@ -0,0 +1,273 @@
+//! Host modes: a page that runs FigCraft (as an `<iframe>`, or in its own document) opens
+//! documents in it and stores what it saves instead of the browser downloading. The same
+//! messages as the other Crafting Apps' bridges.
+//!
+//! ## `?host=parent` — an `<iframe>` (such as a Nextcloud app)
+//!
+//! The framing page and FigCraft talk over `postMessage` between same-origin windows. Messages
+//! are plain objects with a `type`:
+//!
+//! - `figcraft:ready` (to the parent): `{ version }`, sent once the app is running and
+//!   listening; send a file now.
+//! - `figcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
+//!   `Uint8Array`. It opens exactly as a file picked with File › Open or dropped on the window
+//!   would (the app's own open queue, with its "Opening as a new file" card). A payload over the
+//!   browser's own open limit ([`figcraft_ui_egui::browser_can_read`]'s 512 MB) is refused before
+//!   its bytes are copied, and anything malformed is ignored.
+//! - `figcraft:save` (to the parent): `{ name, saveAs, bytes }` (a transferred `ArrayBuffer`) for
+//!   every file the app hands its download service — in host mode nothing reaches the browser's
+//!   downloads. The parent stores it and reports failures itself. `saveAs` says whether the file
+//!   becomes the document's file ([`crate::hostmode::save_as`]):
+//!   - A Save of the file the host opened, under its own name: `false`.
+//!   - A document file (`.figcraft` or `.json`, the formats `file.save` and `file.saveAs` write)
+//!     under a name the host didn't open — Save As, or a Save of a document the host never sent
+//!     (an untitled one): `true`. It becomes the document's file; the next Save sends its name
+//!     with `false`. Names compare without case.
+//!   - Everything else is a copy or export that never becomes the document: `false` — rendered
+//!     images, SVG and PDF, `.fig` copies, and the variables exports (a `.variables.json`
+//!     sidecar's `.json` extension doesn't make it a document).
+//! - `figcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
+//! - `figcraft:failed` (to the parent): `{ error }` when the app couldn't start.
+//!
+//! Only the parent window on the page's own origin is heard or answered.
+//!
+//! ## `data-host="page"` — the page's own document
+//!
+//! A page that loads the module into its own document (its own `<canvas id="figcraft_canvas"
+//! data-host="page">`, no iframe) gets the same behaviour over DOM `CustomEvent`s on the canvas
+//! instead of `postMessage`: the same four events outward (`ready`, `save`, `dirty`, `failed`,
+//! with the message fields as the event's `detail`), and the page dispatches `figcraft:open` on
+//! the canvas with `detail: { name, bytes }` to open a document. Events don't bubble, so two
+//! editors on one page can't hear each other, and the canvas is the only target FigCraft
+//! listens on.
+//!
+//! In host mode the app starts with no document (the home screen) and the host sends the file to
+//! edit; `?author=` names the user for comments and board notes.
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use figcraft_ui_egui::FigApp;
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
+
+/// The longest user name taken from `?author=`.
+const MAX_AUTHOR_CHARS: usize = 200;
+
+/// Files the host sent, on their way to the app's own open queue ([`figcraft_ui_egui::pending_open`]):
+/// `(name, bytes)`.
+pub type OpenQueue = Rc<RefCell<Vec<(String, Vec<u8>)>>>;
+
+/// How a host page is reached. The modes behave the same; they differ only in how an event goes
+/// out ([`Transport::send`]) and how an open request comes in ([`Bridge::listen`]).
+#[derive(Clone)]
+enum Transport {
+    /// `?host=parent`: `postMessage` between same-origin windows.
+    Parent { window: web_sys::Window, parent: web_sys::Window, origin: String },
+    /// `data-host="page"`: DOM `CustomEvent`s on the editor's own canvas.
+    Page { canvas: web_sys::HtmlCanvasElement },
+}
+
+impl Transport {
+    /// Hand an event to the host. In parent mode this is a `postMessage` whose object carries a
+    /// `type` field; in page mode a `CustomEvent` of that name on the canvas, whose `detail`
+    /// holds the fields and which never bubbles (two editors on one page must not hear each
+    /// other). `transfer` hands an `ArrayBuffer` to the parent instead of copying it (parent
+    /// mode only; the page's document already shares the buffer's bytes).
+    fn send(&self, event: &str, fields: &[(&str, JsValue)], transfer: Option<&js_sys::ArrayBuffer>) -> Result<(), String> {
+        match self {
+            Transport::Parent { parent, origin, .. } => {
+                let mut message_fields = Vec::with_capacity(fields.len() + 1);
+                message_fields.push(("type", JsValue::from_str(event)));
+                message_fields.extend_from_slice(fields);
+                let message = message(&message_fields).ok_or_else(|| "couldn't build the message".to_string())?;
+                let sent = match transfer {
+                    Some(buffer) => parent.post_message_with_transfer(&message, origin, &js_sys::Array::of1(buffer)),
+                    None => parent.post_message(&message, origin),
+                };
+                sent.map_err(|e| js_error(&e, "couldn't post the message"))
+            }
+            Transport::Page { canvas } => {
+                let detail = message(fields).ok_or_else(|| "couldn't build the event detail".to_string())?;
+                let init = web_sys::CustomEventInit::new();
+                // The builder methods (`bubbles(..)`, `detail(..)`) are deprecated in web-sys
+                // 0.3.106 and fail clippy -D warnings; use the setters.
+                init.set_bubbles(false);
+                init.set_detail(&detail);
+                let custom = web_sys::CustomEvent::new_with_event_init_dict(event, &init).map_err(|e| js_error(&e, "couldn't create the event"))?;
+                // A listener calling `preventDefault` would be the bool; not a send failure.
+                canvas.dispatch_event(&custom).map_err(|e| js_error(&e, "couldn't dispatch the event"))?;
+                Ok(())
+            }
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct Bridge {
+    transport: Transport,
+    /// The file the host opened, and after a `saveAs` hand-over the document's file: the name a
+    /// Save under (`saveAs: false`) is decided against.
+    host_file: Rc<RefCell<Option<String>>>,
+    /// The unsaved-changes state last reported to the host.
+    reported: Rc<Cell<Option<bool>>>,
+}
+
+impl Bridge {
+    /// The parent bridge for `?host=parent`. `None` when the page isn't framed (there is no
+    /// parent to talk to), so opening that URL directly stays the normal app with downloads, or
+    /// when the parent is on another origin: messages only go to this origin, so the browser
+    /// would drop every save without an error while the document showed as saved.
+    pub fn new() -> Option<Self> {
+        let window = web_sys::window()?;
+        let parent = window.parent().ok().flatten()?;
+        if js_sys::Object::is(&parent, &window) {
+            return None;
+        }
+        let origin = window.location().origin().ok()?;
+        // An opaque origin (a `file://` page in some browsers) can't be a `postMessage` target.
+        if origin == "null" {
+            return None;
+        }
+        // Reading another origin's location throws, which is `None` too.
+        if parent.location().origin().ok()? != origin {
+            return None;
+        }
+        Some(Self { transport: Transport::Parent { window, parent, origin }, host_file: Rc::default(), reported: Rc::default() })
+    }
+
+    /// The page bridge for `data-host="page"`: the host page runs FigCraft in its own document
+    /// and hears the editor's DOM `CustomEvent`s on this canvas.
+    pub fn for_page(canvas: &web_sys::HtmlCanvasElement) -> Self {
+        Self { transport: Transport::Page { canvas: canvas.clone() }, host_file: Rc::default(), reported: Rc::default() }
+    }
+
+    /// Hear the files the host sends, and queue each one on `opens` for the app's own open path
+    /// (the shell drains it into [`figcraft_ui_egui::pending_open`] every frame, so a host file
+    /// opens like a dropped one).
+    pub fn listen(&self, opens: OpenQueue, ctx: egui::Context) {
+        match &self.transport {
+            Transport::Parent { window, parent, origin } => {
+                let parent = parent.clone();
+                let origin = origin.clone();
+                let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
+                    if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
+                        return;
+                    }
+                    let data = event.data();
+                    if string(&data, "type").as_deref() != Some("figcraft:open") {
+                        return;
+                    }
+                    deliver_open(&opens, &ctx, &data);
+                });
+                if window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
+                    // The listener lives as long as the page.
+                    on_message.forget();
+                }
+            }
+            Transport::Page { canvas } => {
+                let on_open = Closure::<dyn FnMut(web_sys::Event)>::new(move |event: web_sys::Event| {
+                    // A plain `Event` of the same name carries no detail; only a `CustomEvent`.
+                    let Some(open) = event.dyn_ref::<web_sys::CustomEvent>() else { return };
+                    deliver_open(&opens, &ctx, &open.detail());
+                });
+                if canvas.add_event_listener_with_callback("figcraft:open", on_open.as_ref().unchecked_ref()).is_ok() {
+                    // The listener lives as long as the page.
+                    on_open.forget();
+                }
+            }
+        }
+    }
+
+    /// `?author=`: the host's name for the user signs comments and board notes.
+    pub fn set_author(app: &mut FigApp, author: &str) {
+        let author: String = author.trim().chars().take(MAX_AUTHOR_CHARS).collect();
+        if !author.is_empty() {
+            app.session.prefs.user_name = author;
+        }
+    }
+
+    pub fn post_ready(&self) {
+        let _ = self.transport.send("figcraft:ready", &[("version", env!("CARGO_PKG_VERSION").into())], None);
+    }
+
+    /// The app couldn't start (no WebGPU or WebGL2, for example): let the host say so.
+    pub fn post_failed(&self, error: &str) {
+        let _ = self.transport.send("figcraft:failed", &[("error", error.into())], None);
+    }
+
+    /// Hand a file the app would otherwise download to the host; `false` when nothing was
+    /// delivered. The `saveAs` rule is this module's documentation's.
+    pub fn post_save(&self, path: &str, bytes: &[u8]) -> bool {
+        let name = file_name(path);
+        let host_file = self.host_file.borrow().clone();
+        let save_as = crate::hostmode::save_as(&name, host_file.as_deref());
+        // After a Save As hand-over the document's file is the new one: the next Save of it sends
+        // its name with `saveAs: false`.
+        if save_as {
+            *self.host_file.borrow_mut() = Some(name.clone());
+        }
+        // `figcraft:save` carries the bytes as an `ArrayBuffer`; the parent bridge transfers it.
+        let buffer = js_sys::Uint8Array::from(bytes).buffer();
+        let fields: [(&str, JsValue); 3] = [("name", name.as_str().into()), ("saveAs", save_as.into()), ("bytes", buffer.clone().into())];
+        self.transport.send("figcraft:save", &fields, Some(&buffer)).is_ok()
+    }
+
+    /// Report unsaved changes when they appear or go away, not every frame.
+    pub fn set_dirty(&self, dirty: bool) {
+        if self.reported.get() != Some(dirty) && self.transport.send("figcraft:dirty", &[("dirty", dirty.into())], None).is_ok() {
+            self.reported.set(Some(dirty));
+        }
+    }
+}
+
+/// The file an open message or event carries, queued for the app's own open path, or nothing when
+/// the payload isn't one (no bytes, or over the open limit).
+fn deliver_open(opens: &OpenQueue, ctx: &egui::Context, data: &JsValue) {
+    let name = crate::hostmode::open_name(string(data, "name").as_deref());
+    let Some(bytes) = payload_bytes(data, &name) else { return };
+    opens.borrow_mut().push((name, bytes));
+    ctx.request_repaint();
+}
+
+/// The `bytes` of an open message or event as owned bytes, refused over the browser's own open
+/// limit ([`figcraft_ui_egui::browser_can_read`]) before they are copied. `bytes` is an
+/// `ArrayBuffer` or `Uint8Array`.
+fn payload_bytes(data: &JsValue, name: &str) -> Option<Vec<u8>> {
+    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
+    let len = if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
+        array.length() as f64
+    } else {
+        bytes.dyn_ref::<js_sys::ArrayBuffer>()?.byte_length() as f64
+    };
+    if figcraft_ui_egui::browser_can_read(name, len).is_err() {
+        log::warn!("host file {name} is too large to open in the browser; not opened");
+        return None;
+    }
+    Some(if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() { array.to_vec() } else { js_sys::Uint8Array::new(&bytes).to_vec() })
+}
+
+/// The last component of `path`, or the whole of it when there is none.
+fn file_name(path: &str) -> String {
+    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string())
+}
+
+/// A message object or `CustomEvent` detail with the given fields, or `None` if one couldn't be
+/// built (a field that isn't a valid property name, say).
+fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
+    let m = js_sys::Object::new();
+    for (key, value) in fields {
+        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
+    }
+    Some(m)
+}
+
+fn string(data: &JsValue, key: &str) -> Option<String> {
+    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
+}
+
+/// A `JsValue` error as a string, after `what` went wrong.
+fn js_error(e: &JsValue, what: &str) -> String {
+    format!("{what}: {}", e.as_string().unwrap_or_else(|| format!("{e:?}")))
+}
diff --git a/apps/figcraft-web/src/hostmode.rs b/apps/figcraft-web/src/hostmode.rs
new file mode 100644
index 000000000..54cfbcbc2
--- /dev/null
+++ b/apps/figcraft-web/src/hostmode.rs
@@ -0,0 +1,109 @@
+//! Pure host-mode rules, shared by the bridge ([`crate::host`]) and testable without a browser
+//! (like [`crate::query`]): what opts a page into hosting FigCraft in its own document, the name
+//! the bridge fills in when an open request has none, and whether a handed-over file becomes the
+//! document's file.
+
+/// The one `data-host` value that opts a page in: the exact string `"page"`.
+pub const PAGE_HOST: &str = "page";
+
+/// The file name used when an open request carries no usable one.
+pub const DEFAULT_OPEN_NAME: &str = "Untitled.figcraft";
+
+/// The extensions of files that can be a document's own file: the formats `file.save` and
+/// `file.saveAs` write (`file.open` opens both as native documents). A `.fig` file is an export
+/// copy instead, and so is everything else the app hands over (rendered images, SVG, PDF,
+/// variables).
+const DOC_EXTS: &[&str] = &["figcraft", "json"];
+
+/// The suffix `variable.export`'s downloads carry: a `.json` that is a variables sidecar, not a
+/// document, so its extension alone can't tell the `saveAs` decision.
+const VARIABLES_SIDECAR: &str = ".variables.json";
+
+/// Does this `data-host` value ask for page host mode? Only the exact value [`PAGE_HOST`] counts;
+/// anything else is ignored, so the page host mode stays opt-in. `?host=parent`, the parent
+/// bridge's URL opt-in, is answered before this is asked.
+pub fn page_host_requested(data_host: Option<&str>) -> bool {
+    data_host == Some(PAGE_HOST)
+}
+
+/// A usable file name for an open request: the host's name when it isn't blank, else the
+/// [`DEFAULT_OPEN_NAME`].
+pub fn open_name(name: Option<&str>) -> String {
+    name.filter(|n| !n.trim().is_empty()).unwrap_or(DEFAULT_OPEN_NAME).to_string()
+}
+
+/// Whether the file `name` becomes the document's own file when handed over (`saveAs: true`),
+/// given the file the host opened (`None`: the host never sent one). The rule:
+///
+/// - A document file (`.figcraft` or `.json`, [`DOC_EXTS`]'s formats) under a name the host didn't
+///   open — Save As, or a Save of a document the host never sent — is the document's new file:
+///   `true`. Names compare without case.
+/// - A Save of the host's own file under its name is not: `false`.
+/// - Everything else is a copy or export that never becomes the document — rendered images, SVG,
+///   PDF, `.fig` copies, variables — and the variables sidecar counts as one whatever its `.json`
+///   extension says: `false`.
+pub fn save_as(name: &str, host_file: Option<&str>) -> bool {
+    if name.to_ascii_lowercase().ends_with(VARIABLES_SIDECAR) {
+        return false;
+    }
+    let ext = std::path::Path::new(name).extension().and_then(std::ffi::OsStr::to_str);
+    if !ext.is_some_and(|e| DOC_EXTS.iter().any(|x| x.eq_ignore_ascii_case(e))) {
+        return false;
+    }
+    match host_file {
+        Some(host) => !host.eq_ignore_ascii_case(name),
+        None => true,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_the_exact_page_value_opts_in() {
+        assert!(page_host_requested(Some("page")));
+        for off in [None, Some(""), Some("Page"), Some("PAGE"), Some(" page"), Some("page "), Some("parent")] {
+            assert!(!page_host_requested(off), "{off:?} must keep the page host mode off");
+        }
+    }
+
+    #[test]
+    fn open_names_fall_back_to_the_default_when_blank() {
+        assert_eq!(open_name(Some("Poster.figcraft")), "Poster.figcraft");
+        assert_eq!(open_name(Some(" Poster.figcraft ")), " Poster.figcraft ", "a name with its spacing is kept");
+        assert_eq!(open_name(Some("")), DEFAULT_OPEN_NAME);
+        assert_eq!(open_name(Some("   ")), DEFAULT_OPEN_NAME);
+        assert_eq!(open_name(None), DEFAULT_OPEN_NAME);
+    }
+
+    #[test]
+    fn a_save_of_the_host_s_file_is_not_save_as() {
+        assert!(!save_as("Poster.figcraft", Some("Poster.figcraft")));
+        assert!(!save_as("poster.FIGCRAFT", Some("Poster.figcraft")), "names compare without case");
+        assert!(!save_as("design.json", Some("design.json")));
+    }
+
+    #[test]
+    fn a_new_document_file_is_save_as() {
+        assert!(save_as("Poster 2.figcraft", Some("Poster.figcraft")));
+        assert!(save_as("Poster.json", Some("Poster.figcraft")), "the other format a document's file takes");
+        assert!(save_as("Untitled.figcraft", None), "the host never sent a file");
+        assert!(save_as("Poster.figcraft", Some("design.json")), "the opened .json saved as .figcraft is a new file");
+    }
+
+    #[test]
+    fn copies_and_exports_never_become_the_document_s_file() {
+        for name in ["Poster.png", "Poster@2x.jpg", "Poster.svg", "Poster.pdf", "Poster.fig", "Poster.csv", "Poster.variables.css"] {
+            assert!(!save_as(name, Some("Poster.figcraft")), "{name} is a copy");
+            assert!(!save_as(name, None), "{name} is a copy even without a host file");
+        }
+    }
+
+    #[test]
+    fn the_variables_sidecar_is_a_copy_whatever_its_extension() {
+        assert!(!save_as("Poster.variables.json", Some("Poster.figcraft")));
+        assert!(!save_as("Poster.variables.json", None));
+        assert!(!save_as("design.variables.json", Some("design.variables.json")));
+    }
+}
diff --git a/apps/figcraft-web/src/main.rs b/apps/figcraft-web/src/main.rs
index 48e03ba85..b65a82772 100644
--- a/apps/figcraft-web/src/main.rs
+++ b/apps/figcraft-web/src/main.rs
@@ -19,9 +19,17 @@
 //!   server…), but can't host a session. A page served over `https://` reaches only `wss://`
 //!   servers and the same computer (browsers block `ws://` from secure pages); serve it over
 //!   `http://` on a trusted network to reach plain `ws://` hosts on other machines.
+//! - host mode: `?host=parent` (a same-origin page embedding FigCraft in an `<iframe>`) or
+//!   `data-host="page"` on the canvas (the page's own document) hands the page the app's files
+//!   instead of downloading them and reports unsaved changes (`host`);
+//! - live sessions: it joins sessions a desktop app hosts (File ▸ Join live session…) but can't
+//!   host one. A page served over `https://` can only reach sessions on the same computer
 //!
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?control` installs
-//! `window.figcraft`, the page's control channel (`api.rs`), which is off without it.
+//! `window.figcraft`, the page's control channel (`api.rs`), which is off without it; `?host=parent`
+//! (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the document to open
+//! and stores what FigCraft saves. `&author=` names the user for comments and board notes in either
+//! host mode.
 //!
 //! URL fragment: `#join=<invite link or join code>` joins that live session once the page has
 //! loaded, so a bookmark opens a shared file. `join` takes the rest of the fragment: put it last.
@@ -30,6 +38,10 @@
 
 #[cfg(target_arch = "wasm32")]
 mod api;
+#[cfg(target_arch = "wasm32")]
+mod host;
+#[cfg(any(target_arch = "wasm32", test))]
+mod hostmode;
 #[cfg(any(target_arch = "wasm32", test))]
 mod kept;
 #[cfg(target_arch = "wasm32")]
diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs
index ee8cd9487..7878edbe4 100644
--- a/apps/figcraft-web/src/web.rs
+++ b/apps/figcraft-web/src/web.rs
@@ -32,6 +32,21 @@ pub fn start() {
             log::error!("missing <canvas id=\"{CANVAS_ID}\">");
             return;
         };
+        // Host modes: `?host=parent`, a same-origin page framing FigCraft, opens documents in it
+        // and stores what it saves (`host`); unframed there is no parent, so that URL on its own
+        // stays the normal app with downloads. `data-host="page"` on the canvas opts a page in
+        // instead: it runs FigCraft in its own document and talks over DOM `CustomEvent`s on the
+        // canvas (`host`).
+        let bridge = if query_param("host").as_deref() == Some("parent") {
+            crate::host::Bridge::new()
+        } else if crate::hostmode::page_host_requested(canvas.get_attribute("data-host").as_deref()) {
+            Some(crate::host::Bridge::for_page(&canvas))
+        } else {
+            None
+        };
+        let app_bridge = bridge.clone();
+        // Files the host sends, on their way into the app's own open queue each frame.
+        let opens: crate::host::OpenQueue = std::rc::Rc::default();
         let mut options = eframe::WebOptions::default();
         // `?webgl`: force the WebGL2 backend (troubleshooting, and headless browsers whose WebGPU
         // adapter request returns nothing).
@@ -44,7 +59,7 @@ pub fn start() {
             .start(
                 canvas,
                 options,
-                Box::new(|cc| {
+                Box::new(move |cc| {
                     if let Some(rs) = &cc.wgpu_render_state {
                         log::info!("figcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
                     }
@@ -64,6 +79,11 @@ pub fn start() {
                     fig.note_recovered(recovered);
                     if let Err(e) = crate::pasted::install(cc.egui_ctx.clone()) {
                         log::error!("couldn't listen for pasted images: {e:?}");
+                    // Host mode: the host sends the file to edit, so start with no document (the
+                    // Live sessions: the browser joins sessions a desktop app hosts; whatever arrives
+                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone(), host: app_bridge.clone() }));
+                    // `?author=`: the host's name for the user signs this visit's comments and board
+                        crate::host::Bridge::set_author(&mut fig, &author);
                     }
                     // `#join=<link>`: join that session, as opening an invite link does on the desktop.
                     let hash = web_sys::window().and_then(|w| w.location().hash().ok()).unwrap_or_default();
@@ -78,10 +98,21 @@ pub fn start() {
                             log::error!("couldn't install window.figcraft: {e:?}");
                         }
                     }
-                    Ok(Box::new(WebShell { fig }))
+                    // The host's files arrive on the app's own open path (a dropped file's).
+                    if let Some(bridge) = &app_bridge {
+                        bridge.listen(opens.clone(), cc.egui_ctx.clone());
+                    }
+                    Ok(Box::new(WebShell { fig, host: app_bridge, opens }))
                 }),
             )
             .await;
+        // Ready only once the runner is up: starting can still fail after the app is made.
+        if let Some(bridge) = &bridge {
+            match &result {
+                Ok(()) => bridge.post_ready(),
+                Err(e) => bridge.post_failed(&format!("{e:?}")),
+            }
+        }
         if let Some(el) = document.get_element_by_id(LOADING_ID) {
             match result {
                 Ok(()) => el.remove(),
@@ -141,20 +172,34 @@ fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
+fn query_param(key: &str) -> Option<String> {
+    web_sys::UrlSearchParams::new_with_str(&query()).ok()?.get(key)
+}
+
 struct WebShell {
     fig: FigApp,
+    /// The host bridge, when the page hosts the app (`?host=parent` or `data-host="page"`).
+    host: Option<crate::host::Bridge>,
+    /// Files the host sent, waiting to join the app's own open queue.
+    opens: crate::host::OpenQueue,
 }
 
 impl eframe::App for WebShell {
     // eframe runs `logic` for visible tabs and, with only `run_logic`, for hidden ones: keep
     // autosave/live/control deadlines moving without a paint. `FigApp::ui` does not repeat it.
-    /// Run the browser shell's eframe logic callback: guard `background_tick` so hidden tabs
-    /// still advance autosave, live and control deadlines without painting. `FigApp::ui` does
+    /// Run the browser shell's eframe logic callback: hand the host's files to the app's open
+    /// queue, guard `background_tick` so hidden tabs still advance autosave, live and control
+    /// deadlines without painting, and report unsaved changes to the host. `FigApp::ui` does
     /// not repeat it.
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         // Every frame, hidden or not, starts here: what the last one left is what a panic keeps.
         UNSAVED.with(|u| u.try_borrow_mut().map(|mut u| u.follow(&self.fig.session))).ok();
+        // Files the host sent join the app's own open queue (a dropped file's): the same
         figcraft_ui_egui::windows::guard(&mut self.fig, ctx, |fig| fig.background_tick(ctx));
+        // The host hears when unsaved changes appear or go away (crate::host).
+        if let Some(bridge) = &self.host {
+            bridge.set_dirty(self.fig.session.docs.iter().any(|d| d.is_dirty()));
+        }
     }
 
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
@@ -184,10 +229,13 @@ impl eframe::App for WebShell {
 /// over their contents (pickers that need a path return nothing, the trait's defaults); files are
 /// saved as downloads. Copies go to the system clipboard through egui's output; pastes arrive as
 /// paste events with their text or image (a page can't read the clipboard when it likes).
+/// saved as downloads, or handed to the host page in host mode. Copies go to the system clipboard
 struct WebServices {
     /// `prefers-reduced-motion: reduce` (it follows the setting while the page is open).
     reduce_motion: Option<web_sys::MediaQueryList>,
     ctx: egui::Context,
+    /// The host bridge in host mode: files are handed over instead of downloaded ([`crate::host`]).
+    host: Option<crate::host::Bridge>,
 }
 
 impl Services for WebServices {
@@ -204,11 +252,15 @@ impl Services for WebServices {
     fn downloads(&self) -> bool {
         true
     }
-    /// A Blob behind a temporary `<a download>` link, clicked and removed.
+    /// A Blob behind a temporary `<a download>` link, clicked and removed; in host mode the file
+    /// goes to the host page instead ([`crate::host`]).
     fn download(&mut self, name: &str, bytes: &[u8]) -> bool {
         if crate::api::capture(name, bytes) {
             return true;
         }
+        if let Some(bridge) = &self.host {
+            return bridge.post_save(name, bytes);
+        }
         match download(name, bytes) {
             Ok(()) => true,
             Err(e) => {
diff --git a/packaging/web/README.md b/packaging/web/README.md
index 609cb5da6..10e1ae037 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -107,6 +107,94 @@ Local test: `python3 -m http.server 8767` inside the folder, then open http://lo
   (`allow-popups` lets Help links open in a new tab).
 - Don't send `X-Frame-Options: DENY` or a `frame-ancestors` CSP that excludes the embedding page.
 
+## Host mode (`?host=parent`, or the page's own document)
+
+A page can embed FigCraft so that it hands files over instead of downloading them and reports
+unsaved changes. Two opt-in transports carry the same messages:
+
+- **`?host=parent`** on the iframe's URL (`https://example.com/figcraft/?host=parent`): a
+  **same-origin** framing page talks to the app over `postMessage`. Opened outside an iframe, the
+  URL gives the normal app with downloads; with a parent on another origin there is no host mode
+  either (messages to another origin are dropped silently, so saves would be lost while the
+  document looked saved).
+- **`data-host="page"`** (the exact value `page`) on the canvas: a page that loads the module into
+  its own document gets the same behaviour over DOM `CustomEvent`s on the canvas, with no iframe
+  (see below).
+
+| Message | Direction | Fields |
+|---|---|---|
+| `figcraft:ready` | app → page | `version`: the app is running and listening; send a file now |
+| `figcraft:open` | page → app | `name`, `bytes` (an `ArrayBuffer` or `Uint8Array`): open like File › Open (a payload over the browser open limit of 512 MB is refused; anything malformed is ignored) |
+| `figcraft:save` | app → page | `name`, `saveAs`, `bytes` (a transferred `ArrayBuffer`): every file the app would otherwise download. The page stores it and reports failures itself. `saveAs` says whether the file becomes the document's file: `false` after Save of the file the page sent, under its own name; `true` for a document file (`.figcraft`, `.json`) under a name the page didn't send — Save As, or a Save of a document the page never sent — after which the next Save carries that name with `false`; `false` for copies and exports that don't become the document (rendered images, SVG, PDF, `.fig` copies, the variables exports) |
+| `figcraft:dirty` | app → page | `dirty`: unsaved changes appeared or went away |
+| `figcraft:failed` | app → page | `error`: the app couldn't start (no WebGPU or WebGL2, for example) |
+
+Files reach the page through the app's download service, the path this web build saves by: Save As
+(and a Save of a document with no file yet), the `.fig` copy, the export panel and its dialog,
+Export frames as PDF, plugin output and the variables export (Variables panel ▸ Export…). In host
+mode each arrives as `figcraft:save` instead of a download.
+
+In host mode the app starts with no document (the home screen), so the page sends the file to edit
+and guards leaving the page while changes are unsaved. `&author=` on the URL names the user for
+comments and board notes.
+
+### Same-document host mode
+
+The host application loads the wasm-bindgen module itself and gives FigCraft one of its own
+canvases, so there is no iframe and no `?host=parent`. It opts in with `data-host="page"` on that
+canvas — the exact value `page` — and the canvas keeps the id the app looks up
+(`id="figcraft_canvas"`):
+
+```html
+<canvas id="figcraft_canvas" data-host="page" style="width: 100%; height: 720px; display: block;"></canvas>
+```
+
+The page and the app then talk with DOM `CustomEvent`s on the canvas instead of `postMessage`. The
+app dispatches the same messages it would post to a parent — `figcraft:ready`, `figcraft:save`,
+`figcraft:dirty`, `figcraft:failed` — with the message fields (without the type) as the event's
+`detail`, and it opens a document when the page dispatches a `figcraft:open` event with
+`detail: { name, bytes }`. Events do not bubble, so listen on the canvas itself (two editors on
+one page can't hear each other).
+
+Add the listeners before `init`: the app announces itself with `figcraft:ready` while `init` is
+still running, and a file sent in reply would otherwise be missed.
+
+```js
+import init from "./figcraft-web-<hash>.js"; // the wasm-bindgen glue shipped with the app
+
+const canvas = document.getElementById("figcraft_canvas");
+
+canvas.addEventListener("figcraft:ready", async () => {
+  // The app is listening; hand it a document now, if you have one.
+  const bytes = await documentBytes(); // an ArrayBuffer or Uint8Array
+  canvas.dispatchEvent(new CustomEvent("figcraft:open", {
+    detail: { name: "Poster.figcraft", bytes },
+  }));
+});
+
+// Every file FigCraft would otherwise download arrives here.
+canvas.addEventListener("figcraft:save", (event) => {
+  const { name, saveAs, bytes } = event.detail; // bytes is an ArrayBuffer
+  // Store the file under `name`; `saveAs` says whether it becomes the document's file.
+  // Report your own errors.
+  storeFile(name, bytes, saveAs);
+});
+canvas.addEventListener("figcraft:dirty", (event) => {
+  unsaved = event.detail.dirty; // warn before leaving, as you like
+});
+canvas.addEventListener("figcraft:failed", (event) => {
+  showError(event.detail.error); // the app couldn't start
+});
+
+await init({ module_or_path: "./figcraft-web-<hash>_bg.wasm" });
+```
+
+- Saves are not downloads in this mode: the `bytes` in `figcraft:save` hold the file, and the host
+  decides where it goes.
+- `?author=` on the page's URL still names the user for comments and board notes.
+- An unframed page that uses `?host=parent` keeps the normal app with downloads; only the exact
+  `data-host` value `page` turns this mode on.
+
 ## Renderer selection and fallback flags
 
 FigCraft renders with wgpu. It uses **WebGPU** when the browser has it and falls back to

From 51bbc2b1a7f19c6fb91acdd0665eec6e83b5062e Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:32:30 +1030
Subject: [PATCH 44/70] figcraft-web: a host-opened file is the document's
 file; a failed save hand-over changes nothing

---
 apps/figcraft-web/src/host.rs | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/apps/figcraft-web/src/host.rs b/apps/figcraft-web/src/host.rs
index d08bdf45b..5ed0f683a 100644
--- a/apps/figcraft-web/src/host.rs
+++ b/apps/figcraft-web/src/host.rs
@@ -147,6 +147,7 @@ impl Bridge {
     /// (the shell drains it into [`figcraft_ui_egui::pending_open`] every frame, so a host file
     /// opens like a dropped one).
     pub fn listen(&self, opens: OpenQueue, ctx: egui::Context) {
+        let host_file = self.host_file.clone();
         match &self.transport {
             Transport::Parent { window, parent, origin } => {
                 let parent = parent.clone();
@@ -159,7 +160,7 @@ impl Bridge {
                     if string(&data, "type").as_deref() != Some("figcraft:open") {
                         return;
                     }
-                    deliver_open(&opens, &ctx, &data);
+                    deliver_open(&opens, &ctx, &host_file, &data);
                 });
                 if window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
                     // The listener lives as long as the page.
@@ -170,7 +171,7 @@ impl Bridge {
                 let on_open = Closure::<dyn FnMut(web_sys::Event)>::new(move |event: web_sys::Event| {
                     // A plain `Event` of the same name carries no detail; only a `CustomEvent`.
                     let Some(open) = event.dyn_ref::<web_sys::CustomEvent>() else { return };
-                    deliver_open(&opens, &ctx, &open.detail());
+                    deliver_open(&opens, &ctx, &host_file, &open.detail());
                 });
                 if canvas.add_event_listener_with_callback("figcraft:open", on_open.as_ref().unchecked_ref()).is_ok() {
                     // The listener lives as long as the page.
@@ -203,15 +204,16 @@ impl Bridge {
         let name = file_name(path);
         let host_file = self.host_file.borrow().clone();
         let save_as = crate::hostmode::save_as(&name, host_file.as_deref());
-        // After a Save As hand-over the document's file is the new one: the next Save of it sends
-        // its name with `saveAs: false`.
-        if save_as {
-            *self.host_file.borrow_mut() = Some(name.clone());
-        }
         // `figcraft:save` carries the bytes as an `ArrayBuffer`; the parent bridge transfers it.
         let buffer = js_sys::Uint8Array::from(bytes).buffer();
         let fields: [(&str, JsValue); 3] = [("name", name.as_str().into()), ("saveAs", save_as.into()), ("bytes", buffer.clone().into())];
-        self.transport.send("figcraft:save", &fields, Some(&buffer)).is_ok()
+        let sent = self.transport.send("figcraft:save", &fields, Some(&buffer)).is_ok();
+        // After a Save As hand-over the host has the new file: the next Save of it sends its name
+        // with `saveAs: false`. A failed send changes nothing, so a retry is still a Save As.
+        if sent && save_as {
+            *self.host_file.borrow_mut() = Some(name);
+        }
+        sent
     }
 
     /// Report unsaved changes when they appear or go away, not every frame.
@@ -224,9 +226,12 @@ impl Bridge {
 
 /// The file an open message or event carries, queued for the app's own open path, or nothing when
 /// the payload isn't one (no bytes, or over the open limit).
-fn deliver_open(opens: &OpenQueue, ctx: &egui::Context, data: &JsValue) {
+fn deliver_open(opens: &OpenQueue, ctx: &egui::Context, host_file: &RefCell<Option<String>>, data: &JsValue) {
     let name = crate::hostmode::open_name(string(data, "name").as_deref());
     let Some(bytes) = payload_bytes(data, &name) else { return };
+    // The document's file is now the one the host sent: a Save of it under this name is
+    // `saveAs: false`.
+    *host_file.borrow_mut() = Some(name.clone());
     opens.borrow_mut().push((name, bytes));
     ctx.request_repaint();
 }

From e83eeeb925ba6b94830f7c50fd0a3ce27a57099c Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Sun, 1 Nov 2026 14:43:04 +0800
Subject: [PATCH 45/70] figcraft-web: carry the host bridge over the current
 startup code (one web-sys entry, one app construction, host files drained
 into the open queue); roadmap header merged

---
 ROADMAP.md                   |  3 +--
 apps/figcraft-web/Cargo.toml |  3 +--
 apps/figcraft-web/src/web.rs | 30 +++++++++++++++++++++++-------
 3 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 2a5fa6fff..c2aa86c22 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,8 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (web host bridge: `?host=parent` in an iframe or `data-host="page"` on the canvas hands a page the app's files instead of downloads and reports unsaved changes, documented in the hosting guide; colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
diff --git a/apps/figcraft-web/Cargo.toml b/apps/figcraft-web/Cargo.toml
index 75f7e312c..15f98bee5 100644
--- a/apps/figcraft-web/Cargo.toml
+++ b/apps/figcraft-web/Cargo.toml
@@ -30,5 +30,4 @@ eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 wasm-bindgen = "0.2"
 js-sys = "0.3"
 wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "Storage"] }
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "Event", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "MessageEvent", "UrlSearchParams", "CustomEvent", "CustomEventInit"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "Storage", "Event", "MessageEvent", "UrlSearchParams", "CustomEvent", "CustomEventInit"] }
diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs
index 7878edbe4..12fb6af5e 100644
--- a/apps/figcraft-web/src/web.rs
+++ b/apps/figcraft-web/src/web.rs
@@ -64,7 +64,10 @@ pub fn start() {
                         log::info!("figcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
                     }
                     let reduce_motion = web_sys::window().and_then(|w| w.match_media("(prefers-reduced-motion: reduce)").ok().flatten());
-                    let mut session = Session::new();
+                    // Host mode: the host sends the file to edit, so start with no document (the
+                    // home screen), as the desktop app does without a file; otherwise the session
+                    // starts with one new document.
+                    let mut session = if app_bridge.is_some() { Session::empty() } else { Session::new() };
                     // The host names its own server: the default for sharing, codes and the team list.
                     if let Some(server) = page_meta("figcraft-server").as_deref().and_then(crate::query::page_server) {
                         session.prefs.publish_server = server;
@@ -75,14 +78,16 @@ pub fn start() {
                     // whatever arrives on the socket wakes the page for a frame.
                     let ctx = cc.egui_ctx.clone();
                     session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint()))));
-                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone(), host: app_bridge.clone() }));
                     fig.note_recovered(recovered);
                     if let Err(e) = crate::pasted::install(cc.egui_ctx.clone()) {
                         log::error!("couldn't listen for pasted images: {e:?}");
-                    // Host mode: the host sends the file to edit, so start with no document (the
-                    // Live sessions: the browser joins sessions a desktop app hosts; whatever arrives
-                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone(), host: app_bridge.clone() }));
+                    }
                     // `?author=`: the host's name for the user signs this visit's comments and board
+                    // notes (nothing is stored in the browser, so nothing needs keeping).
+                    if app_bridge.is_some()
+                        && let Some(author) = query_param("author")
+                    {
                         crate::host::Bridge::set_author(&mut fig, &author);
                     }
                     // `#join=<link>`: join that session, as opening an invite link does on the desktop.
@@ -195,6 +200,17 @@ impl eframe::App for WebShell {
         // Every frame, hidden or not, starts here: what the last one left is what a panic keeps.
         UNSAVED.with(|u| u.try_borrow_mut().map(|mut u| u.follow(&self.fig.session))).ok();
         // Files the host sent join the app's own open queue (a dropped file's): the same
+        // "Opening as a new file" card, and `file.open` with the contents once read.
+        for (name, bytes) in std::mem::take(&mut *self.opens.borrow_mut()) {
+            let read: figcraft_ui_egui::ReadFuture = Box::pin(std::future::ready(Ok(bytes)));
+            self.fig.ui.pending_opens.push(figcraft_ui_egui::pending_open::PendingOpen {
+                label: name.clone(),
+                params: serde_json::json!({ "name": name }),
+                command: "file.open",
+                target: None,
+                read: Some(read),
+            });
+        }
         figcraft_ui_egui::windows::guard(&mut self.fig, ctx, |fig| fig.background_tick(ctx));
         // The host hears when unsaved changes appear or go away (crate::host).
         if let Some(bridge) = &self.host {
@@ -227,9 +243,9 @@ impl eframe::App for WebShell {
 
 /// Browser services. Files are opened and imported through the browser's file picker, which hands
 /// over their contents (pickers that need a path return nothing, the trait's defaults); files are
-/// saved as downloads. Copies go to the system clipboard through egui's output; pastes arrive as
-/// paste events with their text or image (a page can't read the clipboard when it likes).
 /// saved as downloads, or handed to the host page in host mode. Copies go to the system clipboard
+/// through egui's output; pastes arrive as paste events with their text or image (a page can't
+/// read the clipboard when it likes).
 struct WebServices {
     /// `prefers-reduced-motion: reduce` (it follows the setting while the page is open).
     reduce_motion: Option<web_sys::MediaQueryList>,

From 3acb629e19d27c94b8d0ad070649025701e1d416 Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Sun, 1 Nov 2026 15:04:09 +0800
Subject: [PATCH 46/70] packaging/web: say that ?host=parent takes precedence
 over data-host="page"

---
 packaging/web/README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packaging/web/README.md b/packaging/web/README.md
index 10e1ae037..a2cd4ac40 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -192,8 +192,10 @@ await init({ module_or_path: "./figcraft-web-<hash>_bg.wasm" });
 - Saves are not downloads in this mode: the `bytes` in `figcraft:save` hold the file, and the host
   decides where it goes.
 - `?author=` on the page's URL still names the user for comments and board notes.
-- An unframed page that uses `?host=parent` keeps the normal app with downloads; only the exact
-  `data-host` value `page` turns this mode on.
+- An unframed page that uses `?host=parent` keeps the normal app with downloads.
+  `data-host="page"` turns this mode on only when `?host=parent` is absent: if `?host=parent` is
+  present it takes precedence, so a same-origin framed page uses the parent bridge, while an
+  unframed or cross-origin page gets no bridge and keeps normal downloads.
 
 ## Renderer selection and fallback flags
 

From 845e34dfeb833d335846e6b6a98eecaf8c5f216c Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Sun, 1 Nov 2026 17:30:54 +0800
Subject: [PATCH 47/70] packaging/web: document what page host mode trusts, the
 limits on host files, and the stable event names

---
 packaging/web/README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/packaging/web/README.md b/packaging/web/README.md
index a2cd4ac40..4b501f29e 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -197,6 +197,12 @@ await init({ module_or_path: "./figcraft-web-<hash>_bg.wasm" });
   present it takes precedence, so a same-origin framed page uses the parent bridge, while an
   unframed or cross-origin page gets no bridge and keeps normal downloads.
 
+### Trust and limits
+
+- **Who is trusted.** In page host mode the page and FigCraft share one document, so any script on the page can drive the app: open files in it and receive what it saves. Use this mode only for a page you control. The iframe mode (`?host=parent`) answers only the parent window, on the page's own origin.
+- **Files from the host are untrusted input.** An opened file goes through the same reading as one picked with File ▸ Open or dropped on the window, with the same format limits; before it is copied into the app's memory, its size is checked against the host open limit (512 MB) and a larger file is refused, and a name is cut to 255 characters.
+- **The event and message names are the interface.** `figcraft:ready`, `figcraft:open`, `figcraft:save`, `figcraft:dirty` and `figcraft:failed`, and the fields they carry (the same as the `?host=parent` messages), stay stable; changing one is a breaking change.
+
 ## Renderer selection and fallback flags
 
 FigCraft renders with wgpu. It uses **WebGPU** when the browser has it and falls back to

From cb9a63807ef9e8716018d6256ce95dff8f3481c0 Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Thu, 5 Nov 2026 16:47:23 +0800
Subject: [PATCH 48/70] figcraft-web: speak the host messages through
 craft-web-host

The transports, the message types and the origin checks come from the shared crate (storytold/craft-libs#420); FigCraft keeps what is its own: which saved files become the document, the open size limit and the author.
---
 Cargo.lock                        |  10 ++
 apps/figcraft-web/Cargo.toml      |   2 +
 apps/figcraft-web/src/host.rs     | 244 +++++++-----------------------
 apps/figcraft-web/src/hostmode.rs |  43 ++----
 apps/figcraft-web/src/web.rs      |  18 +--
 packaging/web/README.md           |   4 +-
 6 files changed, 86 insertions(+), 235 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b9fb98654..36bd121b6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1157,6 +1157,15 @@ dependencies = [
  "zip 9.1.1",
 ]
 
+[[package]]
+name = "craft-web-host"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=2e2312ddaf21bc3d85cd3395d0955c7d239306f6#2e2312ddaf21bc3d85cd3395d0955c7d239306f6"
+dependencies = [
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "craft-window"
 version = "0.1.0"
@@ -2121,6 +2130,7 @@ name = "figcraft-web"
 version = "0.15.0"
 dependencies = [
  "base64 0.22.1",
+ "craft-web-host",
  "eframe",
  "egui",
  "figcraft-collab-net",
diff --git a/apps/figcraft-web/Cargo.toml b/apps/figcraft-web/Cargo.toml
index 15f98bee5..7f0b4ded5 100644
--- a/apps/figcraft-web/Cargo.toml
+++ b/apps/figcraft-web/Cargo.toml
@@ -19,6 +19,8 @@ figcraft-format = { workspace = true }
 figcraft-ui-egui = { workspace = true }
 figcraft-collab-net = { workspace = true }
 figcraft-text = { workspace = true }
+# The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
+craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "2e2312ddaf21bc3d85cd3395d0955c7d239306f6", version = "0.1.0" }
 base64 = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
diff --git a/apps/figcraft-web/src/host.rs b/apps/figcraft-web/src/host.rs
index 5ed0f683a..1000c1490 100644
--- a/apps/figcraft-web/src/host.rs
+++ b/apps/figcraft-web/src/host.rs
@@ -1,23 +1,21 @@
 //! Host modes: a page that runs FigCraft (as an `<iframe>`, or in its own document) opens
-//! documents in it and stores what it saves instead of the browser downloading. The same
-//! messages as the other Crafting Apps' bridges.
+//! documents in it and stores what it saves instead of the browser downloading. The messages
+//! and the two transports are `craft-web-host`'s (storytold/craft-libs): the same contract as
+//! the other Craft apps' bridges. This module is FigCraft's part of it.
 //!
-//! ## `?host=parent` — an `<iframe>` (such as a Nextcloud app)
-//!
-//! The framing page and FigCraft talk over `postMessage` between same-origin windows. Messages
-//! are plain objects with a `type`:
-//!
-//! - `figcraft:ready` (to the parent): `{ version }`, sent once the app is running and
-//!   listening; send a file now.
-//! - `figcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
-//!   `Uint8Array`. It opens exactly as a file picked with File › Open or dropped on the window
-//!   would (the app's own open queue, with its "Opening as a new file" card). A payload over the
-//!   browser's own open limit ([`figcraft_ui_egui::browser_can_read`]'s 512 MB) is refused before
-//!   its bytes are copied, and anything malformed is ignored.
-//! - `figcraft:save` (to the parent): `{ name, saveAs, bytes }` (a transferred `ArrayBuffer`) for
-//!   every file the app hands its download service — in host mode nothing reaches the browser's
-//!   downloads. The parent stores it and reports failures itself. `saveAs` says whether the file
-//!   becomes the document's file ([`crate::hostmode::save_as`]):
+//! - `?host=parent` (an `<iframe>`, such as a Nextcloud app) talks to the same-origin parent over
+//!   `postMessage`; `data-host="page"` on the canvas (the page's own document) uses DOM
+//!   `CustomEvent`s on the canvas instead. `?host=parent` wins when both are present.
+//! - `figcraft:ready` (to the host) once the app is running and listening; send a file now.
+//! - `figcraft:open` (from the host): `{ name, bytes }`. It opens exactly as a file picked with
+//!   File › Open or dropped on the window would (the app's own open queue, with its "Opening as
+//!   a new file" card). A payload over the browser's own open limit
+//!   ([`figcraft_ui_egui::browser_can_read`]'s 512 MB) is refused before its bytes are copied,
+//!   and anything malformed is ignored. FigCraft reads whole files, so it says `file: false` in
+//!   `ready` and a host sends `bytes`.
+//! - `figcraft:save` (to the host): `{ name, saveAs, bytes }` for every file the app hands its
+//!   download service; in host mode nothing reaches the browser's downloads. `saveAs` says whether
+//!   the file becomes the document's file ([`crate::hostmode::save_as`]):
 //!   - A Save of the file the host opened, under its own name: `false`.
 //!   - A document file (`.figcraft` or `.json`, the formats `file.save` and `file.saveAs` write)
 //!     under a name the host didn't open — Save As, or a Save of a document the host never sent
@@ -26,31 +24,20 @@
 //!   - Everything else is a copy or export that never becomes the document: `false` — rendered
 //!     images, SVG and PDF, `.fig` copies, and the variables exports (a `.variables.json`
 //!     sidecar's `.json` extension doesn't make it a document).
-//! - `figcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
-//! - `figcraft:failed` (to the parent): `{ error }` when the app couldn't start.
-//!
-//! Only the parent window on the page's own origin is heard or answered.
-//!
-//! ## `data-host="page"` — the page's own document
-//!
-//! A page that loads the module into its own document (its own `<canvas id="figcraft_canvas"
-//! data-host="page">`, no iframe) gets the same behaviour over DOM `CustomEvent`s on the canvas
-//! instead of `postMessage`: the same four events outward (`ready`, `save`, `dirty`, `failed`,
-//! with the message fields as the event's `detail`), and the page dispatches `figcraft:open` on
-//! the canvas with `detail: { name, bytes }` to open a document. Events don't bubble, so two
-//! editors on one page can't hear each other, and the canvas is the only target FigCraft
-//! listens on.
+//! - `figcraft:dirty` whenever unsaved changes appear or go away, `figcraft:failed` when the app
+//!   couldn't start.
 //!
 //! In host mode the app starts with no document (the home screen) and the host sends the file to
 //! edit; `?author=` names the user for comments and board notes.
 
-use std::cell::{Cell, RefCell};
+use std::cell::RefCell;
 use std::rc::Rc;
 
+use craft_web_host::web::{FileData, Host, Message};
 use figcraft_ui_egui::FigApp;
-use wasm_bindgen::JsCast as _;
-use wasm_bindgen::JsValue;
-use wasm_bindgen::closure::Closure;
+
+/// The app id in the host messages (`figcraft:ready`).
+const APP: &str = "figcraft";
 
 /// The longest user name taken from `?author=`.
 const MAX_AUTHOR_CHARS: usize = 200;
@@ -59,88 +46,20 @@ const MAX_AUTHOR_CHARS: usize = 200;
 /// `(name, bytes)`.
 pub type OpenQueue = Rc<RefCell<Vec<(String, Vec<u8>)>>>;
 
-/// How a host page is reached. The modes behave the same; they differ only in how an event goes
-/// out ([`Transport::send`]) and how an open request comes in ([`Bridge::listen`]).
-#[derive(Clone)]
-enum Transport {
-    /// `?host=parent`: `postMessage` between same-origin windows.
-    Parent { window: web_sys::Window, parent: web_sys::Window, origin: String },
-    /// `data-host="page"`: DOM `CustomEvent`s on the editor's own canvas.
-    Page { canvas: web_sys::HtmlCanvasElement },
-}
-
-impl Transport {
-    /// Hand an event to the host. In parent mode this is a `postMessage` whose object carries a
-    /// `type` field; in page mode a `CustomEvent` of that name on the canvas, whose `detail`
-    /// holds the fields and which never bubbles (two editors on one page must not hear each
-    /// other). `transfer` hands an `ArrayBuffer` to the parent instead of copying it (parent
-    /// mode only; the page's document already shares the buffer's bytes).
-    fn send(&self, event: &str, fields: &[(&str, JsValue)], transfer: Option<&js_sys::ArrayBuffer>) -> Result<(), String> {
-        match self {
-            Transport::Parent { parent, origin, .. } => {
-                let mut message_fields = Vec::with_capacity(fields.len() + 1);
-                message_fields.push(("type", JsValue::from_str(event)));
-                message_fields.extend_from_slice(fields);
-                let message = message(&message_fields).ok_or_else(|| "couldn't build the message".to_string())?;
-                let sent = match transfer {
-                    Some(buffer) => parent.post_message_with_transfer(&message, origin, &js_sys::Array::of1(buffer)),
-                    None => parent.post_message(&message, origin),
-                };
-                sent.map_err(|e| js_error(&e, "couldn't post the message"))
-            }
-            Transport::Page { canvas } => {
-                let detail = message(fields).ok_or_else(|| "couldn't build the event detail".to_string())?;
-                let init = web_sys::CustomEventInit::new();
-                // The builder methods (`bubbles(..)`, `detail(..)`) are deprecated in web-sys
-                // 0.3.106 and fail clippy -D warnings; use the setters.
-                init.set_bubbles(false);
-                init.set_detail(&detail);
-                let custom = web_sys::CustomEvent::new_with_event_init_dict(event, &init).map_err(|e| js_error(&e, "couldn't create the event"))?;
-                // A listener calling `preventDefault` would be the bool; not a send failure.
-                canvas.dispatch_event(&custom).map_err(|e| js_error(&e, "couldn't dispatch the event"))?;
-                Ok(())
-            }
-        }
-    }
-}
-
 #[derive(Clone)]
 pub struct Bridge {
-    transport: Transport,
+    host: Rc<Host>,
     /// The file the host opened, and after a `saveAs` hand-over the document's file: the name a
     /// Save under (`saveAs: false`) is decided against.
     host_file: Rc<RefCell<Option<String>>>,
-    /// The unsaved-changes state last reported to the host.
-    reported: Rc<Cell<Option<bool>>>,
 }
 
 impl Bridge {
-    /// The parent bridge for `?host=parent`. `None` when the page isn't framed (there is no
-    /// parent to talk to), so opening that URL directly stays the normal app with downloads, or
-    /// when the parent is on another origin: messages only go to this origin, so the browser
-    /// would drop every save without an error while the document showed as saved.
-    pub fn new() -> Option<Self> {
-        let window = web_sys::window()?;
-        let parent = window.parent().ok().flatten()?;
-        if js_sys::Object::is(&parent, &window) {
-            return None;
-        }
-        let origin = window.location().origin().ok()?;
-        // An opaque origin (a `file://` page in some browsers) can't be a `postMessage` target.
-        if origin == "null" {
-            return None;
-        }
-        // Reading another origin's location throws, which is `None` too.
-        if parent.location().origin().ok()? != origin {
-            return None;
-        }
-        Some(Self { transport: Transport::Parent { window, parent, origin }, host_file: Rc::default(), reported: Rc::default() })
-    }
-
-    /// The page bridge for `data-host="page"`: the host page runs FigCraft in its own document
-    /// and hears the editor's DOM `CustomEvent`s on this canvas.
-    pub fn for_page(canvas: &web_sys::HtmlCanvasElement) -> Self {
-        Self { transport: Transport::Page { canvas: canvas.clone() }, host_file: Rc::default(), reported: Rc::default() }
+    /// The bridge for this page, or `None` when FigCraft isn't hosted: no `?host=parent` and no
+    /// `data-host="page"` on the canvas, an unframed `?host=parent` page (it stays the normal app
+    /// with downloads), or a parent on another origin.
+    pub fn connect(canvas: &web_sys::HtmlCanvasElement) -> Option<Self> {
+        Some(Self { host: Rc::new(Host::connect(APP, canvas)?), host_file: Rc::default() })
     }
 
     /// Hear the files the host sends, and queue each one on `opens` for the app's own open path
@@ -148,37 +67,11 @@ impl Bridge {
     /// opens like a dropped one).
     pub fn listen(&self, opens: OpenQueue, ctx: egui::Context) {
         let host_file = self.host_file.clone();
-        match &self.transport {
-            Transport::Parent { window, parent, origin } => {
-                let parent = parent.clone();
-                let origin = origin.clone();
-                let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
-                    if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
-                        return;
-                    }
-                    let data = event.data();
-                    if string(&data, "type").as_deref() != Some("figcraft:open") {
-                        return;
-                    }
-                    deliver_open(&opens, &ctx, &host_file, &data);
-                });
-                if window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
-                    // The listener lives as long as the page.
-                    on_message.forget();
-                }
+        self.host.listen(move |message| {
+            if let Message::Open { name, data } = message {
+                deliver_open(&opens, &ctx, &host_file, &name, &data);
             }
-            Transport::Page { canvas } => {
-                let on_open = Closure::<dyn FnMut(web_sys::Event)>::new(move |event: web_sys::Event| {
-                    // A plain `Event` of the same name carries no detail; only a `CustomEvent`.
-                    let Some(open) = event.dyn_ref::<web_sys::CustomEvent>() else { return };
-                    deliver_open(&opens, &ctx, &host_file, &open.detail());
-                });
-                if canvas.add_event_listener_with_callback("figcraft:open", on_open.as_ref().unchecked_ref()).is_ok() {
-                    // The listener lives as long as the page.
-                    on_open.forget();
-                }
-            }
-        }
+        });
     }
 
     /// `?author=`: the host's name for the user signs comments and board notes.
@@ -190,12 +83,12 @@ impl Bridge {
     }
 
     pub fn post_ready(&self) {
-        let _ = self.transport.send("figcraft:ready", &[("version", env!("CARGO_PKG_VERSION").into())], None);
+        let _ = self.host.post_ready(env!("CARGO_PKG_VERSION"), false);
     }
 
     /// The app couldn't start (no WebGPU or WebGL2, for example): let the host say so.
     pub fn post_failed(&self, error: &str) {
-        let _ = self.transport.send("figcraft:failed", &[("error", error.into())], None);
+        let _ = self.host.post_failed(error, None);
     }
 
     /// Hand a file the app would otherwise download to the host; `false` when nothing was
@@ -204,10 +97,7 @@ impl Bridge {
         let name = file_name(path);
         let host_file = self.host_file.borrow().clone();
         let save_as = crate::hostmode::save_as(&name, host_file.as_deref());
-        // `figcraft:save` carries the bytes as an `ArrayBuffer`; the parent bridge transfers it.
-        let buffer = js_sys::Uint8Array::from(bytes).buffer();
-        let fields: [(&str, JsValue); 3] = [("name", name.as_str().into()), ("saveAs", save_as.into()), ("bytes", buffer.clone().into())];
-        let sent = self.transport.send("figcraft:save", &fields, Some(&buffer)).is_ok();
+        let sent = self.host.post_save(&name, bytes, None, save_as).is_ok();
         // After a Save As hand-over the host has the new file: the next Save of it sends its name
         // with `saveAs: false`. A failed send changes nothing, so a retry is still a Save As.
         if sent && save_as {
@@ -216,63 +106,33 @@ impl Bridge {
         sent
     }
 
-    /// Report unsaved changes when they appear or go away, not every frame.
+    /// Report unsaved changes when they appear or go away, not every frame (the crate does not
+    /// repeat a state it already reported).
     pub fn set_dirty(&self, dirty: bool) {
-        if self.reported.get() != Some(dirty) && self.transport.send("figcraft:dirty", &[("dirty", dirty.into())], None).is_ok() {
-            self.reported.set(Some(dirty));
-        }
+        self.host.post_dirty(dirty);
     }
 }
 
-/// The file an open message or event carries, queued for the app's own open path, or nothing when
-/// the payload isn't one (no bytes, or over the open limit).
-fn deliver_open(opens: &OpenQueue, ctx: &egui::Context, host_file: &RefCell<Option<String>>, data: &JsValue) {
-    let name = crate::hostmode::open_name(string(data, "name").as_deref());
-    let Some(bytes) = payload_bytes(data, &name) else { return };
+/// The file an open message carries, queued for the app's own open path, or nothing when the
+/// payload isn't one (a `File` the app doesn't read, or over the open limit).
+fn deliver_open(opens: &OpenQueue, ctx: &egui::Context, host_file: &RefCell<Option<String>>, name: &str, data: &FileData) {
+    let name = crate::hostmode::open_name(name);
+    let FileData::Bytes(array) = data else {
+        log::warn!("host file {name} came as a File; FigCraft reads bytes only; not opened");
+        return;
+    };
+    if figcraft_ui_egui::browser_can_read(&name, data.size()).is_err() {
+        log::warn!("host file {name} is too large to open in the browser; not opened");
+        return;
+    }
     // The document's file is now the one the host sent: a Save of it under this name is
     // `saveAs: false`.
     *host_file.borrow_mut() = Some(name.clone());
-    opens.borrow_mut().push((name, bytes));
+    opens.borrow_mut().push((name, array.to_vec()));
     ctx.request_repaint();
 }
 
-/// The `bytes` of an open message or event as owned bytes, refused over the browser's own open
-/// limit ([`figcraft_ui_egui::browser_can_read`]) before they are copied. `bytes` is an
-/// `ArrayBuffer` or `Uint8Array`.
-fn payload_bytes(data: &JsValue, name: &str) -> Option<Vec<u8>> {
-    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
-    let len = if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
-        array.length() as f64
-    } else {
-        bytes.dyn_ref::<js_sys::ArrayBuffer>()?.byte_length() as f64
-    };
-    if figcraft_ui_egui::browser_can_read(name, len).is_err() {
-        log::warn!("host file {name} is too large to open in the browser; not opened");
-        return None;
-    }
-    Some(if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() { array.to_vec() } else { js_sys::Uint8Array::new(&bytes).to_vec() })
-}
-
 /// The last component of `path`, or the whole of it when there is none.
 fn file_name(path: &str) -> String {
     std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string())
 }
-
-/// A message object or `CustomEvent` detail with the given fields, or `None` if one couldn't be
-/// built (a field that isn't a valid property name, say).
-fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
-    let m = js_sys::Object::new();
-    for (key, value) in fields {
-        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
-    }
-    Some(m)
-}
-
-fn string(data: &JsValue, key: &str) -> Option<String> {
-    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
-}
-
-/// A `JsValue` error as a string, after `what` went wrong.
-fn js_error(e: &JsValue, what: &str) -> String {
-    format!("{what}: {}", e.as_string().unwrap_or_else(|| format!("{e:?}")))
-}
diff --git a/apps/figcraft-web/src/hostmode.rs b/apps/figcraft-web/src/hostmode.rs
index 54cfbcbc2..a06c745f4 100644
--- a/apps/figcraft-web/src/hostmode.rs
+++ b/apps/figcraft-web/src/hostmode.rs
@@ -1,10 +1,6 @@
 //! Pure host-mode rules, shared by the bridge ([`crate::host`]) and testable without a browser
-//! (like [`crate::query`]): what opts a page into hosting FigCraft in its own document, the name
-//! the bridge fills in when an open request has none, and whether a handed-over file becomes the
-//! document's file.
-
-/// The one `data-host` value that opts a page in: the exact string `"page"`.
-pub const PAGE_HOST: &str = "page";
+//! (like [`crate::query`]): the name the bridge fills in when an open request has none, and whether
+//! a handed-over file becomes the document's file. Which pages host the app is `craft-web-host`'s.
 
 /// The file name used when an open request carries no usable one.
 pub const DEFAULT_OPEN_NAME: &str = "Untitled.figcraft";
@@ -19,17 +15,14 @@ const DOC_EXTS: &[&str] = &["figcraft", "json"];
 /// document, so its extension alone can't tell the `saveAs` decision.
 const VARIABLES_SIDECAR: &str = ".variables.json";
 
-/// Does this `data-host` value ask for page host mode? Only the exact value [`PAGE_HOST`] counts;
-/// anything else is ignored, so the page host mode stays opt-in. `?host=parent`, the parent
-/// bridge's URL opt-in, is answered before this is asked.
-pub fn page_host_requested(data_host: Option<&str>) -> bool {
-    data_host == Some(PAGE_HOST)
-}
+/// The name `craft-web-host` gives an open request that carries no usable one (it cleans a host's
+/// name and falls back to this).
+const NAMELESS: &str = "document";
 
-/// A usable file name for an open request: the host's name when it isn't blank, else the
-/// [`DEFAULT_OPEN_NAME`].
-pub fn open_name(name: Option<&str>) -> String {
-    name.filter(|n| !n.trim().is_empty()).unwrap_or(DEFAULT_OPEN_NAME).to_string()
+/// A usable file name for an open request: the cleaned name the crate hands over, or
+/// [`DEFAULT_OPEN_NAME`] when the host sent none.
+pub fn open_name(name: &str) -> String {
+    if name == NAMELESS { DEFAULT_OPEN_NAME.to_string() } else { name.to_string() }
 }
 
 /// Whether the file `name` becomes the document's own file when handed over (`saveAs: true`),
@@ -61,20 +54,10 @@ mod tests {
     use super::*;
 
     #[test]
-    fn only_the_exact_page_value_opts_in() {
-        assert!(page_host_requested(Some("page")));
-        for off in [None, Some(""), Some("Page"), Some("PAGE"), Some(" page"), Some("page "), Some("parent")] {
-            assert!(!page_host_requested(off), "{off:?} must keep the page host mode off");
-        }
-    }
-
-    #[test]
-    fn open_names_fall_back_to_the_default_when_blank() {
-        assert_eq!(open_name(Some("Poster.figcraft")), "Poster.figcraft");
-        assert_eq!(open_name(Some(" Poster.figcraft ")), " Poster.figcraft ", "a name with its spacing is kept");
-        assert_eq!(open_name(Some("")), DEFAULT_OPEN_NAME);
-        assert_eq!(open_name(Some("   ")), DEFAULT_OPEN_NAME);
-        assert_eq!(open_name(None), DEFAULT_OPEN_NAME);
+    fn open_names_fall_back_to_the_default_when_the_host_sent_none() {
+        assert_eq!(open_name("Poster.figcraft"), "Poster.figcraft");
+        assert_eq!(open_name("Poster 2.json"), "Poster 2.json");
+        assert_eq!(open_name("document"), DEFAULT_OPEN_NAME, "what the crate says for a missing or blank name");
     }
 
     #[test]
diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs
index 12fb6af5e..69042ce06 100644
--- a/apps/figcraft-web/src/web.rs
+++ b/apps/figcraft-web/src/web.rs
@@ -32,18 +32,12 @@ pub fn start() {
             log::error!("missing <canvas id=\"{CANVAS_ID}\">");
             return;
         };
-        // Host modes: `?host=parent`, a same-origin page framing FigCraft, opens documents in it
-        // and stores what it saves (`host`); unframed there is no parent, so that URL on its own
-        // stays the normal app with downloads. `data-host="page"` on the canvas opts a page in
-        // instead: it runs FigCraft in its own document and talks over DOM `CustomEvent`s on the
-        // canvas (`host`).
-        let bridge = if query_param("host").as_deref() == Some("parent") {
-            crate::host::Bridge::new()
-        } else if crate::hostmode::page_host_requested(canvas.get_attribute("data-host").as_deref()) {
-            Some(crate::host::Bridge::for_page(&canvas))
-        } else {
-            None
-        };
+        // Host modes (`craft-web-host`): `?host=parent`, a same-origin page framing FigCraft, opens
+        // documents in it and stores what it saves (`host`); unframed there is no parent, so that URL
+        // on its own stays the normal app with downloads. `data-host="page"` on the canvas opts a
+        // page in instead: it runs FigCraft in its own document and talks over DOM `CustomEvent`s on
+        // the canvas.
+        let bridge = crate::host::Bridge::connect(&canvas);
         let app_bridge = bridge.clone();
         // Files the host sends, on their way into the app's own open queue each frame.
         let opens: crate::host::OpenQueue = std::rc::Rc::default();
diff --git a/packaging/web/README.md b/packaging/web/README.md
index 4b501f29e..b5b702941 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -123,7 +123,7 @@ unsaved changes. Two opt-in transports carry the same messages:
 
 | Message | Direction | Fields |
 |---|---|---|
-| `figcraft:ready` | app → page | `version`: the app is running and listening; send a file now |
+| `figcraft:ready` | app → page | `version`, `appVersion`: the app is running and listening; send a file now |
 | `figcraft:open` | page → app | `name`, `bytes` (an `ArrayBuffer` or `Uint8Array`): open like File › Open (a payload over the browser open limit of 512 MB is refused; anything malformed is ignored) |
 | `figcraft:save` | app → page | `name`, `saveAs`, `bytes` (a transferred `ArrayBuffer`): every file the app would otherwise download. The page stores it and reports failures itself. `saveAs` says whether the file becomes the document's file: `false` after Save of the file the page sent, under its own name; `true` for a document file (`.figcraft`, `.json`) under a name the page didn't send — Save As, or a Save of a document the page never sent — after which the next Save carries that name with `false`; `false` for copies and exports that don't become the document (rendered images, SVG, PDF, `.fig` copies, the variables exports) |
 | `figcraft:dirty` | app → page | `dirty`: unsaved changes appeared or went away |
@@ -197,6 +197,8 @@ await init({ module_or_path: "./figcraft-web-<hash>_bg.wasm" });
   present it takes precedence, so a same-origin framed page uses the parent bridge, while an
   unframed or cross-origin page gets no bridge and keeps normal downloads.
 
+The messages and both transports are the shared contract of [`craft-web-host`](https://github.com/storytold/craft-libs/tree/main/crates/web-host) (storytold/craft-libs#420), the same for every Craft app: its README lists every message, including `saved`, with the compatibility notes. In `figcraft:ready`, `version` is the contract's (`"1"`) and `appVersion` is this app's release. FigCraft reads bytes, so a host sends `bytes`, not a `File`.
+
 ### Trust and limits
 
 - **Who is trusted.** In page host mode the page and FigCraft share one document, so any script on the page can drive the app: open files in it and receive what it saves. Use this mode only for a page you control. The iframe mode (`?host=parent`) answers only the parent window, on the page's own origin.

From 05db36303f60a02edced55c1542ede373ad7556b Mon Sep 17 00:00:00 2001
From: Helen Kwok <107752876+helenkwok@users.noreply.github.com>
Date: Sun, 1 Nov 2026 20:43:17 +0800
Subject: [PATCH 49/70] figcraft-web: a Save of a host-opened document goes out
 under the host's file name

In page host mode a plain Save of a .figcraft the host opened used the document's internal name, so the host got a different file name with saveAs true instead of an update to the file it opened. Services gains host_file(); Save uses it for a .figcraft host file, Save As keeps the document name, and a missing, .json or .fig host file stays a Save As.
---
 apps/figcraft-web/src/host.rs         |  5 +++
 apps/figcraft-web/src/web.rs          |  3 ++
 crates/ui-egui/src/app/files.rs       | 26 +++++++++---
 crates/ui-egui/src/host_save_tests.rs | 60 +++++++++++++++++++++++++++
 crates/ui-egui/src/lib.rs             |  2 +
 crates/ui-egui/src/services.rs        |  5 +++
 6 files changed, 95 insertions(+), 6 deletions(-)
 create mode 100644 crates/ui-egui/src/host_save_tests.rs

diff --git a/apps/figcraft-web/src/host.rs b/apps/figcraft-web/src/host.rs
index 1000c1490..57b67ca85 100644
--- a/apps/figcraft-web/src/host.rs
+++ b/apps/figcraft-web/src/host.rs
@@ -91,6 +91,11 @@ impl Bridge {
         let _ = self.host.post_failed(error, None);
     }
 
+    /// The document file the host opened or the last Save As made, if any.
+    pub fn host_file(&self) -> Option<String> {
+        self.host_file.borrow().clone()
+    }
+
     /// Hand a file the app would otherwise download to the host; `false` when nothing was
     /// delivered. The `saveAs` rule is this module's documentation's.
     pub fn post_save(&self, path: &str, bytes: &[u8]) -> bool {
diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs
index 69042ce06..7da9f8c93 100644
--- a/apps/figcraft-web/src/web.rs
+++ b/apps/figcraft-web/src/web.rs
@@ -279,6 +279,9 @@ impl Services for WebServices {
             }
         }
     }
+    fn host_file(&self) -> Option<String> {
+        self.host.as_ref()?.host_file()
+    }
     fn clipboard_set_text(&mut self, s: &str) {
         figcraft_ui_egui::egui_copy_text(&self.ctx, s);
     }
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index 3351329fd..1ae5e5679 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -6,12 +6,7 @@ use super::{
 impl FigApp {
     pub fn save_as_dialog(&mut self) {
         if self.services.downloads() {
-            if let Some(r) = self.run("file.saveAs", json!({"data": true}))
-                && self.download(r["name"].as_str().unwrap_or_default(), &r)
-            {
-                self.run("file.markSaved", json!({}));
-                dialogs::file_saved(self, &r);
-            }
+            self.save_download(None);
             return;
         }
         let Ok(name) = self.session.doc().map(|d| d.name.clone()) else { return };
@@ -43,6 +38,17 @@ impl FigApp {
         });
     }
 
+    /// Save by handing the file over as a download. `keep`: the name a Save of a host-opened
+    /// document keeps; `None` is a Save As, under the document's own name.
+    fn save_download(&mut self, keep: Option<&str>) {
+        if let Some(r) = self.run("file.saveAs", json!({"data": true}))
+            && self.download(keep.unwrap_or_else(|| r["name"].as_str().unwrap_or_default()), &r)
+        {
+            self.run("file.markSaved", json!({}));
+            dialogs::file_saved(self, &r);
+        }
+    }
+
     pub fn save(&mut self) {
         // A branch tab saves its main file.
         let tab = figcraft_engine::branches::file_tab(&self.session);
@@ -57,6 +63,9 @@ impl FigApp {
             if self.run("file.save", json!({})).is_some() {
                 self.toast(i18n::tr("Saved"));
             }
+        } else if let Some(name) = self.services.host_file().filter(|n| is_document_file(n)) {
+            // A host-opened document is saved as the file the host gave: the host updates that file.
+            self.save_download(Some(&name));
         } else {
             self.save_as_dialog();
         }
@@ -299,3 +308,8 @@ impl FigApp {
         failed
     }
 }
+
+/// A `.figcraft` file name: the document format a Save writes (a `.fig` is an export copy).
+fn is_document_file(name: &str) -> bool {
+    Path::new(name).extension().and_then(OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("figcraft"))
+}
diff --git a/crates/ui-egui/src/host_save_tests.rs b/crates/ui-egui/src/host_save_tests.rs
new file mode 100644
index 000000000..0e84d8ab5
--- /dev/null
+++ b/crates/ui-egui/src/host_save_tests.rs
@@ -0,0 +1,60 @@
+//! In a page host the browser hands files to the host: a Save of the document the host opened goes
+//! out under the host's file name, a Save As under the document's own name.
+
+use std::sync::{Arc, Mutex};
+
+use figcraft_engine::Session;
+use serde_json::json;
+
+use crate::{FigApp, Services};
+
+type Saved = Arc<Mutex<Vec<String>>>;
+
+/// Services that save by downloads, with a document file the host opened.
+struct Host {
+    got: Saved,
+    file: Option<&'static str>,
+}
+
+impl Services for Host {
+    fn downloads(&self) -> bool {
+        true
+    }
+    fn download(&mut self, name: &str, _bytes: &[u8]) -> bool {
+        self.got.lock().unwrap().push(name.to_string());
+        true
+    }
+    fn host_file(&self) -> Option<String> {
+        self.file.map(str::to_string)
+    }
+}
+
+fn app(file: Option<&'static str>) -> (FigApp, Saved) {
+    let got = Saved::default();
+    let mut app = FigApp::new(Session::empty(), Box::new(Host { got: got.clone(), file }));
+    app.session.execute("file.new", &json!({"name": "Original"})).unwrap();
+    (app, got)
+}
+
+#[test]
+fn save_keeps_the_name_the_host_opened() {
+    let (mut app, got) = app(Some("client.figcraft"));
+    app.save();
+    assert_eq!(got.lock().unwrap().as_slice(), ["client.figcraft"]);
+}
+
+#[test]
+fn save_as_uses_the_document_s_own_name() {
+    let (mut app, got) = app(Some("client.figcraft"));
+    app.save_as_dialog();
+    assert_eq!(got.lock().unwrap().as_slice(), ["Original.figcraft"]);
+}
+
+#[test]
+fn without_a_host_file_or_for_a_copy_format_save_is_a_save_as() {
+    for file in [None, Some("design.json"), Some("export.fig")] {
+        let (mut app, got) = app(file);
+        app.save();
+        assert_eq!(got.lock().unwrap().as_slice(), ["Original.figcraft"], "{file:?}");
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index e9969c106..a7397cee4 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -124,6 +124,8 @@ mod home_recents_tests;
 #[cfg(test)]
 mod home_tests;
 #[cfg(test)]
+mod host_save_tests;
+#[cfg(test)]
 mod idle_tests;
 #[cfg(test)]
 mod ime_tests;
diff --git a/crates/ui-egui/src/services.rs b/crates/ui-egui/src/services.rs
index c9f8e22a2..b5a997a85 100644
--- a/crates/ui-egui/src/services.rs
+++ b/crates/ui-egui/src/services.rs
@@ -24,6 +24,11 @@ pub trait Services {
     fn download(&mut self, _name: &str, _bytes: &[u8]) -> bool {
         false
     }
+    /// The document file a host page opened, where the app runs inside one (the browser's host
+    /// mode): a Save of that document keeps this name instead of the document's own.
+    fn host_file(&self) -> Option<String> {
+        None
+    }
     /// A folder to write several files into.
     fn pick_folder(&mut self, _title: &str) -> DialogFuture {
         Box::pin(std::future::ready(None))

From 01762dae332960ba0b3b81a7e0bafad57d139695 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Thu, 5 Nov 2026 15:48:40 +0100
Subject: [PATCH 50/70] fix(ui): About credits table columns can be dragged
 wider or narrower (#1969)

* fix(ui): About credits table columns can be dragged wider or narrower

The Contributors and Models tables already open fitted to the dialog, the
name column taking the spare width, and scroll sideways only when there is
not room for every column. Their columns were fixed, though: no edge could
be dragged. They are resizable now, down to 28 points (the flexible column
to its minimum). Widening a column grows the table, as in a spreadsheet,
and only then does it scroll sideways; cells clip instead of overlapping.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* About: refit credits tables when what they measure changes

The columns became resizable, so the table keeps its own widths. A longer
name, a changed cell or a resized window left the old widths in place and
clipped text. The table now goes back to its fit when a column measure or
the clip rect width changes, which scrolling never moves.

Adds tests that drag every column edge, change the fit and scroll a
widened table, as CodeRabbit asked for the drag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Tests: a fitted credits table fills the window exactly

The table ends on the window edge, which the layout rounds to whole points,
so the check allows that edge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/dialogs/credits.rs         |  37 ++++--
 .../ui-egui/src/dialogs/credits/ui_tests.rs   | 119 ++++++++++++++++++
 2 files changed, 147 insertions(+), 9 deletions(-)

diff --git a/crates/ui-egui/src/dialogs/credits.rs b/crates/ui-egui/src/dialogs/credits.rs
index e10a8434a..2c64ccafb 100644
--- a/crates/ui-egui/src/dialogs/credits.rs
+++ b/crates/ui-egui/src/dialogs/credits.rs
@@ -247,6 +247,8 @@ const SORT_ARROW_W: f32 = 12.0;
 /// Padding inside each cell, on each side.
 const CELL_PAD: f32 = 6.0;
 const NAME_MIN_W: f32 = 110.0;
+/// The narrowest a credits column can be dragged.
+const MIN_COLUMN: f32 = 28.0;
 
 /// About ▸ Contributors: a name toggle, a sort, and the list as a grab bag or a table.
 pub fn contributors_ui(ui: &mut egui::Ui) {
@@ -341,13 +343,17 @@ fn column_width<'a>(ui: &egui::Ui, header: &str, cells: impl Iterator<Item = &'a
 }
 
 /// A credits table: columns of `widths`, the `None` one taking what the others leave (at least
-/// `flex_min`). The header stays put while the rows scroll, within `height` (header included). Too
-/// narrow for every column, it scrolls sideways rather than clip one.
+/// [`NAME_MIN_W`]). The header stays put while the rows scroll, within `height` (header included). Too
+/// narrow for every column, it scrolls sideways rather than clip one. Every
+/// column edge can be dragged, down to [`MIN_COLUMN`] (the `None` column to [`NAME_MIN_W`]): widening
+/// a column grows the table, as in a spreadsheet, and only then does it scroll sideways. When the
+/// window, a column's width or `flex_text` (the width the `None` column's text needs) changes, the
+/// columns go back to this fit, dropping any dragged widths.
 fn credits_table(
     ui: &mut egui::Ui,
     id: &str,
     widths: &[Option<f32>],
-    flex_min: f32,
+    flex_text: f32,
     height: f32,
     header: impl FnOnce(egui_extras::TableRow<'_, '_>),
     body: impl FnOnce(egui_extras::TableBody<'_>),
@@ -358,21 +364,31 @@ fn credits_table(
     // The table puts a row gap under its header.
     let body_h = (height - TABLE_HEADER_H - ui.spacing().item_spacing.y).max(TABLE_ROW_H);
     egui::ScrollArea::horizontal().id_salt((id, "h")).auto_shrink([false, true]).show(ui, |ui| {
-        let flex = (ui.available_width() - fixed).max(flex_min);
+        let flex = (ui.available_width() - fixed).max(NAME_MIN_W);
         // No gaps between cells: their padding spaces them, and the header rule runs unbroken.
         ui.spacing_mut().item_spacing.x = 0.0;
+        // The table keeps its own column widths, so a change in what they were fitted to has to clear
+        // them. Scrolling can nudge the available width, so this compares the clip rect, which scrolling
+        // never moves.
+        let fit = egui::Id::unique(("credits_fit", id));
+        let measured = (widths.to_vec(), flex_text, ui.clip_rect().width());
+        let refit = ui.data_mut(|d| d.get_temp::<(Vec<Option<f32>>, f32, f32)>(fit)).as_ref() != Some(&measured);
+        ui.data_mut(|d| d.insert_temp(fit, measured));
         let mut b = egui_extras::TableBuilder::new(ui)
             .id_salt(id)
             .striped(true)
-            .resizable(false)
+            .resizable(true)
             .auto_shrink([false, false])
             .min_scrolled_height(body_h)
             .max_scroll_height(body_h)
             .cell_layout(egui::Layout::left_to_right(egui::Align::Center));
+        if refit {
+            b.reset();
+        }
         for w in widths {
             b = b.column(match w {
-                Some(w) => egui_extras::Column::exact(*w),
-                None => egui_extras::Column::exact(flex).clip(true),
+                Some(w) => egui_extras::Column::initial(*w).at_least(MIN_COLUMN).clip(true),
+                None => egui_extras::Column::initial(flex).at_least(NAME_MIN_W).clip(true),
             });
         }
         b.header(TABLE_HEADER_H, header).body(body);
@@ -395,11 +411,13 @@ fn table(ui: &mut egui::Ui, list: &[&Contributor], v: &mut View, height: f32) {
     let t = Tokens::get(ui.ctx());
     let names = v.names;
     let widths = contributor_widths(ui, list);
+    let shown: Vec<String> = list.iter().map(|c| c.name(names)).collect();
+    let name_text = column_width(ui, SortKey::Name.label().1, shown.iter().map(String::as_str));
     credits_table(
         ui,
         "credits_table",
         &widths,
-        NAME_MIN_W,
+        name_text,
         height,
         |mut header| {
             for k in SortKey::ALL {
@@ -522,12 +540,13 @@ fn models_in(ui: &mut egui::Ui, models: &[Model], total_commits: u64) {
     let total = total_commits.max(models.iter().map(|m| m.commits).max().unwrap_or(0));
     let rows: Vec<[String; 6]> = models.iter().map(|m| model_cells(m, total)).collect();
     let widths = model_widths(ui, &rows);
+    let model_text = column_width(ui, tr(MODEL_HEADS[1]), rows.iter().filter_map(|r| r.get(1)).map(String::as_str));
     let numeric = |i: usize| i >= 3;
     credits_table(
         ui,
         "credits_models",
         &widths,
-        NAME_MIN_W,
+        model_text,
         table_height(ui, rows.len()),
         |mut header| {
             for (i, h) in MODEL_HEADS.iter().enumerate() {
diff --git a/crates/ui-egui/src/dialogs/credits/ui_tests.rs b/crates/ui-egui/src/dialogs/credits/ui_tests.rs
index fb3993ad9..cc2df5786 100644
--- a/crates/ui-egui/src/dialogs/credits/ui_tests.rs
+++ b/crates/ui-egui/src/dialogs/credits/ui_tests.rs
@@ -267,3 +267,122 @@ fn the_about_window_draws_every_tab() {
         assert_eq!(app.ui.about_tab, tab);
     }
 }
+
+const WINDOW: f32 = 640.5;
+const WIDTHS: [Option<f32>; 3] = [None, Some(80.0), Some(80.0)];
+const NAME: f32 = 120.0;
+
+/// One frame of a table long enough to scroll, in a window `width` wide; the rects of its header cells.
+fn table_frame(ctx: &egui::Context, width: f32, widths: &[Option<f32>], name: f32, events: Vec<egui::Event>) -> Vec<Rect> {
+    let screen_rect = Some(Rect::from_min_size(egui::Pos2::ZERO, vec2(width, 300.0)));
+    let raw = egui::RawInput { screen_rect, events, ..Default::default() };
+    let mut cells = Vec::new();
+    let out = ctx.run_ui(raw, |ui| {
+        cells.clear();
+        credits_table(
+            ui,
+            "test",
+            widths,
+            name,
+            240.0,
+            |mut header| {
+                for _ in widths {
+                    header.col(|ui| cells.push(ui.max_rect()));
+                }
+            },
+            |body| {
+                body.rows(TABLE_ROW_H, 40, |mut row| {
+                    for _ in widths {
+                        row.col(|ui| {
+                            ui.label("x");
+                        });
+                    }
+                });
+            },
+        );
+    });
+    out.drop_without_applying_deltas();
+    cells
+}
+
+/// [`table_frame`] at the usual size.
+fn settled_frame(ctx: &egui::Context) -> Vec<Rect> {
+    table_frame(ctx, WINDOW, &WIDTHS, NAME, Vec::new())
+}
+
+/// A new context with the table open and settled, and the rects of its header cells.
+fn opened_table() -> (egui::Context, Vec<Rect>) {
+    let ctx = egui::Context::default();
+    settled_frame(&ctx);
+    let cells = settled_frame(&ctx);
+    (ctx, cells)
+}
+
+/// Drags a column's right edge (cells have no gap between them), then lets go.
+fn drag_edge(ctx: &egui::Context, cell: Rect, by: f32) {
+    let start = egui::pos2(cell.right(), cell.center().y);
+    let halfway = start + vec2(by / 2.0, 0.0);
+    let end = start + vec2(by, 0.0);
+    let moved = egui::Event::PointerMoved;
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    for event in [moved(start), button(start, true), moved(halfway), moved(end), button(end, false)] {
+        table_frame(ctx, WINDOW, &WIDTHS, NAME, vec![event]);
+    }
+}
+
+#[test]
+fn every_column_can_be_dragged_at_its_right_edge_and_stays_there() {
+    let (_, opened) = opened_table();
+    for (dragged, cell) in opened.iter().enumerate() {
+        let (ctx, _) = opened_table();
+        drag_edge(&ctx, *cell, -30.0);
+        settled_frame(&ctx);
+        let after = settled_frame(&ctx);
+        for (column, (was, now)) in opened.iter().zip(&after).enumerate() {
+            let want = if column == dragged { was.width() - 30.0 } else { was.width() };
+            assert!((now.width() - want).abs() < 1.0, "dragging column {dragged}: column {column} is {now:?}, was {was:?}");
+        }
+    }
+}
+
+#[test]
+fn a_changed_fit_replaces_the_column_widths() {
+    let (ctx, opened) = opened_table();
+    drag_edge(&ctx, opened[0], -30.0);
+    let longer_name = table_frame(&ctx, WINDOW, &WIDTHS, NAME + 80.0, Vec::new());
+    assert!((longer_name[0].width() - opened[0].width()).abs() < 1.0, "a longer name drops a dragged width: {longer_name:?}");
+    let wider = table_frame(&ctx, WINDOW, &[None, Some(200.0), Some(80.0)], NAME, Vec::new());
+    let widths: Vec<f32> = wider.iter().map(|c| c.width().round()).collect();
+    assert!(widths.ends_with(&[200.0, 80.0]), "a longer cell widens its column: {widths:?}");
+    // The table fills the window, which the layout rounds to whole points.
+    assert!(wider[2].right() <= WINDOW.ceil(), "the table still fits the window: {wider:?}");
+    let narrower = table_frame(&ctx, 400.0, &WIDTHS, NAME, Vec::new());
+    assert!(narrower[2].right() <= 400.0, "a narrower window refits the table: {narrower:?}");
+}
+
+#[test]
+fn scrolling_sideways_keeps_dragged_widths() {
+    let (ctx, opened) = opened_table();
+    drag_edge(&ctx, opened[0], 100.0);
+    settled_frame(&ctx);
+    let dragged = settled_frame(&ctx);
+    assert!((dragged[0].width() - opened[0].width() - 100.0).abs() < 1.0, "the drag took: {dragged:?}");
+    table_frame(&ctx, WINDOW, &WIDTHS, NAME, vec![egui::Event::PointerMoved(dragged[0].center())]);
+    let mut scrolled = false;
+    for delta in [-13.3, -27.77, -41.1, 30.6] {
+        let wheel = egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(delta, 0.0),
+            modifiers: egui::Modifiers::NONE,
+            phase: egui::TouchPhase::Move,
+        };
+        table_frame(&ctx, WINDOW, &WIDTHS, NAME, vec![wheel]);
+        for _ in 0..8 {
+            let cells = settled_frame(&ctx);
+            assert!((cells[0].width() - dragged[0].width()).abs() < 1.0, "scrolled by {delta}: {cells:?}");
+            scrolled |= cells[0].left() < dragged[0].left() - 1.0;
+        }
+    }
+    assert!(scrolled, "the wheel never moved the table sideways");
+}

From 64f254a823a9ffb9b2f110dcc7fb71a151efb8fc Mon Sep 17 00:00:00 2001
From: Trevor Brown <trevorbrown.dev@gmail.com>
Date: Thu, 5 Nov 2026 16:07:52 -0500
Subject: [PATCH 51/70] Colour picker: dragging a gradient handle on the canvas
 keeps the picker and the handles up (#1852) (#1985)

* M1: dragging a gradient handle on the canvas keeps the colour picker open (#1852)

A press on one of the open gradient's handles or stops closed the picker: the canvas took the press
and began the drag, then the picker, drawn later in the same frame, saw a press outside its card and
closed, committing the drag's interaction at once. The handles vanished with the picker and the drag
went on without an undo step of its own. The handles are the picker's controls: while a gradient
handle or stop drags (`handles::gradient_dragging`, the press included) the picker doesn't close on
an outside press, as it already doesn't while the eyedropper samples. A press elsewhere on the
canvas still closes it. Docs: ui-parity.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* M1: a handle drag released off the canvas ends there (#1852)

Review: a gradient handle drag whose button went up over a panel, over the colour picker or outside
the window stayed stashed, its interaction uncommitted, until the pointer was back on the canvas,
and the next press there moved the handle to wherever it landed; with the picker now held open while
a gradient drag is stashed, it would also have stayed open meanwhile. `handles::end_released_drag`
commits and clears a stashed drag when the button is up, called from the canvas input's off-canvas
branch and when the pointer is over something drawn above the canvas. Test:
`a_gradient_drag_released_off_the_canvas_ends_there` (released over the sidebar and over the picker).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* M1: a handle drag ends on a release over a ruler, and when Escape or Undo closes its gesture (#1852)

The release check ran only where the pointer was not on the canvas, after the
comment pins and ruler guides had their turn; both return early, so a gradient
handle released over a ruler stayed dragged, uncommitted, until the next press.
It now runs first, wherever the pointer is, and the frame it ends a drag on is
the handle's, as the release on the handle itself was.

Escape (the picker closes and commits) or Undo can also close the gesture while
the button is still down. The stashed drag then kept setting the fill every
frame with no gesture open, one undo step a frame; with no gesture open the
drag is now over.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
---
 crates/ui-egui/src/canvas/handles.rs          |  32 ++++
 crates/ui-egui/src/canvas/input.rs            |   8 +
 .../src/colorpicker_selection_tests.rs        | 157 ++++++++++++++++++
 crates/ui-egui/src/widgets/colorpicker.rs     |   5 +-
 docs/ui-parity.md                             |   7 +-
 5 files changed, 205 insertions(+), 4 deletions(-)

diff --git a/crates/ui-egui/src/canvas/handles.rs b/crates/ui-egui/src/canvas/handles.rs
index 137e2c92b..949819b03 100644
--- a/crates/ui-egui/src/canvas/handles.rs
+++ b/crates/ui-egui/src/canvas/handles.rs
@@ -185,6 +185,33 @@ fn drag_id() -> Id {
     Id::unique("figcraft_handle_drag")
 }
 
+/// Whether a gradient handle or stop on the canvas is being dragged, the press that starts it
+/// included: those are the open colour picker's own controls, so the picker stays through the drag
+/// instead of taking the press for one outside it (#1852).
+pub fn gradient_dragging(ctx: &egui::Context) -> bool {
+    matches!(ctx.data(|d| d.get_temp::<Drag>(drag_id())), Some(Drag::Gradient { .. }))
+}
+
+/// Whether the document has a gesture open: a handle drag edits only inside its own.
+fn gesture_open(app: &FigApp) -> bool {
+    app.session.ds().is_ok_and(|d| d.interaction.is_some())
+}
+
+/// A handle drag whose button went up wherever the pointer was (off the canvas, over a panel, the
+/// colour picker or a ruler, outside the window) ends as a release on the handle would: the edit
+/// commits now, instead of waiting, uncommitted, to move the handle to wherever the pointer next
+/// presses. So does one whose gesture Escape or Undo closed under the held button: it stops there
+/// rather than editing on with no gesture open, an undo step a frame. True when a drag ended.
+pub fn end_released_drag(app: &mut FigApp, ctx: &egui::Context) -> bool {
+    let stashed = ctx.data(|d| d.get_temp::<Drag>(drag_id())).is_some();
+    if !stashed || (ctx.input(|i| i.pointer.primary_down()) && gesture_open(app)) {
+        return false;
+    }
+    let _ = app.session.commit_interaction();
+    ctx.data_mut(|d| d.remove::<Drag>(drag_id()));
+    true
+}
+
 /// The gradient being edited (single node, picker open on a gradient paint).
 fn gradient_target(app: &FigApp) -> Option<(NodeId, bool, usize, figcraft_color::Gradient)> {
     let Some(PickerTarget::Paint { fills, index, ids }) = &app.ui.picker else { return None };
@@ -516,6 +543,11 @@ pub fn input(app: &mut FigApp, ctx: &egui::Context, pos: Pos2) -> bool {
     });
     let dragging: Option<Drag> = ctx.data(|d| d.get_temp(drag_id()));
     if let Some(drag) = dragging {
+        // Escape or Undo closed the gesture under the held button: the drag is over.
+        if !gesture_open(app) {
+            ctx.data_mut(|d| d.remove::<Drag>(drag_id()));
+            return true;
+        }
         if down {
             apply(app, &drag, pos, shift);
             ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
diff --git a/crates/ui-egui/src/canvas/input.rs b/crates/ui-egui/src/canvas/input.rs
index 5aa054163..3ef5d7574 100644
--- a/crates/ui-egui/src/canvas/input.rs
+++ b/crates/ui-egui/src/canvas/input.rs
@@ -183,6 +183,8 @@ pub(super) fn input(app: &mut FigApp, ui: &mut Ui, resp: &egui::Response) -> boo
         if !ctx.input(|i| i.pointer.button_down(egui::PointerButton::Middle) || i.pointer.primary_down()) {
             app.canvas.middle_pan = None;
         }
+        // So is a handle drag.
+        crate::handles::end_released_drag(app, &ctx);
         return true;
     };
     // A press on the canvas gives the keyboard back to it (arrows nudge again).
@@ -230,6 +232,12 @@ pub(super) fn input(app: &mut FigApp, ui: &mut Ui, resp: &egui::Response) -> boo
         }
         return true;
     }
+    // A handle drag whose button went up ends first, wherever on the canvas the pointer is: over a
+    // ruler or a comment pin, which take the pointer below, or over something drawn above the
+    // canvas (the colour picker, a card). The handle had the press, so it has the release too.
+    if crate::handles::end_released_drag(app, &ctx) {
+        return false;
+    }
     if !app.canvas.dragging && (resp.hovered() || app.ui.comments.dragging()) && crate::comments::input(app, &ctx, pos) {
         return false;
     }
diff --git a/crates/ui-egui/src/colorpicker_selection_tests.rs b/crates/ui-egui/src/colorpicker_selection_tests.rs
index 1e0fe8d1d..e791e0ca9 100644
--- a/crates/ui-egui/src/colorpicker_selection_tests.rs
+++ b/crates/ui-egui/src/colorpicker_selection_tests.rs
@@ -215,3 +215,160 @@ fn a_press_in_the_gradient_variable_picker_keeps_the_colour_picker_open() {
     assert!(u.app.ui.picker.is_some(), "the child variable picker is part of the interaction");
     u.button(at, false);
 }
+
+#[test]
+fn dragging_a_gradient_handle_on_the_canvas_keeps_the_picker_open() {
+    // #1852: the handles belong to the picker, so the press that starts a drag is not a press
+    // outside it: the picker and the handles stay, the drag is one undo step, and a press elsewhere
+    // on the layer still closes it.
+    let mut s = Session::new();
+    let a = NodeId(s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 200, "height": 200})).unwrap()["id"].as_u64().unwrap());
+    s.execute("fill.set", &json!({"id": a, "paint": {"type": "linearGradient", "stops": ["#ff0000", "#0000ff"]}})).unwrap();
+    s.execute("select.set", &json!({"ids": [a]})).unwrap();
+    let mut u = Ui::new(s);
+    let target = PickerTarget::Paint { fills: true, index: 0, ids: vec![a] };
+    u.app.open_picker(target.clone(), None);
+    for _ in 0..5 {
+        u.frame(vec![]);
+    }
+    assert_eq!(u.app.ui.picker, Some(target.clone()));
+    let depth = u.app.session.undo_depth().0;
+    let from_handle = |u: &Ui| match &u.app.session.doc().unwrap().node(a).unwrap().fills[0].kind {
+        figcraft_color::PaintKind::Gradient(g) => g.from,
+        _ => panic!("the fill is a gradient"),
+    };
+    assert_eq!(from_handle(&u), (0.5, 0.0), "a linear gradient starts at the top middle");
+    // Drag the start handle from the top middle of the layer to its left middle.
+    let from = u.app.to_screen(200.0, 100.0);
+    let to = u.app.to_screen(100.0, 200.0);
+    u.button(from, true);
+    assert_eq!(u.app.ui.picker, Some(target.clone()), "the press on the handle keeps the picker open");
+    for _ in 0..2 {
+        u.frame(vec![egui::Event::PointerMoved(to)]);
+    }
+    assert_eq!(u.app.ui.picker, Some(target.clone()), "and so does the drag");
+    let (x, y) = from_handle(&u);
+    assert!(x.abs() < 0.02 && (y - 0.5).abs() < 0.02, "the handle followed the pointer: ({x}, {y})");
+    u.button(to, false);
+    u.frame(vec![]);
+    assert_eq!(u.app.ui.picker, Some(target.clone()), "released, the picker is still open");
+    assert_eq!(u.app.session.undo_depth().0, depth + 1, "the drag is one undo step");
+    // A press on the layer away from its handles is still a press outside the picker.
+    let body = u.app.to_screen(250.0, 250.0);
+    u.button(body, true);
+    u.button(body, false);
+    u.frame(vec![]);
+    assert!(u.app.ui.picker.is_none(), "a plain canvas press closes it");
+}
+
+#[test]
+fn a_gradient_drag_released_off_the_canvas_ends_there() {
+    // A handle drag whose button goes up over the sidebar or over the picker itself ends there:
+    // the edit commits, the picker stays, and the next press on the canvas is a plain press (it
+    // closes the picker) rather than a move of the handle to wherever it landed.
+    for over in ["sidebar", "picker"] {
+        let mut s = Session::new();
+        let a = NodeId(s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 200, "height": 200})).unwrap()["id"].as_u64().unwrap());
+        s.execute("fill.set", &json!({"id": a, "paint": {"type": "linearGradient", "stops": ["#ff0000", "#0000ff"]}})).unwrap();
+        s.execute("select.set", &json!({"ids": [a]})).unwrap();
+        let mut u = Ui::new(s);
+        let target = PickerTarget::Paint { fills: true, index: 0, ids: vec![a] };
+        u.app.open_picker(target.clone(), None);
+        for _ in 0..5 {
+            u.frame(vec![]);
+        }
+        let depth = u.app.session.undo_depth().0;
+        let from_handle = |u: &Ui| match &u.app.session.doc().unwrap().node(a).unwrap().fills[0].kind {
+            figcraft_color::PaintKind::Gradient(g) => g.from,
+            _ => panic!("the fill is a gradient"),
+        };
+        u.button(u.app.to_screen(200.0, 100.0), true);
+        u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0, 200.0))]);
+        assert!(crate::handles::gradient_dragging(&u.ctx), "{over}: the handle is being dragged");
+        let spot = match over {
+            "sidebar" => u.app.ui.right_panel_rect.unwrap().center(),
+            _ => u.app.ui.picker_popover.as_ref().unwrap().rect.center(),
+        };
+        if over == "picker" {
+            assert!(u.app.canvas.rect.contains(spot), "the picker lies over the canvas");
+        } else {
+            assert!(!u.app.canvas.rect.contains(spot), "the sidebar is off the canvas");
+        }
+        u.button(spot, false);
+        u.frame(vec![]);
+        assert!(!crate::handles::gradient_dragging(&u.ctx), "{over}: the release ended the drag");
+        assert_eq!(u.app.ui.picker, Some(target.clone()), "{over}: the picker is still open");
+        assert_eq!(u.app.session.undo_depth().0, depth + 1, "{over}: the drag is one undo step");
+        let moved = from_handle(&u);
+        assert!(moved.0.abs() < 0.02 && (moved.1 - 0.5).abs() < 0.02, "{over}: the handle stayed where it was dragged: {moved:?}");
+        // The next press on the layer is a plain one: the handle stays put and the picker closes.
+        let body = u.app.to_screen(250.0, 250.0);
+        u.button(body, true);
+        u.frame(vec![]);
+        assert_eq!(from_handle(&u), moved, "{over}: a later press doesn't move the handle");
+        assert!(u.app.ui.picker.is_none(), "{over}: a later press closes the picker as any outside press does");
+        u.button(body, false);
+    }
+}
+
+/// A rectangle with a linear gradient fill, selected, its picker open and the canvas settled; a
+/// second layer drawn after it leaves an undo step that isn't the gradient's. Rulers on or off.
+fn gradient_ui(rulers: bool) -> Ui {
+    let mut s = Session::new();
+    if rulers {
+        s.execute("view.rulers", &json!({"on": true})).unwrap();
+    }
+    let a = NodeId(s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 200, "height": 200})).unwrap()["id"].as_u64().unwrap());
+    s.execute("fill.set", &json!({"id": a, "paint": {"type": "linearGradient", "stops": ["#ff0000", "#0000ff"]}})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 400, "y": 100, "width": 20, "height": 20})).unwrap();
+    s.execute("select.set", &json!({"ids": [a]})).unwrap();
+    let mut u = Ui::new(s);
+    u.app.open_picker(PickerTarget::Paint { fills: true, index: 0, ids: vec![a] }, None);
+    for _ in 0..5 {
+        u.frame(vec![]);
+    }
+    u
+}
+
+#[test]
+fn a_gradient_drag_released_over_a_ruler_ends_there() {
+    // The rulers take the pointer on the canvas before the handles do: the release still ends the
+    // drag, as one undo step, instead of leaving it waiting for the next press.
+    let mut u = gradient_ui(true);
+    let depth = u.app.session.undo_depth().0;
+    u.button(u.app.to_screen(200.0, 100.0), true);
+    u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0, 200.0))]);
+    assert!(crate::handles::gradient_dragging(&u.ctx), "the handle is being dragged");
+    let r = u.app.canvas.rect;
+    let ruler = egui::Pos2::new(r.min.x + 5.0, r.center().y);
+    assert!(!u.app.ui.picker_popover.as_ref().unwrap().rect.contains(ruler), "the ruler is not under the picker");
+    u.button(ruler, false);
+    assert!(!crate::handles::gradient_dragging(&u.ctx), "the release over the ruler ended the drag");
+    assert_eq!(u.app.session.undo_depth().0, depth + 1, "the drag is one undo step");
+}
+
+#[test]
+fn a_gradient_drag_whose_gesture_closes_under_the_held_button_stops_editing() {
+    // Escape (the picker closes and commits) or Undo ends the gesture while the button is still
+    // down: moving on edits nothing more, rather than adding an undo step every frame.
+    for close in ["escape", "undo"] {
+        let mut u = gradient_ui(false);
+        u.button(u.app.to_screen(200.0, 100.0), true);
+        u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0, 200.0))]);
+        assert!(crate::handles::gradient_dragging(&u.ctx), "{close}: the handle is being dragged");
+        if close == "escape" {
+            crate::colorpicker::close(&mut u.app);
+        } else {
+            assert!(u.app.session.undo().unwrap(), "{close}: there is a step to undo");
+        }
+        let depth = u.app.session.undo_depth().0;
+        let doc = u.app.session.doc().unwrap().clone();
+        for k in 1..=4 {
+            u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0 + 20.0 * f64::from(k), 200.0))]);
+        }
+        assert!(!crate::handles::gradient_dragging(&u.ctx), "{close}: the drag is over");
+        assert_eq!(u.app.session.undo_depth().0, depth, "{close}: no undo step a frame");
+        assert!(*u.app.session.doc().unwrap() == doc, "{close}: the gradient stays where the gesture left it");
+        u.button(u.app.to_screen(180.0, 200.0), false);
+    }
+}
diff --git a/crates/ui-egui/src/widgets/colorpicker.rs b/crates/ui-egui/src/widgets/colorpicker.rs
index 5fbcc7b40..6ba6af305 100644
--- a/crates/ui-egui/src/widgets/colorpicker.rs
+++ b/crates/ui-egui/src/widgets/colorpicker.rs
@@ -977,7 +977,10 @@ pub fn show(app: &mut FigApp, ctx: &egui::Context) {
     // Sampling a colour from the canvas — the eyedropper this picker's own button started, or the
     // colour it just sampled — is the press, not a press outside: neither may close the picker.
     let picking = app.session.tool.pick_only || app.session.tool.picked.is_some();
-    pop = pop.close_on_outside(!picking);
+    // Nor may a press on the open gradient's handles or stops on the canvas: they are this picker's
+    // controls, and the canvas took the press before the picker drew (#1852).
+    let own = picking || crate::handles::gradient_dragging(ctx);
+    pop = pop.close_on_outside(!own);
     // Only the opening control is held out: any other sidebar or canvas press dismisses it.
     let mut held: Vec<Rect> = app.ui.picker_button.into_iter().collect();
     held.extend(crate::variable_ui::picker_rect(ctx));
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index cc0fc9db8..d98a6ed73 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI and interaction parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testing on the result, group drags, frame outlines and slices; outlines for the selection, mask outlines; arc fields, live boolean editing, shape builder on strokes, one-sided widths; fields select their text on focus; Typography spacing icons support scrubbing (#373); CSS colour names in hex fields; a rename selects the whole name, so typing replaces it; Escape or Enter after a pen path stays on the same vector (#760); IME composition kept on through idle frames of a text edit, candidates at the caret (#747); Selection colors for mixed selections and smart-selection spacing (#753); submenus with a hover delay and a safe triangle; the Actions palette's tabs, ranked search, highlight and recents; menu items that ask for a value; editor fixes from the community batches) · **Target:** Figma Design UI3 (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** patch (a press on the open gradient's handles or stops on the canvas keeps the colour picker open through the drag, as its own control (#1852); a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testing on the result, group drags, frame outlines and slices; outlines for the selection, mask outlines; arc fields, live boolean editing, shape builder on strokes, one-sided widths; fields select their text on focus; Typography spacing icons support scrubbing (#373); CSS colour names in hex fields; a rename selects the whole name, so typing replaces it; Escape or Enter after a pen path stays on the same vector (#760); IME composition kept on through idle frames of a text edit, candidates at the caret (#747); Selection colors for mixed selections and smart-selection spacing (#753); submenus with a hover delay and a safe triangle; the Actions palette's tabs, ranked search, highlight and recents; menu items that ask for a value; editor fixes from the community batches) · **Target:** Figma Design UI3 (desktop app 126.10.7)
 
 Fine canvas control is what Figma users feel first: handles, snapping, nudging, modifier keys,
 drag behaviour, numeric precision. This checklist covers the tools, gestures and panels. Status:
@@ -30,7 +30,7 @@ interaction feel not yet compared.
 | Colour names in hex fields | done | every hex field (fills, strokes, text ranges, effects, layout grids, colour variables, page and prototype backgrounds, the colour picker's Hex) takes a CSS colour name as well: `red` becomes `FF0000`; case, spaces and hyphens are ignored (`Light Blue`); names are opaque and keep the colour's opacity; hex wins where both could match. The picker's CSS field takes every CSS name too (`Color::from_hex_or_name`, `color::named`) |
 | Fields select their text on focus | done | Number and text values keep their vertical position when their editor gains focus (including typography spacing; `sidebar_field_text_stays_in_place_on_focus`). a click or Tab into a one-line field selects all of its text, so typing replaces the value: hex and colour fields, number fields, inline fields (a fill's hex, variable values, renames), names, search boxes and dialog fields; a drag from the press selects only what it covers; multi-line fields (descriptions, comments) keep the caret where clicked. The first click into an inline field (a fill's hex) now takes the keyboard; it took a second click. A rename (double-click, F2, File ▸ Rename, a page) selects the whole name before its field first draws, so a key typed in that same frame replaces the name; it was appended (`widgets::select_all_on_focus`, `select_all_tests`, `layers_rename_tests`) |
 | Colour picker models | done | Hex, RGB, HSL, HSB, LCH, OKLCH and CSS; LCH and OKLCH keep lightness and hue when a colour leaves sRGB (chroma comes down); the values typed stay while the colour is theirs (a hue typed on a grey, a chroma sRGB can't hold); CSS reads `lch()` and `oklch()` with any hue unit and `none` (`figcraft_color::{Lch, Oklch}`). Values are the stored channels read as sRGB |
-| Colour picker placement and dismissal | done | Opens 8 pt beside the sidebar at the opening control, lifted to fit the screen; outside presses (including the sidebar), Escape and X close it. Reopening resets a dragged position; eyedropper sampling keeps it open. |
+| Colour picker placement and dismissal | done | Opens 8 pt beside the sidebar at the opening control, lifted to fit the screen; outside presses (including the sidebar), Escape and X close it. Reopening resets a dragged position; eyedropper sampling keeps it open, and so does a drag of the open gradient's handles or stops on the canvas (#1852). |
 | Colour picker image well | partial | the Image tab shows a checkered placeholder and Upload from computer until there is a file (no dialog at once); an image paint shows its asset preview; a file dropped on the open picker replaces the image, keeping the fill mode, crop, position and adjustments (`image.replace`). Layers' fills and strokes only (text ranges, styles and selection colours keep Upload). The Fill and Stroke swatches take no drop: a dragged file's position isn't known, so a drop with none goes to the open picker |
 | Colour picker on a new fill or stroke | done | + opens the picker on the new paint when the selection shares one paint list; on a mixed selection + adds a paint to each layer and no picker opens (#404) |
 | Blend mode menus: the layer's (Design panel) and each paint's (colour picker) | done | Pass through and Normal are distinct (Normal isolates a group's or frame's children); paints have no pass-through; plus darker drawn exactly on the canvas |
@@ -113,7 +113,7 @@ interaction feel not yet compared.
 | Masks: what a mask hides doesn't take clicks; a mask group's box is the mask's | done | |
 | Layout grids (Ctrl+G) | done | columns, rows and grid; stretch, left, centre, right; Auto count; several per frame; styles; not shown or snapped on a rotated frame; a nested frame's grids snap but only top-level frames draw them |
 | Gamut warnings for Display P3 files | done | colour picker note; View ▸ Soft-proof sRGB stripes what sRGB can't show (the canvas itself is sRGB) |
-| Gradient and padding/gap handles on the canvas | done | |
+| Gradient and padding/gap handles on the canvas | done | the gradient's handles and stops show while its picker is open, and dragging one keeps the picker open (#1852) |
 | Hover outline, selection colours, handle sizes | done | measured from UI3 screenshots; the outline follows the layer's geometry, rounded corners (each radius and the smoothing) included, whatever the stroke alignment (#1506) |
 | Cursors per tool and modifier | done | the engine names a cursor for every tool, modifier and hover target (`tool.overlay.cursor`, tabled in `cursor_tests`) and the UI shows the system's or draws its own at the pointer (`cursors.rs`, `cursors_tests`; original glyphs from lines and the code-drawn icons). Arrow for Move and Scale; two-headed arrows on the handles that follow the handle and the box's rotation; outside a corner a curved rotate arrow turned to that corner, turning with the pointer while rotating; crosshair for the frame, section, slice, shape, pencil and Text tools; the I-beam over a text with the Text tool and over the text being edited; the pen as a cross with what a click does beside it (nothing: a new point; a ring: closes, connects to or goes on from a point; a plus: adds a point on a segment, also Alt in vector edit mode; a curve: bends, the Bend tool or Cmd/Ctrl); open and closed hand for the Hand tool, Space and the middle button; zoom in and out (Alt) while Z is held; eyedropper; comment pin; the copy cursor with Alt over a selected layer and while Alt-dragging; not-allowed while a drag resizes, rotates or moves a layer inside an instance (it is undone on release) and over a layers row that takes no drop. Ruler guides and gradient, crop and padding handles keep their own cursors (the tool's used to replace them). `ui.inspect` reports `cursor`. Left: no cursor for removing a point with the pen (the pen doesn't remove points); the drawn cursors follow the pointer a frame behind the system's; not compared with Figma's side by side |
 | Multiplayer cursors, cursor chat, spotlight | partial | in live sessions: named cursors, chat bubbles that fade, `/` to chat, spotlight from your avatar's menu with a banner; no audio or reactions |
@@ -178,6 +178,7 @@ in the table. `crates/ui-egui/src/shortcut_keys_tests.rs` drives the keys a look
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-04 | patch | M1, #1852: a press on one of the open gradient's handles or stops on the canvas is the colour picker's own, not a press outside it (Figma keeps the picker and the handles up while a handle or stop is dragged; the stops are made to be dragged: "You can click and drag a stop to change its placement on the gradient", Use gradients as a fill or stroke). The canvas took the press and began the drag, then the picker, drawn later in the same frame, saw a press outside its card and closed, committing the drag's interaction at once; the handles vanished with it and the drag went on without an undo step of its own. Now the picker stays while a gradient handle or stop drags, and the drag is one undo step; a press elsewhere on the canvas still closes it. A handle drag whose button goes up off the canvas (over a panel or the picker) ends there too, instead of waiting, uncommitted, to move the handle to the next press on the canvas. Tests: `colorpicker_selection_tests::dragging_a_gradient_handle_on_the_canvas_keeps_the_picker_open`, `colorpicker_selection_tests::a_gradient_drag_released_off_the_canvas_ends_there`. |
 | 2026-11-02 | patch | M8, #1875: a click with the Bend tool on a sharp point between two segments gives it handles along the line between its neighbours, a third of the way to each ("Click on a point or path where you want to add a curve", Edit vector layers); a click on a curved point still makes it sharp, a drag still sets the handles by hand, an endpoint is left alone. Between a handle's end and a point both within reach of the pointer, the nearer one on the page is hit (the handle on a tie), so a short path's point (its handles a few pixels long) can be clicked again. Before, only a drag curved a point, and a short one left two tiny handles in its direction. Tests: `vectoredit::tests::short_handles_leave_their_point_clickable`, `vectoredit::tests::a_bend_click_curves_a_sharp_point_between_its_neighbours`, `bend_tool_smooths_and_sharpens_points`. Numbers unchanged. |
 | 2026-11-02 | minor | M4, #1827: wrap style on a text layer (`WrapStyle`: Auto, Balance, Pretty): Balance re-breaks each paragraph at the narrowest width that keeps its line count (bisection over the greedy breaker, as browsers balance), Pretty narrows one of the last four lines just enough so the last line isn't one word; `text.wrapStyle`, `node.set wrapStyle` (`textWrap` too), inspect `wrapStyle`, Dev Mode CSS `text-wrap` (Tailwind `text-balance` / `text-pretty`), the Type settings control under Vertical trim. Per-paragraph settings, text-style support and the `.fig` import/export mapping stay open. Test: `text_behaviour_tests::balance_and_pretty_wrap_styles_break_lines_as_documented`. |
 | 2026-11-02 | patch | M4: Backspace or Delete at the start of a list item takes its marker and keeps its level ("Use Backspace or Delete at the beginning of a list item to delete the counter, but keep the same level of indentation", Create bulleted and numbered lists): a plain paragraph may now carry a list level, and the text layout starts it where that level's item text starts (the gutters stay even when no list is left). Backspace used to drop the level too, and Delete at an item's start deleted the next character. Tab on such a paragraph types a tab, as outside a list. Tests: `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests::a_plain_paragraph_at_a_list_level_starts_where_the_items_text_does` |

From 8da11395e9ed6eea36caff3ff902a6e8bb86e7dc Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <72558888+aleksei-suholita@users.noreply.github.com>
Date: Thu, 5 Nov 2026 22:08:15 +0100
Subject: [PATCH 52/70] =?UTF-8?q?M3:=20glass=20effects=20take=20variables,?=
 =?UTF-8?q?=20and=20their=20frost=20stays=20within=200=E2=80=93100=20(#188?=
 =?UTF-8?q?6)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M3: glass effects take variables, and their frost stays within 0–100 (#1885)

Glass's light angle, intensity, refraction, depth, dispersion, frost and
splay bind to number variables, on a layer (`variable.bind`,
`effects/<i>/<field>`, `radius` being the frost) and in an effect style
(`style.bind`), and the Design panel's glass fields take a variable like
the shadow and blur fields. A variable reads as the field shows it:
intensity, refraction, dispersion and splay in percent.

A glass's frost stays within 0–100, the reference tool's range: a larger
frost from an older file draws at 100, and the field, a bound variable and
scaling stop there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: a frost from an older file scales and shows as it draws (#1885)

Review follow-up: a frost saved past 100 draws at 100, so scaling a layer
starts from that (150 halved draws at 50, not 75) and the Design panel's
Frost field shows it. The revision row's binding path escapes its pipes, so
the table keeps three columns.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: Dev Mode and .fig export show a frost from an older file as it draws (#1885)

A frost saved before the 0–100 range draws at 100, and the canvas, CSS and
scaling already read it that way, but Dev Mode's Glass row and the .fig
export still read the stored number, so they said 150 where the canvas
shows 100. Both now read the sanitized frost.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
---
 ROADMAP.md                                 |  3 +-
 crates/doc/src/effects_tests.rs            | 41 ++++++++++++++++++++++
 crates/doc/src/props.rs                    | 32 +++++++++++++++--
 crates/engine/src/assets/style_vars.rs     |  1 +
 crates/engine/src/binding_lists_tests.rs   | 35 ++++++++++++++++++
 crates/engine/src/cmd/arrange.rs           |  3 +-
 crates/engine/src/cmd/styles.rs            |  7 ++--
 crates/engine/src/dev/devinspect.rs        |  2 +-
 crates/engine/src/effects_tests.rs         | 26 ++++++++++++++
 crates/format/src/fig/export/paint.rs      |  2 +-
 crates/format/src/fig/export_tests.rs      | 19 ++++++++++
 crates/ui-egui/src/field_tests.rs          |  4 +--
 crates/ui-egui/src/panels/right/effects.rs | 36 +++++++++++++------
 docs/components-parity.md                  |  5 +--
 14 files changed, 194 insertions(+), 22 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index c2aa86c22..abc435b80 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** minor (web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -358,6 +358,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass effects take variables (light angle, intensity, refraction, depth, dispersion, frost and splay, on layers and in effect styles, and from the Design panel's glass fields), and a glass's frost stays within 0–100, the reference tool's range: a larger frost from an older file draws at 100, and the field, a bound variable and scaling stop there. Numbers unchanged |
 | 2026-10-31 | minor | M12: as the help describes, holding Cmd/Ctrl while moving a connector's end places it on any part of an object instead of snapping to a side. It keeps that spot as a fraction of the object's box, so it follows the object when it moves or resizes, and without the key an end snaps as before. `board.connector {fromAt, toAt}` and `board.reattach {at}` take it; saved only when set. Numbers unchanged |
 | 2026-10-31 | patch | M11: a trackpad or touch tap sends its press and release in one frame, so a plugin panel's field committed in the frame its button was clicked and the value was lost: the Counter's Set count… kept the old count. The plugin now gets both, the field's value first. The `window.figcraft` docs name `screenshot`'s `data`. Numbers unchanged |
 | 2026-10-31 | patch | M4: Dash and Custom strokes have a Dash cap (None, Round, Square) in the advanced stroke settings and `node.set {dashCap}`, on both ends of every dash on the canvas and in PNG, PDF and SVG. Unset, dashes keep taking the end point caps, so older files look the same; the saved file writes it only when set. Numbers unchanged |
diff --git a/crates/doc/src/effects_tests.rs b/crates/doc/src/effects_tests.rs
index 0ef39c851..f1676f2dd 100644
--- a/crates/doc/src/effects_tests.rs
+++ b/crates/doc/src/effects_tests.rs
@@ -49,6 +49,47 @@ fn glass_values_are_clamped_and_reach_their_backdrop() {
     assert_eq!(hidden.backdrop_radius(), 0.0);
 }
 
+#[test]
+fn glass_frost_stays_within_the_reference_range() {
+    // A file from before the 0–100 range draws its frost at 100, and reaches no further.
+    let g = Glass { frost: 150.0, ..Glass::default() };
+    assert_eq!(g.sanitized().frost, Glass::MAX_FROST);
+    let e = Effect { kind: EffectKind::Glass(g), visible: true };
+    let capped = Effect { kind: EffectKind::Glass(Glass { frost: Glass::MAX_FROST, ..Glass::default() }), visible: true };
+    assert_eq!(e.backdrop_radius(), capped.backdrop_radius());
+}
+
+#[test]
+fn glass_fields_take_bound_numbers_as_the_panel_shows_them() {
+    let mut g = Glass::default();
+    for (field, x) in [
+        ("lightAngle", 30.0),
+        ("lightIntensity", 25.0),
+        ("refraction", 40.0),
+        ("depth", 12.0),
+        ("dispersion", 10.0),
+        ("radius", 8.0),
+        ("splay", 50.0),
+    ] {
+        assert!(g.set_bound(field, x), "{field}");
+    }
+    assert_eq!((g.light_angle, g.light_intensity, g.refraction, g.depth, g.dispersion, g.frost, g.splay), (30.0, 0.25, 0.4, 12.0, 0.1, 8.0, 0.5));
+    // Out of range: clamped to the field's range.
+    for (field, x) in [("lightAngle", 270.0), ("lightIntensity", 250.0), ("depth", 0.0), ("radius", 150.0), ("splay", -5.0)] {
+        assert!(g.set_bound(field, x), "{field}");
+    }
+    assert_eq!((g.light_angle, g.light_intensity, g.depth, g.frost, g.splay), (180.0, 1.0, 1.0, Glass::MAX_FROST, 0.0));
+    // A field glass doesn't have, or a value that isn't a number, changes nothing.
+    let before = g.clone();
+    assert!(!g.set_bound("spread", 3.0));
+    assert!(!g.set_bound("splay", f64::NAN));
+    assert!(!g.set_bound("depth", f64::INFINITY));
+    assert_eq!(g, before);
+    for field in Glass::BOUND_FIELDS {
+        assert!(Glass::default().set_bound(field, 1.0), "{field}");
+    }
+}
+
 #[test]
 fn effect_colours() {
     let mut e = Effect::noise();
diff --git a/crates/doc/src/props.rs b/crates/doc/src/props.rs
index 0c78681f2..242ce3d11 100644
--- a/crates/doc/src/props.rs
+++ b/crates/doc/src/props.rs
@@ -660,7 +660,7 @@ pub struct Glass {
     pub depth: f64,
     /// Colour splitting along the curved edge (0–1).
     pub dispersion: f64,
-    /// Blur of the backdrop (a blur radius, document units).
+    /// Blur of the backdrop (a blur radius, document units, 0–[`Self::MAX_FROST`]).
     pub frost: f64,
     /// How widely the light spreads over the glass (0–1).
     pub splay: f64,
@@ -673,6 +673,34 @@ impl Default for Glass {
 }
 
 impl Glass {
+    /// The most frost a glass takes, as the reference tool's Frost field (0–100).
+    pub const MAX_FROST: f64 = 100.0;
+
+    /// The fields a variable binds on a glass effect (`effects/<i>/<field>`), see [`Self::set_bound`].
+    pub const BOUND_FIELDS: [&'static str; 7] = ["lightAngle", "lightIntensity", "refraction", "depth", "dispersion", "radius", "splay"];
+
+    /// Sets `field` (one of [`Self::BOUND_FIELDS`]) from a bound number variable, read as the
+    /// Design panel's field shows it: intensity, refraction, dispersion and splay in percent, the
+    /// frost as `radius`, each clamped to the field's range. False for a field glass doesn't have
+    /// or a value that isn't finite (nothing changes).
+    pub fn set_bound(&mut self, field: &str, x: f64) -> bool {
+        if !x.is_finite() {
+            return false;
+        }
+        let pct = (x / 100.0).clamp(0.0, 1.0);
+        match field {
+            "lightAngle" => self.light_angle = x.clamp(-180.0, 180.0),
+            "lightIntensity" => self.light_intensity = pct,
+            "refraction" => self.refraction = pct,
+            "depth" => self.depth = x.clamp(1.0, 1000.0),
+            "dispersion" => self.dispersion = pct,
+            "radius" => self.frost = x.clamp(0.0, Self::MAX_FROST),
+            "splay" => self.splay = pct,
+            _ => return false,
+        }
+        true
+    }
+
     /// The values clamped to their ranges (non-finite ones at their defaults).
     pub fn sanitized(&self) -> Glass {
         let d = Glass::default();
@@ -683,7 +711,7 @@ impl Glass {
             refraction: ok(self.refraction, d.refraction, 0.0, 1.0),
             depth: ok(self.depth, d.depth, 1.0, 1000.0),
             dispersion: ok(self.dispersion, d.dispersion, 0.0, 1.0),
-            frost: ok(self.frost, d.frost, 0.0, 1000.0),
+            frost: ok(self.frost, d.frost, 0.0, Self::MAX_FROST),
             splay: ok(self.splay, d.splay, 0.0, 1.0),
         }
     }
diff --git a/crates/engine/src/assets/style_vars.rs b/crates/engine/src/assets/style_vars.rs
index 7fb30fd06..1fea32bf4 100644
--- a/crates/engine/src/assets/style_vars.rs
+++ b/crates/engine/src/assets/style_vars.rs
@@ -33,6 +33,7 @@ pub fn field_type(kind: &StyleKind, key: &str) -> Option<VariableType> {
             (EffectKind::DropShadow(_) | EffectKind::InnerShadow(_), "color") => Some(Color),
             (EffectKind::DropShadow(_) | EffectKind::InnerShadow(_), "radius" | "spread" | "offsetX" | "offsetY") => Some(Number),
             (EffectKind::LayerBlur(_) | EffectKind::BackgroundBlur(_), "radius" | "startRadius") => Some(Number),
+            (EffectKind::Glass(_), f) if figcraft_doc::Glass::BOUND_FIELDS.contains(&f) => Some(Number),
             _ => None,
         },
         (StyleKind::Grid { grids }, Some((BoundList::Grids, i, "size" | "count" | "gutter" | "offset"))) => grids.get(i).map(|_| Number),
diff --git a/crates/engine/src/binding_lists_tests.rs b/crates/engine/src/binding_lists_tests.rs
index 8b221efdd..cddd6bbcb 100644
--- a/crates/engine/src/binding_lists_tests.rs
+++ b/crates/engine/src/binding_lists_tests.rs
@@ -98,6 +98,41 @@ fn effect_moves_and_removals_reject_junk() {
     assert_eq!(s.doc().unwrap().node(r).unwrap().effects.len(), 1);
 }
 
+fn glass(s: &Session, r: NodeId) -> figcraft_doc::Glass {
+    match s.doc().unwrap().node(r).unwrap().effects.first().map(|e| &e.kind) {
+        Some(EffectKind::Glass(g)) => g.clone(),
+        k => panic!("{k:?}"),
+    }
+}
+
+#[test]
+fn glass_fields_take_number_variables() {
+    let (mut s, r) = setup();
+    ex(&mut s, "effect.add", json!({"ids": [r], "type": "glass"}));
+    // Percent fields read the variable as the Design panel shows them; `radius` is the frost.
+    ex(&mut s, "variable.bind", json!({"ids": [r], "field": "effects/0/splay", "variable": "large"}));
+    ex(&mut s, "variable.bind", json!({"ids": [r], "field": "effects/0/radius", "variable": "small"}));
+    ex(&mut s, "variable.bind", json!({"ids": [r], "field": "effects/0/depth", "variable": "large"}));
+    let g = glass(&s, r);
+    assert_eq!((g.splay, g.frost, g.depth), (0.3, 2.0, 30.0));
+    // A new value follows, clamped to the field's range (frost stops at 100).
+    ex(&mut s, "variable.set", json!({"variable": "small", "value": 150}));
+    ex(&mut s, "variable.set", json!({"variable": "large", "value": 75}));
+    let g = glass(&s, r);
+    assert_eq!((g.splay, g.frost, g.depth), (0.75, figcraft_doc::Glass::MAX_FROST, 75.0));
+    // A colour variable doesn't fit a glass field.
+    assert!(s.execute("variable.bind", &json!({"ids": [r], "field": "effects/0/refraction", "variable": "brand"})).is_err());
+    // An effect style binds them too, and every layer using it follows.
+    let fx = ex_value(&mut s, "style.create", json!({"type": "effect", "name": "Pane", "from": r}))["id"].as_str().unwrap().to_string();
+    ex(&mut s, "style.bind", json!({"style": fx, "field": "effects/0/refraction", "variable": "large"}));
+    assert_eq!(glass(&s, r).refraction, 0.75);
+    assert!(s.execute("style.bind", &json!({"style": fx, "field": "effects/0/spread", "variable": "large"})).is_err(), "glass has no spread");
+}
+
+fn ex_value(s: &mut Session, cmd: &str, p: serde_json::Value) -> serde_json::Value {
+    s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
+}
+
 fn fill_hex(s: &Session, r: NodeId) -> Vec<String> {
     s.doc().unwrap().node(r).unwrap().fills.iter().filter_map(|p| p.solid_color()).map(|c| c.to_hex()).collect()
 }
diff --git a/crates/engine/src/cmd/arrange.rs b/crates/engine/src/cmd/arrange.rs
index b90cf1d1f..88146ea95 100644
--- a/crates/engine/src/cmd/arrange.rs
+++ b/crates/engine/src/cmd/arrange.rs
@@ -465,7 +465,8 @@ pub fn scale_node(doc: &mut Document, id: NodeId, k: f64) -> Result<()> {
                 }
                 EffectKind::Glass(g) => {
                     g.depth *= k;
-                    g.frost *= k;
+                    // From the frost it draws with (an older file's past 100 draws at 100).
+                    g.frost = (g.sanitized().frost * k).min(figcraft_doc::Glass::MAX_FROST);
                 }
             }
         }
diff --git a/crates/engine/src/cmd/styles.rs b/crates/engine/src/cmd/styles.rs
index 99d4521e4..0bd43e388 100644
--- a/crates/engine/src/cmd/styles.rs
+++ b/crates/engine/src/cmd/styles.rs
@@ -53,7 +53,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "style.bind",
             "Bind variable in style",
-            "{style, field, variable? (id or name; none: unbind)}  bind a variable to a field of the style's value: a paint style's `fills/<i>/color` (or `fill`: its first paint) and `fills/<i>/stops/<j>/color`, an effect style's `effects/<i>/<color|radius|spread|offsetX|offsetY|startRadius>`, a grid style's `layoutGrids/<i>/<size|count|gutter|offset>`, a text style's `fontSize|lineHeight|letterSpacing` (numbers, px) and `fontFamily|fontStyle` (strings). Every layer using the style shows the field resolved in its own modes; the style keeps it resolved in the default modes",
+            "{style, field, variable? (id or name; none: unbind)}  bind a variable to a field of the style's value: a paint style's `fills/<i>/color` (or `fill`: its first paint) and `fills/<i>/stops/<j>/color`, an effect style's `effects/<i>/<color|radius|spread|offsetX|offsetY|startRadius>` (glass: `lightAngle|lightIntensity|refraction|depth|dispersion|radius|splay`), a grid style's `layoutGrids/<i>/<size|count|gutter|offset>`, a text style's `fontSize|lineHeight|letterSpacing` (numbers, px) and `fontFamily|fontStyle` (strings). Every layer using the style shows the field resolved in its own modes; the style keeps it resolved in the default modes",
             true,
             bind_style
         ),
@@ -196,7 +196,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "variable.bind",
             "Bind variable",
-            "{ids?, field (fill|stroke (first paint)|fills/<i>/color|strokes/<i>/color|fills/<i>/stops/<j>/color (gradient stops)|effects/<i>/<offsetX|offsetY|radius|startRadius|spread|color>|layoutGrids/<i>/<size|count|gutter|offset>|componentProperties/<name> (instances: boolean/text properties; variant properties take string variables naming a value)|width|height|opacity (percent)|cornerRadius|gap|paddingHorizontal|characters|visible|fontSize…; list indices bottom first), variable (null unbinds)}",
+            "{ids?, field (fill|stroke (first paint)|fills/<i>/color|strokes/<i>/color|fills/<i>/stops/<j>/color (gradient stops)|effects/<i>/<offsetX|offsetY|radius|startRadius|spread|color|lightAngle|lightIntensity|refraction|depth|dispersion|splay> (glass: `radius` is its frost; intensity, refraction, dispersion and splay in percent)|layoutGrids/<i>/<size|count|gutter|offset>|componentProperties/<name> (instances: boolean/text properties; variant properties take string variables naming a value)|width|height|opacity (percent)|cornerRadius|gap|paddingHorizontal|characters|visible|fontSize…; list indices bottom first), variable (null unbinds)}",
             true,
             bind
         ),
@@ -1304,6 +1304,9 @@ pub(crate) fn set_effect_field(effects: &mut [Effect], i: usize, prop: &str, val
         (EffectKind::DropShadow(s) | EffectKind::InnerShadow(s), "color", _, VariableValue::Color(c)) => s.color = *c,
         (EffectKind::LayerBlur(b) | EffectKind::BackgroundBlur(b), "radius", Some(x), _) => b.radius = x.max(0.0),
         (EffectKind::LayerBlur(b) | EffectKind::BackgroundBlur(b), "startRadius", Some(x), _) => b.start_radius = x.max(0.0),
+        (EffectKind::Glass(g), field, Some(x), _) => {
+            g.set_bound(field, x);
+        }
         _ => {}
     }
 }
diff --git a/crates/engine/src/dev/devinspect.rs b/crates/engine/src/dev/devinspect.rs
index e646e53f4..3daf7d1b0 100644
--- a/crates/engine/src/dev/devinspect.rs
+++ b/crates/engine/src/dev/devinspect.rs
@@ -475,7 +475,7 @@ pub fn properties_with(doc: &Document, id: NodeId, fmt: ColorFormat) -> Vec<Sect
                     pct(g.refraction),
                     num(g.depth),
                     pct(g.dispersion),
-                    num(g.frost),
+                    num(g.sanitized().frost),
                     pct(g.splay)
                 ),
             ),
diff --git a/crates/engine/src/effects_tests.rs b/crates/engine/src/effects_tests.rs
index 607b77114..a011b7a32 100644
--- a/crates/engine/src/effects_tests.rs
+++ b/crates/engine/src/effects_tests.rs
@@ -95,6 +95,32 @@ fn scaling_scales_grain_and_glass() {
     assert_eq!((g.refraction, nz.density), (d.refraction, 0.5));
 }
 
+#[test]
+fn scaling_a_frost_from_an_older_file_starts_from_what_it_draws() {
+    // A frost of 150, saved before the 0–100 range, draws at 100: halved, it draws at 50.
+    let mut s = Session::new();
+    let r = rect(&mut s);
+    s.execute("effect.add", &json!({"ids": [r], "type": "glass"})).unwrap();
+    s.execute("effect.set", &json!({"ids": [r], "index": 0, "effect": {"type": "glass", "frost": 150}})).unwrap();
+    s.execute("transform.scale", &json!({"ids": [r], "factor": 0.5})).unwrap();
+    let EffectKind::Glass(g) = &s.doc().unwrap().node(r).unwrap().effects[0].kind else { panic!() };
+    assert_eq!(g.frost, 50.0);
+}
+
+#[test]
+fn inspect_shows_a_frost_from_an_older_file_as_it_draws() {
+    // A frost of 150, saved before the 0–100 range, draws at 100: Dev Mode says 100 as CSS does.
+    let mut s = Session::new();
+    let r = rect(&mut s);
+    s.execute("effect.add", &json!({"ids": [r], "type": "glass"})).unwrap();
+    s.execute("effect.set", &json!({"ids": [r], "index": 0, "effect": {"type": "glass", "frost": 150}})).unwrap();
+    let doc = s.doc().unwrap();
+    let sections = crate::devinspect::properties(doc, r);
+    let glass = &sections.iter().find(|s| s.title == "Effects").unwrap().rows[0];
+    assert!(glass.value.contains(" frost 100 "), "{}", glass.value);
+    assert!(code_for(doc, r, CodeLang::Css).contains("backdrop-filter: blur(50px);"));
+}
+
 #[test]
 fn inspect_and_css_show_the_new_effects() {
     let mut s = Session::new();
diff --git a/crates/format/src/fig/export/paint.rs b/crates/format/src/fig/export/paint.rs
index 26718e44f..2bb62ae2f 100644
--- a/crates/format/src/fig/export/paint.rs
+++ b/crates/format/src/fig/export/paint.rs
@@ -234,7 +234,7 @@ impl<'d> Exporter<'d> {
             }
             EffectKind::Glass(g) => {
                 self.warn("glass effects keep only their frost");
-                f.extend([("type", e("GLASS")), ("radius", fl(g.frost))]);
+                f.extend([("type", e("GLASS")), ("radius", fl(g.sanitized().frost))]);
             }
         }
         o(f)
diff --git a/crates/format/src/fig/export_tests.rs b/crates/format/src/fig/export_tests.rs
index f3d7ac06f..79671a39c 100644
--- a/crates/format/src/fig/export_tests.rs
+++ b/crates/format/src/fig/export_tests.rs
@@ -1243,6 +1243,25 @@ fn local_samples_round_trip() {
     }
 }
 
+#[test]
+fn a_glass_frost_is_written_as_it_draws() {
+    // A frost saved before the 0–100 range (or not a number) is written at what it draws: 100, or
+    // the default.
+    for (frost, written) in [(12.0, 12.0), (500.0, Glass::MAX_FROST), (f64::NAN, Glass::default().frost)] {
+        let mut doc = Document::new("glass");
+        let page = doc.first_page().unwrap();
+        let r = doc.create(page, NodeKind::Rectangle, "Pane", 0.0, 0.0, 24.0, 24.0).unwrap();
+        doc.get_mut(r).unwrap().effects = vec![Effect { kind: EffectKind::Glass(Glass { frost, ..Glass::default() }), visible: true }];
+        let (bytes, _) = export(&doc, None).unwrap();
+        let archive = Archive::open(&bytes).unwrap();
+        let (schema, message) = decode_canvas(&archive.canvas).unwrap();
+        let msg = schema.decode_message(schema.find("Message").unwrap(), &message).unwrap();
+        let pane = msg.get("nodeChanges").unwrap().list().iter().find(|nc| nc.get("name").and_then(Kv::str) == Some("Pane")).unwrap();
+        let radius = pane.get("effects").unwrap().list()[0].get("radius").and_then(Kv::f64).unwrap();
+        assert_eq!(radius, written, "frost {frost}");
+    }
+}
+
 #[test]
 fn a_vector_drawable_export_setting_is_written_as_svg_with_a_warning() {
     let mut doc = Document::new("vd");
diff --git a/crates/ui-egui/src/field_tests.rs b/crates/ui-egui/src/field_tests.rs
index 566f0828b..49b8a94b7 100644
--- a/crates/ui-egui/src/field_tests.rs
+++ b/crates/ui-egui/src/field_tests.rs
@@ -667,11 +667,11 @@ fn the_glass_light_intensity_field_has_a_label() {
     u.ctx.data_mut(|d| d.insert_temp(Id::unique(("fx_open", 0usize)), true));
     u.frame(vec![]);
     let shapes = u.frame_output(vec![]).shapes;
-    let lead = u.ctx.read_response(Id::unique(("fx_gi", 0usize)).with("lead")).expect("the intensity field is shown").rect;
+    let lead = u.ctx.read_response(Id::unique(("fx", "lightIntensity", 0usize)).with("lead")).expect("the intensity field is shown").rect;
     let labels: Vec<(String, bool)> =
         painted_texts(&shapes).into_iter().filter(|(_, _, at)| lead.contains(at.center())).map(|(text, cut, _)| (text, cut)).collect();
     assert_eq!(labels, [("Intensity".to_string(), false)], "labelled, and not cut short");
-    let field = u.ctx.read_response(Id::unique(("fx_gi", 0usize)).with("field")).expect("its value").rect;
+    let field = u.ctx.read_response(Id::unique(("fx", "lightIntensity", 0usize)).with("field")).expect("its value").rect;
     assert_eq!(field.max.x - lead.min.x, GLASS_FIELD_W, "the width the next test measures against");
 }
 
diff --git a/crates/ui-egui/src/panels/right/effects.rs b/crates/ui-egui/src/panels/right/effects.rs
index 528d19bfd..b25990db7 100644
--- a/crates/ui-egui/src/panels/right/effects.rs
+++ b/crates/ui-egui/src/panels/right/effects.rs
@@ -108,7 +108,22 @@ pub(crate) fn effect_open(ctx: &egui::Context, i: usize) -> bool {
 
 /// A number field of effect `i` that can be bound to a variable (`effects/<i>/<prop>`).
 fn fx_field(app: &mut FigApp, ui: &mut Ui, ids: &[NodeId], i: usize, prop: &str, lead: Lead, value: f64, width: f32) -> Option<FieldEdit> {
-    crate::variable_ui::number_field(app, ui, ids, &format!("effects/{i}/{prop}"), Id::unique(("fx", prop, i)), lead, Some(value), "", width)
+    fx_field_in(app, ui, ids, i, prop, lead, Some(value), "", width)
+}
+
+/// [`fx_field`] showing `value` as given (a glass percentage) with `suffix` after it.
+fn fx_field_in(
+    app: &mut FigApp,
+    ui: &mut Ui,
+    ids: &[NodeId],
+    i: usize,
+    prop: &str,
+    lead: Lead,
+    value: Option<f64>,
+    suffix: &str,
+    width: f32,
+) -> Option<FieldEdit> {
+    crate::variable_ui::number_field(app, ui, ids, &format!("effects/{i}/{prop}"), Id::unique(("fx", prop, i)), lead, value, suffix, width)
 }
 
 /// Draw type-specific effect fields for shadows, blurs, noise, texture and glass, using live
@@ -290,29 +305,30 @@ fn effect_settings(app: &mut FigApp, ui: &mut Ui, ids: &[NodeId], i: usize, e: &
                     }
                 })
             };
+            // Each field takes a variable (`effects/<i>/<field>`), read as the field shows it:
+            // percentages for the 0–1 values, and the frost as `radius` (see `Glass::set_bound`).
             let pct = |v: f64| Some((v * 100.0).round());
             let unit = |v: f64| (v / 100.0).clamp(0.0, 1.0);
             row(ui, 32.0, |ui| {
-                let ed =
-                    widgets::number_field(ui, Id::unique(("fx_gl", i)), Lead::Text(tr("Light|glass")), Some(g.light_angle.round()), "°", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "lightAngle", Lead::Text(tr("Light|glass")), Some(g.light_angle.round()), "°", half);
                 edit(app, ed, &|v| with(&|gl| gl.light_angle = v.clamp(-180.0, 180.0)));
-                let ed = widgets::number_field(ui, Id::unique(("fx_gi", i)), Lead::Text(tr("Intensity")), pct(g.light_intensity), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "lightIntensity", Lead::Text(tr("Intensity")), pct(g.light_intensity), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.light_intensity = unit(v)));
             });
             row(ui, 32.0, |ui| {
-                let ed = widgets::number_field(ui, Id::unique(("fx_gr", i)), Lead::Text(tr("Refraction")), pct(g.refraction), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "refraction", Lead::Text(tr("Refraction")), pct(g.refraction), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.refraction = unit(v)));
-                let ed = widgets::number_field(ui, Id::unique(("fx_gd", i)), Lead::Text(tr("Depth")), Some(g.depth), "", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "depth", Lead::Text(tr("Depth")), Some(g.depth), "", half);
                 edit(app, ed, &|v| with(&|gl| gl.depth = v.clamp(1.0, 1000.0)));
             });
             row(ui, 32.0, |ui| {
-                let ed = widgets::number_field(ui, Id::unique(("fx_gs", i)), Lead::Text(tr("Dispersion")), pct(g.dispersion), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "dispersion", Lead::Text(tr("Dispersion")), pct(g.dispersion), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.dispersion = unit(v)));
-                let ed = widgets::number_field(ui, Id::unique(("fx_gf", i)), Lead::Text(tr("Frost")), Some(g.frost), "", half, 1.0);
-                edit(app, ed, &|v| with(&|gl| gl.frost = v.clamp(0.0, 1000.0)));
+                let ed = fx_field_in(app, ui, ids, i, "radius", Lead::Text(tr("Frost")), Some(g.sanitized().frost), "", half);
+                edit(app, ed, &|v| with(&|gl| gl.frost = v.clamp(0.0, Glass::MAX_FROST)));
             });
             row(ui, 32.0, |ui| {
-                let ed = widgets::number_field(ui, Id::unique(("fx_gp", i)), Lead::Text(tr("Splay")), pct(g.splay), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "splay", Lead::Text(tr("Splay")), pct(g.splay), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.splay = unit(v)));
             });
         }
diff --git a/docs/components-parity.md b/docs/components-parity.md
index 0e3248248..94a579758 100644
--- a/docs/components-parity.md
+++ b/docs/components-parity.md
@@ -1,6 +1,6 @@
 # Components, variants, styles and variables parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-01 · **Change:** minor (Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
 
 Design systems are why teams adopt Figma. **Components: breadth ~96%, ready ~72%. Styles and
 variables: breadth ~95%, ready ~76% (estimated).** QA'd with a synthetic design system of ~300
@@ -67,7 +67,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 | Modes: add, duplicate, rename, delete, set as default / reorder | done | layers on Auto follow a new default; explicit modes stay |
 | Deleting a bound variable or its collection | done | layers keep their last value and are unbound; aliases to it take its values and colour calculations reading it keep the colour they show |
 | Code syntax per platform (Web, iOS, Android) | done | generated CSS uses the Web name, SwiftUI the iOS one and Compose the Android one (a variable without one keeps its value there); in the variables JSON; ArkUI and Flutter have no platform of their own and write values |
-| Bindings: fills, strokes, effects, opacity, padding, gaps, sizes, radius, font family/style, font size/weight, line height, letter spacing, paragraph spacing/indent, text, visibility, layout grids, instance properties | done | type-checked per field; number variables fill text content; the Design panel's font family and font style menus start with Apply variable (string variables), and a bound one shows its variable in place of the menu; a colour variable bound to a solid paint brings its whole colour, alpha included, once (the paint's opacity restarts at 100% on binding, an opacity set while bound multiplies on top; unbinding moves the alpha back into the opacity) |
+| Bindings: fills, strokes, effects, opacity, padding, gaps, sizes, radius, font family/style, font size/weight, line height, letter spacing, paragraph spacing/indent, text, visibility, layout grids, instance properties | done | type-checked per field; glass fields too (light angle, intensity, refraction, depth, dispersion, frost and splay, percentages as the Design panel shows them); number variables fill text content; the Design panel's font family and font style menus start with Apply variable (string variables), and a bound one shows its variable in place of the menu; a colour variable bound to a solid paint brings its whole colour, alpha included, once (the paint's opacity restarts at 100% on binding, an opacity set while bound multiplies on top; unbinding moves the alpha back into the opacity) |
 | Explicit modes per frame, library collections' modes | done | stored variable and collection references resolve by exact id in export, library copies and swaps, imported aliases, alias deletion and cycle checks, Dev Inspect, the library mode picker and prototype playback; a collection or variable named like another's id no longer stands in for it there |
 | Gradient stops and variant properties bound to variables | done | a stop's binding follows it when earlier stops are removed |
 | Extended collections | done | this file's collections (Extend collection on a collection's row; following its edits at once, chains included) and library collections, including a library's own extended collections (chains through libraries); overrides per mode with reset; follow library updates, variables new to the library collection being an update of their own; modes inherited. Checked with synthetic libraries only ([gaps](gaps.md) #14) |
@@ -78,6 +78,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass effects take variables, as the reference tool's do: its light angle, intensity, refraction, depth, dispersion, frost and splay bind to number variables on a layer (`variable.bind`, `effects/<i>/<lightAngle\|lightIntensity\|refraction\|depth\|dispersion\|radius\|splay>`, `radius` being the frost) and in an effect style (`style.bind`), and the Design panel's glass fields take a variable like the shadow and blur fields. A variable reads as the field shows it: intensity, refraction, dispersion and splay in percent. Tests: `binding_lists_tests::glass_fields_take_number_variables`, `effects_tests::glass_fields_take_bound_numbers_as_the_panel_shows_them`. Grade unchanged. |
 | 2026-11-01 | patch | M3: Delete on a layer inside an instance hides it (an override) instead of being refused ("You can't delete a layer or object from an instance. If you try, Figma will only toggle the layer's visibility instead of removing it", Guide to auto layout); `edit.delete` reports those ids under `hidden`, the structure and the main component stay as they were, one undo step; deleting the instance itself still removes it. Found by a documentation audit of the auto layout page. Test: `components_behaviour_tests::deleting_a_layer_inside_an_instance_hides_it_instead` (the refusal row for it is gone from `what_instances_cannot_override_is_refused`). Numbers unchanged |
 | 2026-10-31 | minor | M3, gap 10: library analytics cover styles and variables. A file reports how many of its layers use each of a library's styles and variables, and Show usage (`library.usage`) lists them beside the components, by a Type choice, with their layers and files. Layers inside instances count for their component. Insertions, detachments and modes aren't counted for them yet. Numbers unchanged. Tests: `library_assets_tests`. |
 | 2026-10-31 | minor | M6: as the help center describes code syntax, Dev Mode's SwiftUI and Compose code now writes a bound variable's iOS or Android code syntax in place of its value, as CSS already wrote the Web one: fills, strokes and their weight, sizes, corner radius, gaps, padding, opacity, the font family and size and the characters. A variable with no code syntax for the platform keeps the value, since a name made up here wouldn't exist in the code it lands in. ArkUI and Flutter have no code syntax platform and are unchanged. Test: `variables_behaviour_tests::swiftui_and_compose_name_variables_by_their_code_syntax`. Numbers unchanged. Grade unchanged |

From fe3567a56ba6f22d2722c902061dc965d50225d9 Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <72558888+aleksei-suholita@users.noreply.github.com>
Date: Thu, 5 Nov 2026 22:27:51 +0100
Subject: [PATCH 53/70] M3: glass bends with the reference tool's thick-lens
 profile and splits its colours over 8 steps (#1887)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M3: glass bends with the reference tool's thick-lens profile and splits its colours over 8 steps (#1885)

The backdrop bends most a 1-unit bevel in from the edge, falls off as the
3.5th power of the way out of the curve to nothing `depth` further in, and
moves a fifth as much on the bevel itself (it fell off as the square of the
way in from the very edge). Dispersion samples each channel at 8 steps along
the bend with a triangular window, red moving furthest and blue least (it was
three samples, blue furthest), as far apart as the reference tool's: at 100%
red and blue move 0.16 of the bend apart (`Glass::DISPERSION_SPREAD`).
`Glass::max_bend` bounds red's furthest step, so the backdrop read around a
pane covers every sample, and the field margin covers the bevel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's bend stays within `max_bend`, checked on a single bright pixel too (#1885)

Review follow-up: the bend reaches `depth` × `refraction` a bevel in from
the edge, so `Glass::max_bend` drops its 0.999 and bounds it, as a test now
checks for several refractions. A single white pixel on black pins the
dispersion's triangular window, which a ramp and a flat backdrop can't tell
from one centred sample. The parity assessment records the bend, the
dispersion and how they were measured against the reference tool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's flat inside skips the bend's curve, and full dispersion stays within `max_bend` (#1885)

Review follow-up: `bend_at` returns 0 straight away past `depth` + the
bevel, where the curve and the bevel's easing are both 0, instead of
working out a power of 0 for every pixel of a pane's flat inside. A test
moves one white pixel along a row under every bend of the profile at full
dispersion and checks that no channel ever reads it further out than
`Glass::max_bend`, which sizes the backdrop read around a pane.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
---
 ROADMAP.md                 |   3 +-
 crates/doc/src/props.rs    |  12 ++-
 crates/render/src/glass.rs | 192 +++++++++++++++++++++++++++++++++----
 docs/target-app-parity.md  |   3 +-
 4 files changed, 189 insertions(+), 21 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index abc435b80..1a9258b9c 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -358,6 +358,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile: most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in, and a fifth as much on the bevel itself (it fell off as the square of the way in from the very edge). Dispersion splits the channels over 8 steps with a triangular window, red moving furthest and blue least, as far apart as the reference tool's (at 100% red and blue move 0.16 of the bend apart; it was three samples, blue furthest), and `Glass::max_bend` bounds red's furthest step, so the backdrop read around a pane covers every sample. Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass effects take variables (light angle, intensity, refraction, depth, dispersion, frost and splay, on layers and in effect styles, and from the Design panel's glass fields), and a glass's frost stays within 0–100, the reference tool's range: a larger frost from an older file draws at 100, and the field, a bound variable and scaling stop there. Numbers unchanged |
 | 2026-10-31 | minor | M12: as the help describes, holding Cmd/Ctrl while moving a connector's end places it on any part of an object instead of snapping to a side. It keeps that spot as a fraction of the object's box, so it follows the object when it moves or resizes, and without the key an end snaps as before. `board.connector {fromAt, toAt}` and `board.reattach {at}` take it; saved only when set. Numbers unchanged |
 | 2026-10-31 | patch | M11: a trackpad or touch tap sends its press and release in one frame, so a plugin panel's field committed in the frame its button was clicked and the value was lost: the Counter's Set count… kept the old count. The plugin now gets both, the field's value first. The `window.figcraft` docs name `screenshot`'s `data`. Numbers unchanged |
diff --git a/crates/doc/src/props.rs b/crates/doc/src/props.rs
index 242ce3d11..13d1878aa 100644
--- a/crates/doc/src/props.rs
+++ b/crates/doc/src/props.rs
@@ -716,10 +716,18 @@ impl Glass {
         }
     }
 
-    /// Furthest the curved edge moves the backdrop (document units).
+    /// How far `dispersion` splits the colour channels, as a share of the bend: at full dispersion
+    /// red moves up to this much further and blue as much less. Matched to the reference tool:
+    /// across a black-to-white edge in the bend, red and blue part about 4.7 px at 100% and 2.4 px
+    /// at 50% (at 2×, depth 20, refraction 80%).
+    pub const DISPERSION_SPREAD: f64 = 0.16;
+
+    /// Furthest the curved edge moves the backdrop (document units): at most `depth` × `refraction`
+    /// (all of it a bevel in from the edge), and red's dispersion steps up to
+    /// [`Self::DISPERSION_SPREAD`] × `dispersion` times that again.
     pub fn max_bend(&self) -> f64 {
         let g = self.sanitized();
-        g.refraction * g.depth * (1.0 + g.dispersion * 0.25)
+        g.refraction * g.depth * (1.0 + Self::DISPERSION_SPREAD * g.dispersion)
     }
 }
 
diff --git a/crates/render/src/glass.rs b/crates/render/src/glass.rs
index 23301b010..da998bf0d 100644
--- a/crates/render/src/glass.rs
+++ b/crates/render/src/glass.rs
@@ -1,9 +1,12 @@
 //! The glass effect: the backdrop seen through a pane whose edges curve down like a lens.
 //!
-//! Within `depth` of the outline the surface curves: the backdrop there is bent towards the inside
-//! (strongest at the very edge, `refraction` × `depth` far), each colour channel by a slightly
-//! different amount (`dispersion`, a rainbow fringe), and the rim catches the light: brightest
-//! where it faces `light_angle`, half as bright on the opposite side, spread wider by `splay`.
+//! Within `depth` of the outline the surface curves like a thick lens: the backdrop there is bent
+//! towards the inside, most a [`BEVEL`] in from the edge (`refraction` × `depth` far), falling off
+//! as the 3.5th power of the way out of the curve and gone `depth` further in, with a fifth as
+//! much on the bevel itself ([`bend_at`]). Each colour channel bends by a different amount
+//! (`dispersion`, a rainbow fringe: red furthest, blue least, each smeared along the bend), and the
+//! rim catches the light: brightest where it faces `light_angle`, half as bright on the opposite
+//! side, spread wider by `splay`.
 //! `frost` blurs the backdrop first. Distances to the outline come from an exact Euclidean
 //! distance transform of the shape's coverage.
 //!
@@ -162,6 +165,70 @@ fn smooth_normals(dist: &[f32], w: usize, h: usize, r: usize) -> Vec<(f32, f32)>
         .collect()
 }
 
+/// The bevel along a glass's edge (document units): where the bend eases off before the edge.
+pub(crate) const BEVEL: f64 = 1.0;
+
+/// How sharply the bend falls off going in: the 3.5th power of the way out of the curve.
+const PROFILE_EXP: f32 = 3.5;
+
+/// The furthest the backdrop moves, as a share of `depth`.
+const MAX_BEND: f32 = 0.999;
+
+/// The bend on the bevel itself, as a share of [`MAX_BEND`] × `depth` × `refraction`.
+const RIM_BEND: f32 = 0.2;
+
+/// Steps of the dispersion window: each channel is sampled this many times along the bend, weighted
+/// by a triangle (the two end steps weigh nothing and are skipped).
+const DISPERSION_STEPS: usize = 8;
+
+/// `x` from `a` to `b` as 0 to 1, clamped (a span under 1e-5 counts as 1e-5).
+fn lin(a: f32, b: f32, x: f32) -> f32 {
+    ((x - a) / (b - a).max(1e-5)).clamp(0.0, 1.0)
+}
+
+/// How far the backdrop moves at `x` pixels in from the edge, for a glass `depth` and [`BEVEL`]
+/// `bevel` deep (pixels) and `refraction` (0–1): a thick lens's profile, the most a bevel in from
+/// the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further
+/// in, and a fifth as much on the bevel itself, eased between the two over its outer 70%.
+pub(crate) fn bend_at(x: f32, depth: f32, bevel: f32, refraction: f32) -> f32 {
+    // Past the curve (and the bevel's easing) nothing bends: the flat inside of the pane.
+    if x >= depth.max(1e-4) + bevel {
+        return 0.0;
+    }
+    let sd = -x;
+    let t = lin(-depth - bevel, -bevel, sd);
+    let most = MAX_BEND * depth;
+    let core = (t.powf(PROFILE_EXP) * depth * refraction).clamp(-most, most);
+    let rim = refraction * RIM_BEND * most;
+    let u = lin(-bevel - 1e-4, -0.3 * bevel, sd);
+    core + (rim - core) * u
+}
+
+/// The backdrop seen at pixel coordinates (`x`, `y`) moved by (`dx`, `dy`), its channels split by
+/// `k` (dispersion, 0–1): red moves up to `k` further, blue up to `k` less, each smeared along the
+/// move by a triangular window of [`DISPERSION_STEPS`]. One sample when `k` is too small to show.
+fn dispersed(frosted: &Pixmap, x: f32, y: f32, dx: f32, dy: f32, k: f32) -> [f32; 4] {
+    let at = |s: f32| sample(frosted, x + dx * s, y + dy * s);
+    if k < 0.001 {
+        let s = at(1.0);
+        return [s[0].min(s[3]), s[1].min(s[3]), s[2].min(s[3]), s[3]];
+    }
+    let last = (DISPERSION_STEPS - 1) as f32;
+    let (mut acc, mut sum) = ([0.0f32; 4], 0.0f32);
+    for i in 1..DISPERSION_STEPS - 1 {
+        let t = i as f32 / last - 0.5;
+        let w = 1.0 - (2.0 * t).abs();
+        let (r, g, b) = (at(1.0 + (t + 0.5) * k), at(1.0 + t * k), at(1.0 + (t - 0.5) * k));
+        acc[0] += r[0] * w;
+        acc[1] += g[1] * w;
+        acc[2] += b[2] * w;
+        acc[3] += r[3].max(g[3]).max(b[3]) * w;
+        sum += w;
+    }
+    let a = acc[3] / sum;
+    [(acc[0] / sum).min(a), (acc[1] / sum).min(a), (acc[2] / sum).min(a), a]
+}
+
 /// Bilinear sample of premultiplied `p` at pixel coordinates `(x, y)` (centres at +0.5), each
 /// channel 0..=255; transparent outside.
 fn sample(p: &Pixmap, x: f32, y: f32) -> [f32; 4] {
@@ -411,20 +478,20 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
     let EffectFrame { shape, back, pad, size: (w, h), xf, scale } = frame;
     let g = g.sanitized();
     let depth = (g.depth * scale).clamp(1.0, 1024.0);
+    let bevel = (BEVEL * scale).min(1024.0);
     let band = (depth * (0.15 + 0.35 * g.splay)).max(1.0);
     let reach = light_reach(band, g.light_intensity);
     let r = (depth * 0.1).clamp(1.0, 8.0) as usize;
     // Coverage with a margin, so wherever the layer is cut every distance the pixels read is
-    // exact: the bend's (within `depth`), the light's (within `reach`) and those the normals are
-    // smoothed from (2r + 1 further).
-    let m = depth.max(reach).ceil() as u32 + 4 * r as u32 + 4;
+    // exact: the bend's (within `depth` + `bevel`), the light's (within `reach`) and those the
+    // normals are smoothed from (2r + 1 further).
+    let m = (depth + bevel).max(reach).ceil() as u32 + 4 * r as u32 + 4;
     let (fields, shift) = shape_fields(shape, xf, w, h, m, r)?;
     let mut frosted = back.clone();
     fx::blur(&mut frosted, g.frost / 2.0 * scale);
     let ang = g.light_angle.to_radians();
     let light = (ang.sin() as f32, -ang.cos() as f32);
-    let bend_max = (g.refraction * depth) as f32;
-    let fringe = (g.dispersion * 0.25) as f32;
+    let (refraction, dispersion, bevel) = (g.refraction as f32, (g.dispersion * Glass::DISPERSION_SPREAD) as f32, bevel as f32);
     let power = (6.0 - 5.0 * g.splay) as f32;
     let (band, reach) = (band as f32, reach as f32);
     // The falloff, lowered by its value at `reach` and scaled back to 1 at the edge, so the light
@@ -441,19 +508,15 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
             if c <= 0.0 {
                 continue;
             }
-            let t = (d / depth).min(1.0);
-            let bend = bend_max * (1.0 - t) * (1.0 - t);
+            let bend = bend_at(d, depth, bevel, refraction);
             let (bx, by) = (x as f32 + pad as f32 + 0.5, y as f32 + pad as f32 + 0.5);
             let base = if bend == 0.0 {
-                // Nothing bends (past `depth`, or no refraction): the three channels' samples are
-                // at the same point, so one sample.
+                // Nothing bends (past `depth` + `bevel`, or no refraction): the channels' samples
+                // are at the same point, so one sample.
                 let s = sample(&frosted, bx, by);
                 [s[0].min(s[3]), s[1].min(s[3]), s[2].min(s[3]), s[3]]
             } else {
-                let at = |k: f32| sample(&frosted, bx + inward.0 * bend * k, by + inward.1 * bend * k);
-                let (rs, gs, bs) = (at(1.0 - fringe), at(1.0), at(1.0 + fringe));
-                let a = rs[3].max(gs[3]).max(bs[3]);
-                [rs[0].min(a), gs[1].min(a), bs[2].min(a), a]
+                dispersed(&frosted, bx, by, inward.0 * bend, inward.1 * bend, dispersion)
             };
             // The rim catches the light where it faces it, and half as much opposite. It fades out
             // by `reach` and is none past it, wherever the layer is cut.
@@ -479,6 +542,101 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
 mod tests {
     use super::*;
 
+    /// The bend at depth 20, refraction 0.8 and a 1-unit bevel, x units in from the edge: the
+    /// reference profile's values.
+    #[test]
+    fn the_bend_follows_the_thick_lens_profile() {
+        let table = [
+            (0.10, 3.1968),
+            (0.25, 3.1968),
+            (0.50, 6.8543),
+            (0.75, 11.4263),
+            (1.00, 15.9982),
+            (2.0, 13.3707),
+            (4.0, 9.0591),
+            (6.0, 5.8457),
+            (8.0, 3.5426),
+            (10.0, 1.9742),
+            (16.0, 0.1250),
+            (20.0, 0.0004),
+            (21.0, 0.0),
+            (40.0, 0.0),
+        ];
+        for (x, want) in table {
+            let got = bend_at(x, 20.0, 1.0, 0.8);
+            assert!((got - want).abs() < 1e-3, "x {x}: {got} vs {want}");
+        }
+        // No refraction, no bend; never more than 0.999 × depth, never outwards.
+        assert_eq!(bend_at(0.5, 20.0, 1.0, 0.0), 0.0);
+        for i in 0..400 {
+            let x = i as f32 * 0.1;
+            let b = bend_at(x, 20.0, 1.0, 1.0);
+            assert!((0.0..=0.999 * 20.0).contains(&b), "x {x}: {b}");
+        }
+        // A depth thinner than the bevel (zoomed far in) still gives numbers.
+        assert!(bend_at(0.5, 1.0, 8.0, 1.0).is_finite());
+        // `Glass::max_bend`, which sizes the backdrop read around a pane, bounds the whole bend.
+        for refraction in [0.3, 0.8, 1.0] {
+            let most = (0..800).map(|i| bend_at(i as f32 * 0.05, 20.0, 1.0, refraction as f32)).fold(0.0f32, f32::max);
+            let bound = Glass { refraction, depth: 20.0, dispersion: 0.0, ..Glass::default() }.max_bend();
+            assert!(f64::from(most) <= bound + 1e-4, "refraction {refraction}: {most} past {bound}");
+        }
+    }
+
+    /// Dispersion off is one sample at the moved point; on, the channels split along the move, red
+    /// further and blue less, and a flat backdrop stays flat.
+    #[test]
+    fn dispersion_splits_the_channels_along_the_bend() {
+        // A 40 × 1 ramp: red, green and blue all rise with x.
+        let mut p = Pixmap::new(40, 1).unwrap();
+        for (i, px) in p.data_mut().chunks_exact_mut(4).enumerate() {
+            let v = (i * 6) as u8;
+            px.copy_from_slice(&[v, v, v, 255]);
+        }
+        let one = sample(&p, 10.5 + 8.0, 0.5);
+        let off = dispersed(&p, 10.5, 0.5, 8.0, 0.0, 0.0);
+        assert_eq!(off, [one[0], one[1], one[2], one[3]]);
+        let on = dispersed(&p, 10.5, 0.5, 8.0, 0.0, 1.0);
+        assert!(on[0] > on[1] && on[1] > on[2], "{on:?}");
+        assert!((on[1] - one[1]).abs() < 1e-3, "green stays centred on the move: {on:?} vs {one:?}");
+        let mut flat = Pixmap::new(40, 1).unwrap();
+        flat.fill(tiny_skia::Color::from_rgba8(90, 120, 200, 255));
+        let f = dispersed(&flat, 10.5, 0.5, 8.0, 0.0, 1.0);
+        assert!(f.iter().zip([90.0, 120.0, 200.0, 255.0]).all(|(a, b)| (a - b).abs() < 1e-3), "{f:?}");
+        // One white pixel on black: only the weighted steps that reach it pick it up, red and green
+        // from opposite ends of their windows (the same amount), blue none.
+        let mut impulse = Pixmap::new(40, 1).unwrap();
+        impulse.fill(tiny_skia::Color::BLACK);
+        impulse.data_mut()[20 * 4..21 * 4].copy_from_slice(&[255, 255, 255, 255]);
+        let spread = dispersed(&impulse, 10.5, 0.5, 8.0, 0.0, 1.0);
+        assert!((spread[0] - 33.392857).abs() < 1e-3 && (spread[1] - 33.392857).abs() < 1e-3, "{spread:?}");
+        assert_eq!(spread[2], 0.0);
+    }
+
+    /// At full dispersion red's furthest step stays within `Glass::max_bend` of the pixel, all
+    /// along the bend, so the backdrop read around a pane covers it: one white pixel further out
+    /// than that is never seen.
+    #[test]
+    fn full_dispersion_reads_no_further_than_max_bend() {
+        let bound = Glass { refraction: 1.0, depth: 20.0, dispersion: 1.0, ..Glass::default() }.max_bend() as f32;
+        let k = Glass::DISPERSION_SPREAD as f32;
+        let mut furthest = 0usize;
+        for i in 0..100 {
+            let bend = bend_at(i as f32 * 0.25, 20.0, 1.0, 1.0);
+            for at in 0..40 {
+                let mut impulse = Pixmap::new(40, 1).unwrap();
+                impulse.fill(tiny_skia::Color::BLACK);
+                impulse.data_mut()[at * 4..at * 4 + 4].copy_from_slice(&[255, 255, 255, 255]);
+                let s = dispersed(&impulse, 0.5, 0.5, bend, 0.0, k);
+                if s[0].max(s[1]).max(s[2]) > 0.0 {
+                    furthest = furthest.max(at);
+                }
+            }
+        }
+        // A sample `o` pixels along picks up the pixel `at` while |o − at| < 1.
+        assert!(furthest > 0 && (furthest as f32) < bound + 1.0, "pixel {furthest} seen, past {bound}");
+    }
+
     #[test]
     fn distance_of_a_square() {
         let mut p = Pixmap::new(21, 21).unwrap();
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 75a426231..312c7e0ac 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # FigCraft parity with Figma
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-01 · **Change:** minor (bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
 
 The authoritative assessment of how close FigCraft is to Figma Design. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) is the ranked work list; the measured menu checklist is
@@ -648,6 +648,7 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile (most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in) and splits its colours over 8 steps, red and blue 0.16 of the bend apart at 100% dispersion. Measured against the reference tool on synthetic files at 2×: the black band a pane pulls to its edge ends within 3 px of the reference tool's, and red and blue part 2.27 px at 50% dispersion and 4.66 px at 100% (2.38 and 4.69 there). Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Grade unchanged. |
 | 2026-11-01 | patch | M4: bulleted lists draw the same bullet at every level of indentation ("Figma bullets will keep the same styling at all levels of indentation", Create bulleted and numbered lists); the deeper levels drew a white bullet and a small square, pinned as silent before. Numbered levels (1., a., i.) are unchanged. Found by a documentation audit of the text rules. Test: `tail_tests::list_numbering_by_level` (the bullets row). Numbers unchanged |
 | 2026-11-01 | patch | M4: typing `1)` followed by a space at the start of a plain paragraph starts a numbered list, as `1.` already did ("Enter one of the creation characters below followed by a Space: 1. 1)", Create bulleted and numbered lists). Found by a documentation audit of the text rules. Test: `text_tail_tests::typing_a_creation_character_and_a_space_starts_a_list`. Numbers unchanged |
 | 2026-11-01 | patch | M4: a link made with `text.link` (Cmd/Ctrl+K, Shift+Cmd/Ctrl+U) underlines the linked text unless it has a decoration of its own ("Links are styled with an underline by default. Use the keyboard shortcut to remove the underline", Add links to text); Underline (Cmd/Ctrl+U) takes the underline off and the link stays. Found by a documentation audit of the text rules. Test: `text_behaviour_tests::a_link_is_underlined_by_default_and_underline_takes_it_off`. Numbers unchanged |

From 857d7089beac68c671e8ce886045ce0ec3c320c4 Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <72558888+aleksei-suholita@users.noreply.github.com>
Date: Thu, 5 Nov 2026 22:44:38 +0100
Subject: [PATCH 54/70] M3: glass's light is a line on its bevel, and splay
 turns the bend towards the centre (#1888)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M3: glass bends with the reference tool's thick-lens profile and splits its colours over 8 steps (#1885)

The backdrop bends most a 1-unit bevel in from the edge, falls off as the
3.5th power of the way out of the curve to nothing `depth` further in, and
moves a fifth as much on the bevel itself (it fell off as the square of the
way in from the very edge). Dispersion samples each channel at 8 steps along
the bend with a triangular window, red moving furthest and blue least (it was
three samples, blue furthest), as far apart as the reference tool's: at 100%
red and blue move 0.16 of the bend apart (`Glass::DISPERSION_SPREAD`).
`Glass::max_bend` bounds red's furthest step, so the backdrop read around a
pane covers every sample, and the field margin covers the bevel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's bend stays within `max_bend`, checked on a single bright pixel too (#1885)

Review follow-up: the bend reaches `depth` × `refraction` a bevel in from
the edge, so `Glass::max_bend` drops its 0.999 and bounds it, as a test now
checks for several refractions. A single white pixel on black pins the
dispersion's triangular window, which a ramp and a flat backdrop can't tell
from one centred sample. The parity assessment records the bend, the
dispersion and how they were measured against the reference tool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's light is a line on its bevel, and splay turns the bend towards the centre (#1885)

The light is a line on the 1-unit bevel added to the backdrop, as the
reference tool's: fully where the edge faces the light, none below 0.35 of
facing it and 0.6 as much on the opposite side, with a faint gradient across
the curve, 5% darker facing the light and lighter opposite. It was a glow
mixed towards white, as deep as `splay` made it, so `light_reach` goes.

`splay` turns the bend from along the edge's normal towards the way away
from the layer's centre, and no longer widens the light: files with a splay
above 0 look different. The direction to the centre is worked out in the
shape's own frame (`own_frame`, shared with the field cache), so cut renders
match the whole one byte for byte.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: cut renders of glass match with splay turning a dispersed bend (#1885)

Review follow-up: the cut-versus-whole test had splay only on looks without
refraction, so no turned bend reached the dispersion. A look with splay 1 and
the default bend and dispersion now renders the same however it is cut. The
parity assessment records the light on the bevel and splay's new meaning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's flat inside skips the bend's curve, and full dispersion stays within `max_bend` (#1885)

Review follow-up: `bend_at` returns 0 straight away past `depth` + the
bevel, where the curve and the bevel's easing are both 0, instead of
working out a power of 0 for every pixel of a pane's flat inside. A test
moves one white pixel along a row under every bend of the profile at full
dispersion and checks that no channel ever reads it further out than
`Glass::max_bend`, which sizes the backdrop read around a pane.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's light shows over a transparent backdrop, and its flat inside skips the light (#1885)

Review follow-up: the light was added to the backdrop's colour and then
clamped to the backdrop's alpha, so with nothing under the glass (an
export of the pane alone) the line on the bevel vanished, where the old
glow raised the alpha and showed. Now the alpha rises as far as the lit
colour needs (`lit`), and stays the backdrop's wherever the light fits
under it, so renders over an opaque backdrop don't change.

Past `depth` + the bevel the rim light, the gradient and the bend are all
0, so those pixels take one sample of the backdrop and skip the light's
direction, facing and splay work, as the old glow's `reach` early-out did.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
---
 ROADMAP.md                           |   3 +-
 crates/doc/src/props.rs              |   3 +-
 crates/render/src/backdrop_tests.rs  |  57 +++++++-
 crates/render/src/glass.rs           | 190 +++++++++++++++++++--------
 crates/render/src/glass_cut_tests.rs |  26 ++--
 docs/target-app-parity.md            |   3 +-
 6 files changed, 209 insertions(+), 73 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 1a9258b9c..6dc415125 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -358,6 +358,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it and 0.6 as much on the opposite side, with a faint gradient across the curve, 5% darker facing the light and lighter opposite (it was a glow mixed towards white, as deep as `splay` made it). `splay` turns the bend from along the edge's normal towards the way away from the layer's centre, as the reference tool's does, and no longer widens the light: files with a splay above 0 look different. The direction to the centre is worked out in the shape's own frame, so cut renders match. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile: most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in, and a fifth as much on the bevel itself (it fell off as the square of the way in from the very edge). Dispersion splits the channels over 8 steps with a triangular window, red moving furthest and blue least, as far apart as the reference tool's (at 100% red and blue move 0.16 of the bend apart; it was three samples, blue furthest), and `Glass::max_bend` bounds red's furthest step, so the backdrop read around a pane covers every sample. Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass effects take variables (light angle, intensity, refraction, depth, dispersion, frost and splay, on layers and in effect styles, and from the Design panel's glass fields), and a glass's frost stays within 0–100, the reference tool's range: a larger frost from an older file draws at 100, and the field, a bound variable and scaling stop there. Numbers unchanged |
 | 2026-10-31 | minor | M12: as the help describes, holding Cmd/Ctrl while moving a connector's end places it on any part of an object instead of snapping to a side. It keeps that spot as a fraction of the object's box, so it follows the object when it moves or resizes, and without the key an end snaps as before. `board.connector {fromAt, toAt}` and `board.reattach {at}` take it; saved only when set. Numbers unchanged |
diff --git a/crates/doc/src/props.rs b/crates/doc/src/props.rs
index 13d1878aa..75dca8913 100644
--- a/crates/doc/src/props.rs
+++ b/crates/doc/src/props.rs
@@ -662,7 +662,8 @@ pub struct Glass {
     pub dispersion: f64,
     /// Blur of the backdrop (a blur radius, document units, 0–[`Self::MAX_FROST`]).
     pub frost: f64,
-    /// How widely the light spreads over the glass (0–1).
+    /// Which way the curved edge bends the backdrop: along the edge's normal (0) to away from the
+    /// layer's centre (1).
     pub splay: f64,
 }
 
diff --git a/crates/render/src/backdrop_tests.rs b/crates/render/src/backdrop_tests.rs
index 33d2c0d12..32fb32c4f 100644
--- a/crates/render/src/backdrop_tests.rs
+++ b/crates/render/src/backdrop_tests.rs
@@ -254,16 +254,65 @@ fn glass_edges_bend_split_and_catch_the_light() {
     let (rim, middle) = changed(&split, &bent);
     assert!(rim > 0 && middle == 0, "dispersion: rim {rim}, middle {middle}");
 
-    // The light (from the top left by default) brightens the top-left rim more than the
-    // bottom-right one, and only near the edge.
+    // The light (from the top left by default) is a line on the 1-unit bevel: the top-left corner
+    // catches it all, the bottom-right one (facing away) 0.6 as much, the top side (45° from it)
+    // 0.574 and the bottom side 0.6 × 0.574, and the top-right corner (side on) none. Further in
+    // only the faint gradient across the curve shows, and nothing past `depth`.
     let (d, f, _) = glass_scene(Glass { light_intensity: 1.0, ..plain });
     let lit = render_node(&d, f, 1.0).unwrap();
     let gain = |x: u32, y: u32| i32::from(px(&lit, x, y)[1]) - i32::from(px(&flat, x, y)[1]);
-    assert!(gain(82, 42) > gain(197, 117), "{} vs {}", gain(82, 42), gain(197, 117));
-    assert!(gain(82, 42) > 40, "{}", gain(82, 42));
+    let (top_left, bottom_right, top, bottom, top_right) = (gain(80, 40), gain(199, 119), gain(140, 40), gain(140, 119), gain(199, 40));
+    assert!(
+        top_left > bottom_right && bottom_right > top && top > bottom && bottom > top_right.abs(),
+        "{top_left} {bottom_right} {top} {bottom} {top_right}"
+    );
+    assert!(top_left > 120 && top_right.abs() <= 2, "{top_left} {top_right}");
+    assert!(gain(140, 44).abs() <= 13, "4 px in: the gradient only, {}", gain(140, 44));
     assert_eq!(gain(140, 80), 0);
 }
 
+#[test]
+fn splay_turns_the_bend_towards_the_centre() {
+    // Refraction only, so the bend alone moves the stripes' edges.
+    let bend = Glass { frost: 0.0, refraction: 1.0, dispersion: 0.0, light_intensity: 0.0, depth: 16.0, ..Glass::default() };
+    let (d, f, _) = glass_scene(bend.clone());
+    let edge = render_node(&d, f, 1.0).unwrap();
+    let (d, f, _) = glass_scene(Glass { splay: 1.0, ..bend });
+    let centre = render_node(&d, f, 1.0).unwrap();
+    let diff = |xs: std::ops::Range<u32>, ys: std::ops::Range<u32>| {
+        let mut most = 0;
+        for y in ys {
+            for x in xs.clone() {
+                most = most.max(px(&edge, x, y).iter().zip(px(&centre, x, y)).map(|(a, b)| a.abs_diff(b)).max().unwrap());
+            }
+        }
+        most
+    };
+    // Halfway along the left side the edge's normal and the way from the centre (140, 80) agree:
+    // nearly the same pixels. In the top-left corner they part, and so does what shows there.
+    assert!(diff(80..96, 78..82) <= 8, "mid-left: {}", diff(80..96, 78..82));
+    assert!(diff(80..96, 40..56) > 40, "corner: {}", diff(80..96, 40..56));
+}
+
+/// Glass with nothing under it (an export of the pane alone): the light on the bevel still shows,
+/// the alpha rising with it, and the flat inside and the outside stay clear.
+#[test]
+fn glass_over_nothing_still_catches_the_light() {
+    let mut d = Document::new("glass");
+    let p = d.first_page().unwrap();
+    let pane = d.create(p, NodeKind::Rectangle, "Glass", 40.0, 30.0, 120.0, 80.0).unwrap();
+    let n = d.get_mut(pane).unwrap();
+    n.fills.clear();
+    n.effects = vec![Effect { kind: EffectKind::Glass(Glass { light_intensity: 1.0, ..Glass::default() }), visible: true }];
+    let out = render_area(&d, &[pane], Rect::new(0.0, 0.0, 200.0, 140.0), 1.0).unwrap();
+    // The top-left corner faces the light (from the top left): white, as opaque as it is bright.
+    let corner = px(&out, 40, 30);
+    assert!(corner[3] > 100 && corner.iter().all(|v| v.abs_diff(corner[3]) <= 2), "{corner:?}");
+    assert!(out.data().chunks_exact(4).all(|q| q[0] <= q[3] && q[1] <= q[3] && q[2] <= q[3]), "premultiplied");
+    assert_eq!(px(&out, 100, 70), [0; 4]);
+    assert_eq!(px(&out, 10, 10), [0; 4]);
+}
+
 #[test]
 fn glass_and_backdrop_blur_survive_bands_and_partial_renders() {
     let (d, _, _) = glass_scene(Glass::default());
diff --git a/crates/render/src/glass.rs b/crates/render/src/glass.rs
index da998bf0d..0ccbf2c2f 100644
--- a/crates/render/src/glass.rs
+++ b/crates/render/src/glass.rs
@@ -3,10 +3,12 @@
 //! Within `depth` of the outline the surface curves like a thick lens: the backdrop there is bent
 //! towards the inside, most a [`BEVEL`] in from the edge (`refraction` × `depth` far), falling off
 //! as the 3.5th power of the way out of the curve and gone `depth` further in, with a fifth as
-//! much on the bevel itself ([`bend_at`]). Each colour channel bends by a different amount
-//! (`dispersion`, a rainbow fringe: red furthest, blue least, each smeared along the bend), and the
-//! rim catches the light: brightest where it faces `light_angle`, half as bright on the opposite
-//! side, spread wider by `splay`.
+//! much on the bevel itself ([`bend_at`]). `splay` turns which way it bends, from along the edge's
+//! normal (0) to away from the layer's centre (1). Each colour channel bends by a different amount
+//! (`dispersion`, a rainbow fringe: red furthest, blue least, each smeared along the bend). The
+//! bevel catches the light as a thin line added to the backdrop ([`rim_light_at`]): fully where the
+//! edge faces `light_angle`, none below 0.35 of facing it, 0.6 as much on the opposite side; and a
+//! faint gradient runs across the curve, 5% darker where it faces the light and lighter opposite.
 //! `frost` blurs the backdrop first. Distances to the outline come from an exact Euclidean
 //! distance transform of the shape's coverage.
 //!
@@ -181,11 +183,45 @@ const RIM_BEND: f32 = 0.2;
 /// by a triangle (the two end steps weigh nothing and are skipped).
 const DISPERSION_STEPS: usize = 8;
 
+/// The least an edge faces the light (the cosine between its outward normal and the light) and
+/// still catches some.
+const HL_LO: f32 = 0.35;
+
+/// How much of the light the side opposite it catches.
+const HL_SECONDARY: f32 = 0.6;
+
+/// The gradient across the curve at its strongest, a share of the light's intensity.
+const BROAD: f32 = 0.05;
+
 /// `x` from `a` to `b` as 0 to 1, clamped (a span under 1e-5 counts as 1e-5).
 fn lin(a: f32, b: f32, x: f32) -> f32 {
     ((x - a) / (b - a).max(1e-5)).clamp(0.0, 1.0)
 }
 
+/// `x` from `a` to `b` as a smooth 0-to-1 step (Hermite), clamped.
+fn smoothstep(a: f32, b: f32, x: f32) -> f32 {
+    let t = ((x - a) / (b - a).max(1e-5)).clamp(0.0, 1.0);
+    t * t * (3.0 - 2.0 * t)
+}
+
+/// How much of the rim light falls `x` pixels in from the edge, for a `bevel` pixels deep: all
+/// of it within a fifth of the bevel, none a bevel in.
+pub(crate) fn rim_light_at(x: f32, bevel: f32) -> f32 {
+    smoothstep(-bevel - 0.001, -0.2 * bevel, -x)
+}
+
+/// How much light an edge catches, `facing` being the cosine between its outward normal and the
+/// light: from [`HL_LO`] to fully facing it, and [`HL_SECONDARY`] as much facing away.
+fn catches(facing: f32) -> f32 {
+    smoothstep(HL_LO, 1.0, facing) + HL_SECONDARY * smoothstep(HL_LO, 1.0, -facing)
+}
+
+/// How strongly the gradient across the curve shows `x` pixels in from the edge (`depth` and
+/// `bevel` in pixels): fully on the bevel, falling as the square of the way in to none at `depth`.
+pub(crate) fn sheen_at(x: f32, depth: f32, bevel: f32) -> f32 {
+    lin(-depth, -bevel + 1e-4, -x).powi(2)
+}
+
 /// How far the backdrop moves at `x` pixels in from the edge, for a glass `depth` and [`BEVEL`]
 /// `bevel` deep (pixels) and `refraction` (0–1): a thick lens's profile, the most a bevel in from
 /// the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further
@@ -229,6 +265,17 @@ fn dispersed(frosted: &Pixmap, x: f32, y: f32, dx: f32, dy: f32, k: f32) -> [f32
     [(acc[0] / sum).min(a), (acc[1] / sum).min(a), (acc[2] / sum).min(a), a]
 }
 
+/// `base`, a premultiplied backdrop pixel (channels 0–255), with `add` (levels, below 0 darkens)
+/// added to its colour, at coverage `c`. Where that is more than the backdrop's alpha holds (all of
+/// it over a transparent backdrop, an export with nothing under the glass), the alpha rises with
+/// it, so the light shows there too.
+fn lit(base: [f32; 4], add: f32, c: f32) -> [u8; 4] {
+    let [r, g, b, a] = base;
+    let (r, g, b) = (r + add, g + add, b + add);
+    let a = a.max(0.0).max(r).max(g).max(b).min(255.0);
+    [r, g, b, a].map(|v| (v.clamp(0.0, a) * c).round().clamp(0.0, 255.0) as u8)
+}
+
 /// Bilinear sample of premultiplied `p` at pixel coordinates `(x, y)` (centres at +0.5), each
 /// channel 0..=255; transparent outside.
 fn sample(p: &Pixmap, x: f32, y: f32) -> [f32; 4] {
@@ -256,17 +303,6 @@ fn sample(p: &Pixmap, x: f32, y: f32) -> [f32; 4] {
     })
 }
 
-/// The furthest in (pixels) the rim light is worth half a level or more: where
-/// `255 × intensity × e^(−d / band)` falls to 0.5, at most [`MAX_LIGHT_PX`] (0 for no light).
-fn light_reach(band: f64, intensity: f64) -> f64 {
-    let k = 255.0 * intensity / 0.5;
-    if k > 1.0 && band.is_finite() { (band * k.ln()).min(MAX_LIGHT_PX) } else { 0.0 }
-}
-
-/// The light reaches no further in than this many pixels (a wide light on a deep pane at a high
-/// zoom would otherwise need a huge margin of coverage around every cut).
-const MAX_LIGHT_PX: f64 = 512.0;
-
 /// A shape's coverage (alpha), distance to its edge and smoothed inward normals over a window of
 /// pixels whose top-left pixel is (`x0`, `y0`).
 struct Fields {
@@ -420,9 +456,19 @@ fn shape_fields(shape: &Outline, xf: Affine, w: u32, h: u32, m: u32, r: usize) -
     Some((Arc::new(Fields::new(&cov, -i64::from(m), -i64::from(m), r)), (0, 0)))
 }
 
-/// [`shape_fields`] for a whole shape, from the cache; `None` when it isn't kept (first asked for
-/// in this render, too big, or its transform too far out).
-fn whole_shape(shape: &Outline, xf: Affine, m: u32, r: usize) -> Option<(Arc<Fields>, (i64, i64))> {
+/// A layer transform split so the same shape at the same zoom lands on the same pixels of its own
+/// frame wherever a render puts it or cuts it (see [`own_frame`]).
+struct OwnFrame {
+    /// The whole pixels of the translation: the shift from layer pixels to the shape's own frame.
+    shift: (i64, i64),
+    /// The translation's fraction of a pixel, in steps of 1/65536.
+    frac: (i64, i64),
+    /// Local coordinates → the shape's own frame: the linear part and that fraction.
+    xf: Affine,
+}
+
+/// `xf` (local → layer pixels) split into its [`OwnFrame`]; `None` for a translation too far out.
+fn own_frame(xf: Affine) -> Option<OwnFrame> {
     let [a, b, c, d, e, f] = xf.as_coeffs();
     // The translation in steps of 1/65536 px (far finer than the rasteriser's 1/64, coarse enough
     // that rounding errors in where a render starts land on the same step), its whole pixels (the
@@ -435,7 +481,14 @@ fn whole_shape(shape: &Outline, xf: Affine, m: u32, r: usize) -> Option<(Arc<Fie
     let (qe, qf) = (q(e)?, q(f)?);
     let shift = (qe.div_euclid(STEPS as i64), qf.div_euclid(STEPS as i64));
     let frac = (qe.rem_euclid(STEPS as i64), qf.rem_euclid(STEPS as i64));
-    let own = Affine::new([a, b, c, d, frac.0 as f64 / STEPS, frac.1 as f64 / STEPS]);
+    Some(OwnFrame { shift, frac, xf: Affine::new([a, b, c, d, frac.0 as f64 / STEPS, frac.1 as f64 / STEPS]) })
+}
+
+/// [`shape_fields`] for a whole shape, from the cache; `None` when it isn't kept (first asked for
+/// in this render, too big, or its transform too far out).
+fn whole_shape(shape: &Outline, xf: Affine, m: u32, r: usize) -> Option<(Arc<Fields>, (i64, i64))> {
+    let [a, b, c, d, _, _] = xf.as_coeffs();
+    let OwnFrame { shift, frac, xf: own } = own_frame(xf)?;
     let bb = (own * shape.0.clone()).bounding_box();
     let (x0, y0, x1, y1) = (bb.x0.floor(), bb.y0.floor(), bb.x1.ceil(), bb.y1.ceil());
     if ![x0, y0, x1, y1].iter().all(|v| v.is_finite() && v.abs() < 1e9) {
@@ -479,27 +532,25 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
     let g = g.sanitized();
     let depth = (g.depth * scale).clamp(1.0, 1024.0);
     let bevel = (BEVEL * scale).min(1024.0);
-    let band = (depth * (0.15 + 0.35 * g.splay)).max(1.0);
-    let reach = light_reach(band, g.light_intensity);
     let r = (depth * 0.1).clamp(1.0, 8.0) as usize;
     // Coverage with a margin, so wherever the layer is cut every distance the pixels read is
-    // exact: the bend's (within `depth` + `bevel`), the light's (within `reach`) and those the
-    // normals are smoothed from (2r + 1 further).
-    let m = (depth + bevel).max(reach).ceil() as u32 + 4 * r as u32 + 4;
+    // exact: the bend's and the gradient's (within `depth` + `bevel`; the light lies on the bevel)
+    // and those the normals are smoothed from (2r + 1 further).
+    let m = (depth + bevel).ceil() as u32 + 4 * r as u32 + 4;
     let (fields, shift) = shape_fields(shape, xf, w, h, m, r)?;
     let mut frosted = back.clone();
     fx::blur(&mut frosted, g.frost / 2.0 * scale);
     let ang = g.light_angle.to_radians();
     let light = (ang.sin() as f32, -ang.cos() as f32);
+    // The layer's centre in its own frame (see `own_frame`), which `splay` bends away from: the
+    // direction to it is the same wherever a render puts or cuts the layer.
+    let local_centre = shape.0.bounding_box().center();
+    let ((sx, sy), centre) = match own_frame(xf) {
+        Some(own) => (own.shift, own.xf * local_centre),
+        None => ((0, 0), xf * local_centre),
+    };
     let (refraction, dispersion, bevel) = (g.refraction as f32, (g.dispersion * Glass::DISPERSION_SPREAD) as f32, bevel as f32);
-    let power = (6.0 - 5.0 * g.splay) as f32;
-    let (band, reach) = (band as f32, reach as f32);
-    // The falloff, lowered by its value at `reach` and scaled back to 1 at the edge, so the light
-    // fades out to 0 at `reach` instead of stopping there.
-    let floor = (-reach / band).exp();
-    let fall = 1.0 - floor;
-    let intensity = g.light_intensity as f32;
-    let depth = depth as f32;
+    let (splay, intensity, depth) = (g.splay as f32, g.light_intensity as f32, depth as f32);
     let mut out = Pixmap::new(w, h)?;
     let dst = out.data_mut();
     for y in 0..h as usize {
@@ -508,30 +559,37 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
             if c <= 0.0 {
                 continue;
             }
-            let bend = bend_at(d, depth, bevel, refraction);
             let (bx, by) = (x as f32 + pad as f32 + 0.5, y as f32 + pad as f32 + 0.5);
-            let base = if bend == 0.0 {
-                // Nothing bends (past `depth` + `bevel`, or no refraction): the channels' samples
-                // are at the same point, so one sample.
-                let s = sample(&frosted, bx, by);
-                [s[0].min(s[3]), s[1].min(s[3]), s[2].min(s[3]), s[3]]
+            let (base, add) = if d >= depth + bevel {
+                // Past the curve nothing bends and no light falls (the rim light and the gradient
+                // are 0 there): the channels' samples are at the same point, so one sample.
+                (dispersed(&frosted, bx, by, 0.0, 0.0, 0.0), 0.0)
             } else {
-                dispersed(&frosted, bx, by, inward.0 * bend, inward.1 * bend, dispersion)
-            };
-            // The rim catches the light where it faces it, and half as much opposite. It fades out
-            // by `reach` and is none past it, wherever the layer is cut.
-            let hl = if d < reach && fall > 0.0 {
+                // The curve's outward direction: the edge's normal, turned by `splay` towards the
+                // way away from the centre (not renormalised: where the two part, the bend is less).
+                let away = if splay > 0.0 {
+                    let px = ((x as i64 - sx) as f64 + 0.5 - centre.x) as f32;
+                    let py = ((y as i64 - sy) as f64 + 0.5 - centre.y) as f32;
+                    let len = (px * px + py * py).sqrt();
+                    if len > 1e-6 { (px / len, py / len) } else { (0.0, 0.0) }
+                } else {
+                    (0.0, 0.0)
+                };
+                let out_dir = (-inward.0 * (1.0 - splay) + away.0 * splay, -inward.1 * (1.0 - splay) + away.1 * splay);
+                // No refraction: nothing bends, so one sample (`dispersed` with no move).
+                let bend = bend_at(d, depth, bevel, refraction);
+                let k = if bend == 0.0 { 0.0 } else { dispersion };
+                let base = dispersed(&frosted, bx, by, -out_dir.0 * bend, -out_dir.1 * bend, k);
+                // The bevel catches the light as a line added to the backdrop, by how much the edge
+                // faces it; across the curve a faint gradient, darker on the side facing it.
                 let facing = -(inward.0 * light.0 + inward.1 * light.1);
-                let spec = facing.max(0.0).powf(power) + 0.5 * (-facing).max(0.0).powf(power);
-                (intensity * spec * ((-d / band).exp() - floor) / fall).clamp(0.0, 1.0)
-            } else {
-                0.0
+                let rim = rim_light_at(d, bevel) * catches(facing);
+                let sheen = -(out_dir.0 * light.0 + out_dir.1 * light.1) * sheen_at(d, depth, bevel) * BROAD;
+                (base, 255.0 * intensity * (rim + sheen))
             };
             let i = (y * w as usize + x) * 4;
             if let Some(p) = dst.get_mut(i..i + 4) {
-                for (o, v) in p.iter_mut().zip(base) {
-                    *o = ((v * (1.0 - hl) + 255.0 * hl) * c).round().clamp(0.0, 255.0) as u8;
-                }
+                p.copy_from_slice(&lit(base, add, c));
             }
         }
     }
@@ -673,14 +731,32 @@ mod tests {
         assert!(c.held <= 100 && !c.map.contains_key(&key(4)));
     }
 
+    /// The rim light and the gradient across the curve at depth 20 and a 1-unit bevel, x units in
+    /// from the edge: the reference profile's values.
     #[test]
-    fn light_reach_is_where_the_light_falls_under_half_a_level() {
-        let r = light_reach(10.0, 1.0);
-        assert!((255.0 * (-r / 10.0).exp() - 0.5).abs() < 1e-9, "{r}");
-        // No light, too faint to show, or a band that isn't a number: it reaches nowhere.
-        for (band, intensity) in [(10.0, 0.0), (10.0, 0.5 / 255.0), (f64::NAN, 1.0), (f64::INFINITY, 1.0)] {
-            assert_eq!(light_reach(band, intensity), 0.0, "{band} {intensity}");
+    fn the_light_lies_on_the_bevel_and_the_gradient_across_the_curve() {
+        for (x, rim, sheen) in [
+            (0.10, 1.0, 1.0),
+            (0.25, 0.9888, 1.0),
+            (0.50, 0.6843, 1.0),
+            (0.75, 0.2330, 1.0),
+            (1.00, 0.0, 1.0),
+            (2.0, 0.0, 0.8975),
+            (4.0, 0.0, 0.7091),
+            (6.0, 0.0, 0.5429),
+            (8.0, 0.0, 0.3989),
+            (16.0, 0.0, 0.0443),
+            (20.0, 0.0, 0.0),
+            (30.0, 0.0, 0.0),
+        ] {
+            assert!((rim_light_at(x, 1.0) - rim).abs() < 1e-3, "rim at {x}: {}", rim_light_at(x, 1.0));
+            assert!((sheen_at(x, 20.0, 1.0) - sheen).abs() < 1e-3, "gradient at {x}: {}", sheen_at(x, 20.0, 1.0));
         }
-        assert_eq!(light_reach(1e6, 1.0), MAX_LIGHT_PX);
+        // Facing the light fully, at 45° (cos 0.707) and side on; the opposite side 0.6 as much.
+        assert!((catches(1.0) - 1.0).abs() < 1e-6);
+        assert!((catches(std::f32::consts::FRAC_1_SQRT_2) - 0.574).abs() < 1e-3, "{}", catches(std::f32::consts::FRAC_1_SQRT_2));
+        assert_eq!(catches(0.0), 0.0);
+        assert!((catches(-1.0) - 0.6).abs() < 1e-6);
+        assert!((catches(-std::f32::consts::FRAC_1_SQRT_2) - 0.6 * 0.574).abs() < 1e-3);
     }
 }
diff --git a/crates/render/src/glass_cut_tests.rs b/crates/render/src/glass_cut_tests.rs
index 931243776..9bd74f80d 100644
--- a/crates/render/src/glass_cut_tests.rs
+++ b/crates/render/src/glass_cut_tests.rs
@@ -59,25 +59,31 @@ fn cut_diffs(d: &Document, p: NodeId) -> Vec<(u32, (u8, usize))> {
         .collect()
 }
 
-/// A pane deeper than the light may reach, over black and lit from the left: across its middle row
-/// each pixel is the light alone. It fades out smoothly where it stops, with no ring.
+/// A deep pane over black, lit from the left, at 2× (its 1-unit bevel 2 px wide): across its middle
+/// row the left rim catches the light, the right rim 0.6 as much, and in between only the faint
+/// gradient across the curve shows (black can't darken, so the lit half stays black), changing
+/// smoothly, with no ring.
 #[test]
-fn the_light_fades_out_where_it_stops() {
+fn the_light_is_a_line_on_the_bevel() {
     let mut d = Document::new("glass");
     let p = d.first_page().unwrap();
     let back = d.create(p, NodeKind::Rectangle, "Back", 0.0, 0.0, 700.0, 700.0).unwrap();
     d.get_mut(back).unwrap().fills = vec![Paint::solid(Color::BLACK)];
     let pane = d.create(p, NodeKind::Rectangle, "Glass", 50.0, 50.0, 600.0, 600.0).unwrap();
-    let g = Glass { depth: 300.0, splay: 1.0, light_angle: -90.0, light_intensity: 1.0, frost: 0.0, refraction: 0.0, ..Glass::default() };
+    let g = Glass { depth: 300.0, light_angle: -90.0, light_intensity: 1.0, frost: 0.0, refraction: 0.0, ..Glass::default() };
     let n = d.get_mut(pane).unwrap();
     n.fills.clear();
     n.effects = vec![Effect { kind: EffectKind::Glass(g), visible: true }];
     let full = render_view_single(&d, p, &View { origin: (0.0, 0.0), scale: 2.0, width: 1400, height: 1400 }, &Options::default()).unwrap();
     let row = &full.data()[700 * 1400 * 4..][..1400 * 4];
-    let red: Vec<u8> = row.chunks(4).map(|px| px[0]).skip(101).take(598).collect();
-    let step = red.windows(2).map(|w| w[0].abs_diff(w[1])).max().unwrap();
-    assert!(step <= 2, "the light jumps {step} levels between neighbouring pixels");
-    assert!(red[0] > 200 && red[597] < red[0], "lit at the edge, fading in: {} … {}", red[0], red[597]);
+    let red: Vec<u8> = row.chunks(4).map(|px| px[0]).collect();
+    // The pane covers pixels 100..1300 of the row.
+    let (left, right) = (red[100], red[1299]);
+    assert!(left > 230, "the left rim catches the light, less the gradient: {left}");
+    assert!((140..=175).contains(&right), "the right rim 0.6 as much, plus the gradient: {right}");
+    assert!(red[106] <= 14 && red[1293] <= 14, "3 units in, the gradient only: {} {}", red[106], red[1293]);
+    let step = red[104..1296].windows(2).map(|w| w[0].abs_diff(w[1])).max().unwrap();
+    assert!(step <= 2, "the gradient jumps {step} levels between neighbouring pixels");
 }
 
 /// Digests of glass renders over a spread of settings, scales and corners: compare two builds'
@@ -115,11 +121,13 @@ fn glass_digests() {
 
 #[test]
 fn a_cut_through_the_pane_matches_the_whole_render() {
-    // The last look is deep enough that the light is held to `MAX_LIGHT_PX`.
+    // The last look is deep (300 units), so the curve reaches far in from every cut.
     let looks = [
         wide_light(),
         Glass::default(),
         Glass { splay: 0.5, frost: 0.0, refraction: 0.0, ..Glass::default() },
+        // Splay with the bend and dispersion on: the dispersed samples follow the turned bend.
+        Glass { splay: 1.0, frost: 0.0, ..Glass::default() },
         Glass { depth: 300.0, ..wide_light() },
     ];
     // Rounded corners without the pane's fill: a fill's curved edge rasters 1–2 levels apart in a
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 312c7e0ac..3b31d3228 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # FigCraft parity with Figma
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
 
 The authoritative assessment of how close FigCraft is to Figma Design. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) is the ranked work list; the measured menu checklist is
@@ -648,6 +648,7 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it, 0.6 as much on the opposite side, with a faint gradient across the curve. `splay` turns the bend from along the edge's normal towards the way away from the layer's centre and no longer widens the light, as in the reference tool. Checked side by side on synthetic files: a splay of 1 bends the backdrop towards the centre in both. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Grade unchanged. |
 | 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile (most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in) and splits its colours over 8 steps, red and blue 0.16 of the bend apart at 100% dispersion. Measured against the reference tool on synthetic files at 2×: the black band a pane pulls to its edge ends within 3 px of the reference tool's, and red and blue part 2.27 px at 50% dispersion and 4.66 px at 100% (2.38 and 4.69 there). Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Grade unchanged. |
 | 2026-11-01 | patch | M4: bulleted lists draw the same bullet at every level of indentation ("Figma bullets will keep the same styling at all levels of indentation", Create bulleted and numbered lists); the deeper levels drew a white bullet and a small square, pinned as silent before. Numbered levels (1., a., i.) are unchanged. Found by a documentation audit of the text rules. Test: `tail_tests::list_numbering_by_level` (the bullets row). Numbers unchanged |
 | 2026-11-01 | patch | M4: typing `1)` followed by a space at the start of a plain paragraph starts a numbered list, as `1.` already did ("Enter one of the creation characters below followed by a Space: 1. 1)", Create bulleted and numbered lists). Found by a documentation audit of the text rules. Test: `text_tail_tests::typing_a_creation_character_and_a_space_starts_a_list`. Numbers unchanged |

From 8eb0b87646c5aef712326d6c431ccde5408630de Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <72558888+aleksei-suholita@users.noreply.github.com>
Date: Thu, 5 Nov 2026 22:59:27 +0100
Subject: [PATCH 55/70] M3: glass bends towards its core, and rounded
 rectangles work it out in closed form (#1889)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* M3: glass bends with the reference tool's thick-lens profile and splits its colours over 8 steps (#1885)

The backdrop bends most a 1-unit bevel in from the edge, falls off as the
3.5th power of the way out of the curve to nothing `depth` further in, and
moves a fifth as much on the bevel itself (it fell off as the square of the
way in from the very edge). Dispersion samples each channel at 8 steps along
the bend with a triangular window, red moving furthest and blue least (it was
three samples, blue furthest), as far apart as the reference tool's: at 100%
red and blue move 0.16 of the bend apart (`Glass::DISPERSION_SPREAD`).
`Glass::max_bend` bounds red's furthest step, so the backdrop read around a
pane covers every sample, and the field margin covers the bevel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's bend stays within `max_bend`, checked on a single bright pixel too (#1885)

Review follow-up: the bend reaches `depth` × `refraction` a bevel in from
the edge, so `Glass::max_bend` drops its 0.999 and bounds it, as a test now
checks for several refractions. A single white pixel on black pins the
dispersion's triangular window, which a ramp and a flat backdrop can't tell
from one centred sample. The parity assessment records the bend, the
dispersion and how they were measured against the reference tool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's light is a line on its bevel, and splay turns the bend towards the centre (#1885)

The light is a line on the 1-unit bevel added to the backdrop, as the
reference tool's: fully where the edge faces the light, none below 0.35 of
facing it and 0.6 as much on the opposite side, with a faint gradient across
the curve, 5% darker facing the light and lighter opposite. It was a glow
mixed towards white, as deep as `splay` made it, so `light_reach` goes.

`splay` turns the bend from along the edge's normal towards the way away
from the layer's centre, and no longer widens the light: files with a splay
above 0 look different. The direction to the centre is worked out in the
shape's own frame (`own_frame`, shared with the field cache), so cut renders
match the whole one byte for byte.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass bends towards its core, and rounded rectangles work it out in closed form (#1885)

The backdrop bends towards the glass's core, the shape shrunk by `depth`
and the bevel, instead of along the smoothed edge normal: round a sharp
corner the bend turns smoothly instead of meeting along the diagonal, and a
part thinner than twice that (a capsule, a letter's stroke) bends across
itself towards its own middle, pixels about as deep as any within 2 px. The
fields keep a bend direction beside the normal (an exact feature transform
from the core, box-blurred once), their key includes the core's depth, and
their margin covers the core.

Rectangles, frames, components, instances and sections whose corners aren't
smoothed, under a rotation, flip and even scale, work their glass out in
closed form (`AnalyticRect`): signed distance, the light's normal (corners
rounded to at least the bevel) and the bend direction (corners rounded to
the core) per pixel, in the layer's own frame, with nothing to rasterise,
transform or keep. A zoom frame draws in 40 ms instead of 54 and a resize
frame in 46 instead of 67 (`glass_render_timings`, release, 2×).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: cut renders of glass match with splay turning a dispersed bend (#1885)

Review follow-up: the cut-versus-whole test had splay only on looks without
refraction, so no turned bend reached the dispersion. A look with splay 1 and
the default bend and dispersion now renders the same however it is cut. The
parity assessment records the light on the bevel and splay's new meaning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M8: a glass too big to keep bends along its normals, and the core's fields take less memory (#1885)

Review follow-up: a shape that doesn't use the closed form and whose whole
window at the zoom, with the core's margin, would pass `MAX_SHAPE_PX`
(a large vector, text or smoothed rectangle, or a deep glass far zoomed in)
bends along its edge normals instead of working out a core, with the plain
margin. The choice depends on the shape and the zoom alone, so every band and
patch of a render agrees, and no render works out a core over more pixels
than a kept shape holds. The core's feature transform keeps `u32` indices
(16 bytes a pixel) and drops its maxima and core before making the
directions.

The edge normals are box-blurred twice again and the bend directions once,
as their docs say: the two were swapped.

The parity assessment records the bend towards the core and the closed form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's flat inside skips the bend's curve, and full dispersion stays within `max_bend` (#1885)

Review follow-up: `bend_at` returns 0 straight away past `depth` + the
bevel, where the curve and the bevel's easing are both 0, instead of
working out a power of 0 for every pixel of a pane's flat inside. A test
moves one white pixel along a row under every bend of the profile at full
dispersion and checks that no channel ever reads it further out than
`Glass::max_bend`, which sizes the backdrop read around a pane.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M3: glass's light shows over a transparent backdrop, and its flat inside skips the light (#1885)

Review follow-up: the light was added to the backdrop's colour and then
clamped to the backdrop's alpha, so with nothing under the glass (an
export of the pane alone) the line on the bevel vanished, where the old
glow raised the alpha and showed. Now the alpha rises as far as the lit
colour needs (`lit`), and stays the backdrop's wherever the light fits
under it, so renders over an opaque backdrop don't change.

Past `depth` + the bevel the rim light, the gradient and the bend are all
0, so those pixels take one sample of the backdrop and skip the light's
direction, facing and splay work, as the old glow's `reach` early-out did.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* M8: a kept glass shape works out only its bend again when the depth changes, and a core gets a wider margin (#1885)

Review follow-up. The field cache was keyed on the core's exact depth, so
every step of the Depth slider missed it and worked the whole shape out
again over a window twice as wide: coverage, distances, normals, the
feature transform and the blur, every frame, for every shape that isn't a
plain rounded rectangle. Only the bend directions depend on the depth. The
kept fields (`EdgeFields`: coverage, distances, normals) are now keyed
without it, and hold the bend directions for the last two depths asked
for beside them, so a new depth works out only those (`EdgeFields::bends`).
Two glass layers of one shape at different depths each keep theirs.

The margin a core takes was `reach` + 2 px past the plain one, but the
nearest core pixel can be √2 × `reach` away round a sharp corner, past
what that covers once `reach` is over about 91 px. It is now
1.5 × `reach` + 2 px past the plain margin. The cut-through-the-pane test
gets a 60-unit-deep look (a core 122 px in at 2×).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Glass: splay's doc says splay 0 bends towards the core

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
---
 ROADMAP.md                           |   4 +-
 crates/doc/src/props.rs              |   4 +-
 crates/render/src/backdrop.rs        |   2 +-
 crates/render/src/glass.rs           | 587 ++++++++++++++++++++++++---
 crates/render/src/glass_cut_tests.rs |  31 +-
 docs/target-app-parity.md            |   7 +-
 6 files changed, 579 insertions(+), 56 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 6dc415125..60f5962d2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends towards its core, and rounded rectangles work it out in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -358,6 +358,8 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | patch | M8, #1885: a glass whose shape is too big to keep whole at the zoom (past `MAX_SHAPE_PX` with its core's margin) bends along its edge normals instead of working out a core, so its fields never cover more pixels than a kept shape's, and the core's feature transform holds 16 bytes a pixel. The edge normals are box-blurred twice again and the bend directions once, as documented. Test: `glass::tests::a_shape_too_big_to_keep_bends_along_its_normals`. Numbers unchanged |
+| 2026-11-02 | minor | M3, #1885: glass bends the backdrop towards its core, the shape shrunk by `depth` and the bevel, as the reference tool's: round a sharp corner the bend turns smoothly instead of meeting along the diagonal, and a part thinner than twice that (a capsule, a letter's stroke) bends across itself towards its own middle (pixels about as deep as any within 2 px). Rectangles, frames, components, instances and sections whose corners aren't smoothed work their glass out in closed form, with nothing to rasterise, transform or keep: a zoom frame draws in 40 ms instead of 54 and a resize frame in 46 instead of 67 (`glass_render_timings`, release, 2×). Other shapes keep their fields, with the bend directions for the last two depths asked for beside them, so dragging the Depth slider works out only those again. Tests: `glass::tests::a_sharp_corner_bends_round_towards_the_core`, `glass::tests::a_thin_part_bends_across_itself`, `glass::tests::neighbouring_strokes_bend_towards_their_own_middles`, `glass::tests::a_rounded_rectangle_in_closed_form_matches_its_distance_transform`, `glass_cut_tests::what_the_shape_depends_on_works_it_out_again_and_nothing_else_does`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it and 0.6 as much on the opposite side, with a faint gradient across the curve, 5% darker facing the light and lighter opposite (it was a glow mixed towards white, as deep as `splay` made it). `splay` turns the bend from along the edge's normal towards the way away from the layer's centre, as the reference tool's does, and no longer widens the light: files with a splay above 0 look different. The direction to the centre is worked out in the shape's own frame, so cut renders match. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile: most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in, and a fifth as much on the bevel itself (it fell off as the square of the way in from the very edge). Dispersion splits the channels over 8 steps with a triangular window, red moving furthest and blue least, as far apart as the reference tool's (at 100% red and blue move 0.16 of the bend apart; it was three samples, blue furthest), and `Glass::max_bend` bounds red's furthest step, so the backdrop read around a pane covers every sample. Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass effects take variables (light angle, intensity, refraction, depth, dispersion, frost and splay, on layers and in effect styles, and from the Design panel's glass fields), and a glass's frost stays within 0–100, the reference tool's range: a larger frost from an older file draws at 100, and the field, a bound variable and scaling stop there. Numbers unchanged |
diff --git a/crates/doc/src/props.rs b/crates/doc/src/props.rs
index 75dca8913..11c3c16a4 100644
--- a/crates/doc/src/props.rs
+++ b/crates/doc/src/props.rs
@@ -662,8 +662,8 @@ pub struct Glass {
     pub dispersion: f64,
     /// Blur of the backdrop (a blur radius, document units, 0–[`Self::MAX_FROST`]).
     pub frost: f64,
-    /// Which way the curved edge bends the backdrop: along the edge's normal (0) to away from the
-    /// layer's centre (1).
+    /// Which way the curved edge bends the backdrop: towards the shape's core (0; along the edge's
+    /// normal for a shape too big to work one out) to away from the layer's centre (1).
     pub splay: f64,
 }
 
diff --git a/crates/render/src/backdrop.rs b/crates/render/src/backdrop.rs
index 031046c18..97aec946b 100644
--- a/crates/render/src/backdrop.rs
+++ b/crates/render/src/backdrop.rs
@@ -160,7 +160,7 @@ pub fn effects(n: &Node, frame: EffectFrame<'_>) -> Option<Pixmap> {
                 fx::mask_by(&mut l, cov.as_ref()?, false);
                 l
             }
-            EffectKind::Glass(g) => glass::glass(g, frame)?,
+            EffectKind::Glass(g) => glass::glass(g, frame, glass::RoundedRect::of(n))?,
             _ => continue,
         };
         match out.as_mut() {
diff --git a/crates/render/src/glass.rs b/crates/render/src/glass.rs
index 0ccbf2c2f..f84aad971 100644
--- a/crates/render/src/glass.rs
+++ b/crates/render/src/glass.rs
@@ -16,15 +16,17 @@
 //! later render asks for the same shape at the same zoom they are worked out for the whole shape,
 //! in its own pixel frame, and kept in a cache of at most [`MAX_CACHED_BYTES`]: moving or editing
 //! what lies under the glass, dragging its sliders, panning and patching the canvas reuse them.
-//! Zooming doesn't (each zoom is new).
+//! Zooming doesn't (each zoom is new). The bend directions towards the core depend on the depth
+//! too: they are kept beside them for the last two depths asked for, so dragging the Depth slider
+//! works out only those again.
 
 use std::collections::HashMap;
 use std::hash::{DefaultHasher, Hash, Hasher};
 use std::sync::{Arc, Mutex, OnceLock};
 
-use figcraft_doc::Glass;
-use figcraft_geom::Affine;
+use figcraft_doc::{Glass, Node, NodeKind};
 use figcraft_geom::kurbo::Shape as _;
+use figcraft_geom::{Affine, Point};
 use tiny_skia::Pixmap;
 
 use crate::backdrop::EffectFrame;
@@ -33,8 +35,9 @@ use crate::shadow::{Outline, spread_alpha};
 
 /// Squared distance transform of one row or column (Felzenszwalb & Huttenlocher): `f` holds 0 at
 /// sources and a large value elsewhere; `d` gets each sample's squared distance to the nearest
-/// source. `v` and `z` are scratch space (`f.len()` and `f.len() + 1` long).
-fn edt_1d(f: &[f64], d: &mut [f64], v: &mut [usize], z: &mut [f64]) {
+/// source, and `src`, when given, that source's index. `v` and `z` are scratch space (`f.len()` and
+/// `f.len() + 1` long).
+fn edt_1d(f: &[f64], d: &mut [f64], v: &mut [usize], z: &mut [f64], mut src: Option<&mut [usize]>) {
     let n = f.len();
     // Every index below stays under these lengths (k <= q < n), checked once here.
     if n == 0 || d.len() < n || v.len() < n || z.len() < n + 1 {
@@ -75,6 +78,9 @@ fn edt_1d(f: &[f64], d: &mut [f64], v: &mut [usize], z: &mut [f64]) {
         }
         let dv = qf - v[k] as f64;
         d[q] = dv * dv + f[v[k]];
+        if let Some(o) = src.as_deref_mut().and_then(|s| s.get_mut(q)) {
+            *o = v[k];
+        }
     }
 }
 
@@ -92,7 +98,7 @@ pub fn inside_distance(cov: &Pixmap) -> Vec<f32> {
                 *fy = *gv;
             }
         }
-        edt_1d(f.get(..h).unwrap_or(&[]), d.get_mut(..h).unwrap_or(&mut []), &mut v, &mut z);
+        edt_1d(f.get(..h).unwrap_or(&[]), d.get_mut(..h).unwrap_or(&mut []), &mut v, &mut z, None);
         for y in 0..h {
             if let (Some(gv), Some(dy)) = (g.get_mut(y * w + x), d.get(y)) {
                 *gv = *dy;
@@ -104,7 +110,7 @@ pub fn inside_distance(cov: &Pixmap) -> Vec<f32> {
         if let (Some(src), Some(dst)) = (g.get(row..row + w), f.get_mut(..w)) {
             dst.copy_from_slice(src);
         }
-        edt_1d(f.get(..w).unwrap_or(&[]), d.get_mut(..w).unwrap_or(&mut []), &mut v, &mut z);
+        edt_1d(f.get(..w).unwrap_or(&[]), d.get_mut(..w).unwrap_or(&mut []), &mut v, &mut z, None);
         if let (Some(dst), Some(src)) = (g.get_mut(row..row + w), d.get(..w)) {
             dst.copy_from_slice(src);
         }
@@ -113,6 +119,133 @@ pub fn inside_distance(cov: &Pixmap) -> Vec<f32> {
     g.iter().map(|s| if *s > 0.0 { (s.sqrt() - 0.5).max(0.0) as f32 } else { 0.0 }).collect()
 }
 
+/// [`nearest_sites`]' answer for a pixel with no site.
+const NO_SITE: u32 = u32::MAX;
+
+/// For each pixel of a `w` × `h` grid, the nearest pixel (centre to centre) where `site` is true, as
+/// its index, or [`NO_SITE`] when there is none: the exact Euclidean feature transform (the distance
+/// transform above, keeping where each distance comes from). 16 bytes a pixel at most.
+fn nearest_sites(site: &[bool], w: usize, h: usize) -> Vec<u32> {
+    const FAR: f64 = 1e20;
+    let n = w.max(h);
+    let (mut f, mut d, mut v, mut z, mut src) = (vec![0f64; n], vec![0f64; n], vec![0usize; n], vec![0f64; n + 1], vec![0usize; n]);
+    // Down each column: the squared distance to its nearest site, and that site's row.
+    let (mut col_d, mut col_row) = (vec![FAR; w * h], vec![NO_SITE; w * h]);
+    for x in 0..w {
+        for y in 0..h {
+            if let Some(fy) = f.get_mut(y) {
+                *fy = if site.get(y * w + x).copied().unwrap_or(false) { 0.0 } else { FAR };
+            }
+        }
+        edt_1d(f.get(..h).unwrap_or(&[]), d.get_mut(..h).unwrap_or(&mut []), &mut v, &mut z, src.get_mut(..h));
+        for y in 0..h {
+            if let (Some(cd), Some(cr), Some(dy), Some(sy)) = (col_d.get_mut(y * w + x), col_row.get_mut(y * w + x), d.get(y), src.get(y)) {
+                (*cd, *cr) = (*dy, u32::try_from(*sy).unwrap_or(NO_SITE));
+            }
+        }
+    }
+    // Along each row: the nearest of those, by the column it is in.
+    let mut out = vec![NO_SITE; w * h];
+    for y in 0..h {
+        let row = y * w;
+        if let (Some(dst), Some(from)) = (f.get_mut(..w), col_d.get(row..row + w)) {
+            dst.copy_from_slice(from);
+        }
+        edt_1d(f.get(..w).unwrap_or(&[]), d.get_mut(..w).unwrap_or(&mut []), &mut v, &mut z, src.get_mut(..w));
+        for x in 0..w {
+            if let (Some(dx), Some(sx)) = (d.get(x), src.get(x))
+                && *dx < FAR / 2.0
+                && let (Some(o), Some(&sy)) = (out.get_mut(row + x), col_row.get(row + *sx))
+                && sy != NO_SITE
+            {
+                *o = u32::try_from(sy as usize * w + sx).unwrap_or(NO_SITE);
+            }
+        }
+    }
+    out
+}
+
+/// The largest of `src` (`w` × `h`) within `r` pixels across and down of each pixel (a square
+/// window): running maxima along the rows, then the columns.
+fn max_within(src: &[f32], w: usize, h: usize, r: usize) -> Vec<f32> {
+    let (mut rows, mut out) = (vec![0f32; w * h], vec![0f32; w * h]);
+    max_pass(src, &mut rows, w, h, r, true);
+    max_pass(&rows, &mut out, w, h, r, false);
+    out
+}
+
+/// One pass of [`max_within`] along rows (`rows`) or columns: a queue holds the window's candidates
+/// for its largest, falling from the front, so each value enters and leaves it once.
+fn max_pass(src: &[f32], dst: &mut [f32], w: usize, h: usize, r: usize, rows: bool) {
+    let (lines, len, step, across) = if rows { (h, w, 1, w) } else { (w, h, w, 1) };
+    let mut queue = std::collections::VecDeque::new();
+    for l in 0..lines {
+        let base = l * across;
+        let at = |i: usize| src.get(base + i * step).copied().unwrap_or(0.0);
+        queue.clear();
+        let mut next = 0;
+        for i in 0..len {
+            while next < len && next <= i + r {
+                let v = at(next);
+                while queue.back().is_some_and(|&b| at(b) <= v) {
+                    queue.pop_back();
+                }
+                queue.push_back(next);
+                next += 1;
+            }
+            while queue.front().is_some_and(|&f| f + r < i) {
+                queue.pop_front();
+            }
+            if let (Some(o), Some(&f)) = (dst.get_mut(base + i * step), queue.front()) {
+                *o = at(f);
+            }
+        }
+    }
+}
+
+/// How far around (pixels) a pixel counts as the middle of a thin part: no deeper than the pixels
+/// within this many across and down, give or take [`RIDGE_SLACK`].
+const RIDGE_PX: usize = 2;
+
+/// How much shallower than the deepest pixel within [`RIDGE_PX`] a pixel can be and still count as
+/// a thin part's middle: half a pixel per pixel, so a gently tapering stroke keeps its middle while
+/// the diagonal running into a corner (depth rising by 0.7 px per pixel, more in the window) and
+/// the band along an edge (1 px per pixel) do not.
+const RIDGE_SLACK: f32 = 0.5 * RIDGE_PX as f32;
+
+/// Unit inward directions from each pixel of a shape (`dist`, its inside distance field, `w` × `h`)
+/// to the nearest point of its core, which the glass bends the backdrop towards: where the shape
+/// is `reach` pixels deep or more, and the middle of each part thinner than that (a capsule, a
+/// letter's stroke: pixels about as deep as any within [`RIDGE_PX`]). Bending towards the core
+/// rather than along the edge's normal rounds a sharp corner's bend (no seam along its diagonal)
+/// and makes a thin part bend across itself, each part towards its own middle. Box-blurred once
+/// over `r` pixels (the normals twice: these are smooth already, but turn round at a thin part's
+/// middle); zero on the core and outside.
+fn bend_directions(dist: &[f32], w: usize, h: usize, reach: f32, r: usize) -> Vec<(f32, f32)> {
+    // The maxima and the core are dropped before the directions are made, keeping the peak down.
+    let near = {
+        let around = max_within(dist, w, h, RIDGE_PX);
+        let core: Vec<bool> = dist.iter().zip(&around).map(|(d, m)| *d > 0.0 && (*d >= reach - 1e-3 || *d >= m - RIDGE_SLACK - 1e-3)).collect();
+        nearest_sites(&core, w, h)
+    };
+    let (mut gx, mut gy) = (vec![0f32; w * h], vec![0f32; w * h]);
+    for (i, &s) in near.iter().enumerate() {
+        if s != NO_SITE
+            && let Some(d) = dist.get(i)
+            && *d > 0.0
+            && let (Some(a), Some(b)) = (gx.get_mut(i), gy.get_mut(i))
+        {
+            let s = s as usize;
+            let (dx, dy) = ((s % w) as f32 - (i % w) as f32, (s / w) as f32 - (i / w) as f32);
+            let len = (dx * dx + dy * dy).sqrt();
+            if len > 1e-6 {
+                (*a, *b) = (dx / len, dy / len);
+            }
+        }
+    }
+    smoothed_units(gx, gy, w, h, r, 1)
+}
+
 /// Running-sum box blur of a `w` × `h` field along rows (`stride` 1) or columns (`stride` `w`),
 /// radius `r`, zero outside.
 fn box_pass(src: &[f32], dst: &mut [f32], w: usize, h: usize, r: usize, rows: bool) {
@@ -151,9 +284,15 @@ fn smooth_normals(dist: &[f32], w: usize, h: usize, r: usize) -> Vec<(f32, f32)>
             }
         }
     }
+    smoothed_units(gx, gy, w, h, r, 2)
+}
+
+/// The vectors (`gx`, `gy`) of a `w` × `h` field box-blurred `times` over `r` pixels and made unit
+/// length; zero where they cancel out (no direction).
+fn smoothed_units(mut gx: Vec<f32>, mut gy: Vec<f32>, w: usize, h: usize, r: usize, times: usize) -> Vec<(f32, f32)> {
     let mut tmp = vec![0f32; w * h];
     for g in [&mut gx, &mut gy] {
-        for _ in 0..2 {
+        for _ in 0..times {
             box_pass(g, &mut tmp, w, h, r, true);
             box_pass(&tmp, g, w, h, r, false);
         }
@@ -303,9 +442,10 @@ fn sample(p: &Pixmap, x: f32, y: f32) -> [f32; 4] {
     })
 }
 
-/// A shape's coverage (alpha), distance to its edge and smoothed inward normals over a window of
-/// pixels whose top-left pixel is (`x0`, `y0`).
-struct Fields {
+/// A shape's coverage (alpha), distance to its edge and smoothed inward normals (which the light
+/// reads) over a window of pixels whose top-left pixel is (`x0`, `y0`): what the shape and the zoom
+/// alone decide, so it is kept whatever the depth ([`whole_shape`]).
+struct EdgeFields {
     x0: i64,
     y0: i64,
     w: usize,
@@ -313,36 +453,101 @@ struct Fields {
     cov: Vec<u8>,
     dist: Vec<f32>,
     normals: Vec<(f32, f32)>,
+    /// How far the normals and the bend directions are smoothed (pixels).
+    r: usize,
+    /// The bend directions for the last [`KEPT_BENDS`] core depths asked for, by their bits, the
+    /// most recent last ([`EdgeFields::bends()`]).
+    bends: Mutex<Vec<(u32, Bends)>>,
 }
 
-/// Bytes a field pixel holds: coverage, distance and a normal.
-const FIELD_PX_BYTES: u64 = 1 + 4 + 8;
+/// How many depths' bend directions a kept shape holds: two glass layers of the same shape with
+/// different depths don't take turns working theirs out.
+const KEPT_BENDS: usize = 2;
 
-impl Fields {
+/// Inward bend directions ([`bend_directions`]) over an [`EdgeFields`] window.
+type Bends = Arc<Vec<(f32, f32)>>;
+
+/// The fields `glass` reads: a shape's [`EdgeFields`] and its bend directions for one depth.
+struct Fields {
+    edge: Arc<EdgeFields>,
+    /// `None` for a shape too big to work out a core ([`fits_whole`]): it bends along its normals.
+    bends: Option<Bends>,
+}
+
+/// Bytes a field pixel holds: coverage, distance, a normal and [`KEPT_BENDS`] bend directions.
+const FIELD_PX_BYTES: u64 = 1 + 4 + 8 + 8 * KEPT_BENDS as u64;
+
+/// A pixel of [`Fields`]: coverage (0–1), distance to the edge, inward normal, inward bend direction.
+type FieldPx = (f32, f32, (f32, f32), (f32, f32));
+
+impl EdgeFields {
     /// The fields of `cov`, the shape's coverage on the window at (`x0`, `y0`), normals smoothed
     /// over `r` pixels.
-    fn new(cov: &Pixmap, x0: i64, y0: i64, r: usize) -> Fields {
+    fn new(cov: &Pixmap, x0: i64, y0: i64, r: usize) -> EdgeFields {
         FIELDS_COMPUTED.with(|n| n.set(n.get() + 1));
         let dist = inside_distance(cov);
         let (w, h) = (cov.width() as usize, cov.height() as usize);
         let normals = smooth_normals(&dist, w, h, r);
         let cov = cov.data().chunks_exact(4).map(|p| p.get(3).copied().unwrap_or(0)).collect();
-        Fields { x0, y0, w, h, cov, dist, normals }
+        EdgeFields { x0, y0, w, h, cov, dist, normals, r, bends: Mutex::new(Vec::new()) }
     }
 
-    /// Coverage (0–1), distance and inward normal at pixel (`x`, `y`); `None` outside the window.
-    fn at(&self, x: i64, y: i64) -> Option<(f32, f32, (f32, f32))> {
-        let (fx, fy) = (x.checked_sub(self.x0)?, y.checked_sub(self.y0)?);
-        if fx < 0 || fy < 0 || fx >= self.w as i64 || fy >= self.h as i64 {
+    /// The bend directions towards the core `reach` pixels in: kept from a recent render at the
+    /// same depth, else worked out and kept in place of the least recent (bands of one render
+    /// asking at once wait for the first).
+    fn bends(&self, reach: f32) -> Bends {
+        let bits = reach.to_bits();
+        let mut kept = self.bends.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        if let Some(i) = kept.iter().position(|(b, _)| *b == bits) {
+            let hit = kept.remove(i);
+            let bends = hit.1.clone();
+            kept.push(hit);
+            return bends;
+        }
+        BENDS_COMPUTED.with(|n| n.set(n.get() + 1));
+        let bends = Arc::new(bend_directions(&self.dist, self.w, self.h, reach, self.r));
+        if kept.len() >= KEPT_BENDS {
+            kept.remove(0);
+        }
+        kept.push((bits, bends.clone()));
+        bends
+    }
+}
+
+impl Fields {
+    /// The fields of `cov`, the shape's coverage on the window at (`x0`, `y0`), normals and bend
+    /// directions smoothed over `r` pixels, bending towards the core `reach` pixels in (along the
+    /// normals without a `reach`).
+    fn new(cov: &Pixmap, x0: i64, y0: i64, r: usize, reach: Option<f32>) -> Fields {
+        Fields::of(Arc::new(EdgeFields::new(cov, x0, y0, r)), reach)
+    }
+
+    /// `edge`'s fields bending towards the core `reach` pixels in (along the normals without one).
+    fn of(edge: Arc<EdgeFields>, reach: Option<f32>) -> Fields {
+        let bends = reach.map(|reach| edge.bends(reach));
+        Fields { edge, bends }
+    }
+
+    /// The fields at pixel (`x`, `y`); `None` outside the window.
+    fn at(&self, x: i64, y: i64) -> Option<FieldPx> {
+        let e = &*self.edge;
+        let (fx, fy) = (x.checked_sub(e.x0)?, y.checked_sub(e.y0)?);
+        if fx < 0 || fy < 0 || fx >= e.w as i64 || fy >= e.h as i64 {
             return None;
         }
-        let i = fy as usize * self.w + fx as usize;
-        Some((f32::from(*self.cov.get(i)?) / 255.0, *self.dist.get(i)?, *self.normals.get(i)?))
+        let i = fy as usize * e.w + fx as usize;
+        let normal = *e.normals.get(i)?;
+        let bend = match &self.bends {
+            Some(bends) => *bends.get(i)?,
+            None => normal,
+        };
+        Some((f32::from(*e.cov.get(i)?) / 255.0, *e.dist.get(i)?, normal, bend))
     }
 }
 
 thread_local! {
     static FIELDS_COMPUTED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+    static BENDS_COMPUTED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
 }
 
 /// How many times this thread has worked out a glass shape's fields: what a cache miss costs. For
@@ -351,9 +556,16 @@ pub fn glass_fields_computed() -> u64 {
     FIELDS_COMPUTED.with(std::cell::Cell::get)
 }
 
-/// What a glass shape's fields depend on, with the transform's translation reduced to its fraction
-/// of a pixel: the same shape at the same zoom has the same key wherever it is and however a render
-/// cuts it.
+/// How many times this thread has worked out a glass shape's bend directions towards its core: a
+/// new shape, or a kept one at a new depth. For tests and benchmarks.
+pub fn glass_bends_computed() -> u64 {
+    BENDS_COMPUTED.with(std::cell::Cell::get)
+}
+
+/// What a glass shape's [`EdgeFields`] depend on, with the transform's translation reduced to its
+/// fraction of a pixel: the same shape at the same zoom has the same key wherever it is and however
+/// a render cuts it. Not the depth (beyond the margin and smoothing): the bend directions that
+/// depend on it are worked out from the kept fields ([`EdgeFields::bends()`]).
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 struct ShapeKey {
     path: u64,
@@ -376,7 +588,7 @@ const MAX_CACHED_BYTES: u64 = 128 << 20;
 const MAX_CACHED_BYTES: u64 = 32 << 20;
 
 /// A shape's fields once worked out; parallel bands wanting the same shape wait for one of them.
-type Slot = Arc<OnceLock<Option<Arc<Fields>>>>;
+type Slot = Arc<OnceLock<Option<Arc<EdgeFields>>>>;
 
 /// The shapes' fields by key, at most `budget` bytes; the least recently used go first. A shape is
 /// kept from the second render that asks for it: one asked for once (each step of a zoom, a pane
@@ -440,20 +652,33 @@ fn shape_cache() -> &'static Mutex<ShapeCache> {
     C.get_or_init(|| Mutex::new(ShapeCache::new(MAX_CACHED_BYTES)))
 }
 
+/// Whether `shape` (through `xf`) fits [`MAX_SHAPE_PX`] whole with a margin `m` round it: the
+/// window a kept shape's fields cover ([`whole_shape`]). Depends on the shape and the zoom alone, so
+/// every band and patch of a render answers the same.
+fn fits_whole(shape: &Outline, xf: Affine, m: u32) -> bool {
+    let Some(own) = own_frame(xf) else { return false };
+    let bb = (own.xf * shape.0.clone()).bounding_box();
+    let margin = f64::from(m.div_ceil(32).saturating_mul(32));
+    let (w, h) = (bb.x1.ceil() - bb.x0.floor() + 2.0 + 2.0 * margin, bb.y1.ceil() - bb.y0.floor() + 2.0 + 2.0 * margin);
+    let px = w * h;
+    px.is_finite() && px <= MAX_SHAPE_PX as f64
+}
+
 /// The fields `glass` reads for a `w` × `h` layer whose `shape` maps through `xf` (local → layer
-/// pixels), exact for distances up to the margin `m`, normals smoothed over `r` pixels, and the
-/// shift from layer pixels to the fields' pixels.
+/// pixels), exact for distances up to the margin `m`, normals and bend directions smoothed over
+/// `r` pixels, bending towards the core `reach` pixels in, and the shift from layer pixels to the
+/// fields' pixels.
 ///
 /// A shape asked for again in a later render, whose window fits [`MAX_SHAPE_PX`], is worked out
 /// whole, in its own frame (the translation's fraction of a pixel), and kept: a band, a canvas
 /// patch or the next frame of a drag reads the same fields. Otherwise it is worked out for the part
 /// shown plus the margin.
-fn shape_fields(shape: &Outline, xf: Affine, w: u32, h: u32, m: u32, r: usize) -> Option<(Arc<Fields>, (i64, i64))> {
-    if let Some(whole) = whole_shape(shape, xf, m, r) {
-        return Some(whole);
+fn shape_fields(shape: &Outline, xf: Affine, w: u32, h: u32, m: u32, r: usize, reach: Option<f32>) -> Option<(Fields, (i64, i64))> {
+    if let Some((edge, shift)) = whole_shape(shape, xf, m, r) {
+        return Some((Fields::of(edge, reach), shift));
     }
     let cov = spread_alpha(std::slice::from_ref(shape), 0.0, Affine::translate((f64::from(m), f64::from(m))) * xf, w + 2 * m, h + 2 * m)?;
-    Some((Arc::new(Fields::new(&cov, -i64::from(m), -i64::from(m), r)), (0, 0)))
+    Some((Fields::new(&cov, -i64::from(m), -i64::from(m), r, reach), (0, 0)))
 }
 
 /// A layer transform split so the same shape at the same zoom lands on the same pixels of its own
@@ -484,9 +709,9 @@ fn own_frame(xf: Affine) -> Option<OwnFrame> {
     Some(OwnFrame { shift, frac, xf: Affine::new([a, b, c, d, frac.0 as f64 / STEPS, frac.1 as f64 / STEPS]) })
 }
 
-/// [`shape_fields`] for a whole shape, from the cache; `None` when it isn't kept (first asked for
-/// in this render, too big, or its transform too far out).
-fn whole_shape(shape: &Outline, xf: Affine, m: u32, r: usize) -> Option<(Arc<Fields>, (i64, i64))> {
+/// [`shape_fields`]' [`EdgeFields`] for a whole shape, from the cache; `None` when it isn't kept
+/// (first asked for in this render, too big, or its transform too far out).
+fn whole_shape(shape: &Outline, xf: Affine, m: u32, r: usize) -> Option<(Arc<EdgeFields>, (i64, i64))> {
     let [a, b, c, d, _, _] = xf.as_coeffs();
     let OwnFrame { shift, frac, xf: own } = own_frame(xf)?;
     let bb = (own * shape.0.clone()).bounding_box();
@@ -518,26 +743,178 @@ fn whole_shape(shape: &Outline, xf: Affine, m: u32, r: usize) -> Option<(Arc<Fie
             win.data_mut().get_mut(start..start + row)?.copy_from_slice(src);
         }
         let origin = (x0 as i64 - 1 - i64::from(margin), y0 as i64 - 1 - i64::from(margin));
-        Some(Fields::new(&win, origin.0, origin.1, r))
+        Some(EdgeFields::new(&win, origin.0, origin.1, r))
     };
     let slot =
         shape_cache().lock().unwrap_or_else(std::sync::PoisonError::into_inner).slot(&key, ww * wh * FIELD_PX_BYTES, crate::render_number())?;
     Some((slot.get_or_init(|| compute().map(Arc::new)).clone()?, shift))
 }
 
+/// A layer whose glass shape is a rectangle with circular corners: its size and corner radii
+/// (top-left, top-right, bottom-right, bottom-left), as [`figcraft_geom::rounded_rect`] draws them.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct RoundedRect {
+    pub width: f64,
+    pub height: f64,
+    pub radii: [f64; 4],
+}
+
+impl RoundedRect {
+    /// The rounded rectangle `n`'s glass is the shape of, when its outline is one: rectangles,
+    /// frames, components, instances and sections whose corners aren't smoothed.
+    pub fn of(n: &Node) -> Option<RoundedRect> {
+        let rect_like = matches!(
+            n.kind,
+            NodeKind::Rectangle
+                | NodeKind::Frame
+                | NodeKind::Component { .. }
+                | NodeKind::ComponentSet { .. }
+                | NodeKind::Instance { .. }
+                | NodeKind::Section { .. }
+        );
+        let sized = n.width.is_finite() && n.height.is_finite() && n.width > 0.0 && n.height > 0.0;
+        (rect_like && sized && n.corners.smoothing == 0.0).then(|| {
+            // Clamped as `rounded_rect` clamps them: each radius to half the shorter side.
+            let most = n.width.min(n.height) / 2.0;
+            let radii = n.corners.radii.map(|r| if r.is_finite() { r.clamp(0.0, most) } else { 0.0 });
+            RoundedRect { width: n.width, height: n.height, radii }
+        })
+    }
+}
+
+/// Signed distance from `q` (relative to the centre) to a rectangle reaching `half` each way with
+/// corner radius `r` (negative inside), and its outward gradient: the unit normal along the sides,
+/// pointing away from the corner's centre round the corners.
+fn rounded_rect_sd(q: (f64, f64), half: (f64, f64), r: f64) -> (f64, (f64, f64)) {
+    let (sx, sy) = (if q.0 < 0.0 { -1.0 } else { 1.0 }, if q.1 < 0.0 { -1.0 } else { 1.0 });
+    let k = (q.0.abs() - half.0 + r, q.1.abs() - half.1 + r);
+    if k.0 > 0.0 && k.1 > 0.0 {
+        let len = (k.0 * k.0 + k.1 * k.1).sqrt();
+        (len - r, (sx * k.0 / len, sy * k.1 / len))
+    } else if k.0 > k.1 {
+        (k.0 - r, (sx, 0.0))
+    } else {
+        (k.1 - r, (0.0, sy))
+    }
+}
+
+/// The radius of the corner of `radii` (top-left, top-right, bottom-right, bottom-left) whose
+/// quarter `q` (relative to the centre, y down) lies in.
+fn corner_of(radii: [f64; 4], q: (f64, f64)) -> f64 {
+    let i = match (q.0 < 0.0, q.1 < 0.0) {
+        (true, true) => 0,
+        (false, true) => 1,
+        (false, false) => 2,
+        (true, false) => 3,
+    };
+    radii.get(i).copied().unwrap_or(0.0)
+}
+
+/// A rounded rectangle's glass fields worked out pixel by pixel, in closed form: no coverage to
+/// rasterise, no distance transform, nothing to cache. The same fields as [`Fields`] (the bend
+/// directions round the corners towards the rectangle shrunk by the core's depth, the middle line
+/// of one thinner than twice that), exact rather than from pixels, and the same wherever a render
+/// cuts it: each pixel is placed in the layer's own frame.
+struct AnalyticRect {
+    /// Layer pixels → the shape's own frame.
+    shift: (i64, i64),
+    /// The shape's own frame → local coordinates.
+    inv: Affine,
+    /// Local → device directions (the transform's linear part), and its scale.
+    linear: [f64; 4],
+    scale: f64,
+    half: (f64, f64),
+    radii: [f64; 4],
+    /// The corners the light's normals round to: each radius at least the bevel (a sharp corner's
+    /// bevel catches the light along its diagonal), at most the half side.
+    bevels: [f64; 4],
+    /// The corners the bend rounds to: each radius at least the core's depth, at most the half
+    /// side ([`bend_directions`]).
+    rounds: [f64; 4],
+}
+
+impl AnalyticRect {
+    /// `rect`'s fields for a layer whose `xf` maps local coordinates to its pixels, with a `bevel`
+    /// and bending towards the core `reach` pixels in; `None` when `xf` isn't a rotation, flip and
+    /// even scale (skewed or stretched rectangles go through the distance transform) or its
+    /// translation is too far out.
+    fn new(rect: RoundedRect, xf: Affine, bevel: f64, reach: f64) -> Option<AnalyticRect> {
+        let own = own_frame(xf)?;
+        let [a, b, c, d, _, _] = own.xf.as_coeffs();
+        let (sq_x, sq_y) = (a * a + b * b, c * c + d * d);
+        let even = (sq_x - sq_y).abs() <= 1e-9 * sq_x && (a * c + b * d).abs() <= 1e-9 * sq_x;
+        let scale = sq_x.sqrt();
+        if !(even && scale.is_finite() && scale > 1e-9) {
+            return None;
+        }
+        let half = (rect.width / 2.0, rect.height / 2.0);
+        let at_least = |least: f64| rect.radii.map(|r| r.max(least / scale).min(half.0.min(half.1)));
+        let (bevels, rounds) = (at_least(bevel), at_least(reach));
+        Some(AnalyticRect { shift: own.shift, inv: own.xf.inverse(), linear: [a, b, c, d], scale, half, radii: rect.radii, bevels, rounds })
+    }
+
+    /// The fields at layer pixel (`x`, `y`): coverage (box-filtered from the signed distance),
+    /// distance in, inward normal and inward bend direction.
+    fn at(&self, x: i64, y: i64) -> FieldPx {
+        let p = self.inv * Point::new((x - self.shift.0) as f64 + 0.5, (y - self.shift.1) as f64 + 0.5);
+        let q = (p.x - self.half.0, p.y - self.half.1);
+        let (sd, _) = rounded_rect_sd(q, self.half, corner_of(self.radii, q));
+        let (_, normal) = rounded_rect_sd(q, self.half, corner_of(self.bevels, q));
+        let (_, round) = rounded_rect_sd(q, self.half, corner_of(self.rounds, q));
+        let [a, b, c, d] = self.linear;
+        let inward = |n: (f64, f64)| (-((a * n.0 + c * n.1) / self.scale) as f32, -((b * n.0 + d * n.1) / self.scale) as f32);
+        let sd = sd * self.scale;
+        ((0.5 - sd).clamp(0.0, 1.0) as f32, (-sd).max(0.0) as f32, inward(normal), inward(round))
+    }
+}
+
+/// Where a glass reads its fields: worked out in closed form for a rounded rectangle, from its
+/// coverage otherwise.
+enum Geometry {
+    Rect(AnalyticRect),
+    Fields(Fields, (i64, i64)),
+}
+
+impl Geometry {
+    /// The fields at layer pixel (`x`, `y`); `None` where there are none.
+    fn at(&self, x: i64, y: i64) -> Option<FieldPx> {
+        match self {
+            Geometry::Rect(r) => Some(r.at(x, y)),
+            Geometry::Fields(f, shift) => f.at(x - shift.0, y - shift.1),
+        }
+    }
+}
+
 /// The glass of a `w` × `h` layer whose `shape` maps through `xf` (local → layer pixels), from
-/// `back`, its backdrop padded by `pad` pixels each way, at `scale` device pixels per unit.
-pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
+/// `back`, its backdrop padded by `pad` pixels each way, at `scale` device pixels per unit. `rect`:
+/// the rounded rectangle the shape is, when it is one, so its fields are worked out in closed form.
+pub fn glass(g: &Glass, frame: EffectFrame<'_>, rect: Option<RoundedRect>) -> Option<Pixmap> {
     let EffectFrame { shape, back, pad, size: (w, h), xf, scale } = frame;
     let g = g.sanitized();
     let depth = (g.depth * scale).clamp(1.0, 1024.0);
     let bevel = (BEVEL * scale).min(1024.0);
     let r = (depth * 0.1).clamp(1.0, 8.0) as usize;
-    // Coverage with a margin, so wherever the layer is cut every distance the pixels read is
-    // exact: the bend's and the gradient's (within `depth` + `bevel`; the light lies on the bevel)
-    // and those the normals are smoothed from (2r + 1 further).
-    let m = (depth + bevel).ceil() as u32 + 4 * r as u32 + 4;
-    let (fields, shift) = shape_fields(shape, xf, w, h, m, r)?;
+    // The core the backdrop bends towards lies `reach` in from the edge ([`bend_directions`]).
+    let reach = (depth + bevel) as f32;
+    // Coverage with a margin, so wherever the layer is cut every field the pixels read is the
+    // whole render's: the distances the bend and the gradient read (within `depth` + `bevel`; the
+    // light lies on the bevel), the core they bend towards (its nearest pixel up to √2 × `reach`
+    // further, round a sharp corner, so 1.5 × `reach`; its depths exact within `reach` and
+    // [`RIDGE_PX`] of it), and those the normals and bends are smoothed from (2r + 1 further).
+    let plain = (depth + bevel).ceil() as u32 + 4 * r as u32 + 4;
+    let cored = plain + (1.5 * reach).ceil() as u32 + RIDGE_PX as u32;
+    // A core takes a wider margin and more bytes a pixel, so only a shape whose whole window fits
+    // [`MAX_SHAPE_PX`] works one out: a bigger one bends along its edge normals, so no render
+    // allocates a core's fields over more pixels than a kept shape holds.
+    let core = fits_whole(shape, xf, cored).then_some(reach);
+    let m = if core.is_some() { cored } else { plain };
+    let geometry = match rect.and_then(|rect| AnalyticRect::new(rect, xf, bevel, f64::from(reach))) {
+        Some(analytic) => Geometry::Rect(analytic),
+        None => {
+            let (fields, shift) = shape_fields(shape, xf, w, h, m, r, core)?;
+            Geometry::Fields(fields, shift)
+        }
+    };
     let mut frosted = back.clone();
     fx::blur(&mut frosted, g.frost / 2.0 * scale);
     let ang = g.light_angle.to_radians();
@@ -555,7 +932,7 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
     let dst = out.data_mut();
     for y in 0..h as usize {
         for x in 0..w as usize {
-            let Some((c, d, inward)) = fields.at(x as i64 - shift.0, y as i64 - shift.1) else { continue };
+            let Some((c, d, inward, toward)) = geometry.at(x as i64, y as i64) else { continue };
             if c <= 0.0 {
                 continue;
             }
@@ -565,7 +942,7 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
                 // are 0 there): the channels' samples are at the same point, so one sample.
                 (dispersed(&frosted, bx, by, 0.0, 0.0, 0.0), 0.0)
             } else {
-                // The curve's outward direction: the edge's normal, turned by `splay` towards the
+                // The curve's outward direction: away from its core, turned by `splay` towards the
                 // way away from the centre (not renormalised: where the two part, the bend is less).
                 let away = if splay > 0.0 {
                     let px = ((x as i64 - sx) as f64 + 0.5 - centre.x) as f32;
@@ -575,7 +952,7 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>) -> Option<Pixmap> {
                 } else {
                     (0.0, 0.0)
                 };
-                let out_dir = (-inward.0 * (1.0 - splay) + away.0 * splay, -inward.1 * (1.0 - splay) + away.1 * splay);
+                let out_dir = (-toward.0 * (1.0 - splay) + away.0 * splay, -toward.1 * (1.0 - splay) + away.1 * splay);
                 // No refraction: nothing bends, so one sample (`dispersed` with no move).
                 let bend = bend_at(d, depth, bevel, refraction);
                 let k = if bend == 0.0 { 0.0 } else { dispersion };
@@ -671,6 +1048,124 @@ mod tests {
         assert_eq!(spread[2], 0.0);
     }
 
+    /// A `w` × `h` coverage with the rectangles `rects` (x, y, width, height) filled.
+    fn coverage(w: u32, h: u32, rects: &[(f32, f32, f32, f32)]) -> Pixmap {
+        let mut p = Pixmap::new(w, h).unwrap();
+        let paint = tiny_skia::Paint { shader: tiny_skia::Shader::SolidColor(tiny_skia::Color::WHITE), ..Default::default() };
+        for (x, y, rw, rh) in rects {
+            p.fill_rect(tiny_skia::Rect::from_xywh(*x, *y, *rw, *rh).unwrap(), &paint, tiny_skia::Transform::identity(), None);
+        }
+        p
+    }
+
+    fn bend_dir(f: &Fields, x: i64, y: i64) -> (f32, f32) {
+        f.at(x, y).unwrap().3
+    }
+
+    fn close(a: (f32, f32), b: (f32, f32), tol: f32) -> bool {
+        (a.0 - b.0).abs() <= tol && (a.1 - b.1).abs() <= tol
+    }
+
+    #[test]
+    fn a_sharp_corner_bends_round_towards_the_core() {
+        // A 120 × 80 rectangle at (20, 20), bending towards its core 20 px in.
+        let f = Fields::new(&coverage(160, 120, &[(20.0, 20.0, 120.0, 80.0)]), 0, 0, 1, Some(20.0));
+        let s = std::f32::consts::FRAC_1_SQRT_2;
+        // Halfway down the left side: straight in. In the corner: diagonally, towards the core's own
+        // corner 20 px in.
+        assert!(close(bend_dir(&f, 21, 60), (1.0, 0.0), 0.02), "{:?}", bend_dir(&f, 21, 60));
+        assert!(close(bend_dir(&f, 22, 22), (s, s), 0.05), "{:?}", bend_dir(&f, 22, 22));
+        // Mirror images across the corner's diagonal, with no seam along it: neighbours agree.
+        let (a, b) = (bend_dir(&f, 24, 29), bend_dir(&f, 29, 24));
+        assert!(close(a, (b.1, b.0), 1e-4), "{a:?} vs {b:?}");
+        let (on, off) = (bend_dir(&f, 26, 26), bend_dir(&f, 27, 26));
+        assert!(close(on, off, 0.1), "{on:?} vs {off:?}");
+    }
+
+    #[test]
+    fn a_shape_too_big_to_keep_bends_along_its_normals() {
+        // A small shape fits whole with a core's margin; one wider than the kept-shape limit
+        // doesn't, at this zoom or with this margin, wherever it sits.
+        let shape = |w: f64, h: f64| -> Outline { (figcraft_geom::kurbo::Rect::new(0.0, 0.0, w, h).to_path(0.1), tiny_skia::FillRule::Winding) };
+        assert!(fits_whole(&shape(200.0, 120.0), Affine::translate((10.5, 3.0)), 64));
+        assert!(!fits_whole(&shape(4000.0, 3000.0), Affine::translate((10.5, 3.0)), 64));
+        assert!(!fits_whole(&shape(200.0, 120.0), Affine::scale(40.0), 64));
+        // Without a core the fields hold no bend directions, and bend along the normals.
+        let f = Fields::new(&coverage(160, 120, &[(20.0, 20.0, 120.0, 80.0)]), 0, 0, 1, None);
+        assert!(f.bends.is_none());
+        for (x, y) in [(21, 60), (24, 24), (80, 21)] {
+            let (_, _, normal, bend) = f.at(x, y).unwrap();
+            assert_eq!(normal, bend, "({x}, {y})");
+        }
+    }
+
+    #[test]
+    fn a_thin_part_bends_across_itself() {
+        // A 200 × 12 bar, thinner than twice the reach: its core is its middle line, and each side
+        // bends towards it.
+        let f = Fields::new(&coverage(240, 40, &[(20.0, 14.0, 200.0, 12.0)]), 0, 0, 1, Some(20.0));
+        assert!(close(bend_dir(&f, 120, 14), (0.0, 1.0), 0.02), "top: {:?}", bend_dir(&f, 120, 14));
+        assert!(close(bend_dir(&f, 120, 25), (0.0, -1.0), 0.02), "bottom: {:?}", bend_dir(&f, 120, 25));
+        assert!(f.bends.as_ref().unwrap().iter().all(|(x, y)| x.is_finite() && y.is_finite()));
+    }
+
+    #[test]
+    fn neighbouring_strokes_bend_towards_their_own_middles() {
+        // Two 8 px strokes 2 px apart, like letters: the facing edges bend away from each other,
+        // each into its own stroke.
+        let f = Fields::new(&coverage(60, 60, &[(10.0, 10.0, 8.0, 40.0), (20.0, 10.0, 8.0, 40.0)]), 0, 0, 1, Some(20.0));
+        assert!(bend_dir(&f, 17, 30).0 < -0.9, "{:?}", bend_dir(&f, 17, 30));
+        assert!(bend_dir(&f, 20, 30).0 > 0.9, "{:?}", bend_dir(&f, 20, 30));
+    }
+
+    #[test]
+    fn rounded_rectangle_distances_and_normals() {
+        let half = (60.0, 40.0);
+        // Halfway along the left side, 3 in: 3 deep, the normal straight out.
+        let (sd, n) = rounded_rect_sd((-57.0, 0.0), half, 10.0);
+        assert!((sd + 3.0).abs() < 1e-9 && n == (-1.0, 0.0), "{sd} {n:?}");
+        // Round a 10-unit corner: the distance to its arc, the normal away from its centre.
+        let (sd, n) = rounded_rect_sd((-57.0, -37.0), half, 10.0);
+        let (cx, cy) = (-50.0, -30.0);
+        let len = ((-57.0f64 - cx).powi(2) + (-37.0f64 - cy).powi(2)).sqrt();
+        assert!((sd - (len - 10.0)).abs() < 1e-9, "{sd}");
+        assert!((n.0 + 7.0 / len).abs() < 1e-9 && (n.1 + 7.0 / len).abs() < 1e-9, "{n:?}");
+        // Outside, past the right side.
+        assert!((rounded_rect_sd((65.0, 0.0), half, 10.0).0 - 5.0).abs() < 1e-9);
+        assert_eq!([(-1.0, -1.0), (1.0, -1.0), (1.0, 1.0), (-1.0, 1.0)].map(|q| corner_of([1.0, 2.0, 3.0, 4.0], q)), [1.0, 2.0, 3.0, 4.0]);
+    }
+
+    #[test]
+    fn a_rounded_rectangle_in_closed_form_matches_its_distance_transform() {
+        // A 120 × 80 rectangle at (20, 20), bending towards its core 21 px in, both ways.
+        let fields = Fields::new(&coverage(160, 120, &[(20.0, 20.0, 120.0, 80.0)]), 0, 0, 2, Some(21.0));
+        let rect = RoundedRect { width: 120.0, height: 80.0, radii: [0.0; 4] };
+        let closed = AnalyticRect::new(rect, Affine::translate((20.0, 20.0)), 1.0, 21.0).unwrap();
+        for (x, y) in [(21, 60), (60, 21), (138, 60), (80, 98), (24, 24), (30, 26), (135, 95), (80, 60)] {
+            let (a, b) = (fields.at(x, y).unwrap(), closed.at(x, y));
+            assert!((a.0 - b.0).abs() < 1e-3 && (a.1 - b.1).abs() < 1e-3, "({x}, {y}) coverage and depth: {a:?} vs {b:?}");
+            assert!(a.1 >= 21.0 || close(a.3, b.3, 0.08), "({x}, {y}) bend: {a:?} vs {b:?}");
+        }
+        // Rotated a quarter turn, the fields turn with it; skewed or stretched, no closed form.
+        let turned = AnalyticRect::new(rect, Affine::translate((100.0, 20.0)) * Affine::rotate(std::f64::consts::FRAC_PI_2), 1.0, 21.0).unwrap();
+        assert!(close(turned.at(98, 60).2, (-1.0, 0.0), 1e-6), "{:?}", turned.at(98, 60));
+        assert!(AnalyticRect::new(rect, Affine::new([1.0, 0.0, 0.3, 1.0, 0.0, 0.0]), 1.0, 21.0).is_none());
+        assert!(AnalyticRect::new(rect, Affine::scale_non_uniform(2.0, 1.0), 1.0, 21.0).is_none());
+    }
+
+    #[test]
+    fn nearest_sites_and_running_maxima() {
+        // Sites at (1, 1) and (8, 3) on a 10 × 5 grid.
+        let mut site = vec![false; 50];
+        site[11] = true;
+        site[38] = true;
+        let near = nearest_sites(&site, 10, 5);
+        assert_eq!((near[0], near[4], near[49], near[37]), (11, 11, 38, 38));
+        assert!(nearest_sites(&[false; 6], 3, 2).iter().all(|s| *s == NO_SITE));
+        let m = max_within(&[1.0, 5.0, 2.0, 0.0, 0.0, 3.0], 6, 1, 1);
+        assert_eq!(m, [5.0, 5.0, 5.0, 2.0, 3.0, 3.0]);
+    }
+
     /// At full dispersion red's furthest step stays within `Glass::max_bend` of the pixel, all
     /// along the bend, so the backdrop read around a pane covers it: one white pixel further out
     /// than that is never seen.
diff --git a/crates/render/src/glass_cut_tests.rs b/crates/render/src/glass_cut_tests.rs
index 9bd74f80d..bac1e2af6 100644
--- a/crates/render/src/glass_cut_tests.rs
+++ b/crates/render/src/glass_cut_tests.rs
@@ -121,32 +121,39 @@ fn glass_digests() {
 
 #[test]
 fn a_cut_through_the_pane_matches_the_whole_render() {
-    // The last look is deep (300 units), so the curve reaches far in from every cut.
+    // The last two looks are deep, so the curve reaches far in from every cut: 60 units (at 2× a
+    // core 122 px in, which takes the widest margin a core gets) and 300 (too big for a core).
     let looks = [
         wide_light(),
         Glass::default(),
         Glass { splay: 0.5, frost: 0.0, refraction: 0.0, ..Glass::default() },
         // Splay with the bend and dispersion on: the dispersed samples follow the turned bend.
         Glass { splay: 1.0, frost: 0.0, ..Glass::default() },
+        Glass { depth: 60.0, ..Glass::default() },
         Glass { depth: 300.0, ..wide_light() },
     ];
     // Rounded corners without the pane's fill: a fill's curved edge rasters 1–2 levels apart in a
     // cut, and that is the fill, not the glass.
-    for radius in [0.0, 40.0] {
+    // Plain corners work out in closed form; smoothed ones (sharp ones too: any smoothing counts)
+    // from the coverage, the deepest look too big for a core and bending along its normals.
+    for (radius, smoothing) in [(0.0, 0.0), (40.0, 0.0), (0.0, 0.6), (40.0, 0.6)] {
         for g in &looks {
             let (mut d, p, pane) = pane_over_stripes(g.clone(), radius);
+            d.get_mut(pane).unwrap().corners.smoothing = smoothing;
             if radius > 0.0 {
                 d.get_mut(pane).unwrap().fills.clear();
             }
             for (cut, diff) in cut_diffs(&d, p) {
-                assert_eq!(diff, (0, 0), "cut at {cut} px, radius {radius}, with {g:?}");
+                assert_eq!(diff, (0, 0), "cut at {cut} px, radius {radius}, smoothing {smoothing}, with {g:?}");
             }
         }
     }
 }
 
 /// A `w` × `h` pane of glass `g` at (`x`, `y`) over stripes, alone on its page: (document, page,
-/// pane). Each test gives its own size, so tests running at once don't share cached shapes.
+/// pane). Each test gives its own size, so tests running at once don't share cached shapes. Its
+/// corners are smoothed, so its fields come from its coverage and are kept (a plain rounded
+/// rectangle's are worked out in closed form, with nothing to keep).
 fn pane(g: Glass, x: f64, y: f64, w: f64, h: f64) -> (Document, NodeId, NodeId) {
     let mut d = Document::new("glass");
     let p = d.first_page().unwrap();
@@ -158,6 +165,7 @@ fn pane(g: Glass, x: f64, y: f64, w: f64, h: f64) -> (Document, NodeId, NodeId)
     let n = d.get_mut(pane).unwrap();
     n.transform = Affine::translate((x, y));
     n.corners.radii = [12.0; 4];
+    n.corners.smoothing = 0.6;
     n.effects = vec![Effect { kind: EffectKind::Glass(g), visible: true }];
     (d, p, pane)
 }
@@ -173,6 +181,14 @@ fn computed(f: impl FnOnce()) -> u64 {
     crate::glass::glass_fields_computed() - before
 }
 
+/// How many glass shapes, and how many shapes' bend directions towards their core, `f` works out
+/// on this thread.
+fn computed_and_bent(f: impl FnOnce()) -> (u64, u64) {
+    let before = (crate::glass::glass_fields_computed(), crate::glass::glass_bends_computed());
+    f();
+    (crate::glass::glass_fields_computed() - before.0, crate::glass::glass_bends_computed() - before.1)
+}
+
 #[test]
 fn kept_fields_render_the_same_pixels_as_fresh_ones() {
     let (d, p, _) = pane(Glass::default(), 40.0, 30.0, 211.0, 137.0);
@@ -211,6 +227,13 @@ fn what_the_shape_depends_on_works_it_out_again_and_nothing_else_does() {
     assert_eq!(computed(|| drop(render(&d, p, (0.0, 0.0), 1.0))), 1, "part of a pixel");
     d.get_mut(pane).unwrap().width = 230.0;
     assert_eq!(computed(|| drop(render(&d, p, (0.0, 0.0), 1.0))), 1, "shape");
+    let _ = render(&d, p, (0.0, 0.0), 1.0);
+    // A depth a unit more keeps the same margin: the kept shape is reused, and only the bend
+    // towards the core, which moves with the depth, is worked out again, once (a Depth slider
+    // dragged works out nothing else).
+    set(&mut d, Glass { depth: 21.0, ..Glass::default() });
+    assert_eq!(computed_and_bent(|| drop(render(&d, p, (0.0, 0.0), 1.0))), (0, 1), "depth, within the same margin");
+    assert_eq!(computed_and_bent(|| drop(render(&d, p, (0.0, 0.0), 1.0))), (0, 0), "the same depth again");
     set(&mut d, Glass { depth: 70.0, ..Glass::default() });
     assert_eq!(computed(|| drop(render(&d, p, (0.0, 0.0), 1.0))), 1, "depth");
 }
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 3b31d3228..5d910dabf 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # FigCraft parity with Figma
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends towards its core, rounded rectangles in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
 
 The authoritative assessment of how close FigCraft is to Figma Design. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) is the ranked work list; the measured menu checklist is
@@ -596,7 +596,9 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
   that sees the whole backdrop, inside clipping frames, faded groups and masks too; both blurs
   uniform or progressive (the radius ramps between two points, dragged on the canvas); noise in
   mono, duo and multi colour with grain size, density and blend mode; texture with clip to shape;
-  glass with light angle and intensity, refraction, depth, dispersion, frost and splay; the same in
+  glass with light angle and intensity, refraction, depth, dispersion, frost and splay (a thick lens
+  bending towards the shape's core, its light a line on the bevel, matched to the reference tool on
+  synthetic files); the same in
   PNG, PDF and SVG exports, SVG embedding renders of noise grains, texture, progressive and
   background blur and glass); corner radii with
   smoothing; constraints; auto layout (horizontal, vertical, wrap, grid; hug/fill/fixed; min/max;
@@ -648,6 +650,7 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass bends towards its core, the shape shrunk by `depth` and the bevel, as the reference tool's: round a sharp corner the bend turns smoothly, and a thin part (a capsule, a letter's stroke) bends across itself, checked side by side on a capsule 44 units tall. Rounded rectangles work it out in closed form. A shape too big to keep whole at the zoom bends along its edge normals instead, so no render works out a core over more pixels than a kept shape holds. Tests: `glass::tests::a_sharp_corner_bends_round_towards_the_core`, `glass::tests::a_thin_part_bends_across_itself`, `glass::tests::a_shape_too_big_to_keep_bends_along_its_normals`, `glass_cut_tests::a_cut_through_the_pane_matches_the_whole_render`. Grade unchanged. |
 | 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it, 0.6 as much on the opposite side, with a faint gradient across the curve. `splay` turns the bend from along the edge's normal towards the way away from the layer's centre and no longer widens the light, as in the reference tool. Checked side by side on synthetic files: a splay of 1 bends the backdrop towards the centre in both. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Grade unchanged. |
 | 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile (most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in) and splits its colours over 8 steps, red and blue 0.16 of the bend apart at 100% dispersion. Measured against the reference tool on synthetic files at 2×: the black band a pane pulls to its edge ends within 3 px of the reference tool's, and red and blue part 2.27 px at 50% dispersion and 4.66 px at 100% (2.38 and 4.69 there). Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Grade unchanged. |
 | 2026-11-01 | patch | M4: bulleted lists draw the same bullet at every level of indentation ("Figma bullets will keep the same styling at all levels of indentation", Create bulleted and numbered lists); the deeper levels drew a white bullet and a small square, pinned as silent before. Numbered levels (1., a., i.) are unchanged. Found by a documentation audit of the text rules. Test: `tail_tests::list_numbering_by_level` (the bullets row). Numbers unchanged |

From 39c58338184996c5d78378305eaf51140d771c57 Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Fri, 6 Nov 2026 04:10:50 +0100
Subject: [PATCH 56/70] Keep object snapping when Snap to Pixel Grid is on

Fixes #2029

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/canvas/tools/drag.rs        | 26 +++++++++---------
 crates/engine/src/canvas/tools/draw.rs        |  9 ++++---
 .../engine/src/transform_behaviour_tests.rs   | 27 +++++++++++++++++++
 3 files changed, 47 insertions(+), 15 deletions(-)

diff --git a/crates/engine/src/canvas/tools/drag.rs b/crates/engine/src/canvas/tools/drag.rs
index 194a90fe2..64d48bc86 100644
--- a/crates/engine/src/canvas/tools/drag.rs
+++ b/crates/engine/src/canvas/tools/drag.rs
@@ -218,15 +218,16 @@ impl Session {
                 // Cmd/Ctrl (and Control on macOS) held while dragging suspends snapping.
                 let snap_on = self.ds().map(|ds| ds.view.snap_objects).unwrap_or(true) && !ev.cmd && !ev.ctrl;
                 let mut guides = Vec::new();
+                if self.ds().map(|ds| ds.view.snap_pixel).unwrap_or(true) {
+                    // Keep the box's origin on whole pixels (a rotated parent frame's, inside one);
+                    // snapping to layers comes after, so it wins on the axes it snaps.
+                    d = targets.round_move(d);
+                }
                 if snap_on {
                     let (c, g2) = targets.snap_move(d, SNAP_PX / ev.zoom.max(1e-6));
                     d += c;
                     guides = g2;
                 }
-                if self.ds().map(|ds| ds.view.snap_pixel).unwrap_or(true) {
-                    // Keep the box's origin on whole pixels (a rotated parent frame's, inside one).
-                    d = targets.round_move(d);
-                }
                 let ids = ids.clone();
                 let dup = *duplicate;
                 let page = self.page()?;
@@ -475,20 +476,21 @@ impl Session {
         let targets = if snap { Some(Targets::gather(self.doc()?, page, &ids)) } else { None };
         let mut p = ev.p();
         let mut guides = Vec::new();
+        let _ = start;
+        // In the handle box's own axes (one layer: its local space).
+        let (frame, w0, h0) = r.frame;
+        // The pixel grid: an upright box's dragged sides land on whole pixels (the Scale tool
+        // scales by the factor as dragged). Snapping to layers comes after, so it wins on the axes
+        // it snaps.
+        if !scale_tool && self.ds().map(|d| d.view.snap_pixel).unwrap_or(true) && crate::guides::axis_aligned(frame) {
+            p = Point::new(p.x.round(), p.y.round());
+        }
         if let Some(t) = &targets {
             let (dx, dy, g) = t.snap_point(p.x, p.y, SNAP_PX / ev.zoom.max(1e-6));
             p.x += dx;
             p.y += dy;
             guides = g;
         }
-        let _ = start;
-        // In the handle box's own axes (one layer: its local space).
-        let (frame, w0, h0) = r.frame;
-        // The pixel grid: an upright box's dragged sides land on whole pixels (the Scale tool
-        // scales by the factor as dragged).
-        if !scale_tool && self.ds().map(|d| d.view.snap_pixel).unwrap_or(true) && crate::guides::axis_aligned(frame) {
-            p = Point::new(p.x.round(), p.y.round());
-        }
         let q = frame.inverse() * p;
         let is_line = r.single && ids.first().and_then(|i| self.doc().ok()?.node(*i).map(|n| matches!(n.kind, NodeKind::Line))).unwrap_or(false);
         if scale_tool {
diff --git a/crates/engine/src/canvas/tools/draw.rs b/crates/engine/src/canvas/tools/draw.rs
index d59a2b904..e3cbe7787 100644
--- a/crates/engine/src/canvas/tools/draw.rs
+++ b/crates/engine/src/canvas/tools/draw.rs
@@ -29,20 +29,23 @@ impl Session {
         let tool = self.tool.tool;
         let mut p = ev.p();
         let mut guides = Vec::new();
+        let pixel = self.ds().map(|d| d.view.snap_pixel).unwrap_or(true);
+        // The pixel grid first: snapping to layers comes after, so it wins on the axes it snaps.
+        if pixel {
+            p = Point::new(p.x.round(), p.y.round());
+        }
         if self.ds().map(|d| d.view.snap_objects).unwrap_or(true) && !ev.cmd && !ev.ctrl {
             let (dx, dy, g) = targets.snap_point(p.x, p.y, SNAP_PX / ev.zoom.max(1e-6));
             p.x += dx;
             p.y += dy;
             guides = g;
         }
-        let pixel = self.ds().map(|d| d.view.snap_pixel).unwrap_or(true);
         let mut created = id;
         let page = self.page()?;
         self.preview(|doc, sel| {
-            let (mut a, mut b) = (start, p);
+            let (mut a, b) = (start, p);
             if pixel {
                 a = Point::new(a.x.round(), a.y.round());
-                b = Point::new(b.x.round(), b.y.round());
             }
             let pw = doc.world_transform(parent);
             let (kind, base) = match tool {
diff --git a/crates/engine/src/transform_behaviour_tests.rs b/crates/engine/src/transform_behaviour_tests.rs
index 3e724244e..e22eb0418 100644
--- a/crates/engine/src/transform_behaviour_tests.rs
+++ b/crates/engine/src/transform_behaviour_tests.rs
@@ -625,6 +625,33 @@ fn smart_guides_snap_to_edges_centres_and_equal_spacing() {
     assert_eq!(bounds(&s, b).origin(), Point::new(198.0, 2.0));
 }
 
+#[test]
+fn snapping_to_layers_wins_over_the_pixel_grid() {
+    // Both on (the defaults): a layer's centre at x = 5.5 is still a target.
+    let mut s = Session::new();
+    let a = rect(&mut s, 0.0, 0.0, 11.0, 11.0, None);
+    let b = rect(&mut s, 200.0, 300.0, 100.0, 100.0, None);
+    let _ = a;
+    ex(&mut s, "select.set", json!({"ids": [b]}));
+    // Moving: B's centre (grabbed) snaps to A's; the free axis stays on whole pixels.
+    s.pointer(&ev(PointerKind::Down, Point::new(250.0, 350.0), NONE)).unwrap();
+    s.pointer(&ev(PointerKind::Move, Point::new(6.0, 352.4), NONE)).unwrap();
+    assert!(s.tool.overlay.guides.iter().any(|g| near(g.x0, 5.5) && near(g.x1, 5.5)), "{:?}", s.tool.overlay.guides);
+    s.pointer(&ev(PointerKind::Up, Point::new(6.0, 352.4), NONE)).unwrap();
+    assert_eq!(bounds(&s, b).origin(), Point::new(-44.5, 302.0), "moved onto A's centre");
+    ex(&mut s, "edit.undo", json!({}));
+    // Out of reach of any layer, a move lands on whole pixels.
+    drag(&mut s, Point::new(250.0, 350.0), Point::new(260.3, 360.6), NONE);
+    assert_eq!(bounds(&s, b).origin(), Point::new(210.0, 311.0));
+    ex(&mut s, "edit.undo", json!({}));
+    // Resizing: the left handle snaps to A's centre; the bottom one lands on whole pixels.
+    drag(&mut s, Point::new(200.0, 350.0), Point::new(6.0, 350.0), NONE);
+    assert!(near(bounds(&s, b).x0, 5.5), "{:?}", bounds(&s, b));
+    ex(&mut s, "edit.undo", json!({}));
+    drag(&mut s, Point::new(250.0, 400.0), Point::new(250.0, 450.6), NONE);
+    assert_eq!(size(&s, b), (100.0, 151.0));
+}
+
 #[test]
 fn corner_cursors_stay_diagonal_whatever_the_proportions() {
     let mut s = session();

From 76af4e3f430cf595f0f853dc509cff33ae528231 Mon Sep 17 00:00:00 2001
From: Denis Gomes <6731020+denisg0mes@users.noreply.github.com>
Date: Fri, 6 Nov 2026 02:21:20 -0500
Subject: [PATCH 57/70] M3: Go to main component opens the library file of a
 library component

On an instance of a library component the command refused with "open
that file to edit it". The help center describes it opening the file that
holds the main ("Edit main components"), so it now does: the linked
library file opens in a tab, or its open tab comes to the front, on the
main's page with the main selected and zoomed to.

The library keeps the file's layer ids, so the copy's id map
(ImportedComponent::ids) leads from the local copy back to the exact
layer: a nested instance reaches its own main and a variant that variant.

The new tab takes the canvas size of the tab it came from. A tab still at
the default 1200x800 is refitted to the whole page on its first frame,
which would replace the zoom to the main.

A main deleted from the library file since it was published leaves the
file open with a note. A moved library file, a team library on a server
and a path off this computer are refused before anything opens; the last
uses the same check that guards library reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/assets/library.rs       |  9 +++
 crates/engine/src/assets/library/tests.rs | 66 ++++++++++++++++-
 crates/engine/src/cmd/component.rs        | 86 +++++++++++++++++------
 crates/engine/src/cmd/file.rs             |  3 +-
 crates/engine/src/cmd/file/open.rs        |  2 +-
 docs/components-parity.md                 |  4 +-
 6 files changed, 144 insertions(+), 26 deletions(-)

diff --git a/crates/engine/src/assets/library.rs b/crates/engine/src/assets/library.rs
index 01e8d3244..d9107ad63 100644
--- a/crates/engine/src/assets/library.rs
+++ b/crates/engine/src/assets/library.rs
@@ -1352,6 +1352,15 @@ pub fn library_of(doc: &Document, id: NodeId) -> Option<&str> {
     doc.libraries.import_of(root).map(|r| r.library.as_str())
 }
 
+pub fn library_source(doc: &Document, id: NodeId) -> Option<(&str, NodeId)> {
+    if !doc.is_remote(id) {
+        return None;
+    }
+    let record = doc.libraries.import_of(asset_root(doc, id)?)?;
+    let key = record.ids.iter().find(|(_, local)| **local == id).map_or(record.key, |(key, _)| *key);
+    Some((record.library.as_str(), key))
+}
+
 /// The display name of library `id` in `doc` (its link's name, else the id).
 pub fn library_name<'a>(doc: &'a Document, id: &'a str) -> &'a str {
     doc.libraries.link(id).map_or(id, |l| l.name.as_str())
diff --git a/crates/engine/src/assets/library/tests.rs b/crates/engine/src/assets/library/tests.rs
index bb65f8885..e9b6009ca 100644
--- a/crates/engine/src/assets/library/tests.rs
+++ b/crates/engine/src/assets/library/tests.rs
@@ -189,8 +189,6 @@ fn assert_remote_read_only(s: &mut Session, b: NodeId, remote_button: NodeId) {
     let style = s.doc().unwrap().styles[0].id.clone();
     assert!(s.execute("style.update", &json!({"style": style, "name": "Mine"})).is_err());
     assert!(s.execute("style.delete", &json!({"style": style})).is_err());
-    let e = s.execute("component.goToMain", &json!({"id": b})).unwrap_err();
-    assert!(e.to_string().contains("library"), "{e}");
     assert!(s.execute("select.set", &json!({"ids": [remote_button]})).is_err(), "library copies can't be selected");
     assert!(s.doc().unwrap().pages.contains(&s.page().unwrap()));
     assert!(s.execute("component.pushChanges", &json!({"id": b})).is_err());
@@ -399,6 +397,70 @@ fn add_place_and_update_keep_overrides() {
     let _ = std::fs::remove_dir_all(&d);
 }
 
+fn go_to_main(s: &mut Session, id: NodeId) -> Value {
+    s.active = 0;
+    ex(s, "component.goToMain", json!({"id": id}))
+}
+
+#[test]
+fn going_to_a_library_main_opens_the_library_file() {
+    let d = dir("go-to-main");
+    let lib_path = path_str(&d.join("kit.figcraft"));
+    let mut lib = Session::new();
+    let k = kit(&mut lib);
+    let mut chips = Vec::new();
+    for (i, color) in ["#ff0000", "#00ff00"].iter().enumerate() {
+        let f = idv(&ex(&mut lib, "frame.create", json!({"x": 400.0 + i as f64 * 100.0, "y": 0, "width": 60, "height": 20, "name": "Chip"})));
+        ex(&mut lib, "node.set", json!({"id": f, "props": {"fill": color}}));
+        chips.push(idv(&ex(&mut lib, "component.create", json!({"ids": [f]}))));
+    }
+    ex(&mut lib, "component.combineVariants", json!({"ids": chips}));
+    let kit_page = lib.doc().unwrap().page_of(k.card).unwrap();
+    ex(&mut lib, "page.add", json!({"name": "Notes"}));
+    let lid = publish_to(&mut lib, &lib_path);
+
+    let mut s = Session::new();
+    ex(&mut s, "library.add", json!({"path": lib_path}));
+    let card = idv(&ex(&mut s, "library.place", json!({"library": lid, "component": "Card", "x": 0, "y": 0})));
+    let nested_button = node(&s, card).children[0];
+    let chip = idv(&ex(&mut s, "library.place", json!({"library": lid, "component": "Chip", "x": 0, "y": 200})));
+    ex(&mut s, "instance.setProperties", json!({"ids": [chip], "properties": {"Property 1": "Variant2"}}));
+    s.ds_mut().unwrap().view.vw = 900.0;
+    s.ds_mut().unwrap().view.vh = 500.0;
+    let using = s.doc().unwrap().clone();
+
+    let r = go_to_main(&mut s, card);
+    assert_eq!((id_of(&r["id"]), r["index"].as_u64()), (Some(k.card), Some(1)), "{r}");
+    let ds = s.ds().unwrap();
+    assert_eq!(ds.path.as_deref(), Some(lib_path.as_str()));
+    assert_eq!((ds.selection.clone(), ds.page), (vec![k.card], kit_page));
+    assert_eq!((ds.view.vw, ds.view.vh), (900.0, 500.0), "the canvas it opens on is the one shown, so the fit stands");
+    let shown = ds.doc.world_bounds(k.card).unwrap().center();
+    assert_eq!((ds.view.cx, ds.view.cy), (shown.x, shown.y));
+
+    for (layer, main) in [(nested_button, k.button), (chip, chips[1])] {
+        let r = go_to_main(&mut s, layer);
+        assert_eq!((id_of(&r["id"]), r["index"].as_u64()), (Some(main), Some(1)), "{r}");
+        assert_eq!(s.ds().unwrap().selection, vec![main]);
+    }
+    assert_eq!(s.docs.len(), 2, "the open library file comes to the front");
+    assert_eq!(s.docs[0].doc.as_ref(), &using, "the file going there is unchanged");
+
+    s.active = 1;
+    ex(&mut s, "edit.delete", json!({"ids": [k.card]}));
+    let r = go_to_main(&mut s, card);
+    assert!(r["id"].is_null() && r["index"] == 1, "{r}");
+    assert!(s.message.take().is_some_and(|m| m.contains("isn't in this file any more")));
+
+    ex(&mut s, "file.close", json!({"index": 1, "force": true}));
+    std::fs::rename(&lib_path, d.join("moved.figcraft")).unwrap();
+    s.active = 0;
+    let e = s.execute("component.goToMain", &json!({"id": card})).unwrap_err();
+    assert!(e.to_string().contains("isn't at"), "{e}");
+    assert_eq!(s.docs.len(), 1);
+    let _ = std::fs::remove_dir_all(&d);
+}
+
 #[test]
 fn library_styles_apply_and_import_with_pages() {
     let d = dir("styles");
diff --git a/crates/engine/src/cmd/component.rs b/crates/engine/src/cmd/component.rs
index 50ce61500..7288045ad 100644
--- a/crates/engine/src/cmd/component.rs
+++ b/crates/engine/src/cmd/component.rs
@@ -186,28 +186,35 @@ pub fn specs() -> Vec<CommandSpec> {
             true,
             reset_override
         ),
-        spec!("component.goToMain", "Go to main component", "{id?}", false, |s, p| {
-            let cmd = "component.goToMain";
-            let i = targets(s, p).first().copied().ok_or_else(|| bad(cmd, "select an instance"))?;
-            let doc = s.doc()?;
-            let inst = owning_instance(doc, i).ok_or_else(|| bad(cmd, "not an instance"))?;
-            let Some(NodeKind::Instance { component, .. }) = doc.node(inst).map(|n| n.kind.clone()) else {
-                return Err(bad(cmd, "not an instance"));
-            };
-            if !doc.contains(component) {
-                return Err(EngineError::Disabled(cmd.into(), "the main component was deleted (use component.restoreMain)".into()));
+        spec!(
+            "component.goToMain",
+            "Go to main component",
+            "{id?}  selects the instance's main component; a library component's main is in its library file, which opens in a tab (or comes to the front) with the main selected. Returns {id} (the main in the file now shown), and `index` (the tab) when it went to a library file",
+            false,
+            |s, p| {
+                let cmd = "component.goToMain";
+                let i = targets(s, p).first().copied().ok_or_else(|| bad(cmd, "select an instance"))?;
+                let doc = s.doc()?;
+                let inst = owning_instance(doc, i).ok_or_else(|| bad(cmd, "not an instance"))?;
+                let Some(NodeKind::Instance { component, .. }) = doc.node(inst).map(|n| n.kind.clone()) else {
+                    return Err(bad(cmd, "not an instance"));
+                };
+                if !doc.contains(component) {
+                    return Err(EngineError::Disabled(cmd.into(), "the main component was deleted (use component.restoreMain)".into()));
+                }
+                if let Some((library, key)) = crate::library::library_source(doc, component) {
+                    let name = crate::library::library_name(doc, library).to_string();
+                    let library = library.to_string();
+                    return go_to_library_main(s, &library, &name, key);
+                }
+                super::edit::select_and_page(s, vec![component])?;
+                let ds = s.ds_mut()?;
+                if let Some(b) = ds.doc.world_bounds(component) {
+                    ds.view.fit(b, 2.0);
+                }
+                Ok(json!({"id": component}))
             }
-            if let Some(lib) = crate::library::library_of(doc, component) {
-                let name = crate::library::library_name(doc, lib);
-                return Err(EngineError::Disabled(cmd.into(), format!("the main component is in the library \"{name}\": open that file to edit it")));
-            }
-            super::edit::select_and_page(s, vec![component])?;
-            let ds = s.ds_mut()?;
-            if let Some(b) = ds.doc.world_bounds(component) {
-                ds.view.fit(b, 2.0);
-            }
-            Ok(json!({"id": component}))
-        }),
+        ),
         spec!("component.pushChanges", "Push changes to main component", "{id?}", true, push_changes),
         spec!(
             "component.restoreMain",
@@ -283,6 +290,43 @@ pub fn specs() -> Vec<CommandSpec> {
     ]
 }
 
+fn go_to_library_main(s: &mut Session, library: &str, name: &str, key: NodeId) -> Result<Value> {
+    let cmd = "component.goToMain";
+    let refuse = |why: String| EngineError::Disabled(cmd.into(), why);
+    let path = s
+        .doc()?
+        .libraries
+        .link(library)
+        .map(|l| l.path.clone())
+        .ok_or_else(|| refuse(format!("the library \"{name}\" was removed from this file")))?;
+    if crate::library_server::is_server_link(&path) {
+        return Err(refuse(format!("the main component is in the team library \"{name}\": open its file from the server to edit it")));
+    }
+    if !craft_docpath::is_local(&path) {
+        return Err(refuse(format!("{path}: a library is opened only from this computer")));
+    }
+    if !crate::file_access::exists(&path) {
+        return Err(refuse(format!("the library file of \"{name}\" isn't at {path} any more")));
+    }
+    let viewport = s.ds().map(|d| (d.view.vw, d.view.vh))?;
+    let opened = super::file::open(s, &json!({"path": path}))?;
+    let ds = s.ds_mut()?;
+    (ds.view.vw, ds.view.vh) = viewport;
+    let doc = &ds.doc;
+    let same_library = doc.published.as_ref().is_some_and(|p| p.manifest.id == library);
+    let main = doc.node(key).is_some_and(|n| matches!(n.kind, NodeKind::Component { .. } | NodeKind::ComponentSet { .. }));
+    if !same_library || !main || doc.is_remote(key) {
+        s.message = Some(format!("{name}: the main component isn't in this file any more"));
+        return Ok(json!({"id": null, "index": opened["index"]}));
+    }
+    super::edit::select_and_page(s, vec![key])?;
+    let ds = s.ds_mut()?;
+    if let Some(b) = ds.doc.world_bounds(key) {
+        ds.view.fit(b, 2.0);
+    }
+    Ok(json!({"id": key, "index": opened["index"]}))
+}
+
 /// Place an instance of `component` centred on page point (`x`, `y`), in the frame or auto layout
 /// slot under it (`instance.place`).
 pub(crate) fn place(s: &mut Session, p: &Value) -> Result<Value> {
diff --git a/crates/engine/src/cmd/file.rs b/crates/engine/src/cmd/file.rs
index 0cfdd1ffa..637d0d4a2 100644
--- a/crates/engine/src/cmd/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -37,7 +37,8 @@ pub(crate) use load::{load_fig, read_capped, recovered, recovered_from, variable
 pub use open::MAX_RECENT;
 #[cfg(test)]
 use open::append_pages;
-use open::{import, open, open_recent, revert};
+pub(crate) use open::open;
+use open::{import, open_recent, revert};
 pub(crate) use save::save_ends_preview;
 pub use save::{FileSnapshot, file_bytes, thumbnail};
 use save::{color_profile, mark_saved, save, save_as};
diff --git a/crates/engine/src/cmd/file/open.rs b/crates/engine/src/cmd/file/open.rs
index 59afad98d..4114b773e 100644
--- a/crates/engine/src/cmd/file/open.rs
+++ b/crates/engine/src/cmd/file/open.rs
@@ -54,7 +54,7 @@ pub(super) fn open_recent(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"files": files}))
 }
 
-pub(super) fn open(s: &mut Session, p: &Value) -> Result<Value> {
+pub(crate) fn open(s: &mut Session, p: &Value) -> Result<Value> {
     let variables = variables_param("file.open", p)?;
     if string(p, "path").is_none()
         && let Some(d) = string(p, "data")
diff --git a/docs/components-parity.md b/docs/components-parity.md
index 94a579758..37b5ed0b5 100644
--- a/docs/components-parity.md
+++ b/docs/components-parity.md
@@ -1,6 +1,6 @@
 # Components, variants, styles and variables parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (Go to main component on an instance of a library component opens the library file in a tab and selects the main there; glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
 
 Design systems are why teams adopt Figma. **Components: breadth ~96%, ready ~72%. Styles and
 variables: breadth ~95%, ready ~76% (estimated).** QA'd with a synthetic design system of ~300
@@ -50,6 +50,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 |---|---|---|
 | Publish a file's components, sets, styles and variables (per-asset versions) | done | as local library files |
 | Enable a library in a file; read-only linked copies | done | |
+| Go to main component from an instance of a library component | done | opens the library file in a tab, or brings it to the front, on the page holding the main, selected and zoomed to; a variant goes to that variant. Team libraries on a server are refused with a note; no Return to instance yet |
 | Library updates available; overrides kept | done | a library file saved again within two seconds of being read, at the same length, is read again (its time stamp can't prove it unchanged; #652) |
 | Team libraries: publish to a `figcraft-server` under the file, enable by a share link (a view link reads it), background update checks | done | [server.md](server.md#team-libraries); no team-wide library list or accounts ([gaps](gaps.md) #10) |
 | Library analytics | partial | instances per component and the files using them, and the instances each file detached (per component and per file), as apps report them; insertions and detachments week by week for a year (Show usage: the past 30 days, 90 days or year), for components; the layers and files using each style and variable, without insertions, detachments or modes; no chart |
@@ -78,6 +79,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-06 | minor | M3: Go to main component (context menu, Design panel, Ctrl+Alt+Cmd+K) on an instance of a library component opens the library file, as the help center describes for mains kept in another file ("Edit main components"); it used to refuse. The file opens in a tab, or an open tab comes to the front, on the main's page with the main selected and zoomed to: a nested instance goes to its own main, a variant to that variant. A main deleted from the library file since it was published leaves the file open with a note; a library file that moved, a team library on a server and a path off this computer are refused with a message. Test: `library::tests::going_to_a_library_main_opens_the_library_file`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass effects take variables, as the reference tool's do: its light angle, intensity, refraction, depth, dispersion, frost and splay bind to number variables on a layer (`variable.bind`, `effects/<i>/<lightAngle\|lightIntensity\|refraction\|depth\|dispersion\|radius\|splay>`, `radius` being the frost) and in an effect style (`style.bind`), and the Design panel's glass fields take a variable like the shadow and blur fields. A variable reads as the field shows it: intensity, refraction, dispersion and splay in percent. Tests: `binding_lists_tests::glass_fields_take_number_variables`, `effects_tests::glass_fields_take_bound_numbers_as_the_panel_shows_them`. Grade unchanged. |
 | 2026-11-01 | patch | M3: Delete on a layer inside an instance hides it (an override) instead of being refused ("You can't delete a layer or object from an instance. If you try, Figma will only toggle the layer's visibility instead of removing it", Guide to auto layout); `edit.delete` reports those ids under `hidden`, the structure and the main component stay as they were, one undo step; deleting the instance itself still removes it. Found by a documentation audit of the auto layout page. Test: `components_behaviour_tests::deleting_a_layer_inside_an_instance_hides_it_instead` (the refusal row for it is gone from `what_instances_cannot_override_is_refused`). Numbers unchanged |
 | 2026-10-31 | minor | M3, gap 10: library analytics cover styles and variables. A file reports how many of its layers use each of a library's styles and variables, and Show usage (`library.usage`) lists them beside the components, by a Type choice, with their layers and files. Layers inside instances count for their component. Insertions, detachments and modes aren't counted for them yet. Numbers unchanged. Tests: `library_assets_tests`. |

From 7076ea2131712241cbae8abf63b4953718cbd42a Mon Sep 17 00:00:00 2001
From: Denis Gomes <6731020+denisg0mes@users.noreply.github.com>
Date: Fri, 6 Nov 2026 02:27:21 -0500
Subject: [PATCH 58/70] Credits: my name in the About window

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 contributors/people.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/contributors/people.toml b/contributors/people.toml
index f7ee0420e..745bb84c3 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -104,3 +104,7 @@ real_name = "Oleksii Sukholita"
 
 [people.helenkwok]
 real_name = "Helen Kwok"
+
+[people.denisg0mes]
+real_name = "Denis Gomes"
+display_name = "Denis Gomes"

From bea214ebb05b57efa0a8a9992d37944130882dd0 Mon Sep 17 00:00:00 2001
From: Denis Gomes <6731020+denisg0mes@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:35:30 -0400
Subject: [PATCH 59/70] M7: decode a clipboard PNG before pasting it

with_pixel_size read only the PNG's header, so a PNG with a whole IHDR and
a cut-off body passed as the one to paste. Since #1724 image.place refuses
it as damaged, and nothing was pasted: the decoded clipboard image, which
paste falls back to for an unreadable PNG, was never tried. The PNG is now
decoded in full before it is accepted, so the paste falls back as it does
for any other unreadable PNG. The zero-size and pixel-count checks run
ahead of that decode, so an image past the limit is refused before it is
decoded.

Raised by CodeRabbit on #1360 after the merge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ui-egui/src/menus/clipboard.rs   | 13 ++++++++-----
 crates/ui-egui/src/paste_image_tests.rs | 15 +++++++++++++++
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/crates/ui-egui/src/menus/clipboard.rs b/crates/ui-egui/src/menus/clipboard.rs
index ff065a48f..bae7aaca9 100644
--- a/crates/ui-egui/src/menus/clipboard.rs
+++ b/crates/ui-egui/src/menus/clipboard.rs
@@ -129,9 +129,6 @@ fn clipboard_png(app: &mut FigApp) -> Option<(Vec<u8>, f64, f64)> {
         Some(readable) => readable,
         None => with_pixel_size(encoded_clipboard_image(app)?)?,
     };
-    if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PASTED_IMAGE_PIXELS {
-        return None;
-    }
     let density = figcraft_format::pixel_density(&png);
     let (w, h) = figcraft_format::placed_size(w, h, density, figcraft_engine::cmd::create::PLACED_IMAGE_MAX_SIDE);
     Some((png, w, h))
@@ -140,8 +137,14 @@ fn clipboard_png(app: &mut FigApp) -> Option<(Vec<u8>, f64, f64)> {
 const MAX_PASTED_IMAGE_PIXELS: u64 = 100_000_000;
 
 fn with_pixel_size(png: Vec<u8>) -> Option<(Vec<u8>, (u32, u32))> {
-    let size = image::ImageReader::new(std::io::Cursor::new(&png)).with_guessed_format().ok()?.into_dimensions().ok()?;
-    Some((png, size))
+    use image::ImageDecoder as _;
+    let decoder = image::ImageReader::new(std::io::Cursor::new(&png)).with_guessed_format().ok()?.into_decoder().ok()?;
+    let (w, h) = decoder.dimensions();
+    if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PASTED_IMAGE_PIXELS {
+        return None;
+    }
+    image::DynamicImage::from_decoder(decoder).ok()?;
+    Some((png, (w, h)))
 }
 
 fn encoded_clipboard_image(app: &mut FigApp) -> Option<Vec<u8>> {
diff --git a/crates/ui-egui/src/paste_image_tests.rs b/crates/ui-egui/src/paste_image_tests.rs
index e70ea0968..756c93067 100644
--- a/crates/ui-egui/src/paste_image_tests.rs
+++ b/crates/ui-egui/src/paste_image_tests.rs
@@ -549,3 +549,18 @@ fn a_clipboard_png_past_the_byte_limit_falls_back_to_the_decoded_image() {
     let pasted = doc.nodes().find(|n| n.name == "Pasted image").expect("pasted from the decoded image");
     assert_eq!((pasted.width, pasted.height), (2.0, 2.0));
 }
+
+#[test]
+fn a_clipboard_png_with_a_cut_off_body_falls_back_to_the_decoded_image() {
+    let mut w = Win::new();
+    let mut png = std::io::Cursor::new(Vec::new());
+    image::RgbaImage::new(4, 4).write_to(&mut png, image::ImageFormat::Png).unwrap();
+    let png = png.into_inner();
+    let cut_off = png[..png.len() - 20].to_vec();
+    assert_eq!(image::ImageReader::new(std::io::Cursor::new(&cut_off)).with_guessed_format().unwrap().into_dimensions().unwrap(), (4, 4));
+    *w.clip.borrow_mut() = Clip { png: Some(cut_off), image: Some((2, 2, vec![255; 16])), ..Clip::default() };
+    w.cmd_v();
+    let doc = w.app.session.doc().unwrap();
+    let pasted = doc.nodes().find(|n| n.name == "Pasted image").expect("pasted from the decoded image");
+    assert_eq!((pasted.width, pasted.height), (2.0, 2.0));
+}

From 6a31ea7360e9a7e0c0cd4aed0eb6e4ca85301304 Mon Sep 17 00:00:00 2001
From: Denis Gomes <6731020+denisg0mes@users.noreply.github.com>
Date: Fri, 6 Nov 2026 02:53:58 -0500
Subject: [PATCH 60/70] M3: Go to main component names a library copy with no
 link

A file imported from another app can hold library copies in its library
store with no record of the library they came from. On an instance of
one, the command took the local path and failed in selecting it with
"isn't on a page (it is a library component)", which says nothing about
what to do. It now says the copy has no link to its library and that
enabling the library reaches it.

Found on a real imported file, where copies of the same library set were
cached more than once and only one of them could be linked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/engine/src/assets/library/tests.rs | 5 +++++
 crates/engine/src/cmd/component.rs        | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/crates/engine/src/assets/library/tests.rs b/crates/engine/src/assets/library/tests.rs
index e9b6009ca..733c3ba8c 100644
--- a/crates/engine/src/assets/library/tests.rs
+++ b/crates/engine/src/assets/library/tests.rs
@@ -458,6 +458,11 @@ fn going_to_a_library_main_opens_the_library_file() {
     let e = s.execute("component.goToMain", &json!({"id": card})).unwrap_err();
     assert!(e.to_string().contains("isn't at"), "{e}");
     assert_eq!(s.docs.len(), 1);
+
+    let NodeKind::Instance { component: copy, .. } = node(&s, card).kind else { panic!("not an instance") };
+    s.doc_mut().unwrap().libraries_mut().components.retain(|r| r.root != copy);
+    let e = s.execute("component.goToMain", &json!({"id": card})).unwrap_err();
+    assert!(e.to_string().contains("no link to its library"), "an imported copy without its record: {e}");
     let _ = std::fs::remove_dir_all(&d);
 }
 
diff --git a/crates/engine/src/cmd/component.rs b/crates/engine/src/cmd/component.rs
index 7288045ad..e0b2e02f4 100644
--- a/crates/engine/src/cmd/component.rs
+++ b/crates/engine/src/cmd/component.rs
@@ -207,6 +207,13 @@ pub fn specs() -> Vec<CommandSpec> {
                     let library = library.to_string();
                     return go_to_library_main(s, &library, &name, key);
                 }
+                if doc.is_remote(component) {
+                    return Err(EngineError::Disabled(
+                        cmd.into(),
+                        "the main component is a library copy with no link to its library (it came with an imported file): enable that library to reach it"
+                            .into(),
+                    ));
+                }
                 super::edit::select_and_page(s, vec![component])?;
                 let ds = s.ds_mut()?;
                 if let Some(b) = ds.doc.world_bounds(component) {

From 0097667e249d373619568afbf2a887e010a1f315 Mon Sep 17 00:00:00 2001
From: FredApps <153173854+FredApps@users.noreply.github.com>
Date: Fri, 6 Nov 2026 11:42:42 +0100
Subject: [PATCH 61/70] Copy the shared house rules into AGENTS.md.

plan/ is an optional notebook, the calendar exception and the Rust-only line now live in the Rust rules, and the quality gates no longer say to push to main. The Figma iconography ban stays. CLAUDE.md imports AGENTS.md.
---
 .github/workflows/house-rules.yml |  28 +++++++
 AGENTS.md                         |  70 ++++++++++++++--
 CLAUDE.md                         | 134 +-----------------------------
 3 files changed, 90 insertions(+), 142 deletions(-)
 create mode 100644 .github/workflows/house-rules.yml

diff --git a/.github/workflows/house-rules.yml b/.github/workflows/house-rules.yml
new file mode 100644
index 000000000..de64ad3ee
--- /dev/null
+++ b/.github/workflows/house-rules.yml
@@ -0,0 +1,28 @@
+name: House rules
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  pull_request:
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: house-rules-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  house-rules:
+    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
+    with:
+      rust: true
diff --git a/AGENTS.md b/AGENTS.md
index 4059e4579..e63e92c7c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,3 +1,56 @@
+<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
+## House rules
+
+These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
+
+1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
+2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
+3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
+4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
+5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
+6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
+7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
+8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
+9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
+10. **Keep secrets and personal details out** of the repository, logs and requests.
+11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
+12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
+13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
+14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
+15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
+<!-- craft-house-rules:end -->
+<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
+## Rust Craft repositories
+
+These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
+
+1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
+2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
+3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
+4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
+5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
+6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
+
+## Licence allowlist
+
+Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
+
+- `ISC`
+- `MIT`
+- `BSD-2-Clause`
+- `BSD-3-Clause`
+- `Apache-2.0`
+- `OFL-1.1`
+- `Ubuntu-font-1.0`
+- `Bitstream-Vera`
+- `CC0-1.0`
+- `CC-BY-4.0`
+- `CC-BY-SA-4.0`
+- `LicenseRef-Public-Domain`
+
+`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
+<!-- craft-house-rules:end -->
+
 # FigCraft — instructions for agents
 
 FigCraft is a clean-room, open-source, pure-Rust (egui) reimplementation of the Figma design workflow:
@@ -12,11 +65,10 @@ Repos don't share code.
 1. Read [`ROADMAP.md`](ROADMAP.md) (stage, headline numbers, estimates) and
    [`docs/gaps.md`](docs/gaps.md) (the ranked work list). Unless the user gives you a task, pick
    work from the top of `docs/gaps.md`.
-2. Read `plan/STATUS.md` and `plan/execution-plan.md` (local, gitignored) if present; behaviour
-   reference notes are in `plan/figma/*.md`.
-3. Orient → plan → implement + test → verify (screenshot) → record (ROADMAP, devlog) → commit.
+2. Orient → plan → implement + test → verify (screenshot) → record (ROADMAP, devlog) → commit.
 
-`plan/` is gitignored (local only).
+`plan/` is an optional gitignored notebook. Behaviour reference notes may be in `plan/figma/*.md`.
+Do not ask for it, and do not stop when it is absent.
 
 ## Non-negotiables
 
@@ -59,6 +111,9 @@ Repos don't share code.
 - No `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!` in shipped code
   (workspace clippy lints deny them; tests may use them). Return `Result`/`Option`; use `.get()` for
   data-derived indexes; slice strings only at char boundaries; check floats are finite; cap sizes.
+- New workspace crates include `[lints] workspace = true` in `Cargo.toml`. Production crate roots
+  declare the crate-level lint attributes before modules or other crate items; crate-level `//!`
+  documentation may precede them.
 - `figcraft_engine::guard` turns a panicking command into `EngineError::Internal` and the document
   is rolled back; the desktop app also guards each UI frame and writes recovery copies. These are
   safety nets, not substitutes for `Result`.
@@ -78,13 +133,11 @@ Repos don't share code.
   L6 depends on egui/eframe/rfd/winit. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
   `app.set_props(ids, props)`. Colours come from `theme::Tokens`.
-- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
-- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
+- **Never break wasm** (`cargo xtask wasm`).
 
 ### Quality gates (before every commit)
 `cargo xtask ci` (fmt, clippy -D warnings, tests, layers, assets, wasm). One task per commit with a
-milestone id in the message (`M2.1: auto layout wrap`). Commit after every landed arc of work; push
-to `main`.
+milestone id in the message (`M2.1: auto layout wrap`). Commit after every landed arc of work.
 
 ## Running and looking at the app
 - `cargo run -p figcraft -- --control <port> [file.figcraft|file.svg|image]`. Pick a free port
@@ -98,7 +151,6 @@ to `main`.
   incumbent side by side where the owner allows (`plan/figma/`).
 - Headless: `figcraft-cli` (`info`, `export`, `run`, `commands`, `mcp`). MCP: `figcraft-cli mcp`
   (see `docs/mcp.md`).
-- Shell gotcha on the owner's machine: `mv`/`cp` may be aliased interactive — use `/bin/mv -f`.
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent, edit only the crates/files you own,
   write manifests atomically, delete your target dir when done (disk is limited).
 
diff --git a/CLAUDE.md b/CLAUDE.md
index d12e64e3b..43c994c2d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,133 +1 @@
-# FigCraft — instructions for agents
-
-FigCraft is a clean-room, open-source, pure-Rust (egui) reimplementation of the Figma design workflow:
-interface design, auto layout, components and variants, styles and variables, prototyping and
-inspection. It runs natively on macOS, Windows, Linux and FreeBSD, and in the browser via WASM.
-Siblings: `../vectorcraft` (Illustrator-class), `../photocraft` (Photoshop-class), `../designcraft`
-(InDesign-class) and the other Crafting Apps; same conventions.
-
-Repos don't share code.
-
-## Start every session here
-1. Read [`ROADMAP.md`](ROADMAP.md) (stage, headline numbers, estimates) and
-   [`docs/gaps.md`](docs/gaps.md) (the ranked work list). Unless the user gives you a task, pick
-   work from the top of `docs/gaps.md`.
-2. Read `plan/STATUS.md` and `plan/execution-plan.md` (local, gitignored) if present; behaviour
-   reference notes are in `plan/figma/*.md`.
-3. Orient → plan → implement + test → verify (screenshot) → record (ROADMAP, devlog) → commit.
-
-`plan/` is gitignored (local only).
-
-## Non-negotiables
-
-### Clean-room
-- Behaviour comes from public documentation and black-box observation of the running incumbent app
-  with synthetic documents only. Never read, disassemble or copy anything inside the incumbent's
-  application bundle, web bundle or network traffic (names and public listings only).
-- Never copy GPL/AGPL code.
-- Reference screenshots of the incumbent stay local under the gitignored `plan/figma/screenshots/`
-  and are never committed, published or used as assets.
-
-### Assets: no third-party product iconography or images — ever (absolute rule from the project owner)
-- **Never add, copy, trace, redraw-from, embed or ship any icon, image, illustration, cursor, logo,
-  template, UI kit, preset library, font file or screenshot from Figma, Adobe, Avid, Autodesk or any
-  other product, or from any source whose licence doesn't allow it.** This includes "lookalike"
-  redraws of their icons. Breaking this rule is the worst thing you can do in this repo.
-- Every image, icon, font or other asset must be one of:
-  - original work created for FigCraft by a contributor (licensed MIT OR Apache-2.0);
-  - OSI open source;
-  - public domain / CC0;
-  - Creative Commons with redistribution allowed.
-- **Every asset file must have a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (path, author, source,
-  licence, notes). `cargo xtask assets` (part of `cargo xtask ci`) fails on any unlisted file under
-  `assets/`, `docs/brand/` or `docs/images/`.
-- FigCraft's UI icons are drawn in code (`crates/ui-egui/src/icons.rs`) from simple primitives and
-  are original. Keep it that way: new icons are new code, designed from scratch.
-- The app icon is the owner's chameleon drawing, vectorised (`assets/app-icon/README.md`); `cargo xtask icon`
-  renders the PNGs and `.ico` from `assets/app-icon/figcraft.svg`.
-- **Fonts live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), never in this
-  repo.** The app uses it only through the optional `CRAFT_FONTS_DIR` build input
-  (`.cargo/config.toml` points it at `../craft-fonts` for local builds; `crates/text/build.rs`
-  embeds it). Everything must build, test and run without it (system fonts are scanned at runtime).
-- Demo and test content is synthetic or public domain; never personal photos or data.
-- Code and original assets are MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`, `NOTICE`). The
-  ArtCraft logos in `docs/brand/` are trademarks, not open source, under
-  `docs/brand/LICENSE-brand.txt`: never modify them or use them outside FigCraft.
-- If the provenance of an asset is unclear, don't add it.
-
-### Never crash
-- No `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!` in shipped code
-  (workspace clippy lints deny them; tests may use them). Return `Result`/`Option`; use `.get()` for
-  data-derived indexes; slice strings only at char boundaries; check floats are finite; cap sizes.
-- New workspace crates must include `[lints] workspace = true` in `Cargo.toml` to inherit `[workspace.lints]`. Production crate roots must declare the required crate-level lint attributes before modules or other crate items; crate-level `//!` documentation may precede them.
-- `figcraft_engine::guard` turns a panicking command into `EngineError::Internal` and the document
-  is rolled back; the desktop app also guards each UI frame and writes recovery copies. These are
-  safety nets, not substitutes for `Result`.
-- `unsafe_code = "forbid"` workspace-wide.
-- Every crash fix comes with a regression test. The engine has a junk-parameter sweep over every
-  command (`crates/engine/src/tests.rs`): extend fuzz/sweep tests when you add parsers or commands.
-
-### Architecture
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`spec!(id, label, params doc, undoable, run)`) + tests. The menus, shortcuts, Actions palette,
-  CLI, control channel and MCP server all dispatch the same command ids. Command ids follow the
-  incumbent's menu catalog in `crates/engine/src/catalog.rs` (the parity metric: `cargo xtask parity`).
-- **Programmatic calls never open dialogs.** Commands only *request* UI (`Session::request_ui`); the
-  control channel drops dialog requests.
-- **Layering** is enforced by `cargo xtask layers`: geom/color (L0) → doc (L1) → layout/text/pathops/plugin/collab
-  (L2) → render/format (L3) → svg/pdf (L4) → engine (L5) → ui-egui/mcp (L6) → apps. Nothing below
-  L6 depends on egui/eframe/rfd/winit. **The UI crate is swappable.**
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.set_props(ids, props)`. Colours come from `theme::Tokens`.
-- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
-- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
-
-### Quality gates (before every commit)
-`cargo xtask ci` (fmt, clippy -D warnings, tests, layers, assets, wasm). One task per commit with a
-milestone id in the message (`M2.1: auto layout wrap`). Commit after every landed arc of work; push
-to `main`.
-
-## Running and looking at the app
-- `cargo run -p figcraft -- --control <port> [file.figcraft|file.svg|image]`. Pick a free port
-  (`python3 -c 'import socket;s=socket.socket();s.bind(("127.0.0.1",0));print(s.getsockname()[1])'`);
-  sibling apps use the control channel too.
-- Drive it with JSON lines, e.g.
-  `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}`
-  then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods are documented
-  in `crates/ui-egui/src/control.rs` and `docs/control-protocol.md`.
-- **For UI work, look at the result** (take a screenshot and read the PNG). Compare with the
-  incumbent side by side where the owner allows (`plan/figma/`).
-- Headless: `figcraft-cli` (`info`, `export`, `run`, `commands`, `mcp`). MCP: `figcraft-cli mcp`
-  (see `docs/mcp.md`).
-- Shell gotcha on the owner's machine: `mv`/`cp` may be aliased interactive — use `/bin/mv -f`.
-- Parallel agents: separate `CARGO_TARGET_DIR` per agent, edit only the crates/files you own,
-  write manifests atomically, delete your target dir when done (disk is limited).
-
-## Roadmap
-Progress docs: [`ROADMAP.md`](ROADMAP.md) (one-page
-summary and stage), [`docs/target-app-parity.md`](docs/target-app-parity.md) (the authoritative
-assessment), [`docs/gaps.md`](docs/gaps.md) (ranked work list), [`docs/roadmap.md`](docs/roadmap.md)
-(milestones), [`docs/architecture.md`](docs/architecture.md), the per-area `docs/*-parity.md` files
-and the generated [`docs/parity-checklist.md`](docs/parity-checklist.md) (`cargo xtask parity`).
-When a task lands, update the affected rows and the status line and revision history in the same
-commit. Grade by behaviour against the incumbent, not by whether a menu item exists; err low.
-
-## Contributor credits (About window)
-
-- About ▸ Contributors are compiled into the binary from `contributors/contributors.json`
-  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
-  themselves).
-- **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
-  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
-  whether they want to be credited by more than their username: a real name, a display name, and/or
-  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file)
-  and include it in their PR, committed as them. If no, change nothing: they are credited as
-  `@username` anyway.
-- Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
-  GitHub profiles). Never hand-edit `contributors.json`.
-
-## CI workflows
-- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
-- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
-- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
+@AGENTS.md

From a2be6632ebc0c1722eed8e1dd64b12d31e5c7598 Mon Sep 17 00:00:00 2001
From: Filip Strajnar <filip.strajnar@proton.me>
Date: Fri, 6 Nov 2026 17:03:21 +0100
Subject: [PATCH 62/70] M9: share a file on the local network read-only, with a
 view-only code

The session the app hosts for a local network share now has two secrets:
the edit code and a view-only code (same address and port, a 44-bit secret
of its own). Whoever joins with the view code is welcomed as a viewer: they
see every change and presence, the app makes the file read-only for them,
and the session refuses their batches, as a server does for view links.

Share > Local network offers Can edit / Can view before sharing starts (the
edit code then never shows) and while sharing. collab.share {via: "local",
access: "view"} does the same; share in collab.peers lists both codes and
links. There is still no comment code on the local network.

Next::Stop boxes its event: SessionInfo grew past clippy's
large_enum_variant threshold, and it only ever carries a status or an end.

Tests: loopback_tests::a_view_token_lets_people_look_and_not_edit,
code_tests::a_local_view_code_lets_people_look_and_not_edit,
live_share_tests::a_local_share_can_start_for_looking_only, and the local
share tests that asserted edit-only codes. Docs: collab-protocol.md,
collaboration-parity.md.
---
 apps/figcraft/src/recovery_online_tests.rs |  2 +
 crates/collab-net/src/code_tests.rs        | 52 +++++++++++++++++--
 crates/collab-net/src/driver.rs            |  2 +-
 crates/collab-net/src/driver_tests.rs      |  3 ++
 crates/collab-net/src/guest.rs             |  4 +-
 crates/collab-net/src/host.rs              | 31 +++++++++---
 crates/collab-net/src/join.rs              | 10 ++--
 crates/collab-net/src/link.rs              | 34 +++++++++++--
 crates/collab-net/src/loopback_tests.rs    | 58 +++++++++++++++++++++-
 crates/engine/src/comment_link_tests.rs    |  3 +-
 crates/engine/src/live_share_tests.rs      | 38 +++++++++++---
 crates/engine/src/live_tests.rs            |  2 +
 crates/engine/src/online_tests.rs          |  2 +
 crates/engine/src/sharing/live/host.rs     | 43 ++++++++++------
 crates/engine/src/sharing/live/join.rs     |  5 +-
 crates/engine/src/sharing/live/types.rs    | 11 +++-
 crates/ui-egui/locales/en.toml             |  1 +
 crates/ui-egui/src/live.rs                 | 22 +++++++-
 crates/ui-egui/src/live_docs_tests.rs      |  2 +
 crates/ui-egui/src/live_server_tests.rs    |  1 +
 crates/ui-egui/src/live_share_tests.rs     | 57 ++++++++++++++++++---
 crates/ui-egui/src/live_tests.rs           |  1 +
 crates/ui-egui/src/online_tests.rs         |  2 +
 docs/collab-protocol.md                    | 11 +++-
 docs/collaboration-parity.md               |  5 +-
 25 files changed, 336 insertions(+), 66 deletions(-)

diff --git a/apps/figcraft/src/recovery_online_tests.rs b/apps/figcraft/src/recovery_online_tests.rs
index f877a0d4b..bc3a1d20d 100644
--- a/apps/figcraft/src/recovery_online_tests.rs
+++ b/apps/figcraft/src/recovery_online_tests.rs
@@ -77,6 +77,7 @@ fn root(name: &str) -> PathBuf {
     r
 }
 
+/// What the scripted link says about the session it is in.
 fn info() -> SessionInfo {
     SessionInfo {
         role: Role::Guest,
@@ -90,6 +91,7 @@ fn info() -> SessionInfo {
         address: SERVER.into(),
         network: true,
         access: Access::Edit,
+        view_link: None,
     }
 }
 
diff --git a/crates/collab-net/src/code_tests.rs b/crates/collab-net/src/code_tests.rs
index 7f074f476..a4becfdcc 100644
--- a/crates/collab-net/src/code_tests.rs
+++ b/crates/collab-net/src/code_tests.rs
@@ -1,5 +1,5 @@
-//! Join codes over the network: a file shared on the local network joined by its code (two
-//! engine sessions over loopback), what the browser's driver does with an online code, a server
+//! Join codes over the network: a file shared on the local network joined by its code, and by
+//! its view-only code to look without editing (engine sessions over loopback), what the browser's driver does with an online code, a server
 //! older than join codes, and the links that name a code. (A `figcraft-server` handing codes out
 //! and resolving them is tested in its own crate, with the same link.)
 
@@ -53,6 +53,7 @@ fn layers(s: &Session) -> usize {
     s.doc().map_or(0, |d| d.node_count())
 }
 
+/// A local network share's code joins its session from another app, and edits sync both ways.
 #[test]
 fn a_local_share_is_joined_by_its_code_and_edits_sync() {
     let (mut host, mut guest) = (session("Hana"), session("Ada"));
@@ -65,7 +66,13 @@ fn a_local_share_is_joined_by_its_code_and_edits_sync() {
     assert_eq!(local.ip, Ipv4Addr::LOCALHOST);
     assert_eq!(shared["address"], format!("127.0.0.1:{}", local.port));
     assert_eq!(shared["link"], local.link(), "the code and the invite link name the same session");
-    assert!(shared["share"]["viewCode"].is_null(), "everyone edits on the local network");
+    // A view-only code too, with its own secret, and no comment code.
+    let view = shared["share"]["viewCode"].as_str().unwrap();
+    let Code::Local(viewing) = code::parse(view).unwrap() else { panic!("not a local code") };
+    assert_eq!((viewing.ip, viewing.port), (local.ip, local.port), "the same session");
+    assert_ne!(viewing.secret, local.secret, "a secret of its own");
+    assert_eq!(shared["share"]["viewLink"], viewing.link());
+    assert!(shared["share"]["commentCode"].is_null());
     // Typed the way people type: lower case, spaces for the dashes.
     let typed = shown.to_lowercase().replace('-', " ");
     assert_eq!(guest.execute("collab.join", &json!({"code": typed})).unwrap()["status"], "connecting");
@@ -93,6 +100,8 @@ fn a_local_share_is_joined_by_its_code_and_edits_sync() {
     assert!(label.contains("Couldn't join") || label.contains("The host refused"), "{label}");
 }
 
+/// A well-formed code with the wrong secret is refused by the host, a mistyped one never connects,
+/// and there is no comment code on the local network.
 #[test]
 fn a_local_code_with_the_wrong_secret_or_a_typo_doesnt_join() {
     let (mut host, mut guest) = (session("Hana"), session("Ada"));
@@ -112,11 +121,44 @@ fn a_local_code_with_the_wrong_secret_or_a_typo_doesnt_join() {
     *last = if *last == 'A' { 'B' } else { 'A' };
     let e = guest.execute("collab.join", &json!({"code": typo.iter().collect::<String>()})).unwrap_err().to_string();
     assert!(e.contains("typing mistake"), "{e}");
-    // A view-only code doesn't exist here, and says where it does.
-    let e = host.execute("collab.share", &json!({"access": "view"})).unwrap_err().to_string();
+    // A comment code doesn't exist here, and says where it does.
+    let e = host.execute("collab.share", &json!({"access": "comment"})).unwrap_err().to_string();
     assert!(e.contains("share it online"), "{e}");
 }
 
+/// A local network share started for looking only shows its view code: whoever joins with it sees
+/// every change and can't make one, the edit code (picked later) still edits, and stopping ends
+/// both.
+#[test]
+fn a_local_view_code_lets_people_look_and_not_edit() {
+    let (mut host, mut viewer, mut editor) = (session("Hana"), session("Ada"), session("Bo"));
+    let shared = host.execute("collab.share", &json!({"via": "local", "bind": "local", "access": "view"})).unwrap();
+    assert_eq!(shared["share"]["access"], "view");
+    let (shown, edit) = (shared["code"].as_str().unwrap().to_string(), shared["share"]["editCode"].as_str().unwrap().to_string());
+    assert_eq!(shared["share"]["viewCode"], shown, "the code shown is the view code");
+    assert_ne!(shown, edit);
+    viewer.execute("collab.join", &json!({"code": shown})).unwrap();
+    pump(&mut [&mut host, &mut viewer], "the viewer's join", |s| live(s[1]) && s[0].live().peers.len() == 1);
+    let summary = viewer.live_summary();
+    assert_eq!((&summary["access"], &summary["readOnly"]), (&json!("view"), &json!(true)));
+    // The host's edit reaches the viewer; the viewer's is refused before it leaves.
+    let before = layers(&host);
+    host.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 40, "height": 30})).unwrap();
+    pump(&mut [&mut host, &mut viewer], "the host's edit", |s| layers(s[1]) == before + 1);
+    let e = viewer.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap_err().to_string();
+    assert!(e.contains("View only"), "{e}");
+    // The edit code, picked now, still edits, and the viewer sees it.
+    assert_eq!(host.execute("collab.share", &json!({"access": "edit"})).unwrap()["code"], edit);
+    editor.execute("collab.join", &json!({"code": edit})).unwrap();
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the editor's join", |s| live(s[2]) && s[0].live().peers.len() == 2);
+    assert_eq!(editor.live_summary()["access"], "edit");
+    editor.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap();
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the editor's edit", |s| layers(s[0]) == before + 2 && layers(s[1]) == before + 2);
+    assert_eq!(viewer.live_summary()["readOnly"], true, "picking the edit code changes nothing for who joined to look");
+    assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the end", |s| !s[1].live().status.active() && !s[2].live().status.active());
+}
+
 /// An invite naming only `server` (what a join code is asked at).
 fn code_at(server: &Endpoint) -> Invite {
     Invite { server: server.clone(), file: String::new(), token: String::new() }
diff --git a/crates/collab-net/src/driver.rs b/crates/collab-net/src/driver.rs
index 3ddd3b3c1..001497c6d 100644
--- a/crates/collab-net/src/driver.rs
+++ b/crates/collab-net/src/driver.rs
@@ -391,7 +391,7 @@ impl<S: Socket> Driver<S> {
         match after(outcome, &self.cfg, self.was_live, &mut self.attempt, &self.inbox) {
             Next::Stop(e) => {
                 if let Some(e) = e {
-                    self.inbox.push(e);
+                    self.inbox.push(*e);
                 }
                 self.done = true;
             }
diff --git a/crates/collab-net/src/driver_tests.rs b/crates/collab-net/src/driver_tests.rs
index ea7900745..465bf4ff6 100644
--- a/crates/collab-net/src/driver_tests.rs
+++ b/crates/collab-net/src/driver_tests.rs
@@ -419,6 +419,8 @@ fn pump(d: &mut Driver<Loopback>) {
     }
 }
 
+/// The browser's driver joins a real host over loopback, edits with it, sends presence and hears
+/// the session end.
 #[test]
 fn joins_a_real_host_and_edits_with_it() {
     let host_probe = Inbox::new(Arc::new(|| {}));
@@ -428,6 +430,7 @@ fn joins_a_real_host_and_edits_with_it() {
             any_port_if_taken: false,
             file: FILE.into(),
             token: TOKEN.into(),
+            view_token: None,
             doc: shared(),
             name: "Hana".into(),
             limits: fast_limits(),
diff --git a/crates/collab-net/src/guest.rs b/crates/collab-net/src/guest.rs
index bdb5b98b2..79412e61e 100644
--- a/crates/collab-net/src/guest.rs
+++ b/crates/collab-net/src/guest.rs
@@ -67,7 +67,7 @@ impl Guest {
                     });
                 if let Err(o) = asked.and_then(|(file, token)| resolved(&mut cfg, file, token)) {
                     if let Next::Stop(Some(e)) = after(unresolved(&cfg, o), &cfg, false, &mut 0, &inbox) {
-                        inbox.push(e);
+                        inbox.push(*e);
                     }
                     return;
                 }
@@ -217,7 +217,7 @@ fn supervise(cfg: &GuestConfig, inbox: &Inbox, rx: &Receiver<Cmd>, me: &Sender<C
         match after(outcome, cfg, was_live, &mut attempt, inbox) {
             Next::Stop(e) => {
                 if let Some(e) = e {
-                    inbox.push(e);
+                    inbox.push(*e);
                 }
                 return;
             }
diff --git a/crates/collab-net/src/host.rs b/crates/collab-net/src/host.rs
index 24be22d3e..c7180708c 100644
--- a/crates/collab-net/src/host.rs
+++ b/crates/collab-net/src/host.rs
@@ -1,7 +1,8 @@
 //! The session host the app embeds: the shared [hub](crate::hub) serving one file, the one the
-//! app shares, with the session's single token. The person hosting is in it without a socket:
-//! their presence goes in with [`Host::presence`], their edits with [`Host::send`], what others do
-//! comes out through their [`Inbox`]. When the host stops, the session ends for everyone.
+//! app shares, with the session's edit token and, for a share that has one, its view token. The
+//! person hosting is in it without a socket: their presence goes in with [`Host::presence`], their
+//! edits with [`Host::send`], what others do comes out through their [`Inbox`]. When the host
+//! stops, the session ends for everyone.
 
 use std::io;
 use std::net::{SocketAddr, TcpListener};
@@ -26,6 +27,9 @@ pub struct HostConfig {
     /// The file's session id and secret (both in the invite).
     pub file: String,
     pub token: String,
+    /// A second secret that lets its holders look and not edit (`None`: everyone who gets in
+    /// edits). It must differ from `token`.
+    pub view_token: Option<String>,
     /// The shared document (the session's authoritative copy starts from it).
     pub doc: Document,
     /// The host's own name (empty: "Host").
@@ -40,21 +44,28 @@ pub struct Host {
     me: Peer,
 }
 
-/// The app's one file and its token: everyone with the invite edits.
+/// The app's one file and its tokens: whoever has the edit token edits, whoever has the view
+/// token only looks (the server refuses their changes).
 struct OneFile {
     file: String,
     token: String,
+    view: Option<String>,
 }
 
 impl Backend for OneFile {
+    /// Let in a hello for `file` with `token`, with what its token allows.
     fn admit(&mut self, file: &str, token: &str) -> Result<Admission, String> {
         if file != self.file {
             return Err("this invite is for another file or an earlier session".into());
         }
-        if !same_secret(token, &self.token) {
-            return Err("wrong session token".into());
+        // Both tokens are compared, whichever matches, so the time taken doesn't tell them apart.
+        let edit = same_secret(token, &self.token);
+        let view = self.view.as_deref().is_some_and(|v| same_secret(token, v));
+        match (edit, view) {
+            (true, _) => Ok(Admission { access: Access::Edit, link: None }),
+            (false, true) => Ok(Admission { access: Access::View, link: None }),
+            (false, false) => Err("wrong session token".into()),
         }
-        Ok(Admission { access: Access::Edit, link: None })
     }
 
     fn open(&mut self, _: &str) -> Result<Server, String> {
@@ -69,6 +80,10 @@ impl Backend for OneFile {
 impl Host {
     /// Listen and start the hub; the host joins its own session as the first person.
     pub fn start(cfg: HostConfig, inbox: Inbox) -> io::Result<Host> {
+        // A view token equal to the edit token would let its holders edit: nobody gets in with it.
+        if cfg.view_token.as_deref().is_some_and(|v| same_secret(v, &cfg.token)) {
+            return Err(io::Error::other("the view-only secret is the same as the edit secret"));
+        }
         let listener = match TcpListener::bind(cfg.addr) {
             Ok(l) => l,
             Err(e) if e.kind() == io::ErrorKind::AddrInUse && cfg.any_port_if_taken => TcpListener::bind(SocketAddr::new(cfg.addr.ip(), 0))?,
@@ -99,7 +114,7 @@ impl Host {
             }
         }
         let me = server.peers().find(|p| p.client_id == me).cloned().ok_or_else(|| io::Error::other("the host didn't join its own session"))?;
-        let backend = OneFile { file: cfg.file.clone(), token: cfg.token };
+        let backend = OneFile { file: cfg.file.clone(), token: cfg.token, view: cfg.view_token };
         let local = Local { file: cfg.file, server, id: me.client_id, inbox };
         let hosting = Hosting::start(listener, backend, cfg.limits, Some(local))?;
         Ok(Host { hosting, me })
diff --git a/crates/collab-net/src/join.rs b/crates/collab-net/src/join.rs
index 033186af2..6c913e009 100644
--- a/crates/collab-net/src/join.rs
+++ b/crates/collab-net/src/join.rs
@@ -137,8 +137,9 @@ pub(crate) fn closed(code: u16, reason: &str) -> Outcome {
 
 /// What a guest does after a connection ended.
 pub(crate) enum Next {
-    /// Done: tell the UI this (nothing when you left).
-    Stop(Option<Event>),
+    /// Done: tell the UI this (nothing when you left). Boxed: an event can be large (a welcome),
+    /// and this one is only ever a status or the end of the session.
+    Stop(Option<Box<Event>>),
     /// Connect again after this pause (the UI has been told: `Reconnecting`).
     Reconnect(Duration),
 }
@@ -147,12 +148,12 @@ pub(crate) enum Next {
 /// can't reach the host; a live connection that dropped tries again with growing pauses until the
 /// attempts run out.
 pub(crate) fn after(outcome: Outcome, cfg: &GuestConfig, was_live: bool, attempt: &mut u32, inbox: &Inbox) -> Next {
-    let failed = |reason: String| Next::Stop(Some(Event::Status(Status::Failed { reason })));
+    let failed = |reason: String| Next::Stop(Some(Box::new(Event::Status(Status::Failed { reason }))));
     match outcome {
         Outcome::Left => Next::Stop(None),
         Outcome::Refused(why) => failed(format!("The host refused: {why}")),
         Outcome::Failed(why) => failed(why),
-        Outcome::Ended(reason) => Next::Stop(Some(Event::Ended { reason })),
+        Outcome::Ended(reason) => Next::Stop(Some(Box::new(Event::Ended { reason }))),
         Outcome::Retry(why) if !was_live => failed(format!("Couldn't join the live session: {why}")),
         Outcome::Retry(why) => {
             *attempt += 1;
@@ -228,6 +229,7 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 address: inv.server.display(),
                 network: !inv.loopback(),
                 access,
+                view_link: None,
             };
             seen.peers = peers.clone();
             seen.info = Some(info.clone());
diff --git a/crates/collab-net/src/link.rs b/crates/collab-net/src/link.rs
index fdcba5b97..b2a39ad72 100644
--- a/crates/collab-net/src/link.rs
+++ b/crates/collab-net/src/link.rs
@@ -97,6 +97,26 @@ impl NetLink {
     }
 }
 
+/// A new secret for a hosted session: one a join code can carry (`short`: 44 bits, see
+/// `figcraft_collab::code`), else a full one.
+fn session_secret(short: bool) -> Result<String, String> {
+    match short {
+        true => Ok(code::Local::new(Ipv4Addr::UNSPECIFIED, 0, token::random()?).token()),
+        false => token::secret(),
+    }
+}
+
+/// A view-only secret for a session whose edit secret is `edit`: of the same kind, never the same.
+fn view_secret(short: bool, edit: &str) -> Result<String, String> {
+    for _ in 0..3 {
+        let view = session_secret(short)?;
+        if view != edit {
+            return Ok(view);
+        }
+    }
+    Err("couldn't make a view-only secret".into())
+}
+
 /// This machine's address on the local network: the interface the default route leaves by (no
 /// packet is sent).
 pub fn lan_ip() -> Option<IpAddr> {
@@ -115,6 +135,8 @@ pub fn lan_ip() -> Option<IpAddr> {
 }
 
 impl LiveLink for NetLink {
+    /// Host the open file on `o.bind`: a join code's short secret when `o.short`, and a second,
+    /// view-only secret with its invite link when `o.view`.
     fn host(&mut self, session: SessionId, o: HostOptions) -> Result<SessionInfo, String> {
         let ip = match o.bind {
             Bind::Local => IpAddr::V4(Ipv4Addr::LOCALHOST),
@@ -123,11 +145,10 @@ impl LiveLink for NetLink {
         };
         // A session shared with a join code: its secret is short enough to be typed with the
         // address (see `figcraft_collab::code`); the code and the invite link name the same session.
-        let (file, token) = if o.short {
-            (code::LOCAL_FILE.to_string(), code::Local::new(Ipv4Addr::UNSPECIFIED, 0, token::random()?).token())
-        } else {
-            (token::file_id()?, token::secret()?)
-        };
+        let file = if o.short { code::LOCAL_FILE.to_string() } else { token::file_id()? };
+        let token = session_secret(o.short)?;
+        // A way in for looking only: a second secret of the same kind, never the edit one.
+        let view_token = o.view.then(|| view_secret(o.short, &token)).transpose()?;
         let inbox = self.sessions.inbox();
         let doc = (*o.doc).clone();
         let pages = doc.pages.iter().map(|p| PageInfo { id: p.0, name: doc.node(*p).map(|n| n.name.clone()).unwrap_or_default() }).collect();
@@ -137,12 +158,14 @@ impl LiveLink for NetLink {
             any_port_if_taken: o.port.is_none(),
             file: file.clone(),
             token: token.clone(),
+            view_token: view_token.clone(),
             doc,
             name: o.name,
             limits: self.limits,
             core: figcraft_collab::Limits::default(),
         };
         let host = Host::start(cfg, inbox.clone()).map_err(|e| format!("can't listen on {ip}: {e}"))?;
+        let view_link = view_token.map(|v| Invite::new(host.addr().to_string(), file.clone(), v).link());
         let invite = Invite::new(host.addr().to_string(), file, token);
         let info = SessionInfo {
             role: Role::Host,
@@ -156,6 +179,7 @@ impl LiveLink for NetLink {
             address: host.addr().to_string(),
             network: !ip.is_loopback(),
             access: Access::Edit,
+            view_link,
         };
         self.started(session, Active::Host(host), inbox);
         Ok(info)
diff --git a/crates/collab-net/src/loopback_tests.rs b/crates/collab-net/src/loopback_tests.rs
index 30f77bcb3..dadda9ef4 100644
--- a/crates/collab-net/src/loopback_tests.rs
+++ b/crates/collab-net/src/loopback_tests.rs
@@ -7,7 +7,7 @@ use std::net::{SocketAddr, TcpStream};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
-use figcraft_collab::message::{self, CatchUp, ClientMsg, Hello, Presence, ServerMsg, Signal};
+use figcraft_collab::message::{self, Access, CatchUp, ClientMsg, Hello, Presence, ServerMsg, Signal};
 use figcraft_collab::{Client, Limits};
 use figcraft_doc::{Document, NodeId};
 use figcraft_engine::live::{Event, PEOPLE, Status, TOO_LARGE_TO_JOIN};
@@ -78,6 +78,7 @@ pub(crate) fn fast_limits() -> NetLimits {
     NetLimits { hello_timeout: Duration::from_secs(5), ..NetLimits::default() }
 }
 
+/// A host on a free loopback port with these limits, a probe of what it is told, and its invite.
 fn start_with(limits: NetLimits, core: Limits) -> (Host, Probe, Invite) {
     let probe = Probe::new();
     let mut doc = Document::new("Shared file");
@@ -87,6 +88,7 @@ fn start_with(limits: NetLimits, core: Limits) -> (Host, Probe, Invite) {
         any_port_if_taken: false,
         file: FILE.into(),
         token: TOKEN.into(),
+        view_token: None,
         doc,
         name: "Hana".into(),
         limits,
@@ -214,6 +216,7 @@ fn guests_join_and_see_each_other() {
     assert_eq!(host.connections(), 0);
 }
 
+/// A guest with the wrong token or for another file is refused, and the secret never shows.
 #[test]
 fn a_wrong_token_or_file_is_refused() {
     let (mut host, mut hp, invite) = start();
@@ -236,6 +239,57 @@ fn a_wrong_token_or_file_is_refused() {
     host.stop();
 }
 
+/// Join `addr` with `token` over a bare socket and make an edit: what the welcome allowed, and
+/// whether the host took the edit (`Changes`) or rejected it (`Reject`).
+fn join_and_edit(addr: SocketAddr, token: &str) -> (Access, ServerMsg) {
+    let mut raw = Raw::hello(addr, token);
+    let mut welcome = std::iter::from_fn(|| raw.next()).find(|m| matches!(m, ServerMsg::Welcome { .. })).expect("a welcome");
+    message::unpack(&mut welcome, 64 << 20).unwrap();
+    let ServerMsg::Welcome { access, .. } = welcome else { panic!("not a welcome: {welcome:?}") };
+    let mut client = Client::join(welcome).unwrap();
+    let mut doc = client.document().clone();
+    doc.add_page("Mine");
+    assert!(raw.send(&client.edit(&doc).unwrap().unwrap()));
+    let answer = std::iter::from_fn(|| raw.next()).find(|m| matches!(m, ServerMsg::Changes(_) | ServerMsg::Reject { .. })).expect("an answer");
+    (access, answer)
+}
+
+/// A session hosted with a view token as well (a local network share's view-only code): whoever
+/// joins with it is welcomed as a viewer and their edits are rejected, the edit token still edits,
+/// any other token is still refused, and a view token equal to the edit token isn't hosted.
+#[test]
+fn a_view_token_lets_people_look_and_not_edit() {
+    const VIEW: &str = "ViewOnlyViewOnlyView00";
+    let probe = Probe::new();
+    let cfg = |view: &str| {
+        let mut doc = Document::new("Shared file");
+        doc.repair();
+        HostConfig {
+            addr: SocketAddr::from(([127, 0, 0, 1], 0)),
+            any_port_if_taken: false,
+            file: FILE.into(),
+            token: TOKEN.into(),
+            view_token: Some(view.into()),
+            doc,
+            name: "Hana".into(),
+            limits: fast_limits(),
+            core: Limits::default(),
+        }
+    };
+    let same = Host::start(cfg(TOKEN), probe.inbox.clone()).err().expect("a view token equal to the edit token is refused");
+    assert!(same.to_string().contains("view-only"), "{same}");
+    let mut host = Host::start(cfg(VIEW), probe.inbox.clone()).unwrap();
+    let (access, answer) = join_and_edit(host.addr(), VIEW);
+    assert_eq!(access, Access::View);
+    assert!(matches!(&answer, ServerMsg::Reject { reason, .. } if reason.contains("view")), "{answer:?}");
+    let (access, answer) = join_and_edit(host.addr(), TOKEN);
+    assert_eq!(access, Access::Edit);
+    assert!(matches!(answer, ServerMsg::Changes(_)), "{answer:?}");
+    let refusal = Raw::hello(host.addr(), "WrongWrongWrongWrong00").refusal();
+    assert!(refusal.as_deref().is_some_and(|r| r.contains("token")), "{refusal:?}");
+    host.stop();
+}
+
 #[test]
 fn unreachable_hosts_fail_at_once() {
     // A port nothing listens on.
@@ -677,6 +731,7 @@ fn the_host_removes_someone_and_they_cant_come_back() {
     assert_eq!(host.connections(), 0);
 }
 
+/// A welcome larger than the guest takes says the file is too large to join.
 #[test]
 fn a_welcome_over_the_size_limit_says_the_file_is_too_large() {
     let mut doc = Document::new("B".repeat(1 << 20));
@@ -687,6 +742,7 @@ fn a_welcome_over_the_size_limit_says_the_file_is_too_large() {
         any_port_if_taken: false,
         file: FILE.into(),
         token: TOKEN.into(),
+        view_token: None,
         doc,
         name: "Hana".into(),
         limits: fast_limits(),
diff --git a/crates/engine/src/comment_link_tests.rs b/crates/engine/src/comment_link_tests.rs
index 6c59e96f5..6a29eff2a 100644
--- a/crates/engine/src/comment_link_tests.rs
+++ b/crates/engine/src/comment_link_tests.rs
@@ -81,11 +81,12 @@ fn only_a_comment_link_leaves_the_comment_tool() {
     assert!(!tool_left(crate::live::PUBLISHING, ToolId::Comment));
 }
 
+/// A local network share has edit and view-only codes, not a comment code, and says where one is.
 #[test]
 fn a_local_share_has_no_comment_code() {
     let (mut s, _) = session();
     let e = s.execute("collab.share", &json!({"via": "local", "access": "comment"})).unwrap_err().to_string();
-    assert!(e.contains("can edit it"), "{e}");
+    assert!(e.contains("share it online for a comment code"), "{e}");
     let e = s.execute("collab.share", &json!({"access": "owner"})).unwrap_err().to_string();
     assert!(e.contains("\"comment\""), "{e}");
 }
diff --git a/crates/engine/src/live_share_tests.rs b/crates/engine/src/live_share_tests.rs
index 19afba621..76deed757 100644
--- a/crates/engine/src/live_share_tests.rs
+++ b/crates/engine/src/live_share_tests.rs
@@ -36,13 +36,18 @@ struct Link(Arc<Mutex<Script>>);
 
 /// Where the scripted host listens, and its session's secret.
 const HOST: Local = Local { ip: Ipv4Addr::new(192, 168, 1, 20), port: 47_900, secret: 0x123_4567_89AB };
+/// The same session's view-only secret.
+const VIEW: Local = Local { secret: 0xBA9_8765_4321, ..HOST };
 
 impl LiveLink for Link {
+    /// Host as the network link does: a code's short secret when shared with a code, and the
+    /// view-only link when asked for one.
     fn host(&mut self, session: u64, opts: HostOptions) -> Result<SessionInfo, String> {
         let mut s = self.0.lock().unwrap();
         s.session = session;
         // As the network link does: a short secret when the session is shared with a code.
         let link = if opts.short { HOST.link() } else { "figcraft://join?host=192.168.1.20:47900&file=f&token=AbCdEfGhIjKlMnOpQrStUv".to_string() };
+        let view_link = opts.view.then(|| VIEW.link());
         s.hosted.push(opts);
         Ok(SessionInfo {
             role: Role::Host,
@@ -56,6 +61,7 @@ impl LiveLink for Link {
             address: "192.168.1.20:47900".into(),
             network: true,
             access: Access::Edit,
+            view_link,
         })
     }
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
@@ -146,6 +152,7 @@ fn on_the_server(s: &mut Session, script: &Arc<Mutex<Script>>, codes: Option<(&s
         address: "wss://share.example:443/".into(),
         network: true,
         access: Access::Edit,
+        view_link: None,
     };
     let events = vec![Event::Published(published), Event::Shared(Ok(links(0, codes))), Event::Welcome { info, peers: vec![] }];
     script.lock().unwrap().events.extend(events);
@@ -352,6 +359,8 @@ fn online_sharing_is_off_without_a_server() {
     assert!(matches!(bare.execute("collab.join", &json!({"code": HOST.code()})), Err(EngineError::Disabled(..))));
 }
 
+/// A local network share shows the code that carries the host's address, has a view-only code
+/// for the same session, switches which shows without hosting again, and listens where told.
 #[test]
 fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     let (mut s, script) = session();
@@ -360,30 +369,43 @@ fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     let shown = r["code"].as_str().unwrap();
     assert_eq!(code::parse(shown), Ok(code::Code::Local(HOST)), "{shown}");
     assert_eq!(shown, code::grouped(&HOST.code()));
-    assert_eq!((&r["link"], &r["share"]["viewCode"]), (&json!(HOST.link()), &Value::Null));
+    assert_eq!(r["link"], json!(HOST.link()));
+    // A view-only code too, for the same session with its own secret; no comment code.
+    let view = code::grouped(&VIEW.code());
+    assert_eq!((&r["share"]["viewCode"], &r["share"]["viewLink"]), (&json!(view), &json!(VIEW.link())));
+    assert_eq!((&r["share"]["editLink"], &r["share"]["commentCode"]), (&json!(HOST.link()), &Value::Null));
     {
         let sc = script.lock().unwrap();
         let [h] = sc.hosted.as_slice() else { panic!("hosted {}", sc.hosted.len()) };
-        assert!(h.short && h.bind == Bind::Lan && h.port.is_none(), "the local network unless told otherwise");
+        assert!(h.short && h.view && h.bind == Bind::Lan && h.port.is_none(), "the local network unless told otherwise");
     }
-    // Everyone edits there.
-    assert!(err(&mut s, "collab.share", json!({"access": "view"})).contains("share it online"));
+    // Which code shows: the view code, then the edit code again (nothing is hosted twice).
+    let r = ex(&mut s, "collab.share", json!({"access": "view"}));
+    assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
+    assert_eq!(ex(&mut s, "collab.share", json!({"access": "edit"}))["code"], json!(code::grouped(&HOST.code())));
+    assert!(err(&mut s, "collab.share", json!({"access": "comment"})).contains("share it online"));
+    assert_eq!(script.lock().unwrap().hosted.len(), 1);
     assert_eq!(ex(&mut s, "collab.stop", json!({}))["ended"], true);
     assert!(script.lock().unwrap().asked.is_empty(), "no server to tell");
-    assert!(err(&mut s, "collab.share", json!({"via": "local", "access": "view"})).contains("share it online"));
+    // Shared for looking only from the start: the edit code isn't the one shown.
+    let r = ex(&mut s, "collab.share", json!({"via": "local", "access": "view"}));
+    assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
+    ex(&mut s, "collab.stop", json!({}));
+    assert!(err(&mut s, "collab.share", json!({"via": "local", "access": "comment"})).contains("share it online"));
     // Where to listen is the advanced part.
     ex(&mut s, "collab.share", json!({"via": "local", "bind": "local", "port": 5000}));
     let sc = script.lock().unwrap();
-    assert!(sc.hosted[1].bind == Bind::Local && sc.hosted[1].port == Some(5000));
+    assert!(sc.hosted[2].bind == Bind::Local && sc.hosted[2].port == Some(5000));
     drop(sc);
     ex(&mut s, "collab.stop", json!({}));
     for bad in [json!({"via": "post"}), json!({"via": "local", "port": 70000}), json!({"via": "local", "bind": "everywhere"})] {
         assert!(matches!(s.execute("collab.share", &bad), Err(EngineError::BadParams { .. })), "{bad}");
     }
-    // A plain `collab.host` session has an invite link, not a code.
+    // A plain `collab.host` session has an invite link, not a code, and everyone in it edits.
     let r = ex(&mut s, "collab.host", json!({}));
     assert_eq!((&r["code"], &r["share"]), (&Value::Null, &Value::Null));
-    assert!(!script.lock().unwrap().hosted[2].short);
+    let h = &script.lock().unwrap().hosted[3];
+    assert!(!h.short && !h.view);
 }
 
 #[test]
diff --git a/crates/engine/src/live_tests.rs b/crates/engine/src/live_tests.rs
index 1bae1b106..2d2f504f7 100644
--- a/crates/engine/src/live_tests.rs
+++ b/crates/engine/src/live_tests.rs
@@ -90,6 +90,7 @@ impl LiveLink for Mock {
     }
 }
 
+/// A session you are in as `role`, as client `me`, everyone in it editing.
 pub(crate) fn info(role: Role, me: u32) -> SessionInfo {
     SessionInfo {
         role,
@@ -103,6 +104,7 @@ pub(crate) fn info(role: Role, me: u32) -> SessionInfo {
         address: "127.0.0.1:47900".into(),
         network: false,
         access: crate::live::Access::Edit,
+        view_link: None,
     }
 }
 
diff --git a/crates/engine/src/online_tests.rs b/crates/engine/src/online_tests.rs
index af13db8e7..3f8c6a293 100644
--- a/crates/engine/src/online_tests.rs
+++ b/crates/engine/src/online_tests.rs
@@ -136,6 +136,7 @@ fn edit_link(server: &str, file: &str) -> String {
     format!("figcraft://join?server={server}&file={file}&token={EDIT_TOKEN}")
 }
 
+/// A session you are in as `role` under `name`, invited with `link`.
 fn info(role: Role, name: &str, link: &str) -> SessionInfo {
     SessionInfo {
         role,
@@ -149,6 +150,7 @@ fn info(role: Role, name: &str, link: &str) -> SessionInfo {
         address: SERVER.into(),
         network: true,
         access: Access::Edit,
+        view_link: None,
     }
 }
 
diff --git a/crates/engine/src/sharing/live/host.rs b/crates/engine/src/sharing/live/host.rs
index e4fc2d994..1b3ebb6b0 100644
--- a/crates/engine/src/sharing/live/host.rs
+++ b/crates/engine/src/sharing/live/host.rs
@@ -36,14 +36,16 @@ pub(super) fn unavailable(cmd: &str) -> EngineError {
     )
 }
 
+/// `collab.host`: host the open file (on this machine unless `p` says where) with an invite link.
 pub(super) fn host(s: &mut Session, p: &Value) -> Result<Value> {
-    start_host(s, "collab.host", p, Bind::Local, false)?;
+    start_host(s, "collab.host", p, Bind::Local, false, false)?;
     Ok(s.live_summary())
 }
 
 /// Start hosting the open file for command `cmd` (on `bind` unless `p` says where; `short`: with
-/// a secret a join code can carry): the new session.
-fn start_host(s: &mut Session, cmd: &str, p: &Value, bind: Bind, short: bool) -> Result<SessionId> {
+/// a secret a join code can carry; `view`: with a second secret for looking only): the new
+/// session.
+fn start_host(s: &mut Session, cmd: &str, p: &Value, bind: Bind, short: bool, view: bool) -> Result<SessionId> {
     let port = match get(p, "port") {
         None => None,
         Some(v) => Some(v.as_u64().and_then(|n| u16::try_from(n).ok()).ok_or_else(|| bad(cmd, "`port` must be a whole number from 0 to 65535"))?),
@@ -55,7 +57,7 @@ fn start_host(s: &mut Session, cmd: &str, p: &Value, bind: Bind, short: bool) ->
         Some(other) => other.parse::<IpAddr>().map(Bind::Addr).map_err(|_| bad(cmd, "`bind` must be \"local\", \"lan\" or an IP address"))?,
     };
     let (doc, uid) = s.ds().map(|ds| (ds.doc.clone(), ds.uid))?;
-    let opts = HostOptions { port, bind, name: display_name(&s.prefs), doc, short };
+    let opts = HostOptions { port, bind, name: display_name(&s.prefs), doc, short, view };
     let (id, info) = s.live.start(cmd, |l, id| l.host(id, opts).map_err(|e| EngineError::Other(format!("couldn't start the live session: {e}"))))?;
     s.live.open(Live { id, status: Status::Live, info: Some(info), doc_uid: Some(uid), tab: Some(uid), ..Live::default() });
     Ok(id)
@@ -82,8 +84,9 @@ fn start_publish(s: &mut Session, cmd: &str, server: &str, p: &Value, share: boo
     Ok(id)
 }
 
-/// Why a local network share has no view-only or comment code.
-const LOCAL_EDITS: &str = "everyone who joins a file shared on the local network can edit it: share it online for a view-only or comment code";
+/// Why a local network share has no comment code.
+const LOCAL_COMMENTS: &str =
+    "a file shared on the local network has an edit code and a view-only code, not a comment code: share it online for a comment code";
 
 /// Why a share has no comment code.
 const NO_COMMENT_LINK: &str =
@@ -94,6 +97,8 @@ fn access_param(cmd: &str, p: &Value) -> Result<Option<Access>> {
     string(p, "access").map(|a| Access::parse(&a).ok_or_else(|| bad(cmd, "`access` must be \"edit\", \"comment\" or \"view\""))).transpose()
 }
 
+/// `collab.share`: share the open file with join codes, online or on the local network, or (shared
+/// already) switch which code shows.
 pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
     const CMD: &str = "collab.share";
     let via = match string(p, "via").as_deref().map(str::trim) {
@@ -112,8 +117,8 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
                 "this file is shared the other way already: stop sharing it first (collab.stop), or leave its session (collab.leave)",
             ));
         }
-        if access.is_some_and(|a| a != Access::Edit) && shared == Via::Local {
-            return Err(bad(CMD, LOCAL_EDITS));
+        if access == Some(Access::Comment) && shared == Via::Local {
+            return Err(bad(CMD, LOCAL_COMMENTS));
         }
         if let Some(req) = share_request(s, Vec::new(), true).filter(|_| s.live().share.as_ref().is_some_and(|sh| sh.links.is_none())) {
             let links = share_answer(s, req)?.ok_or_else(|| EngineError::Other("the server made no links".into()))?;
@@ -130,8 +135,8 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
     let access = access.unwrap_or_default();
     let mut server = String::new();
     let id = match via {
-        Via::Local if access != Access::Edit => return Err(bad(CMD, LOCAL_EDITS)),
-        Via::Local => start_host(s, CMD, p, Bind::Lan, true)?,
+        Via::Local if access == Access::Comment => return Err(bad(CMD, LOCAL_COMMENTS)),
+        Via::Local => start_host(s, CMD, p, Bind::Lan, true, true)?,
         Via::Online => {
             server = string(p, "server").unwrap_or_else(|| s.prefs.publish_server.clone()).trim().to_string();
             if server.is_empty() {
@@ -141,17 +146,25 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
         }
     };
     if let Some(live) = s.live.sessions.get_mut(&id) {
-        // On the local network the session's own link is what others join with, and the code says
-        // what the link says: where the session is and its secret. (Online they arrive with the file.)
-        let links = live.info.as_ref().filter(|_| via == Via::Local).map(|i| {
-            let code = code::Local::from_link(&i.link).map(|l| l.code());
-            Shared { edit: SharedLink { id: String::new(), link: i.link.clone(), code }, ..Shared::default() }
+        // On the local network the session's own links are what others join with (its view link
+        // only lets them look), and each code says what its link says: where the session is and
+        // that link's secret. (Online they arrive with the file.)
+        let links = live.info.as_ref().filter(|_| via == Via::Local).map(|i| Shared {
+            edit: local_link(&i.link),
+            view: i.view_link.as_deref().map(local_link),
+            comment: None,
         });
         live.share = Some(Share { via, server, access, links });
     }
     Ok(s.live_summary())
 }
 
+/// A way into a session this app hosts: its invite link and the join code that stands for it
+/// (none when the link can't be put in one: a host without an IPv4 address).
+fn local_link(link: &str) -> SharedLink {
+    SharedLink { id: String::new(), link: link.to_string(), code: code::Local::from_link(link).map(|l| l.code()) }
+}
+
 /// What others join the open file's server file with changed: in its session and its record.
 pub(super) fn shared_now(s: &mut Session, links: Option<Shared>) {
     if let Some((server, file)) = s.live().server_file() {
diff --git a/crates/engine/src/sharing/live/join.rs b/crates/engine/src/sharing/live/join.rs
index 836267b2a..994c4d6a9 100644
--- a/crates/engine/src/sharing/live/join.rs
+++ b/crates/engine/src/sharing/live/join.rs
@@ -162,6 +162,7 @@ fn spotlight(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"spotlighting": s.live().spotlighting}))
 }
 
+/// The live session commands (`collab.*`).
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         spec!(
@@ -174,7 +175,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "collab.share",
             "Share with a join code",
-            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (online only: which code `code` is), server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` an invite link. Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
+            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (look only: their edits are refused): which code `code` is, server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` the session's own invite link (it edits: `share` has the link that goes with each code). Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols), and `share` is {via, access, shared, editCode, viewCode, editLink, viewLink}: the edit and view-only ways in, each with its own secret (commentCode and commentLink null). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
             false,
             share
         ),
@@ -230,7 +231,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "collab.peers",
             "People in this file",
-            "{} → the open file's session (each open file has its own or none): {available, canHost (false in the browser: it can only join), session (its id; null: this file isn't in a session), status: off|connecting|live|reconnecting|failed, reason?, role, me, name, color, fileName, pages, link, url, address, network, access: edit|view|comment (view: a server's view link, edits are refused; comment: its comment link, edits other than to comment threads are refused), readOnly (the open file can't be edited now: view only, comment only, or being published), published (a file you published: {server, file, name, edit, view}), code (the join code to give others, when the file was shared with `collab.share`; null otherwise or while it is on its way), share ({via: online|local, access, shared (false: a file of yours on a server that nobody else gets into now), editCode, viewCode, commentCode, editLink, viewLink, commentLink (what others join with; null when not shared)} or null), follow, syncing, document (index of the synced open document), editing (the text layer you type in: {node, layer, caret, selection}), peers: [{id, name, color, editing (theirs, same shape, or null), presence: {cursor: [page, x, y], selection, viewport: [page, x, y, w, h], editing_text}}], sessions: [{session, document (index of its open document; null for a join on its way), status, reason, role, fileName, link, peers (how many others)}] (every session of the app)}",
+            "{} → the open file's session (each open file has its own or none): {available, canHost (false in the browser: it can only join), session (its id; null: this file isn't in a session), status: off|connecting|live|reconnecting|failed, reason?, role, me, name, color, fileName, pages, link, url, address, network, access: edit|view|comment (view: a view link or code, a server's or a local network share's, edits are refused; comment: a server's comment link, edits other than to comment threads are refused), readOnly (the open file can't be edited now: view only, comment only, or being published), published (a file you published: {server, file, name, edit, view}), code (the join code to give others, when the file was shared with `collab.share`; null otherwise or while it is on its way), share ({via: online|local, access, shared (false: a file of yours on a server that nobody else gets into now), editCode, viewCode, commentCode, editLink, viewLink, commentLink (what others join with; null when not shared)} or null), follow, syncing, document (index of the synced open document), editing (the text layer you type in: {node, layer, caret, selection}), peers: [{id, name, color, editing (theirs, same shape, or null), presence: {cursor: [page, x, y], selection, viewport: [page, x, y, w, h], editing_text}}], sessions: [{session, document (index of its open document; null for a join on its way), status, reason, role, fileName, link, peers (how many others)}] (every session of the app)}",
             false,
             |s, _| Ok(s.live_summary())
         ),
diff --git a/crates/engine/src/sharing/live/types.rs b/crates/engine/src/sharing/live/types.rs
index 93455c0d8..c83f1254c 100644
--- a/crates/engine/src/sharing/live/types.rs
+++ b/crates/engine/src/sharing/live/types.rs
@@ -119,9 +119,13 @@ pub struct SessionInfo {
     pub address: String,
     /// Reachable from other machines (the host listens on a network address, not loopback).
     pub network: bool,
-    /// What you may do: edit, only view (a server's view link), or view and comment (its comment
-    /// link).
+    /// What you may do: edit, only view (a view link or code), or view and comment (a server's
+    /// comment link).
     pub access: Access,
+    /// A session this app hosts with a way in for looking only ([`HostOptions::view`]): its
+    /// invite link, which carries the view secret (`None`: everyone who joins edits, or you
+    /// joined).
+    pub view_link: Option<String>,
 }
 
 /// A file you published to a server: where, and its first share links (they carry their tokens:
@@ -390,6 +394,9 @@ pub struct HostOptions {
     pub doc: Arc<Document>,
     /// Shared with a join code (`collab.share`): the session's secret is short enough to type.
     pub short: bool,
+    /// Also make a second secret whose holders only look: they see every change, and the session
+    /// refuses theirs ([`SessionInfo::view_link`]).
+    pub view: bool,
 }
 
 /// What [`LiveLink::publish`] needs to put the open file on a server.
diff --git a/crates/ui-egui/locales/en.toml b/crates/ui-egui/locales/en.toml
index 11f0bb4ac..23fd4bc72 100644
--- a/crates/ui-egui/locales/en.toml
+++ b/crates/ui-egui/locales/en.toml
@@ -127,6 +127,7 @@ name = "English"
 "Another server, or one that needs its key. The usual server is set in Preferences." = "Another server, or one that needs its key. The usual server is set in Preferences."
 "Any status" = "Any status"
 "Anyone on your network with this code can edit the file, while this app stays open." = "Anyone on your network with this code can edit the file, while this app stays open."
+"Anyone on your network with this code can look at the file, not change it, while this app stays open." = "Anyone on your network with this code can look at the file, not change it, while this app stays open."
 "Anyone with the edit link can change the file; the view link only lets people look. The links carry their secrets: share them like passwords. `figcraft-server links` makes more and revokes them." = "Anyone with the edit link can change the file; the view link only lets people look. The links carry their secrets: share them like passwords. `figcraft-server links` makes more and revokes them."
 "Anyone with this code can edit the file." = "Anyone with this code can edit the file."
 "Anyone with this code can look at the file, not change it." = "Anyone with this code can look at the file, not change it."
diff --git a/crates/ui-egui/src/live.rs b/crates/ui-egui/src/live.rs
index efa64617c..e48ff2017 100644
--- a/crates/ui-egui/src/live.rs
+++ b/crates/ui-egui/src/live.rs
@@ -108,6 +108,9 @@ pub struct LiveUi {
     focus_join: bool,
     /// Share on the local network (else online, through the server in Preferences).
     pub local: bool,
+    /// What the code a local network share starts with lets people do: edit, or only look (the
+    /// edit code then doesn't show until it is picked).
+    pub local_access: Access,
     /// The Share popover's Advanced part shows; what it sets for a local network share: only
     /// this computer can join, and the port (empty: the usual one).
     pub advanced: bool,
@@ -852,6 +855,7 @@ fn start_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens) {
     }
     if local {
         widgets::label(ui, tr("People on your network join with a code. Nothing goes through a server."), t.text_secondary);
+        local_access_choice(app, ui);
     } else {
         online_note(app, ui, t, &server);
     }
@@ -861,10 +865,24 @@ fn start_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens) {
     join_and_advanced(app, ui, t, |app, ui, t| share_advanced(app, ui, t, local, &server));
 }
 
+/// What the code of a local network share lets people do, picked before it starts: edit the file
+/// or only look at it.
+fn local_access_choice(app: &mut FigApp, ui: &mut Ui) {
+    let levels: Vec<(Access, &str)> = LEVELS.into_iter().filter(|(a, _)| *a != Access::Comment).collect();
+    let labels: Vec<&str> = levels.iter().map(|(_, l)| tr(l)).collect();
+    let at = levels.iter().position(|(a, _)| *a == app.ui.live.local_access).unwrap_or_default();
+    if let Some((a, _)) = widgets::segmented_text(ui, &labels, at).and_then(|i| levels.get(i)) {
+        app.ui.live.local_access = *a;
+    }
+}
+
 /// Start sharing the open file on the local network, or online on `server` (the one in
 /// Preferences).
 fn start_sharing(app: &mut FigApp, local: bool, server: &str) {
     let mut params = json!({"via": if local { "local" } else { "online" }});
+    if local {
+        params["access"] = json!(app.ui.live.local_access.id());
+    }
     if local && app.ui.live.this_computer {
         params["bind"] = json!("local");
     }
@@ -1068,6 +1086,7 @@ fn share_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens, share: &Share) {
         (true, Access::View) => tr("Anyone with this code can look at the file, not change it."),
         (true, Access::Comment) => tr("Anyone with this code can look at the file and comment on it, not change it."),
         (true, Access::Edit) => tr("Anyone with this code can edit the file."),
+        (false, Access::View) => tr("Anyone on your network with this code can look at the file, not change it, while this app stays open."),
         (false, _) => tr("Anyone on your network with this code can edit the file, while this app stays open."),
     };
     widgets::label(ui, who, t.text_secondary);
@@ -1081,7 +1100,8 @@ fn share_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens, share: &Share) {
 }
 
 /// What the code shown lets people do, to pick from the levels the share has links for: a server
-/// has links (and codes) for looking only and for commenting; a session this app hosts doesn't.
+/// has links (and codes) for looking only and for commenting; a session this app hosts on the
+/// local network has one for looking only.
 fn access_choice(app: &mut FigApp, ui: &mut Ui, share: &Share) {
     let levels: Vec<(Access, &str)> = LEVELS.into_iter().filter(|(a, _)| share.links.as_ref().is_some_and(|l| l.of(*a).is_some())).collect();
     if levels.len() < 2 {
diff --git a/crates/ui-egui/src/live_docs_tests.rs b/crates/ui-egui/src/live_docs_tests.rs
index 7ac04e82b..7e104dac7 100644
--- a/crates/ui-egui/src/live_docs_tests.rs
+++ b/crates/ui-egui/src/live_docs_tests.rs
@@ -17,6 +17,7 @@ type Queue = Arc<Mutex<Vec<(u64, LiveEvent)>>>;
 struct Hosting(Queue);
 
 impl LiveLink for Hosting {
+    /// Host at once, with an invite link and nobody else in the session.
     fn host(&mut self, session: u64, _: HostOptions) -> Result<SessionInfo, String> {
         let address = format!("127.0.0.1:{}", 47_899 + session);
         Ok(SessionInfo {
@@ -31,6 +32,7 @@ impl LiveLink for Hosting {
             address,
             network: false,
             access: Access::Edit,
+            view_link: None,
         })
     }
     fn join(&mut self, _: u64, _: &str, _: &str) -> Result<(), String> {
diff --git a/crates/ui-egui/src/live_server_tests.rs b/crates/ui-egui/src/live_server_tests.rs
index e2f2a0506..c7e1c2e38 100644
--- a/crates/ui-egui/src/live_server_tests.rs
+++ b/crates/ui-egui/src/live_server_tests.rs
@@ -44,6 +44,7 @@ pub(crate) fn joined(h: &mut Harness, access: Access) {
         address: "127.0.0.1:47900".into(),
         network: false,
         access,
+        view_link: None,
     };
     h.send(vec![LiveEvent::Welcome { info, peers: vec![] }, LiveEvent::Sync(w)]);
     h.frames(2);
diff --git a/crates/ui-egui/src/live_share_tests.rs b/crates/ui-egui/src/live_share_tests.rs
index 563cd2442..b1c6556df 100644
--- a/crates/ui-egui/src/live_share_tests.rs
+++ b/crates/ui-egui/src/live_share_tests.rs
@@ -1,7 +1,7 @@
 //! Sharing with a join code in the window: the Share popover not sharing (online or the local
 //! network, one Start button, the rest under Advanced), sharing online (the code large, copying,
 //! what it lets people do, who is here, stop: the file stays on the server, not shared, and can
-//! be shared again or removed), sharing on the local network, a server without
+//! be shared again or removed), sharing on the local network (to edit, or to look only), a server without
 //! codes, joining with the one join field (the popover, the home screen, the Join dialog), its
 //! errors, the server preference, and an idle popover asking for no frames.
 
@@ -53,9 +53,12 @@ struct Link(Shared);
 
 /// Where the scripted host listens, and its session's secret.
 const HOST: Local = Local { ip: std::net::Ipv4Addr::new(192, 168, 1, 20), port: 47_900, secret: 0x123_4567_89AB };
+/// The same session's view-only secret.
+const VIEW: Local = Local { secret: 0xBA9_8765_4321, ..HOST };
 /// A link without a code in it (an address a code can't carry).
 const PLAIN: &str = "figcraft://join?host=[fd00::1]:47900&file=f&token=AbCdEfGhIjKlMnOpQrStUv";
 
+/// What the scripted link says about a session you are in as `role`, invited with `link`.
 fn info(role: Role, link: &str) -> SessionInfo {
     SessionInfo {
         role,
@@ -69,16 +72,20 @@ fn info(role: Role, link: &str) -> SessionInfo {
         address: "192.168.1.20:47900".into(),
         network: true,
         access: Access::Edit,
+        view_link: None,
     }
 }
 
 impl LiveLink for Link {
+    /// Host as the network link does: port 6 stands for an address a code can't carry, and a
+    /// share for looking only gets a view link too.
     fn host(&mut self, session: u64, opts: HostOptions) -> Result<SessionInfo, String> {
         let mut s = self.0.lock().unwrap();
         s.session = session;
-        let link = if opts.port == Some(6) { PLAIN.to_string() } else { HOST.link() };
+        let (link, view) = if opts.port == Some(6) { (PLAIN.to_string(), PLAIN.replace("AbCd", "View")) } else { (HOST.link(), VIEW.link()) };
+        let view_link = opts.view.then_some(view);
         s.hosted.push(opts);
-        Ok(info(Role::Host, &link))
+        Ok(SessionInfo { view_link, ..info(Role::Host, &link) })
     }
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
         let mut s = self.0.lock().unwrap();
@@ -208,6 +215,8 @@ fn document_arrives(h: &mut Harness, script: &Shared) {
     h.frames(3);
 }
 
+/// Not sharing: one way to start (online or the local network, which also offers Can edit / Can
+/// view) and one to join, with addresses, keys and ports under Advanced.
 #[test]
 fn not_sharing_the_popover_offers_one_way_to_start_and_one_to_join() {
     let (mut h, script) = harness();
@@ -223,9 +232,11 @@ fn not_sharing_the_popover_offers_one_way_to_start_and_one_to_join() {
     }
     let shapes = click(&mut h, &shapes, "Advanced");
     assert!(has_text(&shapes, "Publish to another server…") && !has_text(&shapes, "Port"));
-    // The local network: what it means, and its own advanced part.
+    assert!(!has_text(&shapes, "Can view"), "online, what the code lets people do is picked once shared");
+    // The local network: what it means, what the code lets people do, and its own advanced part.
     let shapes = click(&mut h, &shapes, "Local network");
     assert!(has_text(&shapes, "People on your network join with a code. Nothing goes through a server."));
+    assert!(has_text(&shapes, "Can edit") && has_text(&shapes, "Can view") && !has_text(&shapes, "Can comment"));
     assert!(has_text(&shapes, "This computer only") && has_text(&shapes, "Port") && !has_text(&shapes, "Publish to another server…"));
     assert!(!has_text(&shapes, "About this server"));
     assert_eq!(crate::live::inspect(&h.app)["local"], true);
@@ -377,6 +388,8 @@ fn a_file_that_is_not_shared_can_be_removed_from_the_server_after_asking() {
     assert!(has_text(&shapes, "Share this file") && has_text(&shapes, "Removed from the server"));
 }
 
+/// Sharing on the local network shows the longer code, copies it and its link, and Can view
+/// shows the view-only code; Advanced picks this computer only and a port.
 #[test]
 fn sharing_on_the_local_network_shows_its_longer_code() {
     let (mut h, script) = harness();
@@ -388,15 +401,24 @@ fn sharing_on_the_local_network_shows_its_longer_code() {
         assert!(has_text(&shapes, t), "sharing shows {t:?}");
     }
     assert!(has_text(&shapes, "Anyone on your network with this code can edit the file, while this app stays open."));
-    assert!(!has_text(&shapes, "Can view"), "everyone edits on the local network");
+    assert!(has_text(&shapes, "Can view") && !has_text(&shapes, "Can comment"), "a view-only code too, no comment code");
     {
         let s = script.lock().unwrap();
-        assert!(s.hosted[0].short && s.hosted[0].bind == figcraft_engine::live::Bind::Lan && s.hosted[0].port.is_none());
+        assert!(s.hosted[0].short && s.hosted[0].view && s.hosted[0].bind == figcraft_engine::live::Bind::Lan && s.hosted[0].port.is_none());
         assert!(s.published.is_empty(), "nothing goes to a server");
     }
     let shapes = click(&mut h, &shapes, "Copy code");
     let shapes = click(&mut h, &shapes, "Copy link");
-    assert_eq!(script.lock().unwrap().copied, [shown, HOST.link()]);
+    assert_eq!(script.lock().unwrap().copied, [shown.clone(), HOST.link()]);
+    // Can view shows the view-only code and link, and says what they let people do.
+    let shapes = click(&mut h, &shapes, "Can view");
+    let view = code::grouped(&VIEW.code());
+    assert!(has_text(&shapes, &view) && !has_text(&shapes, &shown));
+    assert!(has_text(&shapes, "Anyone on your network with this code can look at the file, not change it, while this app stays open."));
+    let shapes = click(&mut h, &shapes, "Copy code");
+    let shapes = click(&mut h, &shapes, "Copy link");
+    assert_eq!(script.lock().unwrap().copied[2..], [view, VIEW.link()]);
+    assert_eq!(script.lock().unwrap().hosted.len(), 1, "the same session");
     // Advanced: this computer only, on a port of your choosing.
     let shapes = click(&mut h, &shapes, "Stop sharing");
     let shapes = click(&mut h, &shapes, "Advanced");
@@ -407,6 +429,27 @@ fn sharing_on_the_local_network_shows_its_longer_code() {
     assert!(s.hosted[1].bind == figcraft_engine::live::Bind::Local && s.hosted[1].port == Some(6));
 }
 
+/// Can view picked before a local network share starts: the view-only code is the one shown, so
+/// the edit code isn't on the screen until Can edit is picked.
+#[test]
+fn a_local_share_can_start_for_looking_only() {
+    let (mut h, script) = harness();
+    let shapes = open(&mut h);
+    let shapes = click(&mut h, &shapes, "Local network");
+    let shapes = click(&mut h, &shapes, "Can view");
+    assert_eq!(h.app.ui.live.local_access, Access::View);
+    assert_eq!(h.app.session.live().status, Status::Off, "picking starts nothing");
+    let shapes = click(&mut h, &shapes, "Start sharing");
+    let (view, edit) = (code::grouped(&VIEW.code()), code::grouped(&HOST.code()));
+    assert!(has_text(&shapes, &view) && !has_text(&shapes, &edit));
+    assert!(has_text(&shapes, "Anyone on your network with this code can look at the file, not change it, while this app stays open."));
+    assert_eq!(crate::live::inspect(&h.app)["share"]["access"], "view");
+    assert!(script.lock().unwrap().hosted[0].view);
+    // Can edit shows the edit code.
+    let shapes = click(&mut h, &shapes, "Can edit");
+    assert!(has_text(&shapes, &edit) && has_text(&shapes, "Anyone on your network with this code can edit the file, while this app stays open."));
+}
+
 #[test]
 fn without_a_code_the_link_is_shared_instead() {
     // A server from before join codes.
diff --git a/crates/ui-egui/src/live_tests.rs b/crates/ui-egui/src/live_tests.rs
index cd8454afa..ab8735287 100644
--- a/crates/ui-egui/src/live_tests.rs
+++ b/crates/ui-egui/src/live_tests.rs
@@ -131,6 +131,7 @@ impl Harness {
             address: "127.0.0.1:47900".into(),
             network: false,
             access: figcraft_engine::live::Access::Edit,
+            view_link: None,
         };
         self.send(vec![LiveEvent::Welcome { info, peers: vec![Peer { client_id: 1, name: "Hana".into(), color: "#9747FF".into() }] }]);
     }
diff --git a/crates/ui-egui/src/online_tests.rs b/crates/ui-egui/src/online_tests.rs
index d6968366a..bc41618e9 100644
--- a/crates/ui-egui/src/online_tests.rs
+++ b/crates/ui-egui/src/online_tests.rs
@@ -48,6 +48,7 @@ type Shared = Arc<Mutex<Script>>;
 
 struct Link(Shared);
 
+/// A session you are in as `role` under `name`.
 fn info(role: Role, name: &str) -> SessionInfo {
     SessionInfo {
         role,
@@ -61,6 +62,7 @@ fn info(role: Role, name: &str) -> SessionInfo {
         address: "192.168.1.20:47900".into(),
         network: true,
         access: Access::Edit,
+        view_link: None,
     }
 }
 
diff --git a/docs/collab-protocol.md b/docs/collab-protocol.md
index b4b459afb..e95ba91f0 100644
--- a/docs/collab-protocol.md
+++ b/docs/collab-protocol.md
@@ -597,8 +597,15 @@ resuming with its offline edits, and leaving the session going back to snapshot
   `local`), so a local share is protected by 44 bits, not 128: a code is guessed over the network
   at the rate the host accepts connections, which makes 44 bits years of trying, but treat it as
   a secret for the local network, not for the internet. The invite link names the same session.
-  Whoever sees the code learns the host's address. Everyone who joins edits; a host without an
-  IPv4 address gets no code and shares its link.
+  Whoever sees the code learns the host's address. The session has two secrets, so two codes:
+  the **edit code** and a **view-only code** (the same address and port, a 44-bit secret of its
+  own). The host welcomes whoever joins with the view secret as a viewer (`Access::View`): they
+  see every change and everyone's presence, the app makes the file read-only for them, and the
+  session refuses any batch they send anyway, as a server does for its view links. The Share
+  popover picks which code shows (Can edit / Can view, also before sharing starts, so the edit
+  code need never be on screen; `collab.share {access}`); picking one later changes nothing for
+  who already joined. There is no comment code on the local network. A host without an IPv4
+  address gets no codes and shares its links.
 - **In the browser** a code joins like a link (the page asks the server over its own WebSocket,
   then opens the session's); it shares online through the server in Preferences as the desktop
   app does, and not on the local network (a page can't listen).
diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md
index fb54a8d55..51fab74e9 100644
--- a/docs/collaboration-parity.md
+++ b/docs/collaboration-parity.md
@@ -1,6 +1,6 @@
 # Collaboration parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-31 · **Change:** minor (a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); `figcraft-server` checks the server key by comparing SHA-256 digests, not the raw keys (#1130); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; `comment.list {mentions}` lists only the threads that @mention a name (#1415); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); an AI agent attached over MCP shows where it works (#1416); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); comment.list reports each message's @mentions (#1415); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); a refused batch's fixes take time linear in the batch (#1063); image entries are checked as they apply; branches in live sessions and branch history entries; server message limits follow `max_file_mb`; a damaged log generation field keeps flushed edits; the web build joins from a `#join=` link; removing someone from a live session; live-session revert guard; live sessions per document; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; cursor chat and spotlight in live sessions; branch version history and finer list merges; comments and version history behaviour suite and fixes; hosting the server: `wss://` in the desktop app, server releases, deployment guide; team libraries on the server and swap library; branches: create, update from main, review and merge; wording: the standalone server with share links to edit or view; numbers unchanged) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (a file shared on the local network can be shared to look at only: a view-only code next to the edit code, picked in the Share popover before or while sharing)
 
 Figma is multiplayer first; FigCraft is local first. **Ready ~13% (estimated):** comments, version
 history and branches (review and merge) work inside one file; the real-time collaboration core landed in #103 (sync model,
@@ -15,7 +15,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 | Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, reconnect with backoff), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/<key>` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 |
 | Live cursors, selections, viewports; follow / observation mode; spotlight | yes | **done, in live sessions**: named cursors (one name for live sessions and comments: Preferences ▸ Your name, also in the Share popover and the Join dialog, kept in the browser too; a rename shows at once in the sessions you're in, #1380), selection outlines, avatars (an AI agent attached over MCP also shows its avatar and an outline around the layers it last edited or selected while it works, in or out of a session, #1416), follow (click an avatar), others' text carets and selected characters with their names, a note when two people type in one layer; spotlight (your avatar's menu, `collab.spotlight`): everyone follows your view and page, people who join later too, anyone who moves their view stops following and a banner offers to follow again, a newer spotlight takes over. Left: polish (no accounts, so anyone in the session can spotlight) | 2–4 |
 | Cursor chat, audio, high-fives | yes | **partial, in live sessions**: cursor chat (`/` opens a bubble at your pointer; everyone sees it as you type, it fades a few seconds after the last change, Enter sends and Escape takes it back, 100 characters; `collab.cursorChat` for agents); sent as ephemeral presence the host checks and rate-limits, never stored. No audio, high-fives or emote reactions | 2–5 |
-| Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 |
+| Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address, with an edit code and a view-only code, picked before or while sharing, whose holders see every change and can't make one; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 |
 | Comments: pins on frames and layers, threads, reactions, @mentions, resolve, unread, search and filters, links, in the presenter | yes (shared) | **done, local**: stored in the file, your name from Preferences (an AI agent attached over MCP comments as its own name, marked Agent); a behaviour suite from the documentation (pinning and following layers, threads, own edits and deletes, mentions, reactions, C and Shift+C, stepping, filters, saving, copy and paste); restoring a version keeps them. `comment.list` (CLI, MCP) gives each message its `mentions` (`{name, known, you}`, by the highlighting rule). In a live session threads sync and anyone in it can reply, react and resolve (no accounts: a name is who you are) | (shared once multiplayer lands) |
 | Version history: named versions, autosave checkpoints, view before restore, restore, duplicate | yes (cloud) | **done**, saved in the `.figcraft` file: restoring keeps the replaced design as an autosave first, a titled autosave becomes a named version, merging a branch records the file before and after. Versions are per person in a live session (a shared history needs accounts); no comparing two versions (Dev Mode compares a ready-for-dev layer with its state when marked) | — |
 | Branching and merging | yes (paid plans) | **done, also in live sessions**: branches saved in the `.figcraft` file, each opened in its own tab; Review and merge shows both sides' changes since the branch was made and the conflicts (the same property on both sides, or a layer deleted on one side and edited on the other), each resolved for the branch or main; merge as one undo step (the branch is archived, the main file's history gets a version for the merge), update from main, archive. Each branch keeps its own version history (saved, viewed and restored on the branch tab, kept when it is merged or archived; entries for its creation and updates from main); fills, strokes, effects, layout grids, export settings, guides, interactions, annotations and Dev Mode resources merge item by item. In a live session a branch stays with its author (its ids in their own client space, far above the main file's) and merging it is one edit everyone gets; peers' edits merge against the branch's own base and conflicts resolve as offline; a view link refuses merging. Left: others in the session can't see or open your branches (the server would have to keep them); text runs conflict as a whole; a branch made offline that adds layers merges only outside a session | 1–2 |
@@ -26,6 +26,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same, and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
 | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. |
 | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`<web_url>#join=…`). A browser build served beside its server names it with `<meta name="figcraft-server">`, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged |
 | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. |

From a05201e21fd835b308fc1ce641dc468c6b0e4887 Mon Sep 17 00:00:00 2001
From: Filip Strajnar <filip.strajnar@proton.me>
Date: Fri, 6 Nov 2026 18:45:44 +0100
Subject: [PATCH 63/70] M9: a local view-only share's link is the view link,
 not the edit link

`collab.share {via: "local", access: "view"}` showed the view-only code but
gave the session's own invite link as `link`, and that link edits: whoever
joined through it could change the host's file. A local share's `link`, top
level and in `sessions`, is now the one that goes with the code shown, and it
follows `collab.share {access}`. Online shares keep the owner's own link there,
as before.

Regression test: `code_tests::a_local_view_share_s_link_only_lets_people_look`
joins through that link over loopback and is welcomed as a viewer whose edit
never reaches the host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvG6E2VLhC9d5v8VSsf4ng
---
 crates/collab-net/src/code_tests.rs    | 28 ++++++++++++++++++++++++++
 crates/engine/src/live_share_tests.rs  |  6 +++++-
 crates/engine/src/sharing/live.rs      | 11 ++++++++++
 crates/engine/src/sharing/live/join.rs |  2 +-
 crates/engine/src/sharing/live/sync.rs |  4 ++--
 docs/collab-protocol.md                |  5 +++--
 docs/collaboration-parity.md           |  2 +-
 7 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/crates/collab-net/src/code_tests.rs b/crates/collab-net/src/code_tests.rs
index a4becfdcc..2ef05bc40 100644
--- a/crates/collab-net/src/code_tests.rs
+++ b/crates/collab-net/src/code_tests.rs
@@ -159,6 +159,34 @@ fn a_local_view_code_lets_people_look_and_not_edit() {
     pump(&mut [&mut host, &mut viewer, &mut editor], "the end", |s| !s[1].live().status.active() && !s[2].live().status.active());
 }
 
+/// A local network share's `link` is the one that goes with the code shown: started for looking
+/// only, whoever joins through it can't edit, and the session's line in `sessions` says the same.
+#[test]
+fn a_local_view_share_s_link_only_lets_people_look() {
+    let (mut host, mut viewer) = (session("Hana"), session("Ada"));
+    let shared = host.execute("collab.share", &json!({"via": "local", "bind": "local", "access": "view"})).unwrap();
+    let link = shared["link"].as_str().unwrap().to_string();
+    viewer.execute("collab.join", &json!({"link": link})).unwrap();
+    pump(&mut [&mut host, &mut viewer], "the link's join", |s| live(s[1]) && s[0].live().peers.len() == 1);
+    let summary = viewer.live_summary();
+    assert_eq!((&summary["access"], &summary["readOnly"]), (&json!("view"), &json!(true)), "joined with {link}");
+    let before = layers(&host);
+    let e = viewer.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap_err().to_string();
+    assert!(e.contains("View only"), "{e}");
+    host.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 40, "height": 30})).unwrap();
+    pump(&mut [&mut host, &mut viewer], "the host's edit", |s| layers(s[1]) == before + 1);
+    assert_eq!(layers(&host), before + 1, "nothing of the viewer's reached the host");
+    // The link and the code name the same way in, wherever the session is listed.
+    let Code::Local(local) = code::parse(shared["code"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
+    assert_eq!((&shared["link"], &shared["share"]["viewLink"]), (&json!(local.link()), &json!(local.link())));
+    assert_eq!(shared["sessions"][0]["link"], shared["link"]);
+    // Picking the edit code makes the link the edit one too.
+    let edit = host.execute("collab.share", &json!({"access": "edit"})).unwrap();
+    assert_eq!((&edit["link"], &edit["sessions"][0]["link"]), (&edit["share"]["editLink"], &edit["share"]["editLink"]));
+    assert_ne!(edit["link"], shared["link"]);
+    assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
+}
+
 /// An invite naming only `server` (what a join code is asked at).
 fn code_at(server: &Endpoint) -> Invite {
     Invite { server: server.clone(), file: String::new(), token: String::new() }
diff --git a/crates/engine/src/live_share_tests.rs b/crates/engine/src/live_share_tests.rs
index 76deed757..ee0588ad0 100644
--- a/crates/engine/src/live_share_tests.rs
+++ b/crates/engine/src/live_share_tests.rs
@@ -380,9 +380,12 @@ fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
         assert!(h.short && h.view && h.bind == Bind::Lan && h.port.is_none(), "the local network unless told otherwise");
     }
     // Which code shows: the view code, then the edit code again (nothing is hosted twice).
+    // The link goes with the code: a view-only code's link doesn't edit.
     let r = ex(&mut s, "collab.share", json!({"access": "view"}));
     assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
-    assert_eq!(ex(&mut s, "collab.share", json!({"access": "edit"}))["code"], json!(code::grouped(&HOST.code())));
+    assert_eq!((&r["link"], &r["sessions"][0]["link"]), (&json!(VIEW.link()), &json!(VIEW.link())));
+    let r = ex(&mut s, "collab.share", json!({"access": "edit"}));
+    assert_eq!((&r["code"], &r["link"]), (&json!(code::grouped(&HOST.code())), &json!(HOST.link())));
     assert!(err(&mut s, "collab.share", json!({"access": "comment"})).contains("share it online"));
     assert_eq!(script.lock().unwrap().hosted.len(), 1);
     assert_eq!(ex(&mut s, "collab.stop", json!({}))["ended"], true);
@@ -390,6 +393,7 @@ fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     // Shared for looking only from the start: the edit code isn't the one shown.
     let r = ex(&mut s, "collab.share", json!({"via": "local", "access": "view"}));
     assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
+    assert_eq!((&r["link"], &r["sessions"][0]["link"]), (&json!(VIEW.link()), &json!(VIEW.link())), "the edit link isn't handed out");
     ex(&mut s, "collab.stop", json!({}));
     assert!(err(&mut s, "collab.share", json!({"via": "local", "access": "comment"})).contains("share it online"));
     // Where to listen is the advanced part.
diff --git a/crates/engine/src/sharing/live.rs b/crates/engine/src/sharing/live.rs
index 45d56776c..034137db5 100644
--- a/crates/engine/src/sharing/live.rs
+++ b/crates/engine/src/sharing/live.rs
@@ -147,6 +147,17 @@ impl Live {
         self.info.as_ref().map(|i| i.role)
     }
 
+    /// The session's invite link as `collab.peers` gives it. A file shared on the local network
+    /// gives the link that goes with the code shown: the session's own link is the edit way in,
+    /// and a view-only share must not hand it out. Otherwise the session's own link (online, the
+    /// owner's: `share` has the links for others).
+    pub fn invite_link(&self) -> Option<&str> {
+        match &self.share {
+            Some(sh) if sh.via == Via::Local => sh.link(),
+            _ => self.info.as_ref().map(|i| i.link.as_str()),
+        }
+    }
+
     /// Stop following. False when you weren't following anyone.
     fn unfollow(&mut self) -> bool {
         self.followed = None;
diff --git a/crates/engine/src/sharing/live/join.rs b/crates/engine/src/sharing/live/join.rs
index 994c4d6a9..255471217 100644
--- a/crates/engine/src/sharing/live/join.rs
+++ b/crates/engine/src/sharing/live/join.rs
@@ -175,7 +175,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "collab.share",
             "Share with a join code",
-            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (look only: their edits are refused): which code `code` is, server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` the session's own invite link (it edits: `share` has the link that goes with each code). Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols), and `share` is {via, access, shared, editCode, viewCode, editLink, viewLink}: the edit and view-only ways in, each with its own secret (commentCode and commentLink null). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
+            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (look only: their edits are refused): which code `code` is, server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` the invite link to give with it (local: the one that goes with `code`, so a view-only code's link lets people look only; online: your own link to the file, which edits: `share` has the link that goes with each code). Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols), and `share` is {via, access, shared, editCode, viewCode, editLink, viewLink}: the edit and view-only ways in, each with its own secret (commentCode and commentLink null). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
             false,
             share
         ),
diff --git a/crates/engine/src/sharing/live/sync.rs b/crates/engine/src/sharing/live/sync.rs
index 79f693731..f3ffa5615 100644
--- a/crates/engine/src/sharing/live/sync.rs
+++ b/crates/engine/src/sharing/live/sync.rs
@@ -295,7 +295,7 @@ impl Session {
                     "reason": reason(o),
                     "role": o.role(),
                     "fileName": info.map(|i| i.file_name.as_str()),
-                    "link": info.map(|i| i.link.as_str()),
+                    "link": o.invite_link(),
                     "peers": o.peers.len(),
                 })
             })
@@ -313,7 +313,7 @@ impl Session {
             "color": info.map(|i| i.color.as_str()),
             "fileName": info.map(|i| i.file_name.as_str()),
             "pages": info.map(|i| &i.pages),
-            "link": info.map(|i| i.link.as_str()),
+            "link": l.invite_link(),
             "url": info.map(|i| i.url.as_str()),
             "address": info.map(|i| i.address.as_str()),
             "network": info.map(|i| i.network),
diff --git a/docs/collab-protocol.md b/docs/collab-protocol.md
index e95ba91f0..8d476d760 100644
--- a/docs/collab-protocol.md
+++ b/docs/collab-protocol.md
@@ -603,8 +603,9 @@ resuming with its offline edits, and leaving the session going back to snapshot
   see every change and everyone's presence, the app makes the file read-only for them, and the
   session refuses any batch they send anyway, as a server does for its view links. The Share
   popover picks which code shows (Can edit / Can view, also before sharing starts, so the edit
-  code need never be on screen; `collab.share {access}`); picking one later changes nothing for
-  who already joined. There is no comment code on the local network. A host without an IPv4
+  code need never be on screen; `collab.share {access}`, whose `link` is the one that goes with
+  the code shown, so a view-only share never hands out the edit link); picking one later changes
+  nothing for who already joined. There is no comment code on the local network. A host without an IPv4
   address gets no codes and shares its links.
 - **In the browser** a code joins like a link (the page asks the server over its own WebSocket,
   then opens the session's); it shares online through the server in Preferences as the desktop
diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md
index 51fab74e9..cfab7553a 100644
--- a/docs/collaboration-parity.md
+++ b/docs/collaboration-parity.md
@@ -26,7 +26,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same, and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
+| 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same (its `link`, like its `code`, is the view-only way in), and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
 | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. |
 | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`<web_url>#join=…`). A browser build served beside its server names it with `<meta name="figcraft-server">`, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged |
 | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. |

From 5d21ca879126e8c27d5f757d6b834b67b17cbb5c Mon Sep 17 00:00:00 2001
From: Trevor Brown <trevorbrown.dev@gmail.com>
Date: Fri, 6 Nov 2026 12:51:52 -0500
Subject: [PATCH 64/70] Minimize: a click that shows the right sidebar no
 longer moves the frame it selects (#2051)

The view keeps its centre when the canvas is resized, so the right panel appearing (minimized UI, on the press that selects) shifted the pointer's page point by half the width over the zoom and the move handling took it as a drag. While a button that went down on the canvas is held, a resize now keeps the top-left instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs            | 11 +++
 crates/ui-egui/src/panel_width_tests.rs | 96 +++++++++++++++++++++++++
 2 files changed, 107 insertions(+)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 5ccfe5d46..e1e78b53d 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -206,8 +206,19 @@ pub fn show(app: &mut FigApp, ui: &mut Ui, worker: &mut Worker) {
     {
         // Keep the centre; the first sizing after opening re-fits.
         let first = ds.view.vw == 1200.0 && ds.view.vh == 800.0;
+        // While a button is held that went down on the canvas (a click that selects shows the right panel, minimized, and a
+        // click that deselects hides it) the page point under the pointer stays where it is: the
+        // gesture's own pointer events would otherwise move by half the panel's width over the
+        // zoom, and the move handling would take that for a drag. Keep the top-left instead.
+        let held = resp.is_pointer_button_down_on() && !first;
+        let z = ds.view.zoom.max(1e-9);
+        let (dw, dh) = (f64::from(rect.width()) - ds.view.vw, f64::from(rect.height()) - ds.view.vh);
         ds.view.vw = f64::from(rect.width());
         ds.view.vh = f64::from(rect.height());
+        if held {
+            ds.view.cx += dw / 2.0 / z;
+            ds.view.cy += dh / 2.0 / z;
+        }
         if first {
             ds.zoom_to_fit();
         }
diff --git a/crates/ui-egui/src/panel_width_tests.rs b/crates/ui-egui/src/panel_width_tests.rs
index 357b13669..c7453be24 100644
--- a/crates/ui-egui/src/panel_width_tests.rs
+++ b/crates/ui-egui/src/panel_width_tests.rs
@@ -346,3 +346,99 @@ fn a_narrow_window_shows_one_side_panel_at_a_time() {
     let wide = canvas_width(&mut app, vec2(1440.0, 900.0));
     assert!(wide > 600.0 && wide < 1100.0, "a wide window shows both panels beside the canvas ({wide})");
 }
+
+/// Five frames side by side at 46% zoom with the interface minimized and nothing selected.
+fn minimized_row() -> (Ui, Vec<figcraft_doc::NodeId>) {
+    let mut s = Session::new();
+    let mut ids = Vec::new();
+    for k in 0..5 {
+        let r = s.execute("frame.create", &json!({"x": k * 470, "y": 0, "width": 400, "height": 600})).unwrap();
+        ids.push(figcraft_engine::params::id_of(&r["id"]).unwrap());
+    }
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    let mut u = Ui::new(s);
+    u.app.run("view.minimize", json!({"on": true}));
+    u.app.run("view.set", json!({"zoom": 0.46, "cx": 1500, "cy": 300}));
+    for _ in 0..4 {
+        u.frame(vec![]);
+    }
+    (u, ids)
+}
+
+fn frame_x(u: &Ui, id: figcraft_doc::NodeId) -> f64 {
+    u.app.session.doc().unwrap().world_bounds(id).unwrap().x0
+}
+
+/// A click on a frame while minimized selects it and shows the right panel (the canvas gets
+/// narrower): the frame stays where it was, and no step is added to the history.
+#[test]
+fn a_click_that_shows_the_right_panel_does_not_move_the_frame() {
+    let (mut u, ids) = minimized_row();
+    assert!(u.app.ui.right_panel_rect.is_none(), "nothing selected: no right panel");
+    let wide = u.app.canvas.rect.width();
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    let p = u.app.to_screen(1880.0 + 200.0, 300.0);
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    u.frame(vec![]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() }]);
+    for _ in 0..4 {
+        u.frame(vec![]);
+    }
+    assert_eq!(u.app.session.selection(), vec![ids[4]], "the click selects the frame");
+    assert!(u.app.ui.right_panel_rect.is_some(), "the right panel shows");
+    assert!(u.app.canvas.rect.width() < wide - 100.0, "the canvas is narrower");
+    assert_eq!(frame_x(&u, ids[4]), 1880.0, "a click did not move the frame");
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps, "no history step");
+}
+
+/// A real drag still moves the frame, by the pointer's screen movement over the zoom, in one step.
+#[test]
+fn a_drag_after_the_right_panel_shows_moves_the_frame_by_the_pointer() {
+    let (mut u, ids) = minimized_row();
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    let p = u.app.to_screen(1880.0 + 200.0, 300.0);
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    u.frame(vec![Event::PointerMoved(p + vec2(50.0, 0.0))]);
+    u.frame(vec![Event::PointerMoved(p + vec2(100.0, 0.0))]);
+    u.frame(vec![Event::PointerButton {
+        pos: p + vec2(100.0, 0.0),
+        button: egui::PointerButton::Primary,
+        pressed: false,
+        modifiers: Default::default(),
+    }]);
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert!(u.app.ui.right_panel_rect.is_some(), "the right panel shows");
+    let moved = frame_x(&u, ids[4]) - 1880.0;
+    assert!((moved - 100.0 / 0.46).abs() < 6.0, "moved by 100 points over the zoom, got {moved}");
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps + 1, "one step");
+}
+
+/// Clicking empty canvas deselects and hides the right panel again; the marquee that starts there
+/// has no offset: nothing moves and nothing is selected.
+#[test]
+fn a_click_that_hides_the_right_panel_does_not_move_the_frame() {
+    let (mut u, ids) = minimized_row();
+    u.app.run("select.set", json!({"ids": [ids[4]]}));
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert!(u.app.ui.right_panel_rect.is_some());
+    let p = u.app.to_screen(1880.0 + 200.0, 1000.0);
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() }]);
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert!(u.app.ui.right_panel_rect.is_none(), "deselected: no right panel");
+    assert_eq!(frame_x(&u, ids[4]), 1880.0);
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps);
+}

From b779e46d47ae43635c4c8705a8f69b69c980bbed Mon Sep 17 00:00:00 2001
From: Filip Strajnar <filip.strajnar@proton.me>
Date: Fri, 6 Nov 2026 19:12:40 +0100
Subject: [PATCH 65/70] M9: a local view-only share's url is the view URL, not
 the edit URL

The previous fix made a local share's `link` follow the code shown, but its
top-level `url`, the session's WebSocket URL, still carried the edit token:
`collab.join {link: url}` from a view-only share joined with edit access and
the edit reached the host. The link layer now hands over the view way in as a
link and its URL (`SessionInfo::view`, a `WayIn`, in place of `view_link`), and
`collab.peers` gives a local share's `link` and `url` from the way in for the
code shown (`Live::invite`). Online shares are unchanged.

Regression test: `code_tests::a_local_view_share_s_link_and_url_only_let_people_look`
joins through the `link` and then the `url` over loopback; both are welcomed as
viewers whose edits never reach the host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvG6E2VLhC9d5v8VSsf4ng
---
 apps/figcraft/src/recovery_online_tests.rs |  2 +-
 crates/collab-net/src/code_tests.rs        | 46 +++++++++++++---------
 crates/collab-net/src/join.rs              |  2 +-
 crates/collab-net/src/link.rs              |  6 +--
 crates/engine/src/live_share_tests.rs      | 22 +++++++----
 crates/engine/src/live_tests.rs            |  2 +-
 crates/engine/src/online_tests.rs          |  2 +-
 crates/engine/src/sharing/live.rs          | 17 ++++----
 crates/engine/src/sharing/live/host.rs     |  2 +-
 crates/engine/src/sharing/live/join.rs     |  2 +-
 crates/engine/src/sharing/live/sync.rs     |  7 ++--
 crates/engine/src/sharing/live/types.rs    | 28 +++++++++++--
 crates/ui-egui/src/live_docs_tests.rs      |  2 +-
 crates/ui-egui/src/live_server_tests.rs    |  2 +-
 crates/ui-egui/src/live_share_tests.rs     |  8 ++--
 crates/ui-egui/src/live_tests.rs           |  2 +-
 crates/ui-egui/src/online_tests.rs         |  2 +-
 docs/collab-protocol.md                    |  4 +-
 docs/collaboration-parity.md               |  2 +-
 19 files changed, 99 insertions(+), 61 deletions(-)

diff --git a/apps/figcraft/src/recovery_online_tests.rs b/apps/figcraft/src/recovery_online_tests.rs
index bc3a1d20d..29b821f81 100644
--- a/apps/figcraft/src/recovery_online_tests.rs
+++ b/apps/figcraft/src/recovery_online_tests.rs
@@ -91,7 +91,7 @@ fn info() -> SessionInfo {
         address: SERVER.into(),
         network: true,
         access: Access::Edit,
-        view_link: None,
+        view: None,
     }
 }
 
diff --git a/crates/collab-net/src/code_tests.rs b/crates/collab-net/src/code_tests.rs
index 2ef05bc40..ca7cc51fb 100644
--- a/crates/collab-net/src/code_tests.rs
+++ b/crates/collab-net/src/code_tests.rs
@@ -159,31 +159,41 @@ fn a_local_view_code_lets_people_look_and_not_edit() {
     pump(&mut [&mut host, &mut viewer, &mut editor], "the end", |s| !s[1].live().status.active() && !s[2].live().status.active());
 }
 
-/// A local network share's `link` is the one that goes with the code shown: started for looking
-/// only, whoever joins through it can't edit, and the session's line in `sessions` says the same.
+/// A local network share's `link` and `url` are the ones that go with the code shown: started for
+/// looking only, whoever joins through either can't edit, and the session's line in `sessions`
+/// says the same.
 #[test]
-fn a_local_view_share_s_link_only_lets_people_look() {
-    let (mut host, mut viewer) = (session("Hana"), session("Ada"));
+fn a_local_view_share_s_link_and_url_only_let_people_look() {
+    let mut host = session("Hana");
     let shared = host.execute("collab.share", &json!({"via": "local", "bind": "local", "access": "view"})).unwrap();
-    let link = shared["link"].as_str().unwrap().to_string();
-    viewer.execute("collab.join", &json!({"link": link})).unwrap();
-    pump(&mut [&mut host, &mut viewer], "the link's join", |s| live(s[1]) && s[0].live().peers.len() == 1);
-    let summary = viewer.live_summary();
-    assert_eq!((&summary["access"], &summary["readOnly"]), (&json!("view"), &json!(true)), "joined with {link}");
-    let before = layers(&host);
-    let e = viewer.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap_err().to_string();
-    assert!(e.contains("View only"), "{e}");
-    host.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 40, "height": 30})).unwrap();
-    pump(&mut [&mut host, &mut viewer], "the host's edit", |s| layers(s[1]) == before + 1);
-    assert_eq!(layers(&host), before + 1, "nothing of the viewer's reached the host");
-    // The link and the code name the same way in, wherever the session is listed.
+    for key in ["link", "url"] {
+        let way = shared[key].as_str().unwrap().to_string();
+        let mut viewer = session("Ada");
+        viewer.execute("collab.join", &json!({"link": way})).unwrap();
+        pump(&mut [&mut host, &mut viewer], "the join", |s| live(s[1]) && s[0].live().peers.len() == 1);
+        let summary = viewer.live_summary();
+        assert_eq!((&summary["access"], &summary["readOnly"]), (&json!("view"), &json!(true)), "joined with {key} {way}");
+        let before = layers(&host);
+        let e = viewer.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap_err().to_string();
+        assert!(e.contains("View only"), "{key}: {e}");
+        host.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 40, "height": 30})).unwrap();
+        pump(&mut [&mut host, &mut viewer], "the host's edit", |s| layers(s[1]) == before + 1);
+        assert_eq!(layers(&host), before + 1, "nothing of the viewer's reached the host ({key})");
+        viewer.execute("collab.leave", &json!({})).unwrap();
+        pump(&mut [&mut host, &mut viewer], "the leave", |s| s[0].live().peers.is_empty());
+    }
+    // The link, the URL and the code name the same way in, wherever the session is listed.
     let Code::Local(local) = code::parse(shared["code"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
     assert_eq!((&shared["link"], &shared["share"]["viewLink"]), (&json!(local.link()), &json!(local.link())));
+    let url = shared["url"].as_str().unwrap();
+    assert!(url.starts_with("ws://") && url.ends_with(&format!("&token={}", local.token())), "{url}");
     assert_eq!(shared["sessions"][0]["link"], shared["link"]);
-    // Picking the edit code makes the link the edit one too.
+    // Picking the edit code makes them the edit ones too.
     let edit = host.execute("collab.share", &json!({"access": "edit"})).unwrap();
     assert_eq!((&edit["link"], &edit["sessions"][0]["link"]), (&edit["share"]["editLink"], &edit["share"]["editLink"]));
-    assert_ne!(edit["link"], shared["link"]);
+    let edit_token = edit["link"].as_str().unwrap().rsplit("token=").next().unwrap();
+    assert!(edit["url"].as_str().unwrap().ends_with(&format!("&token={edit_token}")), "{}", edit["url"]);
+    assert_ne!((&edit["link"], &edit["url"]), (&shared["link"], &shared["url"]));
     assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
 }
 
diff --git a/crates/collab-net/src/join.rs b/crates/collab-net/src/join.rs
index 6c913e009..f86409b40 100644
--- a/crates/collab-net/src/join.rs
+++ b/crates/collab-net/src/join.rs
@@ -229,7 +229,7 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 address: inv.server.display(),
                 network: !inv.loopback(),
                 access,
-                view_link: None,
+                view: None,
             };
             seen.peers = peers.clone();
             seen.info = Some(info.clone());
diff --git a/crates/collab-net/src/link.rs b/crates/collab-net/src/link.rs
index b2a39ad72..35bbe7188 100644
--- a/crates/collab-net/src/link.rs
+++ b/crates/collab-net/src/link.rs
@@ -9,7 +9,7 @@ use figcraft_collab::code;
 use figcraft_collab::message::{Access, Admin, AdminReply, ClientMsg, LibraryReply, LibraryReq, PluginReply, PluginReq};
 use figcraft_engine::live::{
     Bind, Event, HostInfo, HostOptions, LiveLink, NO_SESSION, NetReply, NetRequest, PageInfo, Presence, PublishOptions, Published, Resume, Role,
-    SessionId, SessionInfo, Shared,
+    SessionId, SessionInfo, Shared, WayIn,
 };
 
 use crate::guest::{Guest, GuestConfig, Publish, upload_file};
@@ -165,7 +165,7 @@ impl LiveLink for NetLink {
             core: figcraft_collab::Limits::default(),
         };
         let host = Host::start(cfg, inbox.clone()).map_err(|e| format!("can't listen on {ip}: {e}"))?;
-        let view_link = view_token.map(|v| Invite::new(host.addr().to_string(), file.clone(), v).link());
+        let view = view_token.map(|v| Invite::new(host.addr().to_string(), file.clone(), v)).map(|v| WayIn { link: v.link(), url: v.url() });
         let invite = Invite::new(host.addr().to_string(), file, token);
         let info = SessionInfo {
             role: Role::Host,
@@ -179,7 +179,7 @@ impl LiveLink for NetLink {
             address: host.addr().to_string(),
             network: !ip.is_loopback(),
             access: Access::Edit,
-            view_link,
+            view,
         };
         self.started(session, Active::Host(host), inbox);
         Ok(info)
diff --git a/crates/engine/src/live_share_tests.rs b/crates/engine/src/live_share_tests.rs
index ee0588ad0..9c86e0900 100644
--- a/crates/engine/src/live_share_tests.rs
+++ b/crates/engine/src/live_share_tests.rs
@@ -13,7 +13,7 @@ use serde_json::{Value, json};
 
 use crate::live::{
     Access, Bind, DEFAULT_SERVER, Event, HostOptions, LiveLink, Presence, PublishOptions, Published, Role, SessionInfo, Shared, SharedLink, Status,
-    join_target,
+    WayIn, join_target,
 };
 use crate::{EngineError, Session};
 
@@ -39,6 +39,11 @@ const HOST: Local = Local { ip: Ipv4Addr::new(192, 168, 1, 20), port: 47_900, se
 /// The same session's view-only secret.
 const VIEW: Local = Local { secret: 0xBA9_8765_4321, ..HOST };
 
+/// The WebSocket URL the scripted link gives with an invite `link` (the same secret).
+fn mock_url(link: &str) -> String {
+    link.replace("figcraft://join?host=", "ws://")
+}
+
 impl LiveLink for Link {
     /// Host as the network link does: a code's short secret when shared with a code, and the
     /// view-only link when asked for one.
@@ -47,7 +52,7 @@ impl LiveLink for Link {
         s.session = session;
         // As the network link does: a short secret when the session is shared with a code.
         let link = if opts.short { HOST.link() } else { "figcraft://join?host=192.168.1.20:47900&file=f&token=AbCdEfGhIjKlMnOpQrStUv".to_string() };
-        let view_link = opts.view.then(|| VIEW.link());
+        let view = opts.view.then(|| WayIn { link: VIEW.link(), url: mock_url(&VIEW.link()) });
         s.hosted.push(opts);
         Ok(SessionInfo {
             role: Role::Host,
@@ -56,12 +61,12 @@ impl LiveLink for Link {
             color: "#0D99FF".into(),
             file_name: "Shared".into(),
             pages: vec![],
-            url: link.replace("figcraft://join?host=", "ws://"),
+            url: mock_url(&link),
             link,
             address: "192.168.1.20:47900".into(),
             network: true,
             access: Access::Edit,
-            view_link,
+            view,
         })
     }
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
@@ -152,7 +157,7 @@ fn on_the_server(s: &mut Session, script: &Arc<Mutex<Script>>, codes: Option<(&s
         address: "wss://share.example:443/".into(),
         network: true,
         access: Access::Edit,
-        view_link: None,
+        view: None,
     };
     let events = vec![Event::Published(published), Event::Shared(Ok(links(0, codes))), Event::Welcome { info, peers: vec![] }];
     script.lock().unwrap().events.extend(events);
@@ -383,9 +388,9 @@ fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     // The link goes with the code: a view-only code's link doesn't edit.
     let r = ex(&mut s, "collab.share", json!({"access": "view"}));
     assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
-    assert_eq!((&r["link"], &r["sessions"][0]["link"]), (&json!(VIEW.link()), &json!(VIEW.link())));
+    assert_eq!((&r["link"], &r["url"], &r["sessions"][0]["link"]), (&json!(VIEW.link()), &json!(mock_url(&VIEW.link())), &json!(VIEW.link())));
     let r = ex(&mut s, "collab.share", json!({"access": "edit"}));
-    assert_eq!((&r["code"], &r["link"]), (&json!(code::grouped(&HOST.code())), &json!(HOST.link())));
+    assert_eq!((&r["code"], &r["link"], &r["url"]), (&json!(code::grouped(&HOST.code())), &json!(HOST.link()), &json!(mock_url(&HOST.link()))));
     assert!(err(&mut s, "collab.share", json!({"access": "comment"})).contains("share it online"));
     assert_eq!(script.lock().unwrap().hosted.len(), 1);
     assert_eq!(ex(&mut s, "collab.stop", json!({}))["ended"], true);
@@ -393,7 +398,8 @@ fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     // Shared for looking only from the start: the edit code isn't the one shown.
     let r = ex(&mut s, "collab.share", json!({"via": "local", "access": "view"}));
     assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
-    assert_eq!((&r["link"], &r["sessions"][0]["link"]), (&json!(VIEW.link()), &json!(VIEW.link())), "the edit link isn't handed out");
+    assert_eq!((&r["link"], &r["url"]), (&json!(VIEW.link()), &json!(mock_url(&VIEW.link()))), "the edit link and URL aren't handed out");
+    assert_eq!(r["sessions"][0]["link"], json!(VIEW.link()));
     ex(&mut s, "collab.stop", json!({}));
     assert!(err(&mut s, "collab.share", json!({"via": "local", "access": "comment"})).contains("share it online"));
     // Where to listen is the advanced part.
diff --git a/crates/engine/src/live_tests.rs b/crates/engine/src/live_tests.rs
index 2d2f504f7..c9863ae74 100644
--- a/crates/engine/src/live_tests.rs
+++ b/crates/engine/src/live_tests.rs
@@ -104,7 +104,7 @@ pub(crate) fn info(role: Role, me: u32) -> SessionInfo {
         address: "127.0.0.1:47900".into(),
         network: false,
         access: crate::live::Access::Edit,
-        view_link: None,
+        view: None,
     }
 }
 
diff --git a/crates/engine/src/online_tests.rs b/crates/engine/src/online_tests.rs
index 3f8c6a293..98d655f06 100644
--- a/crates/engine/src/online_tests.rs
+++ b/crates/engine/src/online_tests.rs
@@ -150,7 +150,7 @@ fn info(role: Role, name: &str, link: &str) -> SessionInfo {
         address: SERVER.into(),
         network: true,
         access: Access::Edit,
-        view_link: None,
+        view: None,
     }
 }
 
diff --git a/crates/engine/src/sharing/live.rs b/crates/engine/src/sharing/live.rs
index 034137db5..6e5b0515a 100644
--- a/crates/engine/src/sharing/live.rs
+++ b/crates/engine/src/sharing/live.rs
@@ -72,7 +72,7 @@ pub(crate) use join::start_join;
 pub use join::{can_remove_people, specs};
 pub use types::{
     Bind, DEFAULT_SERVER, Event, HostOptions, LiveLink, MAX_NAME, MAX_PEERS, MAX_SELECTION, NO_HOSTING, NO_SESSION, NetReply, NetRequest, ONLINE_OFF,
-    PEOPLE, PageInfo, PublishOptions, Published, Role, SessionId, SessionInfo, Share, Shared, SharedLink, Status, TOO_LARGE_TO_JOIN, Via,
+    PEOPLE, PageInfo, PublishOptions, Published, Role, SessionId, SessionInfo, Share, Shared, SharedLink, Status, TOO_LARGE_TO_JOIN, Via, WayIn,
     join_target, parse_color,
 };
 
@@ -147,14 +147,15 @@ impl Live {
         self.info.as_ref().map(|i| i.role)
     }
 
-    /// The session's invite link as `collab.peers` gives it. A file shared on the local network
-    /// gives the link that goes with the code shown: the session's own link is the edit way in,
-    /// and a view-only share must not hand it out. Otherwise the session's own link (online, the
-    /// owner's: `share` has the links for others).
-    pub fn invite_link(&self) -> Option<&str> {
+    /// The session's invite link and WebSocket URL as `collab.peers` gives them. A file shared
+    /// on the local network gives the ones that go with the code shown: the session's own link
+    /// and URL are the edit way in, and a view-only share must not hand them out. Otherwise the
+    /// session's own (online, the owner's: `share` has the links for others).
+    pub fn invite(&self) -> (Option<&str>, Option<&str>) {
+        let info = self.info.as_ref();
         match &self.share {
-            Some(sh) if sh.via == Via::Local => sh.link(),
-            _ => self.info.as_ref().map(|i| i.link.as_str()),
+            Some(sh) if sh.via == Via::Local => info.and_then(|i| i.way_in(sh.access)).unzip(),
+            _ => (info.map(|i| i.link.as_str()), info.map(|i| i.url.as_str())),
         }
     }
 
diff --git a/crates/engine/src/sharing/live/host.rs b/crates/engine/src/sharing/live/host.rs
index 1b3ebb6b0..916da6949 100644
--- a/crates/engine/src/sharing/live/host.rs
+++ b/crates/engine/src/sharing/live/host.rs
@@ -151,7 +151,7 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
         // that link's secret. (Online they arrive with the file.)
         let links = live.info.as_ref().filter(|_| via == Via::Local).map(|i| Shared {
             edit: local_link(&i.link),
-            view: i.view_link.as_deref().map(local_link),
+            view: i.view.as_ref().map(|v| local_link(&v.link)),
             comment: None,
         });
         live.share = Some(Share { via, server, access, links });
diff --git a/crates/engine/src/sharing/live/join.rs b/crates/engine/src/sharing/live/join.rs
index 255471217..9e7d07902 100644
--- a/crates/engine/src/sharing/live/join.rs
+++ b/crates/engine/src/sharing/live/join.rs
@@ -175,7 +175,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "collab.share",
             "Share with a join code",
-            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (look only: their edits are refused): which code `code` is, server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` the invite link to give with it (local: the one that goes with `code`, so a view-only code's link lets people look only; online: your own link to the file, which edits: `share` has the link that goes with each code). Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols), and `share` is {via, access, shared, editCode, viewCode, editLink, viewLink}: the edit and view-only ways in, each with its own secret (commentCode and commentLink null). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
+            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (look only: their edits are refused): which code `code` is, server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` the invite link to give with it and `url` its WebSocket URL (local: the ones that go with `code`, so a view-only code's link and URL let people look only; online: your own link to the file, which edits: `share` has the link that goes with each code). Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols), and `share` is {via, access, shared, editCode, viewCode, editLink, viewLink}: the edit and view-only ways in, each with its own secret (commentCode and commentLink null). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
             false,
             share
         ),
diff --git a/crates/engine/src/sharing/live/sync.rs b/crates/engine/src/sharing/live/sync.rs
index f3ffa5615..0dcf5eed2 100644
--- a/crates/engine/src/sharing/live/sync.rs
+++ b/crates/engine/src/sharing/live/sync.rs
@@ -283,6 +283,7 @@ impl Session {
             })
             .collect();
         let mine = synced.and_then(|d| d.text_edit.as_ref()).map(|t| editing(&editing_of(t)));
+        let (link, url) = l.invite();
         let sessions: Vec<Value> = self
             .live
             .iter()
@@ -295,7 +296,7 @@ impl Session {
                     "reason": reason(o),
                     "role": o.role(),
                     "fileName": info.map(|i| i.file_name.as_str()),
-                    "link": o.invite_link(),
+                    "link": o.invite().0,
                     "peers": o.peers.len(),
                 })
             })
@@ -313,8 +314,8 @@ impl Session {
             "color": info.map(|i| i.color.as_str()),
             "fileName": info.map(|i| i.file_name.as_str()),
             "pages": info.map(|i| &i.pages),
-            "link": l.invite_link(),
-            "url": info.map(|i| i.url.as_str()),
+            "link": link,
+            "url": url,
             "address": info.map(|i| i.address.as_str()),
             "network": info.map(|i| i.network),
             "access": l.client.as_ref().map(Client::access).or(info.map(|i| i.access)),
diff --git a/crates/engine/src/sharing/live/types.rs b/crates/engine/src/sharing/live/types.rs
index c83f1254c..431934d56 100644
--- a/crates/engine/src/sharing/live/types.rs
+++ b/crates/engine/src/sharing/live/types.rs
@@ -123,9 +123,29 @@ pub struct SessionInfo {
     /// comment link).
     pub access: Access,
     /// A session this app hosts with a way in for looking only ([`HostOptions::view`]): its
-    /// invite link, which carries the view secret (`None`: everyone who joins edits, or you
-    /// joined).
-    pub view_link: Option<String>,
+    /// invite link and WebSocket URL, which carry the view secret (`None`: everyone who joins
+    /// edits, or you joined).
+    pub view: Option<WayIn>,
+}
+
+impl SessionInfo {
+    /// The invite link and WebSocket URL that let people into a session this app hosts with
+    /// `access` (its own link and URL edit). `None`: no way in gives that.
+    pub fn way_in(&self, access: Access) -> Option<(&str, &str)> {
+        match access {
+            Access::Edit => Some((&self.link, &self.url)),
+            Access::View => self.view.as_ref().map(|v| (v.link.as_str(), v.url.as_str())),
+            Access::Comment => None,
+        }
+    }
+}
+
+/// A way into a session this app hosts: an invite link and the WebSocket URL it connects to,
+/// which carry the same secret.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub struct WayIn {
+    pub link: String,
+    pub url: String,
 }
 
 /// A file you published to a server: where, and its first share links (they carry their tokens:
@@ -395,7 +415,7 @@ pub struct HostOptions {
     /// Shared with a join code (`collab.share`): the session's secret is short enough to type.
     pub short: bool,
     /// Also make a second secret whose holders only look: they see every change, and the session
-    /// refuses theirs ([`SessionInfo::view_link`]).
+    /// refuses theirs ([`SessionInfo::view`]).
     pub view: bool,
 }
 
diff --git a/crates/ui-egui/src/live_docs_tests.rs b/crates/ui-egui/src/live_docs_tests.rs
index 7e104dac7..bc1f25f30 100644
--- a/crates/ui-egui/src/live_docs_tests.rs
+++ b/crates/ui-egui/src/live_docs_tests.rs
@@ -32,7 +32,7 @@ impl LiveLink for Hosting {
             address,
             network: false,
             access: Access::Edit,
-            view_link: None,
+            view: None,
         })
     }
     fn join(&mut self, _: u64, _: &str, _: &str) -> Result<(), String> {
diff --git a/crates/ui-egui/src/live_server_tests.rs b/crates/ui-egui/src/live_server_tests.rs
index c7e1c2e38..745a8e93d 100644
--- a/crates/ui-egui/src/live_server_tests.rs
+++ b/crates/ui-egui/src/live_server_tests.rs
@@ -44,7 +44,7 @@ pub(crate) fn joined(h: &mut Harness, access: Access) {
         address: "127.0.0.1:47900".into(),
         network: false,
         access,
-        view_link: None,
+        view: None,
     };
     h.send(vec![LiveEvent::Welcome { info, peers: vec![] }, LiveEvent::Sync(w)]);
     h.frames(2);
diff --git a/crates/ui-egui/src/live_share_tests.rs b/crates/ui-egui/src/live_share_tests.rs
index b1c6556df..8ef118249 100644
--- a/crates/ui-egui/src/live_share_tests.rs
+++ b/crates/ui-egui/src/live_share_tests.rs
@@ -13,7 +13,7 @@ use figcraft_engine::figcraft_collab::code::{self, Local};
 use figcraft_engine::figcraft_collab::message::ClientMsg;
 use figcraft_engine::live::{
     Access, DEFAULT_SERVER, Event as LiveEvent, HostOptions, LiveLink, NetReply, NetRequest, Peer, Presence, PublishOptions, Published, Role,
-    SessionInfo, Shared as SharedLinks, SharedLink, Status,
+    SessionInfo, Shared as SharedLinks, SharedLink, Status, WayIn,
 };
 use serde_json::json;
 
@@ -72,7 +72,7 @@ fn info(role: Role, link: &str) -> SessionInfo {
         address: "192.168.1.20:47900".into(),
         network: true,
         access: Access::Edit,
-        view_link: None,
+        view: None,
     }
 }
 
@@ -83,9 +83,9 @@ impl LiveLink for Link {
         let mut s = self.0.lock().unwrap();
         s.session = session;
         let (link, view) = if opts.port == Some(6) { (PLAIN.to_string(), PLAIN.replace("AbCd", "View")) } else { (HOST.link(), VIEW.link()) };
-        let view_link = opts.view.then_some(view);
+        let view = opts.view.then(|| WayIn { url: view.replace("figcraft://join?host=", "ws://"), link: view });
         s.hosted.push(opts);
-        Ok(SessionInfo { view_link, ..info(Role::Host, &link) })
+        Ok(SessionInfo { view, ..info(Role::Host, &link) })
     }
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
         let mut s = self.0.lock().unwrap();
diff --git a/crates/ui-egui/src/live_tests.rs b/crates/ui-egui/src/live_tests.rs
index ab8735287..5fc809959 100644
--- a/crates/ui-egui/src/live_tests.rs
+++ b/crates/ui-egui/src/live_tests.rs
@@ -131,7 +131,7 @@ impl Harness {
             address: "127.0.0.1:47900".into(),
             network: false,
             access: figcraft_engine::live::Access::Edit,
-            view_link: None,
+            view: None,
         };
         self.send(vec![LiveEvent::Welcome { info, peers: vec![Peer { client_id: 1, name: "Hana".into(), color: "#9747FF".into() }] }]);
     }
diff --git a/crates/ui-egui/src/online_tests.rs b/crates/ui-egui/src/online_tests.rs
index bc41618e9..9d1ad163a 100644
--- a/crates/ui-egui/src/online_tests.rs
+++ b/crates/ui-egui/src/online_tests.rs
@@ -62,7 +62,7 @@ fn info(role: Role, name: &str) -> SessionInfo {
         address: "192.168.1.20:47900".into(),
         network: true,
         access: Access::Edit,
-        view_link: None,
+        view: None,
     }
 }
 
diff --git a/docs/collab-protocol.md b/docs/collab-protocol.md
index 8d476d760..03d57c84e 100644
--- a/docs/collab-protocol.md
+++ b/docs/collab-protocol.md
@@ -603,8 +603,8 @@ resuming with its offline edits, and leaving the session going back to snapshot
   see every change and everyone's presence, the app makes the file read-only for them, and the
   session refuses any batch they send anyway, as a server does for its view links. The Share
   popover picks which code shows (Can edit / Can view, also before sharing starts, so the edit
-  code need never be on screen; `collab.share {access}`, whose `link` is the one that goes with
-  the code shown, so a view-only share never hands out the edit link); picking one later changes
+  code need never be on screen; `collab.share {access}`, whose `link` and `url` are the ones that
+  go with the code shown, so a view-only share never hands out the edit secret); picking one later changes
   nothing for who already joined. There is no comment code on the local network. A host without an IPv4
   address gets no codes and shares its links.
 - **In the browser** a code joins like a link (the page asks the server over its own WebSocket,
diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md
index cfab7553a..ef541f3bf 100644
--- a/docs/collaboration-parity.md
+++ b/docs/collaboration-parity.md
@@ -26,7 +26,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same (its `link`, like its `code`, is the view-only way in), and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
+| 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same (its `link` and `url`, like its `code`, are the view-only way in), and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
 | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. |
 | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`<web_url>#join=…`). A browser build served beside its server names it with `<meta name="figcraft-server">`, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged |
 | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. |

From 36b728304b11090583184bc0021f9f1744c3dcb4 Mon Sep 17 00:00:00 2001
From: Trevor Brown <trevorbrown.dev@gmail.com>
Date: Fri, 6 Nov 2026 13:43:32 -0500
Subject: [PATCH 66/70] Minimize: a held press keeps its page point when the
 canvas moves, not only when it narrows (#2051)

While a press that went down on the canvas is held, the view centre now follows the canvas rect's own move as well as its size change, so a still pointer keeps its page point when the left sidebar or rail appears mid-press.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 crates/ui-egui/src/canvas.rs            | 41 ++++++++++++++-----------
 crates/ui-egui/src/panel_width_tests.rs | 31 +++++++++++++++++++
 2 files changed, 54 insertions(+), 18 deletions(-)

diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index e1e78b53d..684294c44 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -195,32 +195,37 @@ fn pointer_event(app: &FigApp, kind: PointerKind, pos: Pos2, m: &egui::Modifiers
 /// labels, handles, comments, versions/branch/dev/live UI and the cursor.
 pub fn show(app: &mut FigApp, ui: &mut Ui, worker: &mut Worker) {
     let rect = ui.max_rect();
-    app.canvas.rect = rect;
+    let old_rect = std::mem::replace(&mut app.canvas.rect, rect);
     let ctx = ui.ctx().clone();
     let ppp = ctx.pixels_per_point();
     let resp = ui.interact(rect, ui.scope_id().with("canvas"), Sense::click_and_drag());
     let key_box = app.ui.key_box;
     crate::a11y::canvas(&mut app.ui.nav, &resp, || key_box.map_or_else(|| describe(&app.session), describe_box));
-    if let Ok(ds) = app.session.ds_mut()
-        && ((ds.view.vw - f64::from(rect.width())).abs() > 0.5 || (ds.view.vh - f64::from(rect.height())).abs() > 0.5)
-    {
-        // Keep the centre; the first sizing after opening re-fits.
+    if let Ok(ds) = app.session.ds_mut() {
+        let resized = (ds.view.vw - f64::from(rect.width())).abs() > 0.5 || (ds.view.vh - f64::from(rect.height())).abs() > 0.5;
+        // The first sizing after opening re-fits.
         let first = ds.view.vw == 1200.0 && ds.view.vh == 800.0;
-        // While a button is held that went down on the canvas (a click that selects shows the right panel, minimized, and a
-        // click that deselects hides it) the page point under the pointer stays where it is: the
-        // gesture's own pointer events would otherwise move by half the panel's width over the
-        // zoom, and the move handling would take that for a drag. Keep the top-left instead.
-        let held = resp.is_pointer_button_down_on() && !first;
+        // While a button is held that went down on the canvas (a click that selects shows the
+        // right panel, minimized, and a click that deselects hides it; the left panel and rail
+        // can appear too) the page point under a still pointer stays where it is: the gesture's
+        // own pointer events would otherwise map to another page point and the move handling
+        // would take that for a drag. `to_page` is `origin + (p - rect.min) / z` with
+        // `origin = c - vw / 2 / z`, so the centre moves by half the size change plus the
+        // rect's own move, over the zoom.
+        let held = resp.is_pointer_button_down_on() && !first && old_rect.is_finite();
         let z = ds.view.zoom.max(1e-9);
-        let (dw, dh) = (f64::from(rect.width()) - ds.view.vw, f64::from(rect.height()) - ds.view.vh);
-        ds.view.vw = f64::from(rect.width());
-        ds.view.vh = f64::from(rect.height());
-        if held {
-            ds.view.cx += dw / 2.0 / z;
-            ds.view.cy += dh / 2.0 / z;
+        let (dw, dh) = if resized { (f64::from(rect.width()) - ds.view.vw, f64::from(rect.height()) - ds.view.vh) } else { (0.0, 0.0) };
+        if resized {
+            // Otherwise keep the centre.
+            ds.view.vw = f64::from(rect.width());
+            ds.view.vh = f64::from(rect.height());
+            if first {
+                ds.zoom_to_fit();
+            }
         }
-        if first {
-            ds.zoom_to_fit();
+        if held {
+            ds.view.cx += (dw / 2.0 + f64::from(rect.min.x - old_rect.min.x)) / z;
+            ds.view.cy += (dh / 2.0 + f64::from(rect.min.y - old_rect.min.y)) / z;
         }
     }
     let own_cursor = input(app, ui, &resp);
diff --git a/crates/ui-egui/src/panel_width_tests.rs b/crates/ui-egui/src/panel_width_tests.rs
index c7453be24..1bc17e7a1 100644
--- a/crates/ui-egui/src/panel_width_tests.rs
+++ b/crates/ui-egui/src/panel_width_tests.rs
@@ -442,3 +442,34 @@ fn a_click_that_hides_the_right_panel_does_not_move_the_frame() {
     assert_eq!(frame_x(&u, ids[4]), 1880.0);
     assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps);
 }
+
+/// The left sidebar and rail appearing while a press is held (Minimize toggled off mid-press)
+/// moves the canvas's left edge: a still pointer keeps its page point, so the release moves nothing.
+#[test]
+fn a_held_press_keeps_its_page_point_when_the_canvas_moves() {
+    let (mut u, ids) = minimized_row();
+    u.app.run("select.set", json!({"ids": [ids[3]]}));
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    let left = u.app.canvas.rect.min.x;
+    let p = u.app.to_screen(1880.0 + 200.0, 300.0);
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    let before = u.app.to_page(p);
+    u.app.run("view.minimize", json!({"on": false}));
+    u.frame(vec![]);
+    u.frame(vec![]);
+    assert!(u.app.canvas.rect.min.x > left + 100.0, "the left sidebar and rail moved the canvas's edge");
+    let after = u.app.to_page(p);
+    assert!((after.x - before.x).abs() < 0.5 && (after.y - before.y).abs() < 0.5, "the pointer's page point moved: {before:?} to {after:?}");
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() }]);
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert_eq!(frame_x(&u, ids[4]), 1880.0, "the frame did not move");
+    assert_eq!(frame_x(&u, ids[3]), 1410.0);
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps, "no history step");
+}

From 43403b3fedbe10742a49617720b6e04d92c7b07e Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Date: Fri, 6 Nov 2026 19:56:36 +0100
Subject: [PATCH 67/70] M8: glass takes one sample where its colours split
 under 1/256 px

The dispersion window samples the backdrop 18 times a pixel wherever the
curve bends it, even where the move is so short that the channels split
by a sliver of a pixel. Under 1/256 px every step lies within that of
the moved point, so one sample is within one level (of 255) of the window
over any backdrop, the hardest being 1 px columns of black and white or
of white and nothing. Those pixels now take one sample.

A larger split doesn't qualify: at 1/4 px one sample would move red and
blue by 1/8 px, up to 32 levels across a hard edge.
---
 ROADMAP.md                 |  3 ++-
 crates/render/src/glass.rs | 54 +++++++++++++++++++++++++++++++++++---
 2 files changed, 52 insertions(+), 5 deletions(-)

diff --git a/ROADMAP.md b/ROADMAP.md
index 60f5962d2..69ebc7de1 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends towards its core, and rounded rectangles work it out in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (glass takes one sample instead of its dispersion window where the colours split under 1/256 px; glass bends towards its core, and rounded rectangles work it out in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); progress docs cleaned of what merges left twice: rows merged into one, repeated status items removed, and `cargo xtask docs` (in `ci`) fails on a repeated table row or status item; a name typed for a variable or collection finds the one with that exact id before one named like it, and stored mode ids, font family variables and the panels' labels read exact ids (#1613); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); `.fig` elbowed and curved connectors without a saved path are routed like board connectors instead of drawn straight (gap 1); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; `figcraft-cli connect publish` publishes a code repository's code connect mappings to a design file (gap 16); while a drag only moves a large selection, its outlines, box, slots, spacing and Design panel values are worked out once and shifted, not rebuilt on every move (#1571); Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); an imported or pasted file finds an installed family under the other names its fonts give it, and with other case and spacing, instead of reporting it missing (#1292); a development example generates figcraft-cli's shell completions and man pages from its clap definitions (part of #1396); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; the server key is checked by comparing SHA-256 hashes of the presented and the kept key, as the deployment guide says (#1130); opening a file contacts no team library server it names until you check it (#1097); a hostile server can no longer grow a client's memory with made-up people, and a session remembers a bounded number of deleted layer ids (#1121); `doc.list` gives AI agents and plugins the open files' names, not their paths (#1117); with a large selection, frames where nothing changed reuse the selection's outlines, box and slots and the Design panel's instance and position values instead of working them out again (#1571); team libraries and plugins larger than the 16 MiB download burst can be downloaded again, more slowly (#1089); a batch keeps one undo snapshot, not one per step (#1099); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); hovering the canvas hit-tests once per pointer move, not on every frame, and moving an auto layout frame no longer lays out its contents again on every move (#1571); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); grid auto-placement looks for free cells a 64-bit word at a time and skips what blocks it, with the same placements (#1083); with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); a recovery copy made while a version is previewed holds the file, not the version shown; a FigJam `.jam` file opens as a board (#1342); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); `comment.list {mentions}` lists only the threads that @mention a name (#1415); in the browser an internal error that stops the page keeps its unsaved files, which open again on reload (#1123); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); figcraft-cli parses its arguments with clap, following RFC-0012 (#1396); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); the portable Windows zip keeps its settings, recovery copies and plugins in `config\` beside the executable, starting with an installed copy's preferences; the window starts on other graphics when its first ones fail before the first frame: Direct3D 12 compiles with FXC and no device compiles wgpu's indirect-validation shaders, then Vulkan, OpenGL and lower requirements on the power-saving GPU (#965, #1438); Thai, Lao, Khmer and Burmese lines break between words (#1219); an AI agent attached over MCP shows where it works (#1416); a manual overlay's position can be dragged on the canvas (#405); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); SVG import draws each pattern tile once per scale, within the layer budget (#1080); Vietnamese letters typed with combining marks (decomposed) take one font that has every mark, instead of missing-glyph boxes beside the letter (#1478); comment.list reports each message's @mentions (#1415); mask groups draw only over the area they can paint, and nested isolated layers share one memory budget (#1061); components can't contain their own instances, directly or through other components; `edit.duplicate` returns an id map with `map: true` (#995); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); MCP and control calls name their document (#998); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); the instance-swap menus have a search field (#1338); a refused batch's fixes take time linear in the batch (#1063); the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); large images on the canvas draw from a smaller copy, so two 16k images no longer lag (#1483); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); the web build's wasm back under its 24 MiB gate (#1472); shadows of images with transparent pixels follow their alpha (#1289); Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); offline Penpot 2.x import/export (#1143); optional batch continue-on-error with per-step outcomes (#1386); the Design panel's sections on one grid (#858); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); images placed at their own size, 2x screenshots in points (#1360); the toolbar on one 32 pt grid, without its Resources button (#1210); M4: zero-length round-capped dashes draw dots; dash expansion uses the existing safety budget; extracted from #1143; Arabic draft catalog; scaled instances keep their scale when their main is rebuilt (#922); .fig embedded images are copied once per blob, not once per hash (#1059); page ruler guides survive save and reopen (#1476); colour picker LCH and OKLCH models; non-ASCII layer names transliterate in code export (#1235); branches in live sessions and branch history entries, gap 17; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; Installed weights of an embedded font family (#1246); `.sketch` import, best effort (Sketch 48 and newer); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, the iteration marks 〱–〵 and the halfwidth parentheses, with behaviour cases for each; Adobe Fonts found on macOS (#298); egui 0.37 hidden-capture deadline contract; Dev Mode measurements kept on the canvas and a read-only layers panel; boards: a board area row and progress entry; community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -358,6 +358,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-06 | patch | M8: glass takes one backdrop sample instead of its 18-sample dispersion window where the colours split under 1/256 px (the flat end of the curve, where the move is short), within one level of the window over any backdrop: a large pane renders about 2–5% faster, with the same pixels in the renders compared. Tests: `glass::tests::a_split_too_narrow_to_show_takes_one_sample`. Numbers unchanged |
 | 2026-11-02 | patch | M8, #1885: a glass whose shape is too big to keep whole at the zoom (past `MAX_SHAPE_PX` with its core's margin) bends along its edge normals instead of working out a core, so its fields never cover more pixels than a kept shape's, and the core's feature transform holds 16 bytes a pixel. The edge normals are box-blurred twice again and the bend directions once, as documented. Test: `glass::tests::a_shape_too_big_to_keep_bends_along_its_normals`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass bends the backdrop towards its core, the shape shrunk by `depth` and the bevel, as the reference tool's: round a sharp corner the bend turns smoothly instead of meeting along the diagonal, and a part thinner than twice that (a capsule, a letter's stroke) bends across itself towards its own middle (pixels about as deep as any within 2 px). Rectangles, frames, components, instances and sections whose corners aren't smoothed work their glass out in closed form, with nothing to rasterise, transform or keep: a zoom frame draws in 40 ms instead of 54 and a resize frame in 46 instead of 67 (`glass_render_timings`, release, 2×). Other shapes keep their fields, with the bend directions for the last two depths asked for beside them, so dragging the Depth slider works out only those again. Tests: `glass::tests::a_sharp_corner_bends_round_towards_the_core`, `glass::tests::a_thin_part_bends_across_itself`, `glass::tests::neighbouring_strokes_bend_towards_their_own_middles`, `glass::tests::a_rounded_rectangle_in_closed_form_matches_its_distance_transform`, `glass_cut_tests::what_the_shape_depends_on_works_it_out_again_and_nothing_else_does`. Numbers unchanged |
 | 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it and 0.6 as much on the opposite side, with a faint gradient across the curve, 5% darker facing the light and lighter opposite (it was a glow mixed towards white, as deep as `splay` made it). `splay` turns the bend from along the edge's normal towards the way away from the layer's centre, as the reference tool's does, and no longer widens the light: files with a splay above 0 look different. The direction to the centre is worked out in the shape's own frame, so cut renders match. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Numbers unchanged |
diff --git a/crates/render/src/glass.rs b/crates/render/src/glass.rs
index f84aad971..aa30386cc 100644
--- a/crates/render/src/glass.rs
+++ b/crates/render/src/glass.rs
@@ -379,15 +379,27 @@ pub(crate) fn bend_at(x: f32, depth: f32, bevel: f32, refraction: f32) -> f32 {
     core + (rim - core) * u
 }
 
+/// Below this split (pixels: the move's length × `k`) the dispersion window takes one sample: its
+/// steps lie within 1/256 px of the moved point, so one sample is within one level (of 255) of the
+/// window even across the hardest edge, from black to white or opaque to clear in a pixel.
+const ONE_SAMPLE_SPLIT_PX: f32 = 1.0 / 256.0;
+
 /// The backdrop seen at pixel coordinates (`x`, `y`) moved by (`dx`, `dy`), its channels split by
 /// `k` (dispersion, 0–1): red moves up to `k` further, blue up to `k` less, each smeared along the
-/// move by a triangular window of [`DISPERSION_STEPS`]. One sample when `k` is too small to show.
+/// move by a triangular window of [`DISPERSION_STEPS`]. One sample when the split is too small to
+/// show: `k` under 0.001, or the channels under [`ONE_SAMPLE_SPLIT_PX`] apart (where the curve
+/// flattens out and the move is short).
 fn dispersed(frosted: &Pixmap, x: f32, y: f32, dx: f32, dy: f32, k: f32) -> [f32; 4] {
-    let at = |s: f32| sample(frosted, x + dx * s, y + dy * s);
-    if k < 0.001 {
-        let s = at(1.0);
+    if k < 0.001 || (dx * dx + dy * dy).sqrt() * k < ONE_SAMPLE_SPLIT_PX {
+        let s = sample(frosted, x + dx, y + dy);
         return [s[0].min(s[3]), s[1].min(s[3]), s[2].min(s[3]), s[3]];
     }
+    dispersion_window(frosted, x, y, dx, dy, k)
+}
+
+/// [`dispersed`]'s triangular window, every step sampled.
+fn dispersion_window(frosted: &Pixmap, x: f32, y: f32, dx: f32, dy: f32, k: f32) -> [f32; 4] {
+    let at = |s: f32| sample(frosted, x + dx * s, y + dy * s);
     let last = (DISPERSION_STEPS - 1) as f32;
     let (mut acc, mut sum) = ([0.0f32; 4], 0.0f32);
     for i in 1..DISPERSION_STEPS - 1 {
@@ -1048,6 +1060,40 @@ mod tests {
         assert_eq!(spread[2], 0.0);
     }
 
+    /// Where the channels split under [`ONE_SAMPLE_SPLIT_PX`], one sample stands in for the window
+    /// within one level, even over the hardest backdrops: 1 px columns of black and white, and of
+    /// white and nothing.
+    #[test]
+    fn a_split_too_narrow_to_show_takes_one_sample() {
+        for clear in [false, true] {
+            let mut p = Pixmap::new(64, 4).unwrap();
+            for (i, px) in p.data_mut().chunks_exact_mut(4).enumerate() {
+                let on = i % 2 == 1;
+                let v = if on { 255 } else { 0 };
+                px.copy_from_slice(&[v, v, v, if clear { v } else { 255 }]);
+            }
+            let mut worst = 0.0f32;
+            for step in 0..400 {
+                let x = 20.0 + step as f32 / 100.0;
+                // Along the columns' rows and across them, and out past the backdrop's last row.
+                for (dx, dy) in [(2.0f32, 0.0f32), (-2.0, 0.0), (1.2, 1.6), (0.0, 2.0), (40.0, 0.0)] {
+                    let k = ONE_SAMPLE_SPLIT_PX * 0.999 / (dx * dx + dy * dy).sqrt();
+                    let one = dispersed(&p, x, 2.0, dx, dy, k);
+                    assert_eq!(one, dispersed(&p, x, 2.0, dx, dy, 0.0), "one sample at {x}");
+                    let window = dispersion_window(&p, x, 2.0, dx, dy, k);
+                    worst = one.iter().zip(window).fold(worst, |m, (a, b)| m.max((a - b).abs()));
+                }
+            }
+            assert!(worst <= 1.0, "clear {clear}: {worst}");
+        }
+        // A wider split still takes the window.
+        let mut p = Pixmap::new(64, 4).unwrap();
+        p.data_mut().chunks_exact_mut(4).step_by(2).for_each(|px| px.copy_from_slice(&[255; 4]));
+        let k = ONE_SAMPLE_SPLIT_PX * 2.0 / 2.0;
+        assert_eq!(dispersed(&p, 20.3, 2.0, 2.0, 0.0, k), dispersion_window(&p, 20.3, 2.0, 2.0, 0.0, k));
+        assert_ne!(dispersed(&p, 20.3, 2.0, 2.0, 0.0, k), dispersed(&p, 20.3, 2.0, 2.0, 0.0, 0.0));
+    }
+
     /// A `w` × `h` coverage with the rectangles `rects` (x, y, width, height) filled.
     fn coverage(w: u32, h: u32, rects: &[(f32, f32, f32, f32)]) -> Pixmap {
         let mut p = Pixmap::new(w, h).unwrap();

From 3d41394bfcc437fd33ae479254529115a3b72115 Mon Sep 17 00:00:00 2001
From: Oleksii Sukholita <oleksii.sukholita@gmail.com>
Date: Fri, 6 Nov 2026 20:29:14 +0100
Subject: [PATCH 68/70] M3: glass's docs say which centre splay bends away from
 and where a shape gets no core
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Splay bends away from the centre of the layer's bounds, as the reference
tool's does: on a ring or an L that centre lies outside the shape, so an
inner edge bends towards the hole. Checked side by side on a ring and an
L at Splay 0% and 100%. The module doc still said splay 0 bends along the
edge's normal; it bends towards the core since #1889.

`MAX_SHAPE_PX` now says it is 4M px on the desktop and 1M on the web, and
that a bigger shape gets no core, so a large glass text or vector can bend
differently once zoomed into, in a 2× export, or on the web.

Docs only.
---
 crates/doc/src/props.rs    |  4 +++-
 crates/render/src/glass.rs | 27 ++++++++++++++++-----------
 docs/target-app-parity.md  |  3 ++-
 3 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/crates/doc/src/props.rs b/crates/doc/src/props.rs
index 11c3c16a4..f3726033e 100644
--- a/crates/doc/src/props.rs
+++ b/crates/doc/src/props.rs
@@ -663,7 +663,9 @@ pub struct Glass {
     /// Blur of the backdrop (a blur radius, document units, 0–[`Self::MAX_FROST`]).
     pub frost: f64,
     /// Which way the curved edge bends the backdrop: towards the shape's core (0; along the edge's
-    /// normal for a shape too big to work one out) to away from the layer's centre (1).
+    /// normal for a shape too big to work one out) to away from the centre of the layer's bounds
+    /// (1; on a ring or an L, whose centre lies outside the shape, an inner edge bends towards the
+    /// hole, as the reference tool's does).
     pub splay: f64,
 }
 
diff --git a/crates/render/src/glass.rs b/crates/render/src/glass.rs
index f84aad971..3272641e6 100644
--- a/crates/render/src/glass.rs
+++ b/crates/render/src/glass.rs
@@ -3,13 +3,15 @@
 //! Within `depth` of the outline the surface curves like a thick lens: the backdrop there is bent
 //! towards the inside, most a [`BEVEL`] in from the edge (`refraction` × `depth` far), falling off
 //! as the 3.5th power of the way out of the curve and gone `depth` further in, with a fifth as
-//! much on the bevel itself ([`bend_at`]). `splay` turns which way it bends, from along the edge's
-//! normal (0) to away from the layer's centre (1). Each colour channel bends by a different amount
-//! (`dispersion`, a rainbow fringe: red furthest, blue least, each smeared along the bend). The
-//! bevel catches the light as a thin line added to the backdrop ([`rim_light_at`]): fully where the
-//! edge faces `light_angle`, none below 0.35 of facing it, 0.6 as much on the opposite side; and a
-//! faint gradient runs across the curve, 5% darker where it faces the light and lighter opposite.
-//! `frost` blurs the backdrop first. Distances to the outline come from an exact Euclidean
+//! much on the bevel itself ([`bend_at`]). `splay` turns which way it bends, from towards the
+//! shape's core (0; along the edge's normal for a shape too big to keep, see [`MAX_SHAPE_PX`]) to
+//! away from the centre of the layer's bounds (1), as the reference tool's: on a ring or an L,
+//! whose centre lies outside the shape, an inner edge bends towards the hole. Each colour channel
+//! bends by a different amount (`dispersion`, a rainbow fringe: red furthest, blue least, each
+//! smeared along the bend). The bevel catches the light as a thin line added to the backdrop
+//! ([`rim_light_at`]): fully where the edge faces `light_angle`, none below 0.35 of facing it, 0.6
+//! as much on the opposite side; and a faint gradient runs across the curve, 5% darker where it
+//! faces the light and lighter opposite. `frost` blurs the backdrop first. Distances to the outline come from an exact Euclidean
 //! distance transform of the shape's coverage.
 //!
 //! The shape's coverage, distances and normals depend only on the shape and the zoom. Once a
@@ -575,8 +577,11 @@ struct ShapeKey {
     r: usize,
 }
 
-/// The cached fields of a shape whose window holds at most this many pixels; bigger shapes (a
-/// pane far larger than the view) are worked out for the part a render shows each time.
+/// The cached fields of a shape whose window holds at most this many pixels: 4M on the desktop, 1M
+/// on the web. Bigger shapes (a pane far larger than the view) are worked out for the part a render
+/// shows each time, with no core: they bend along their edge normals. So a large glass text or
+/// vector can bend differently once zoomed into, in a 2× export than on the canvas, and on the web
+/// than on the desktop. A rounded rectangle works out its core in closed form at any size.
 #[cfg(not(target_arch = "wasm32"))]
 const MAX_SHAPE_PX: u64 = 4 << 20;
 #[cfg(target_arch = "wasm32")]
@@ -919,8 +924,8 @@ pub fn glass(g: &Glass, frame: EffectFrame<'_>, rect: Option<RoundedRect>) -> Op
     fx::blur(&mut frosted, g.frost / 2.0 * scale);
     let ang = g.light_angle.to_radians();
     let light = (ang.sin() as f32, -ang.cos() as f32);
-    // The layer's centre in its own frame (see `own_frame`), which `splay` bends away from: the
-    // direction to it is the same wherever a render puts or cuts the layer.
+    // The centre of the layer's bounds in its own frame (see `own_frame`), which `splay` bends away
+    // from: the direction to it is the same wherever a render puts or cuts the layer.
     let local_centre = shape.0.bounding_box().center();
     let ((sx, sy), centre) = match own_frame(xf) {
         Some(own) => (own.shift, own.xf * local_centre),
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 5d910dabf..c8ed94702 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # FigCraft parity with Figma
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass bends towards its core, rounded rectangles in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (glass's docs say which centre splay bends away from and where a shape gets no core; glass bends towards its core, rounded rectangles in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719)) · **Target:** Figma Design (desktop app 126.10.7, macOS)
 
 The authoritative assessment of how close FigCraft is to Figma Design. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) is the ranked work list; the measured menu checklist is
@@ -650,6 +650,7 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-06 | patch | M3: glass's docs say which centre `splay` bends away from: the centre of the layer's bounds, as the reference tool's, checked side by side on a ring and an L at Splay 0% and 100% (an inner edge bends towards the hole in both). And where a glass shape gets no core: past 4M px on the desktop and 1M on the web (`MAX_SHAPE_PX`) it bends along its edge normals, so a large glass text or vector can bend differently once zoomed into, in a 2× export, or on the web. Docs only. Grade unchanged. |
 | 2026-11-02 | minor | M3, #1885: glass bends towards its core, the shape shrunk by `depth` and the bevel, as the reference tool's: round a sharp corner the bend turns smoothly, and a thin part (a capsule, a letter's stroke) bends across itself, checked side by side on a capsule 44 units tall. Rounded rectangles work it out in closed form. A shape too big to keep whole at the zoom bends along its edge normals instead, so no render works out a core over more pixels than a kept shape holds. Tests: `glass::tests::a_sharp_corner_bends_round_towards_the_core`, `glass::tests::a_thin_part_bends_across_itself`, `glass::tests::a_shape_too_big_to_keep_bends_along_its_normals`, `glass_cut_tests::a_cut_through_the_pane_matches_the_whole_render`. Grade unchanged. |
 | 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it, 0.6 as much on the opposite side, with a faint gradient across the curve. `splay` turns the bend from along the edge's normal towards the way away from the layer's centre and no longer widens the light, as in the reference tool. Checked side by side on synthetic files: a splay of 1 bends the backdrop towards the centre in both. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Grade unchanged. |
 | 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile (most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in) and splits its colours over 8 steps, red and blue 0.16 of the bend apart at 100% dispersion. Measured against the reference tool on synthetic files at 2×: the black band a pane pulls to its edge ends within 3 px of the reference tool's, and red and blue part 2.27 px at 50% dispersion and 4.66 px at 100% (2.38 and 4.69 there). Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Grade unchanged. |

From 10df192b013b1772ed739b93f30d7fc0e2f88aa3 Mon Sep 17 00:00:00 2001
From: Filip Strajnar <filip.strajnar@proton.me>
Date: Fri, 6 Nov 2026 21:27:47 +0100
Subject: [PATCH 69/70] M9: a share on every interface links to an address
 others reach

A session hosted with `bind` 0.0.0.0 (or ::) kept listening on every
interface but put 0.0.0.0 in its edit and view links, URLs, join codes
and shown address, which nobody can connect to. They now name this
machine's local network address of the listener's family (loopback
without one), on the same port.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvG6DxbDYxuPEA2pJirCLQ
---
 crates/collab-net/src/code_tests.rs | 43 ++++++++++++++++++++++++--
 crates/collab-net/src/link.rs       | 48 ++++++++++++++++++++---------
 2 files changed, 74 insertions(+), 17 deletions(-)

diff --git a/crates/collab-net/src/code_tests.rs b/crates/collab-net/src/code_tests.rs
index ca7cc51fb..eafb63763 100644
--- a/crates/collab-net/src/code_tests.rs
+++ b/crates/collab-net/src/code_tests.rs
@@ -3,7 +3,7 @@
 //! older than join codes, and the links that name a code. (A `figcraft-server` handing codes out
 //! and resolving them is tested in its own crate, with the same link.)
 
-use std::net::{Ipv4Addr, TcpListener};
+use std::net::{IpAddr, Ipv4Addr, SocketAddr, TcpListener};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -18,8 +18,9 @@ use crate::driver::{Driver, Socket};
 use crate::guest::GuestConfig;
 use crate::inbox::Inbox;
 use crate::invite::{Endpoint, Invite, Lookup};
+use crate::link::reachable;
 use crate::loopback_tests::{fast_limits, quick};
-use crate::{NetLink, manage};
+use crate::{NetLink, lan_ip, manage};
 
 fn session(name: &str) -> Session {
     let mut s = Session::new();
@@ -197,6 +198,44 @@ fn a_local_view_share_s_link_and_url_only_let_people_look() {
     assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
 }
 
+/// A share listening on every interface (`bind` 0.0.0.0) names where others reach it, never
+/// 0.0.0.0: this machine's local network address (loopback without one) in its codes, links, URL
+/// and address, and its view code and edit link both join it.
+#[test]
+fn a_share_on_every_interface_names_an_address_others_reach() {
+    let (mut host, mut viewer, mut editor) = (session("Hana"), session("Ada"), session("Bo"));
+    let shared = host.execute("collab.share", &json!({"via": "local", "bind": "0.0.0.0", "access": "view"})).unwrap();
+    let Code::Local(viewing) = code::parse(shared["code"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
+    let at = lan_ip().unwrap_or(Ipv4Addr::LOCALHOST.into());
+    assert_eq!(IpAddr::from(viewing.ip), at);
+    let address = format!("{at}:{}", viewing.port);
+    assert_eq!(shared["address"], address);
+    let Code::Local(editing) = code::parse(shared["share"]["editCode"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
+    assert_eq!((editing.ip, editing.port), (viewing.ip, viewing.port));
+    for way in [&shared["link"], &shared["url"], &shared["share"]["viewLink"], &shared["share"]["editLink"], &shared["sessions"][0]["link"]] {
+        let way = way.as_str().unwrap_or_default();
+        assert!(way.contains(&address) && !way.contains("0.0.0.0"), "{way}");
+    }
+    viewer.execute("collab.join", &json!({"code": shared["code"]})).unwrap();
+    editor.execute("collab.join", &json!({"link": shared["share"]["editLink"]})).unwrap();
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the joins", |s| live(s[1]) && live(s[2]) && s[0].live().peers.len() == 2);
+    assert_eq!((&viewer.live_summary()["access"], &editor.live_summary()["access"]), (&json!("view"), &json!("edit")));
+    assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
+}
+
+/// A listener on one address is reached at it; one on every interface at an address of its own
+/// family, on its port.
+#[test]
+fn a_listener_on_every_interface_is_reached_at_an_address_of_its_family() {
+    let one: SocketAddr = "192.168.1.20:47900".parse().unwrap();
+    assert_eq!(reachable(one), one);
+    for any in ["0.0.0.0:47900", "[::]:47901"] {
+        let any: SocketAddr = any.parse().unwrap();
+        let at = reachable(any);
+        assert!(!at.ip().is_unspecified() && at.is_ipv4() == any.is_ipv4() && at.port() == any.port(), "{any}: {at}");
+    }
+}
+
 /// An invite naming only `server` (what a join code is asked at).
 fn code_at(server: &Endpoint) -> Invite {
     Invite { server: server.clone(), file: String::new(), token: String::new() }
diff --git a/crates/collab-net/src/link.rs b/crates/collab-net/src/link.rs
index 35bbe7188..66d90bc22 100644
--- a/crates/collab-net/src/link.rs
+++ b/crates/collab-net/src/link.rs
@@ -1,6 +1,6 @@
 //! [`NetLink`]: the engine's [`LiveLink`] over the network.
 
-use std::net::{IpAddr, Ipv4Addr, SocketAddr, UdpSocket};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, UdpSocket};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::Duration;
@@ -120,18 +120,34 @@ fn view_secret(short: bool, edit: &str) -> Result<String, String> {
 /// This machine's address on the local network: the interface the default route leaves by (no
 /// packet is sent).
 pub fn lan_ip() -> Option<IpAddr> {
-    let sock = UdpSocket::bind(SocketAddr::from((Ipv4Addr::UNSPECIFIED, 0))).ok()?;
     // Documentation and private ranges: only the route matters.
-    for probe in ["192.0.2.1:9", "10.255.255.255:9"] {
-        if sock.connect(probe).is_ok()
-            && let Ok(a) = sock.local_addr()
-            && !a.ip().is_loopback()
-            && !a.ip().is_unspecified()
-        {
-            return Some(a.ip());
-        }
-    }
-    None
+    route_ip(Ipv4Addr::UNSPECIFIED.into(), &["192.0.2.1:9", "10.255.255.255:9"])
+}
+
+/// The address of `any`'s family that the route to the first of `probes` that has one leaves by
+/// (no packet is sent): never a loopback, unspecified or IPv6 link-local one, which others can't
+/// reach this machine at.
+fn route_ip(any: IpAddr, probes: &[&str]) -> Option<IpAddr> {
+    let sock = UdpSocket::bind(SocketAddr::new(any, 0)).ok()?;
+    probes.iter().find_map(|probe| {
+        sock.connect(probe).ok()?;
+        let ip = sock.local_addr().ok()?.ip();
+        let link_local = matches!(ip, IpAddr::V6(v6) if v6.is_unicast_link_local());
+        (!ip.is_loopback() && !ip.is_unspecified() && !link_local).then_some(ip)
+    })
+}
+
+/// Where others reach a session listening on `addr`: `addr` itself, or for a listener on every
+/// interface (`0.0.0.0`, `::`) this machine's local network address of the same family (its
+/// loopback without one), on the same port. Links name it; the listener keeps every interface.
+pub(crate) fn reachable(addr: SocketAddr) -> SocketAddr {
+    let ip = match addr.ip() {
+        ip if !ip.is_unspecified() => ip,
+        IpAddr::V4(_) => lan_ip().unwrap_or(Ipv4Addr::LOCALHOST.into()),
+        // Documentation and unique local ranges, as for IPv4.
+        IpAddr::V6(_) => route_ip(Ipv6Addr::UNSPECIFIED.into(), &["[2001:db8::1]:9", "[fd00::1]:9"]).unwrap_or(Ipv6Addr::LOCALHOST.into()),
+    };
+    SocketAddr::new(ip, addr.port())
 }
 
 impl LiveLink for NetLink {
@@ -165,8 +181,10 @@ impl LiveLink for NetLink {
             core: figcraft_collab::Limits::default(),
         };
         let host = Host::start(cfg, inbox.clone()).map_err(|e| format!("can't listen on {ip}: {e}"))?;
-        let view = view_token.map(|v| Invite::new(host.addr().to_string(), file.clone(), v)).map(|v| WayIn { link: v.link(), url: v.url() });
-        let invite = Invite::new(host.addr().to_string(), file, token);
+        // Listening on every interface (`0.0.0.0`, `::`), the links name an address others reach.
+        let at = reachable(host.addr()).to_string();
+        let view = view_token.map(|v| Invite::new(at.clone(), file.clone(), v)).map(|v| WayIn { link: v.link(), url: v.url() });
+        let invite = Invite::new(at.clone(), file, token);
         let info = SessionInfo {
             role: Role::Host,
             me: host.me().client_id,
@@ -176,7 +194,7 @@ impl LiveLink for NetLink {
             pages,
             link: invite.link(),
             url: invite.url(),
-            address: host.addr().to_string(),
+            address: at,
             network: !ip.is_loopback(),
             access: Access::Edit,
             view,

From 4cacc9663191e31b2bfce25b4f99299eca596a82 Mon Sep 17 00:00:00 2001
From: Luis <43929895+Luis-0508@users.noreply.github.com>
Date: Sat, 7 Nov 2026 00:27:48 +0100
Subject: [PATCH 70/70] Release: refresh contributor credits for each release
 (#2059)

About > Contributors still showed an old snapshot, because nothing
regenerated contributors/contributors.json before a release. Opt in to
the shared refresh from craft-common-actions: a read-only credits job
regenerates the snapshot for the release commit, and the shared release
workflow installs it before every source build. The snapshot is not
committed back.
---
 .github/workflows/release.yml | 8 ++++++++
 docs/contributors.md          | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 975d54114..d686da692 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,14 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # Regenerates contributors/contributors.json for the release commit; every build bundles it.
+  credits:
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
   release:
+    needs: credits
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
@@ -33,6 +40,7 @@ jobs:
       # crates/text/build.rs keeps the web allowlist small (Inter and Georgian).
       web-craft-fonts: true
       version: ${{ inputs.version }}
+      contributors-artifact: ${{ needs.credits.outputs.artifact-name }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
diff --git a/docs/contributors.md b/docs/contributors.md
index 1f18de9a3..2499d6248 100644
--- a/docs/contributors.md
+++ b/docs/contributors.md
@@ -8,7 +8,8 @@ the AI models named in `Co-Authored-By` trailers.
 - Two files, both **compiled into the binary** by the UI crate's `build.rs` (nothing is read from
   disk or the network at run time; the web build has them too):
   - [`contributors/contributors.json`](../contributors/contributors.json): commit stats per GitHub
-    username; never hand-edit.
+    username; never hand-edit. Release builds regenerate it for the release commit
+    (`.github/workflows/release.yml`, `credits` job); the copy in the repository is not updated.
   - [`contributors/people.toml`](../contributors/people.toml): the names people chose for
     themselves. **Each contributor adds only their own entry**, in their own PR.
 - Each contributor gets one line: GitHub username (always), display name (opt-in, or their synced