Merge main into #1992, keeping main's coverage numbers

.github/workflows/house-rules.yml

@@ -0,0 +1,28 @@
+name: House rules
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  pull_request:
+    paths:
+      - AGENTS.md
+      - CLAUDE.md
+      - .github/workflows/house-rules.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: house-rules-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  house-rules:
+    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
+    with:
+      rust: true

.github/workflows/release.yml

@@ -48,3 +48,4 @@ jobs:
       AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
       AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
       AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}

AGENTS.md

@@ -1,3 +1,56 @@
+<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
+## House rules
+
+These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
+
+1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
+2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
+3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
+4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
+5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
+6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
+7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
+8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
+9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
+10. **Keep secrets and personal details out** of the repository, logs and requests.
+11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
+12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
+13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
+14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
+15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
+<!-- craft-house-rules:end -->
+<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
+## Rust Craft repositories
+
+These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
+
+1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
+2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
+3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
+4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
+5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
+6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
+
+## Licence allowlist
+
+Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
+
+- `ISC`
+- `MIT`
+- `BSD-2-Clause`
+- `BSD-3-Clause`
+- `Apache-2.0`
+- `OFL-1.1`
+- `Ubuntu-font-1.0`
+- `Bitstream-Vera`
+- `CC0-1.0`
+- `CC-BY-4.0`
+- `CC-BY-SA-4.0`
+- `LicenseRef-Public-Domain`
+
+`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
+<!-- craft-house-rules:end -->
+
 # FigCraft — instructions for agents
 
 FigCraft is a clean-room, open-source, pure-Rust (egui) reimplementation of the Figma design workflow:
@@ -12,11 +65,10 @@ Repos don't share code.
 1. Read [`ROADMAP.md`](ROADMAP.md) (stage, headline numbers, estimates) and
    [`docs/gaps.md`](docs/gaps.md) (the ranked work list). Unless the user gives you a task, pick
    work from the top of `docs/gaps.md`.
-2. Read `plan/STATUS.md` and `plan/execution-plan.md` (local, gitignored) if present; behaviour
-   reference notes are in `plan/figma/*.md`.
-3. Orient → plan → implement + test → verify (screenshot) → record (ROADMAP, devlog) → commit.
+2. Orient → plan → implement + test → verify (screenshot) → record (ROADMAP, devlog) → commit.
 
-`plan/` is gitignored (local only).
+`plan/` is an optional gitignored notebook. Behaviour reference notes may be in `plan/figma/*.md`.
+Do not ask for it, and do not stop when it is absent.
 
 ## Non-negotiables
 
@@ -59,6 +111,9 @@ Repos don't share code.
 - No `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!` in shipped code
   (workspace clippy lints deny them; tests may use them). Return `Result`/`Option`; use `.get()` for
   data-derived indexes; slice strings only at char boundaries; check floats are finite; cap sizes.
+- New workspace crates include `[lints] workspace = true` in `Cargo.toml`. Production crate roots
+  declare the crate-level lint attributes before modules or other crate items; crate-level `//!`
+  documentation may precede them.
 - `figcraft_engine::guard` turns a panicking command into `EngineError::Internal` and the document
   is rolled back; the desktop app also guards each UI frame and writes recovery copies. These are
   safety nets, not substitutes for `Result`.
@@ -78,13 +133,11 @@ Repos don't share code.
   L6 depends on egui/eframe/rfd/winit. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
   `app.set_props(ids, props)`. Colours come from `theme::Tokens`.
-- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
-- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
+- **Never break wasm** (`cargo xtask wasm`).
 
 ### Quality gates (before every commit)
 `cargo xtask ci` (fmt, clippy -D warnings, tests, layers, assets, wasm). One task per commit with a
-milestone id in the message (`M2.1: auto layout wrap`). Commit after every landed arc of work; push
-to `main`.
+milestone id in the message (`M2.1: auto layout wrap`). Commit after every landed arc of work.
 
 ## Running and looking at the app
 - `cargo run -p figcraft -- --control <port> [file.figcraft|file.svg|image]`. Pick a free port
@@ -98,7 +151,6 @@ to `main`.
   incumbent side by side where the owner allows (`plan/figma/`).
 - Headless: `figcraft-cli` (`info`, `export`, `run`, `commands`, `mcp`). MCP: `figcraft-cli mcp`
   (see `docs/mcp.md`).
-- Shell gotcha on the owner's machine: `mv`/`cp` may be aliased interactive — use `/bin/mv -f`.
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent, edit only the crates/files you own,
   write manifests atomically, delete your target dir when done (disk is limited).
 

CLAUDE.md

@@ -1,133 +1 @@
-# FigCraft — instructions for agents
-
-FigCraft is a clean-room, open-source, pure-Rust (egui) reimplementation of the Figma design workflow:
-interface design, auto layout, components and variants, styles and variables, prototyping and
-inspection. It runs natively on macOS, Windows, Linux and FreeBSD, and in the browser via WASM.
-Siblings: `../vectorcraft` (Illustrator-class), `../photocraft` (Photoshop-class), `../designcraft`
-(InDesign-class) and the other Crafting Apps; same conventions.
-
-Repos don't share code.
-
-## Start every session here
-1. Read [`ROADMAP.md`](ROADMAP.md) (stage, headline numbers, estimates) and
-   [`docs/gaps.md`](docs/gaps.md) (the ranked work list). Unless the user gives you a task, pick
-   work from the top of `docs/gaps.md`.
-2. Read `plan/STATUS.md` and `plan/execution-plan.md` (local, gitignored) if present; behaviour
-   reference notes are in `plan/figma/*.md`.
-3. Orient → plan → implement + test → verify (screenshot) → record (ROADMAP, devlog) → commit.
-
-`plan/` is gitignored (local only).
-
-## Non-negotiables
-
-### Clean-room
-- Behaviour comes from public documentation and black-box observation of the running incumbent app
-  with synthetic documents only. Never read, disassemble or copy anything inside the incumbent's
-  application bundle, web bundle or network traffic (names and public listings only).
-- Never copy GPL/AGPL code.
-- Reference screenshots of the incumbent stay local under the gitignored `plan/figma/screenshots/`
-  and are never committed, published or used as assets.
-
-### Assets: no third-party product iconography or images — ever (absolute rule from the project owner)
-- **Never add, copy, trace, redraw-from, embed or ship any icon, image, illustration, cursor, logo,
-  template, UI kit, preset library, font file or screenshot from Figma, Adobe, Avid, Autodesk or any
-  other product, or from any source whose licence doesn't allow it.** This includes "lookalike"
-  redraws of their icons. Breaking this rule is the worst thing you can do in this repo.
-- Every image, icon, font or other asset must be one of:
-  - original work created for FigCraft by a contributor (licensed MIT OR Apache-2.0);
-  - OSI open source;
-  - public domain / CC0;
-  - Creative Commons with redistribution allowed.
-- **Every asset file must have a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (path, author, source,
-  licence, notes). `cargo xtask assets` (part of `cargo xtask ci`) fails on any unlisted file under
-  `assets/`, `docs/brand/` or `docs/images/`.
-- FigCraft's UI icons are drawn in code (`crates/ui-egui/src/icons.rs`) from simple primitives and
-  are original. Keep it that way: new icons are new code, designed from scratch.
-- The app icon is the owner's chameleon drawing, vectorised (`assets/app-icon/README.md`); `cargo xtask icon`
-  renders the PNGs and `.ico` from `assets/app-icon/figcraft.svg`.
-- **Fonts live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), never in this
-  repo.** The app uses it only through the optional `CRAFT_FONTS_DIR` build input
-  (`.cargo/config.toml` points it at `../craft-fonts` for local builds; `crates/text/build.rs`
-  embeds it). Everything must build, test and run without it (system fonts are scanned at runtime).
-- Demo and test content is synthetic or public domain; never personal photos or data.
-- Code and original assets are MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`, `NOTICE`). The
-  ArtCraft logos in `docs/brand/` are trademarks, not open source, under
-  `docs/brand/LICENSE-brand.txt`: never modify them or use them outside FigCraft.
-- If the provenance of an asset is unclear, don't add it.
-
-### Never crash
-- No `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!` in shipped code
-  (workspace clippy lints deny them; tests may use them). Return `Result`/`Option`; use `.get()` for
-  data-derived indexes; slice strings only at char boundaries; check floats are finite; cap sizes.
-- New workspace crates must include `[lints] workspace = true` in `Cargo.toml` to inherit `[workspace.lints]`. Production crate roots must declare the required crate-level lint attributes before modules or other crate items; crate-level `//!` documentation may precede them.
-- `figcraft_engine::guard` turns a panicking command into `EngineError::Internal` and the document
-  is rolled back; the desktop app also guards each UI frame and writes recovery copies. These are
-  safety nets, not substitutes for `Result`.
-- `unsafe_code = "forbid"` workspace-wide.
-- Every crash fix comes with a regression test. The engine has a junk-parameter sweep over every
-  command (`crates/engine/src/tests.rs`): extend fuzz/sweep tests when you add parsers or commands.
-
-### Architecture
-- **Everything is a command.** User-visible behaviour = a command in `crates/engine/src/cmd/*`
-  (`spec!(id, label, params doc, undoable, run)`) + tests. The menus, shortcuts, Actions palette,
-  CLI, control channel and MCP server all dispatch the same command ids. Command ids follow the
-  incumbent's menu catalog in `crates/engine/src/catalog.rs` (the parity metric: `cargo xtask parity`).
-- **Programmatic calls never open dialogs.** Commands only *request* UI (`Session::request_ui`); the
-  control channel drops dialog requests.
-- **Layering** is enforced by `cargo xtask layers`: geom/color (L0) → doc (L1) → layout/text/pathops/plugin/collab
-  (L2) → render/format (L3) → svg/pdf (L4) → engine (L5) → ui-egui/mcp (L6) → apps. Nothing below
-  L6 depends on egui/eframe/rfd/winit. **The UI crate is swappable.**
-- **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
-  `app.set_props(ids, props)`. Colours come from `theme::Tokens`.
-- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
-- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
-
-### Quality gates (before every commit)
-`cargo xtask ci` (fmt, clippy -D warnings, tests, layers, assets, wasm). One task per commit with a
-milestone id in the message (`M2.1: auto layout wrap`). Commit after every landed arc of work; push
-to `main`.
-
-## Running and looking at the app
-- `cargo run -p figcraft -- --control <port> [file.figcraft|file.svg|image]`. Pick a free port
-  (`python3 -c 'import socket;s=socket.socket();s.bind(("127.0.0.1",0));print(s.getsockname()[1])'`);
-  sibling apps use the control channel too.
-- Drive it with JSON lines, e.g.
-  `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":10,"y":10,"width":100,"height":50}}}`
-  then `{"id":2,"method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods are documented
-  in `crates/ui-egui/src/control.rs` and `docs/control-protocol.md`.
-- **For UI work, look at the result** (take a screenshot and read the PNG). Compare with the
-  incumbent side by side where the owner allows (`plan/figma/`).
-- Headless: `figcraft-cli` (`info`, `export`, `run`, `commands`, `mcp`). MCP: `figcraft-cli mcp`
-  (see `docs/mcp.md`).
-- Shell gotcha on the owner's machine: `mv`/`cp` may be aliased interactive — use `/bin/mv -f`.
-- Parallel agents: separate `CARGO_TARGET_DIR` per agent, edit only the crates/files you own,
-  write manifests atomically, delete your target dir when done (disk is limited).
-
-## Roadmap
-Progress docs: [`ROADMAP.md`](ROADMAP.md) (one-page
-summary and stage), [`docs/target-app-parity.md`](docs/target-app-parity.md) (the authoritative
-assessment), [`docs/gaps.md`](docs/gaps.md) (ranked work list), [`docs/roadmap.md`](docs/roadmap.md)
-(milestones), [`docs/architecture.md`](docs/architecture.md), the per-area `docs/*-parity.md` files
-and the generated [`docs/parity-checklist.md`](docs/parity-checklist.md) (`cargo xtask parity`).
-When a task lands, update the affected rows and the status line and revision history in the same
-commit. Grade by behaviour against the incumbent, not by whether a menu item exists; err low.
-
-## Contributor credits (About window)
-
-- About ▸ Contributors are compiled into the binary from `contributors/contributors.json`
-  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
-  themselves).
-- **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
-  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
-  whether they want to be credited by more than their username: a real name, a display name, and/or
-  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file)
-  and include it in their PR, committed as them. If no, change nothing: they are credited as
-  `@username` anyway.
-- Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
-  GitHub profiles). Never hand-edit `contributors.json`.
-
-## CI workflows
-- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
-- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
-- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
+@AGENTS.md

Cargo.lock

@@ -1157,6 +1157,15 @@ dependencies = [
  "zip 9.1.1",
 ]
 
+[[package]]
+name = "craft-web-host"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=2e2312ddaf21bc3d85cd3395d0955c7d239306f6#2e2312ddaf21bc3d85cd3395d0955c7d239306f6"
+dependencies = [
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "craft-window"
 version = "0.1.0"
@@ -2121,6 +2130,7 @@ name = "figcraft-web"
 version = "0.15.0"
 dependencies = [
  "base64 0.22.1",
+ "craft-web-host",
  "eframe",
  "egui",
  "figcraft-collab-net",

ROADMAP.md

@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (German coverage re-measured at 2,592 / 2,647 entries (97.9%, 2026-11-04); six German translations for the text-wrap control (M10): Auto, balanced and pretty wrapping; catalog remains a draft; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrapping on 32-bit targets, and font indexing makes its existing offset bounds explicit (#1125); Bosnian (`bs`) draft catalog; text style dedupe is O(spans) via a last-two cache and fingerprint buckets (#1102); pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-Line truncated
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (glass takes one sample instead of its dispersion window where the colours split under 1/256 px; glass bends towards its core, and rounded rectangles work it out in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps; glass effects take variables and keep their frost within 0–100; web host bridge: `?host=parent` or `data-host="page"` hands a page the app's files, documented in the hosting guide; a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a tap on a plugin panel's button keeps what was typed in its fields; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; library analytics list how many layers and files use each style and variable; the Controller menu names each button as PlayStation and Switch controllers do; widgets draw lines and SVG pictures (plugin API 6); a connector end dropped along a side of a shape attaches to that side (#1708); regression tests pin a rounded shape's one-sided stroke and SVG ids and font families without XML-forbidden characters (#1351, #1124); a damaged image is refused with a reason instead of showing as an empty box (#1474); an image copied in another app pastes again on the desktop, and in the browser for the first time (#492); SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the Frame tool's Phone presets have the iPhone 17 family (#1691); Show in folder works in the Flatpak build and selects the file on Linux (#1701); a dashed line starts and ends with a half-length dash, on the canvas and in exports; the Pages, Layers and Assets search fields keep their text in the middle of the field (#1703); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a stroke's Custom style takes a dash pattern of any length as a comma-separated list (#1681); a control request can set its own timeout, up to 10 minutes (`timeoutMs`; `figcraft-cli mcp --attach PORT --timeout SECONDS`) (#1696); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the keyboard's Menu key opens the context menu, as Shift+F10 does; an Open link action can open in place of the prototype, with "Open in new tab" off (gap 15); a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a control request that times out says truthfully whether it was dropped or is still running and will take effect, and only screenshots and input blame the window (#1673); a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; the object a stamp will stick to is outlined while the stamp tool is over it or a stamp is dragged over it, and board objects take no drops (gap 24); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); team library analytics count detached instances per component and file (gap 10); skipping the Open link notice by command is saved with the preferences at once (gap 15); a selected connector's bar on a board sets its start and end points, solid or dashed, its weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; a long layer name stays on one line in the Export button and the Dev Mode header, ending with an ellipsis, and no longer covers the Design panel (#1650); with hundreds of layers selected, the Design panel and the selection overlays stop going over the whole selection on every frame, so dragging 648 layers averages about 1.1 ms of UI per frame (#1571); plugin panels show pictures: an `image` control, base64 within 256 KB and 4,096 px a side, named by its label (gap 6); `.fig` connector labels without a saved snapshot are kept, centred on their line (gap 1); a drag moving many layers re-runs only what sits around them, not each layer's bindings, sizing, text and instance checks, on every move (#1571); damaged font tracking table offsets are checked instead of wrLine truncated
 
 FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
 native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -97,7 +97,7 @@ native speakers' reviews of the nine language drafts need people.
 
 ## Languages
 
-| Language | Code | Catalog entries | Status |
+| Language | Code | Strings | Status |
 |---|---|---|---|
 | English | en | 100% | full |
 | Simplified Chinese | zh-Hans | 95% | draft (needs native review) |
@@ -108,14 +108,11 @@ native speakers' reviews of the nine language drafts need people.
 | Portuguese (Brazil) | pt-BR | 95% | draft (needs native review) |
 | Indonesian | id | 99% | draft (needs native review) |
 | Japanese | ja | 99% | draft (needs native review) |
-| German | de | 2,592 / 2,647 entries (97.9%, measured 2026-11-04) | draft (needs native review) |
+| German | de | 96% | draft (needs native review) |
 | Korean | ko | 95% | draft (needs native review) |
 | Vietnamese | vi | 100% | draft (needs native review) |
 
-German coverage was re-measured on 2026-11-04 with `cargo xtask i18n-report`: 1,969 / 1,975 UI keys,
-594 / 641 command labels and 29 / 31 menu wordings, or 2,592 / 2,647 entries (97.9%). The count measures
-catalog entries, not native-speaker approval; the method is in [localization parity](docs/localization-parity.md#languages).
-The older percentages use the 2026-10-17 measurement over 2,272 entries (strings added since a draft show English); rows with a later date supersede it. Also shipped: Russian (`ru`, 99%, reviewed by VanTan), Swedish (`sv`, 99.6%, command labels since 2026-10-17; native review welcome), Turkish (`tr`, 99%), Czech (`cs`, 99%, draft) and Bosnian (`bs`, 100% on 2026-10-30, draft). Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
+Percentages measured 2026-10-17 over 2,272 entries (strings added since a draft show English). Also shipped: Russian (`ru`, 99%, reviewed by VanTan), Swedish (`sv`, 99.6%, command labels since 2026-10-17; native review welcome), Turkish (`tr`, 99%), Czech (`cs`, 99%, draft) and Bosnian (`bs`, 100% on 2026-10-30, draft). Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
 (Brazil); FigCraft has the localization layer, English and Spanish (Spain and Latin America),
 French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Indonesian, Vietnamese and Arabic drafts (Preferences ▸
 Language; Traditional Chinese has no catalog; CJK UI
@@ -135,8 +132,6 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 ## Progress log
 
-- **2026-11-04** · M10: re-measure German catalog coverage with `cargo xtask i18n-report` and synchronize both language rows at 2,592 / 2,647 entries (97.9%). Record the current key counts and counting method; distinguish the older dated measurements. German remains a draft; grade and estimates unchanged.
-- **2026-11-04** · M10: the text layer's Wrap style control and its Balance/Pretty options and three explanatory tooltips now have German translations. These six UI strings previously fell back to English. German stays a draft; no full native review claimed. Grade and estimates unchanged.
 - **2026-10-30**: M8, #1125: damaged `trak` size-table offsets are checked instead of wrapping on 32-bit targets, and an incomplete normal track is dropped entirely, never returned in part. Font indexing makes its existing bounds explicit, preserving later faces and sparse name-table reads. Synthetic regression tests in `fontdb_tests.rs`. Numbers unchanged.
 - **2026-10-30** · Text style dedupe is O(spans) (M8, #1102): `shape_text` deduped spans into styles by a scan over the styles already collected — O(spans × styles), so a styled text's dedupe grew with the square of its runs (a synthetic 50k-run text with 100 alternating styles spent 7.7 ms in it). Now the last two styles again (spans run in blocks), then buckets keyed by a cheap fingerprint (family and style bytes, size bits with −0.0 folded, the enums, fill count and solid colours), each bucket resolved with the full equality: the result is the scan's, never worse than it, and O(spans) when names and sizes differ (the same synthetic text: 2.6 ms). The font-db write lock is untouched: `find()` loads faces, which needs the write. `layout_dedupe_tests`. Numbers unchanged.
 - **2026-10-29** · M10: correct nine German labels in `de.toml`: gradient stops use Verlaufsstopp, OpenType ss01–ss05 use Stilsatz, and the Home-screen preference names the Startbildschirm consistently in the UI and Actions palette. This is a partial terminology pass; German remains a draft awaiting a full native-speaker review and maintainer approval. Numbers unchanged.
@@ -148,6 +143,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 - **2026-10-27** · Batch continue-on-error (M0.9, #1386): `command.batch` and MCP `batch` accept `onError: "continue"`, roll back failed steps individually and return one outcome per step. References to failed steps fail with both step numbers; successful edits stay one undo step, and the default abort mode is unchanged. Engine and MCP regression tests. Numbers unchanged.
 - **2026-10-26** · Non-ASCII layer names transliterate in code export (M6, #1235): `class_name` runs the name through `deunicode` before its ASCII filter, so 로그인 화면 → `rogeuin-hwamyeon`, кнопка → `knopka`, über → `uber` in the HTML/CSS/React/Leptos class names, component roots and `data-*` variant attributes (SwiftUI/Compose type names unchanged); a name left with nothing (symbols only) takes the node's kind (`.text`, `.frame`) instead of `layer-`, and the 40-character cut lands on a word boundary. New dependency: deunicode (pure Rust tables, zero deps, BSD-3-Clause, the `slug` crate's base). `html_codegen_tests`. Numbers unchanged.
 - **2026-10-25** · M6, #1143: offline Penpot 2.x open/import/export through the editor, CLI and MCP using the existing document model. Unsupported layout settings retain saved positions and bounded source metadata with warnings; font binaries and toggle-overlay are reported, and provider fonts are never downloaded. Shared ZIP/JSON/token budgets guard untrusted input. Figma parity numbers unchanged.
+- **2026-10-26** · Web host bridge: `?host=parent` (a same-origin page embedding FigCraft in an iframe) or `data-host="page"` on the canvas (the page's own document, over non-bubbling `CustomEvent`s) opens the host's file like File ▸ Open (over the browser open limit of 512 MB refused) and takes every file the app would otherwise download (`figcraft:save` with the `saveAs` rule), plus `figcraft:dirty`, `figcraft:ready` and `figcraft:failed`; `?author=` names the user for comments and board notes; host mode starts with no document. Unit tests cover the opt-in rule (only the exact `page` value), the `saveAs` rule and the open-name fallback. Numbers unchanged.
 - **2026-10-25** · egui 0.37 capture lifecycle: screenshots with hidden or unknown visibility queue, request a hidden paint, and expire after 60 seconds if no capture arrives (headless-tested contract). Logic-only edits, saves and inspection continue while hidden. Native visible GUI and forced hidden-window paint, browser and Wayland behavior remain unqualified; parity percentages are unchanged.
 - **2026-10-24** · Open, Save and the folder dialogs start in the folder of the last file or folder picked in the run (#1290): the Linux portal does not remember it between dialogs as the macOS and Windows panels do. A folder deleted since falls back to the system's choice. No numbers change.
 - **2026-10-24** · Boards (M12): board pages get a dot grid under their layers (drawn by the canvas render after the page colour, thinned out when zoomed out); a selected connector shows its ends as handles, and dragging one onto another object re-attaches it there, onto empty canvas leaves it free (`board.reattach`, one undo step, also over MCP); connectors can be curved, and elbows go around the objects they join when the short way would cross them. Checked in the app, through MCP and in the web build ([boards-parity](docs/boards-parity.md)).
@@ -362,8 +358,12 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-04 | minor | German coverage re-measured with `cargo xtask i18n-report`: 1,969 / 1,975 UI keys, 594 / 641 command labels and 29 / 31 menu wordings; both language rows now show 2,592 / 2,647 (97.9%). Missing: 6 UI keys, 47 command labels, 2 menu wordings. Older measurements are dated; native review, grade and estimates unchanged |
-| 2026-11-04 | minor | six German translations for the text-wrap control (M10): Auto, balanced and pretty wrapping; catalog remains a draft. Six previously missing UI entries added to `de.toml`; command labels and menu wordings unchanged. Full native review is still pending; grade and estimates unchanged |
+| 2026-11-06 | patch | M8: glass takes one backdrop sample instead of its 18-sample dispersion window where the colours split under 1/256 px (the flat end of the curve, where the move is short), within one level of the window over any backdrop: a large pane renders about 2–5% faster, with the same pixels in the renders compared. Tests: `glass::tests::a_split_too_narrow_to_show_takes_one_sample`. Numbers unchanged |
+| 2026-11-02 | patch | M8, #1885: a glass whose shape is too big to keep whole at the zoom (past `MAX_SHAPE_PX` with its core's margin) bends along its edge normals instead of working out a core, so its fields never cover more pixels than a kept shape's, and the core's feature transform holds 16 bytes a pixel. The edge normals are box-blurred twice again and the bend directions once, as documented. Test: `glass::tests::a_shape_too_big_to_keep_bends_along_its_normals`. Numbers unchanged |
+| 2026-11-02 | minor | M3, #1885: glass bends the backdrop towards its core, the shape shrunk by `depth` and the bevel, as the reference tool's: round a sharp corner the bend turns smoothly instead of meeting along the diagonal, and a part thinner than twice that (a capsule, a letter's stroke) bends across itself towards its own middle (pixels about as deep as any within 2 px). Rectangles, frames, components, instances and sections whose corners aren't smoothed work their glass out in closed form, with nothing to rasterise, transform or keep: a zoom frame draws in 40 ms instead of 54 and a resize frame in 46 instead of 67 (`glass_render_timings`, release, 2×). Other shapes keep their fields, with the bend directions for the last two depths asked for beside them, so dragging the Depth slider works out only those again. Tests: `glass::tests::a_sharp_corner_bends_round_towards_the_core`, `glass::tests::a_thin_part_bends_across_itself`, `glass::tests::neighbouring_strokes_bend_towards_their_own_middles`, `glass::tests::a_rounded_rectangle_in_closed_form_matches_its_distance_transform`, `glass_cut_tests::what_the_shape_depends_on_works_it_out_again_and_nothing_else_does`. Numbers unchanged |
+| 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it and 0.6 as much on the opposite side, with a faint gradient across the curve, 5% darker facing the light and lighter opposite (it was a glow mixed towards white, as deep as `splay` made it). `splay` turns the bend from along the edge's normal towards the way away from the layer's centre, as the reference tool's does, and no longer widens the light: files with a splay above 0 look different. The direction to the centre is worked out in the shape's own frame, so cut renders match. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Numbers unchanged |
+| 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile: most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in, and a fifth as much on the bevel itself (it fell off as the square of the way in from the very edge). Dispersion splits the channels over 8 steps with a triangular window, red moving furthest and blue least, as far apart as the reference tool's (at 100% red and blue move 0.16 of the bend apart; it was three samples, blue furthest), and `Glass::max_bend` bounds red's furthest step, so the backdrop read around a pane covers every sample. Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Numbers unchanged |
+| 2026-11-02 | minor | M3, #1885: glass effects take variables (light angle, intensity, refraction, depth, dispersion, frost and splay, on layers and in effect styles, and from the Design panel's glass fields), and a glass's frost stays within 0–100, the reference tool's range: a larger frost from an older file draws at 100, and the field, a bound variable and scaling stop there. Numbers unchanged |
 | 2026-10-31 | minor | M12: as the help describes, holding Cmd/Ctrl while moving a connector's end places it on any part of an object instead of snapping to a side. It keeps that spot as a fraction of the object's box, so it follows the object when it moves or resizes, and without the key an end snaps as before. `board.connector {fromAt, toAt}` and `board.reattach {at}` take it; saved only when set. Numbers unchanged |
 | 2026-10-31 | patch | M11: a trackpad or touch tap sends its press and release in one frame, so a plugin panel's field committed in the frame its button was clicked and the value was lost: the Counter's Set count… kept the old count. The plugin now gets both, the field's value first. The `window.figcraft` docs name `screenshot`'s `data`. Numbers unchanged |
 | 2026-10-31 | patch | M4: Dash and Custom strokes have a Dash cap (None, Round, Square) in the advanced stroke settings and `node.set {dashCap}`, on both ends of every dash on the canvas and in PNG, PDF and SVG. Unset, dashes keep taking the end point caps, so older files look the same; the saved file writes it only when set. Numbers unchanged |
@@ -499,6 +499,7 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
 | 2026-10-27 | minor | Placed images keep their own size (M7, #1360): dropping, Place image, paste and `image.place` put an image at its pixel size and fit only a side past 4096 px (they fitted it into 1000 px); a PNG whose `pHYs` records a whole 2x–4x multiple of 72 dpi (macOS screenshots record 144 dpi) is placed at its point size, so an 800 × 600 px capture comes in at 400 × 300; other densities, such as 300 dpi scans, keep their pixel size; the image data stays at full resolution and an explicit width or height still wins. On macOS, paste reads the clipboard's PNG as is (its density and colour profile kept) and falls back to the decoded image. Numbers unchanged |
 | 2026-10-26 | minor | Non-ASCII layer names transliterate in code export (M6, #1235): `class_name` transliterates through the new `deunicode` dependency (pure Rust tables, zero deps, BSD-3-Clause), so Korean, Cyrillic, Latin-diacritic and CJK names become readable ASCII classes (`rogeuin-hwamyeon`, `knopka`, `uber`, `an-niu`) in HTML/CSS/React/Leptos output, component roots and `data-*` variant attributes; symbols-only names take the node's kind (`.text`) instead of `layer-`, and the 40-character cut lands on a word boundary. `html_codegen_tests` updated and extended. Numbers unchanged |
 | 2026-10-25 | minor | M6, #1143: offline Penpot 2.x open/import/export through the editor, CLI and MCP using the existing document model. Unsupported layout settings retain saved positions and bounded source metadata with warnings; font binaries and toggle-overlay are reported, and provider fonts are never downloaded. Shared ZIP/JSON/token budgets guard untrusted input. Figma parity numbers unchanged. |
+| 2026-10-26 | minor | Web host bridge: `?host=parent` (a same-origin page embedding FigCraft in an iframe) or `data-host="page"` on the canvas (the page's own document, over non-bubbling `CustomEvent`s) opens the host's file like File ▸ Open and takes every file the app would otherwise download, with `figcraft:ready`, `figcraft:open`, `figcraft:save` (a `saveAs` rule), `figcraft:dirty` and `figcraft:failed`; `?author=` names the user for comments and board notes; documented in the hosting guide. Numbers unchanged |
 | 2026-10-25 | minor | egui 0.37 capture lifecycle: screenshots with hidden or unknown visibility queue, request a hidden paint, and expire after 60 seconds if no capture arrives (headless-tested contract). Logic-only edits, saves and inspection continue while hidden. Native visible GUI and forced hidden-window paint, browser and Wayland behavior remain unqualified; parity percentages are unchanged. |
 | 2026-10-24 | minor | Server memory (#1134): when the last person leaves a file nobody edited, figcraft-server keeps the client ids it issued in the log instead of rewriting the snapshot (compaction still follows `compact_after`/`compact_mb` and edits), and a snapshot is encoded straight into its file buffer, without a second copy of the body; the file format is unchanged. Numbers unchanged |
 | 2026-10-24 | minor | Boards (M12): a dot grid on board pages under the layers, connector ends dragged onto other objects or empty canvas (`board.reattach`), curved connectors, elbows that go around what they join. Boards row ~35% → ~37%, ~20% → ~21%, 30–60 h → 28–56 h; headline numbers unchanged (boards are outside the weighted sum) |

apps/figcraft-web/Cargo.toml

@@ -19,6 +19,8 @@ figcraft-format = { workspace = true }
 figcraft-ui-egui = { workspace = true }
 figcraft-collab-net = { workspace = true }
 figcraft-text = { workspace = true }
+# The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
+craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "2e2312ddaf21bc3d85cd3395d0955c7d239306f6", version = "0.1.0" }
 base64 = { workspace = true }
 egui = { workspace = true }
 log = { workspace = true }
@@ -30,4 +32,4 @@ eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
 wasm-bindgen = "0.2"
 js-sys = "0.3"
 wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType", "Storage", "Event", "MessageEvent", "UrlSearchParams", "CustomEvent", "CustomEventInit"] }

apps/figcraft-web/src/host.rs

@@ -0,0 +1,143 @@
+//! Host modes: a page that runs FigCraft (as an `<iframe>`, or in its own document) opens
+//! documents in it and stores what it saves instead of the browser downloading. The messages
+//! and the two transports are `craft-web-host`'s (storytold/craft-libs): the same contract as
+//! the other Craft apps' bridges. This module is FigCraft's part of it.
+//!
+//! - `?host=parent` (an `<iframe>`, such as a Nextcloud app) talks to the same-origin parent over
+//!   `postMessage`; `data-host="page"` on the canvas (the page's own document) uses DOM
+//!   `CustomEvent`s on the canvas instead. `?host=parent` wins when both are present.
+//! - `figcraft:ready` (to the host) once the app is running and listening; send a file now.
+//! - `figcraft:open` (from the host): `{ name, bytes }`. It opens exactly as a file picked with
+//!   File › Open or dropped on the window would (the app's own open queue, with its "Opening as
+//!   a new file" card). A payload over the browser's own open limit
+//!   ([`figcraft_ui_egui::browser_can_read`]'s 512 MB) is refused before its bytes are copied,
+//!   and anything malformed is ignored. FigCraft reads whole files, so it says `file: false` in
+//!   `ready` and a host sends `bytes`.
+//! - `figcraft:save` (to the host): `{ name, saveAs, bytes }` for every file the app hands its
+//!   download service; in host mode nothing reaches the browser's downloads. `saveAs` says whether
+//!   the file becomes the document's file ([`crate::hostmode::save_as`]):
+//!   - A Save of the file the host opened, under its own name: `false`.
+//!   - A document file (`.figcraft` or `.json`, the formats `file.save` and `file.saveAs` write)
+//!     under a name the host didn't open — Save As, or a Save of a document the host never sent
+//!     (an untitled one): `true`. It becomes the document's file; the next Save sends its name
+//!     with `false`. Names compare without case.
+//!   - Everything else is a copy or export that never becomes the document: `false` — rendered
+//!     images, SVG and PDF, `.fig` copies, and the variables exports (a `.variables.json`
+//!     sidecar's `.json` extension doesn't make it a document).
+//! - `figcraft:dirty` whenever unsaved changes appear or go away, `figcraft:failed` when the app
+//!   couldn't start.
+//!
+//! In host mode the app starts with no document (the home screen) and the host sends the file to
+//! edit; `?author=` names the user for comments and board notes.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use craft_web_host::web::{FileData, Host, Message};
+use figcraft_ui_egui::FigApp;
+
+/// The app id in the host messages (`figcraft:ready`).
+const APP: &str = "figcraft";
+
+/// The longest user name taken from `?author=`.
+const MAX_AUTHOR_CHARS: usize = 200;
+
+/// Files the host sent, on their way to the app's own open queue ([`figcraft_ui_egui::pending_open`]):
+/// `(name, bytes)`.
+pub type OpenQueue = Rc<RefCell<Vec<(String, Vec<u8>)>>>;
+
+#[derive(Clone)]
+pub struct Bridge {
+    host: Rc<Host>,
+    /// The file the host opened, and after a `saveAs` hand-over the document's file: the name a
+    /// Save under (`saveAs: false`) is decided against.
+    host_file: Rc<RefCell<Option<String>>>,
+}
+
+impl Bridge {
+    /// The bridge for this page, or `None` when FigCraft isn't hosted: no `?host=parent` and no
+    /// `data-host="page"` on the canvas, an unframed `?host=parent` page (it stays the normal app
+    /// with downloads), or a parent on another origin.
+    pub fn connect(canvas: &web_sys::HtmlCanvasElement) -> Option<Self> {
+        Some(Self { host: Rc::new(Host::connect(APP, canvas)?), host_file: Rc::default() })
+    }
+
+    /// Hear the files the host sends, and queue each one on `opens` for the app's own open path
+    /// (the shell drains it into [`figcraft_ui_egui::pending_open`] every frame, so a host file
+    /// opens like a dropped one).
+    pub fn listen(&self, opens: OpenQueue, ctx: egui::Context) {
+        let host_file = self.host_file.clone();
+        self.host.listen(move |message| {
+            if let Message::Open { name, data } = message {
+                deliver_open(&opens, &ctx, &host_file, &name, &data);
+            }
+        });
+    }
+
+    /// `?author=`: the host's name for the user signs comments and board notes.
+    pub fn set_author(app: &mut FigApp, author: &str) {
+        let author: String = author.trim().chars().take(MAX_AUTHOR_CHARS).collect();
+        if !author.is_empty() {
+            app.session.prefs.user_name = author;
+        }
+    }
+
+    pub fn post_ready(&self) {
+        let _ = self.host.post_ready(env!("CARGO_PKG_VERSION"), false);
+    }
+
+    /// The app couldn't start (no WebGPU or WebGL2, for example): let the host say so.
+    pub fn post_failed(&self, error: &str) {
+        let _ = self.host.post_failed(error, None);
+    }
+
+    /// The document file the host opened or the last Save As made, if any.
+    pub fn host_file(&self) -> Option<String> {
+        self.host_file.borrow().clone()
+    }
+
+    /// Hand a file the app would otherwise download to the host; `false` when nothing was
+    /// delivered. The `saveAs` rule is this module's documentation's.
+    pub fn post_save(&self, path: &str, bytes: &[u8]) -> bool {
+        let name = file_name(path);
+        let host_file = self.host_file.borrow().clone();
+        let save_as = crate::hostmode::save_as(&name, host_file.as_deref());
+        let sent = self.host.post_save(&name, bytes, None, save_as).is_ok();
+        // After a Save As hand-over the host has the new file: the next Save of it sends its name
+        // with `saveAs: false`. A failed send changes nothing, so a retry is still a Save As.
+        if sent && save_as {
+            *self.host_file.borrow_mut() = Some(name);
+        }
+        sent
+    }
+
+    /// Report unsaved changes when they appear or go away, not every frame (the crate does not
+    /// repeat a state it already reported).
+    pub fn set_dirty(&self, dirty: bool) {
+        self.host.post_dirty(dirty);
+    }
+}
+
+/// The file an open message carries, queued for the app's own open path, or nothing when the
+/// payload isn't one (a `File` the app doesn't read, or over the open limit).
+fn deliver_open(opens: &OpenQueue, ctx: &egui::Context, host_file: &RefCell<Option<String>>, name: &str, data: &FileData) {
+    let name = crate::hostmode::open_name(name);
+    let FileData::Bytes(array) = data else {
+        log::warn!("host file {name} came as a File; FigCraft reads bytes only; not opened");
+        return;
+    };
+    if figcraft_ui_egui::browser_can_read(&name, data.size()).is_err() {
+        log::warn!("host file {name} is too large to open in the browser; not opened");
+        return;
+    }
+    // The document's file is now the one the host sent: a Save of it under this name is
+    // `saveAs: false`.
+    *host_file.borrow_mut() = Some(name.clone());
+    opens.borrow_mut().push((name, array.to_vec()));
+    ctx.request_repaint();
+}
+
+/// The last component of `path`, or the whole of it when there is none.
+fn file_name(path: &str) -> String {
+    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string())
+}

apps/figcraft-web/src/hostmode.rs

@@ -0,0 +1,92 @@
+//! Pure host-mode rules, shared by the bridge ([`crate::host`]) and testable without a browser
+//! (like [`crate::query`]): the name the bridge fills in when an open request has none, and whether
+//! a handed-over file becomes the document's file. Which pages host the app is `craft-web-host`'s.
+
+/// The file name used when an open request carries no usable one.
+pub const DEFAULT_OPEN_NAME: &str = "Untitled.figcraft";
+
+/// The extensions of files that can be a document's own file: the formats `file.save` and
+/// `file.saveAs` write (`file.open` opens both as native documents). A `.fig` file is an export
+/// copy instead, and so is everything else the app hands over (rendered images, SVG, PDF,
+/// variables).
+const DOC_EXTS: &[&str] = &["figcraft", "json"];
+
+/// The suffix `variable.export`'s downloads carry: a `.json` that is a variables sidecar, not a
+/// document, so its extension alone can't tell the `saveAs` decision.
+const VARIABLES_SIDECAR: &str = ".variables.json";
+
+/// The name `craft-web-host` gives an open request that carries no usable one (it cleans a host's
+/// name and falls back to this).
+const NAMELESS: &str = "document";
+
+/// A usable file name for an open request: the cleaned name the crate hands over, or
+/// [`DEFAULT_OPEN_NAME`] when the host sent none.
+pub fn open_name(name: &str) -> String {
+    if name == NAMELESS { DEFAULT_OPEN_NAME.to_string() } else { name.to_string() }
+}
+
+/// Whether the file `name` becomes the document's own file when handed over (`saveAs: true`),
+/// given the file the host opened (`None`: the host never sent one). The rule:
+///
+/// - A document file (`.figcraft` or `.json`, [`DOC_EXTS`]'s formats) under a name the host didn't
+///   open — Save As, or a Save of a document the host never sent — is the document's new file:
+///   `true`. Names compare without case.
+/// - A Save of the host's own file under its name is not: `false`.
+/// - Everything else is a copy or export that never becomes the document — rendered images, SVG,
+///   PDF, `.fig` copies, variables — and the variables sidecar counts as one whatever its `.json`
+///   extension says: `false`.
+pub fn save_as(name: &str, host_file: Option<&str>) -> bool {
+    if name.to_ascii_lowercase().ends_with(VARIABLES_SIDECAR) {
+        return false;
+    }
+    let ext = std::path::Path::new(name).extension().and_then(std::ffi::OsStr::to_str);
+    if !ext.is_some_and(|e| DOC_EXTS.iter().any(|x| x.eq_ignore_ascii_case(e))) {
+        return false;
+    }
+    match host_file {
+        Some(host) => !host.eq_ignore_ascii_case(name),
+        None => true,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn open_names_fall_back_to_the_default_when_the_host_sent_none() {
+        assert_eq!(open_name("Poster.figcraft"), "Poster.figcraft");
+        assert_eq!(open_name("Poster 2.json"), "Poster 2.json");
+        assert_eq!(open_name("document"), DEFAULT_OPEN_NAME, "what the crate says for a missing or blank name");
+    }
+
+    #[test]
+    fn a_save_of_the_host_s_file_is_not_save_as() {
+        assert!(!save_as("Poster.figcraft", Some("Poster.figcraft")));
+        assert!(!save_as("poster.FIGCRAFT", Some("Poster.figcraft")), "names compare without case");
+        assert!(!save_as("design.json", Some("design.json")));
+    }
+
+    #[test]
+    fn a_new_document_file_is_save_as() {
+        assert!(save_as("Poster 2.figcraft", Some("Poster.figcraft")));
+        assert!(save_as("Poster.json", Some("Poster.figcraft")), "the other format a document's file takes");
+        assert!(save_as("Untitled.figcraft", None), "the host never sent a file");
+        assert!(save_as("Poster.figcraft", Some("design.json")), "the opened .json saved as .figcraft is a new file");
+    }
+
+    #[test]
+    fn copies_and_exports_never_become_the_document_s_file() {
+        for name in ["Poster.png", "Poster@2x.jpg", "Poster.svg", "Poster.pdf", "Poster.fig", "Poster.csv", "Poster.variables.css"] {
+            assert!(!save_as(name, Some("Poster.figcraft")), "{name} is a copy");
+            assert!(!save_as(name, None), "{name} is a copy even without a host file");
+        }
+    }
+
+    #[test]
+    fn the_variables_sidecar_is_a_copy_whatever_its_extension() {
+        assert!(!save_as("Poster.variables.json", Some("Poster.figcraft")));
+        assert!(!save_as("Poster.variables.json", None));
+        assert!(!save_as("design.variables.json", Some("design.variables.json")));
+    }
+}

apps/figcraft-web/src/main.rs

@@ -19,9 +19,17 @@
 //!   server…), but can't host a session. A page served over `https://` reaches only `wss://`
 //!   servers and the same computer (browsers block `ws://` from secure pages); serve it over
 //!   `http://` on a trusted network to reach plain `ws://` hosts on other machines.
+//! - host mode: `?host=parent` (a same-origin page embedding FigCraft in an `<iframe>`) or
+//!   `data-host="page"` on the canvas (the page's own document) hands the page the app's files
+//!   instead of downloading them and reports unsaved changes (`host`);
+//! - live sessions: it joins sessions a desktop app hosts (File ▸ Join live session…) but can't
+//!   host one. A page served over `https://` can only reach sessions on the same computer
 //!
 //! URL query flags: `?webgl` forces the WebGL2 backend instead of WebGPU; `?control` installs
-//! `window.figcraft`, the page's control channel (`api.rs`), which is off without it.
+//! `window.figcraft`, the page's control channel (`api.rs`), which is off without it; `?host=parent`
+//! (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the document to open
+//! and stores what FigCraft saves. `&author=` names the user for comments and board notes in either
+//! host mode.
 //!
 //! URL fragment: `#join=<invite link or join code>` joins that live session once the page has
 //! loaded, so a bookmark opens a shared file. `join` takes the rest of the fragment: put it last.
@@ -30,6 +38,10 @@
 
 #[cfg(target_arch = "wasm32")]
 mod api;
+#[cfg(target_arch = "wasm32")]
+mod host;
+#[cfg(any(target_arch = "wasm32", test))]
+mod hostmode;
 #[cfg(any(target_arch = "wasm32", test))]
 mod kept;
 #[cfg(target_arch = "wasm32")]

apps/figcraft-web/src/web.rs

@@ -32,6 +32,15 @@ pub fn start() {
             log::error!("missing <canvas id=\"{CANVAS_ID}\">");
             return;
         };
+        // Host modes (`craft-web-host`): `?host=parent`, a same-origin page framing FigCraft, opens
+        // documents in it and stores what it saves (`host`); unframed there is no parent, so that URL
+        // on its own stays the normal app with downloads. `data-host="page"` on the canvas opts a
+        // page in instead: it runs FigCraft in its own document and talks over DOM `CustomEvent`s on
+        // the canvas.
+        let bridge = crate::host::Bridge::connect(&canvas);
+        let app_bridge = bridge.clone();
+        // Files the host sends, on their way into the app's own open queue each frame.
+        let opens: crate::host::OpenQueue = std::rc::Rc::default();
         let mut options = eframe::WebOptions::default();
         // `?webgl`: force the WebGL2 backend (troubleshooting, and headless browsers whose WebGPU
         // adapter request returns nothing).
@@ -44,12 +53,15 @@ pub fn start() {
             .start(
                 canvas,
                 options,
-                Box::new(|cc| {
+                Box::new(move |cc| {
                     if let Some(rs) = &cc.wgpu_render_state {
                         log::info!("figcraft-web: wgpu backend {:?}", rs.adapter.get_info().backend);
                     }
                     let reduce_motion = web_sys::window().and_then(|w| w.match_media("(prefers-reduced-motion: reduce)").ok().flatten());
-                    let mut session = Session::new();
+                    // Host mode: the host sends the file to edit, so start with no document (the
+                    // home screen), as the desktop app does without a file; otherwise the session
+                    // starts with one new document.
+                    let mut session = if app_bridge.is_some() { Session::empty() } else { Session::new() };
                     // The host names its own server: the default for sharing, codes and the team list.
                     if let Some(server) = page_meta("figcraft-server").as_deref().and_then(crate::query::page_server) {
                         session.prefs.publish_server = server;
@@ -60,11 +72,18 @@ pub fn start() {
                     // whatever arrives on the socket wakes the page for a frame.
                     let ctx = cc.egui_ctx.clone();
                     session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint()))));
-                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+                    let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone(), host: app_bridge.clone() }));
                     fig.note_recovered(recovered);
                     if let Err(e) = crate::pasted::install(cc.egui_ctx.clone()) {
                         log::error!("couldn't listen for pasted images: {e:?}");
                     }
+                    // `?author=`: the host's name for the user signs this visit's comments and board
+                    // notes (nothing is stored in the browser, so nothing needs keeping).
+                    if app_bridge.is_some()
+                        && let Some(author) = query_param("author")
+                    {
+                        crate::host::Bridge::set_author(&mut fig, &author);
+                    }
                     // `#join=<link>`: join that session, as opening an invite link does on the desktop.
                     let hash = web_sys::window().and_then(|w| w.location().hash().ok()).unwrap_or_default();
                     if let Some(link) = crate::query::join_link(&hash) {
@@ -78,10 +97,21 @@ pub fn start() {
                             log::error!("couldn't install window.figcraft: {e:?}");
                         }
                     }
-                    Ok(Box::new(WebShell { fig }))
+                    // The host's files arrive on the app's own open path (a dropped file's).
+                    if let Some(bridge) = &app_bridge {
+                        bridge.listen(opens.clone(), cc.egui_ctx.clone());
+                    }
+                    Ok(Box::new(WebShell { fig, host: app_bridge, opens }))
                 }),
             )
             .await;
+        // Ready only once the runner is up: starting can still fail after the app is made.
+        if let Some(bridge) = &bridge {
+            match &result {
+                Ok(()) => bridge.post_ready(),
+                Err(e) => bridge.post_failed(&format!("{e:?}")),
+            }
+        }
         if let Some(el) = document.get_element_by_id(LOADING_ID) {
             match result {
                 Ok(()) => el.remove(),
@@ -141,20 +171,45 @@ fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
+fn query_param(key: &str) -> Option<String> {
+    web_sys::UrlSearchParams::new_with_str(&query()).ok()?.get(key)
+}
+
 struct WebShell {
     fig: FigApp,
+    /// The host bridge, when the page hosts the app (`?host=parent` or `data-host="page"`).
+    host: Option<crate::host::Bridge>,
+    /// Files the host sent, waiting to join the app's own open queue.
+    opens: crate::host::OpenQueue,
 }
 
 impl eframe::App for WebShell {
     // eframe runs `logic` for visible tabs and, with only `run_logic`, for hidden ones: keep
     // autosave/live/control deadlines moving without a paint. `FigApp::ui` does not repeat it.
-    /// Run the browser shell's eframe logic callback: guard `background_tick` so hidden tabs
-    /// still advance autosave, live and control deadlines without painting. `FigApp::ui` does
+    /// Run the browser shell's eframe logic callback: hand the host's files to the app's open
+    /// queue, guard `background_tick` so hidden tabs still advance autosave, live and control
+    /// deadlines without painting, and report unsaved changes to the host. `FigApp::ui` does
     /// not repeat it.
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         // Every frame, hidden or not, starts here: what the last one left is what a panic keeps.
         UNSAVED.with(|u| u.try_borrow_mut().map(|mut u| u.follow(&self.fig.session))).ok();
+        // Files the host sent join the app's own open queue (a dropped file's): the same
+        // "Opening as a new file" card, and `file.open` with the contents once read.
+        for (name, bytes) in std::mem::take(&mut *self.opens.borrow_mut()) {
+            let read: figcraft_ui_egui::ReadFuture = Box::pin(std::future::ready(Ok(bytes)));
+            self.fig.ui.pending_opens.push(figcraft_ui_egui::pending_open::PendingOpen {
+                label: name.clone(),
+                params: serde_json::json!({ "name": name }),
+                command: "file.open",
+                target: None,
+                read: Some(read),
+            });
+        }
         figcraft_ui_egui::windows::guard(&mut self.fig, ctx, |fig| fig.background_tick(ctx));
+        // The host hears when unsaved changes appear or go away (crate::host).
+        if let Some(bridge) = &self.host {
+            bridge.set_dirty(self.fig.session.docs.iter().any(|d| d.is_dirty()));
+        }
     }
 
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
@@ -182,12 +237,15 @@ impl eframe::App for WebShell {
 
 /// Browser services. Files are opened and imported through the browser's file picker, which hands
 /// over their contents (pickers that need a path return nothing, the trait's defaults); files are
-/// saved as downloads. Copies go to the system clipboard through egui's output; pastes arrive as
-/// paste events with their text or image (a page can't read the clipboard when it likes).
+/// saved as downloads, or handed to the host page in host mode. Copies go to the system clipboard
+/// through egui's output; pastes arrive as paste events with their text or image (a page can't
+/// read the clipboard when it likes).
 struct WebServices {
     /// `prefers-reduced-motion: reduce` (it follows the setting while the page is open).
     reduce_motion: Option<web_sys::MediaQueryList>,
     ctx: egui::Context,
+    /// The host bridge in host mode: files are handed over instead of downloaded ([`crate::host`]).
+    host: Option<crate::host::Bridge>,
 }
 
 impl Services for WebServices {
@@ -204,11 +262,15 @@ impl Services for WebServices {
     fn downloads(&self) -> bool {
         true
     }
-    /// A Blob behind a temporary `<a download>` link, clicked and removed.
+    /// A Blob behind a temporary `<a download>` link, clicked and removed; in host mode the file
+    /// goes to the host page instead ([`crate::host`]).
     fn download(&mut self, name: &str, bytes: &[u8]) -> bool {
         if crate::api::capture(name, bytes) {
             return true;
         }
+        if let Some(bridge) = &self.host {
+            return bridge.post_save(name, bytes);
+        }
         match download(name, bytes) {
             Ok(()) => true,
             Err(e) => {
@@ -217,6 +279,9 @@ impl Services for WebServices {
             }
         }
     }
+    fn host_file(&self) -> Option<String> {
+        self.host.as_ref()?.host_file()
+    }
     fn clipboard_set_text(&mut self, s: &str) {
         figcraft_ui_egui::egui_copy_text(&self.ctx, s);
     }

apps/figcraft/src/recovery_online_tests.rs

@@ -77,6 +77,7 @@ fn root(name: &str) -> PathBuf {
     r
 }
 
+/// What the scripted link says about the session it is in.
 fn info() -> SessionInfo {
     SessionInfo {
         role: Role::Guest,
@@ -90,6 +91,7 @@ fn info() -> SessionInfo {
         address: SERVER.into(),
         network: true,
         access: Access::Edit,
+        view: None,
     }
 }
 

contributors/people.toml

@@ -101,3 +101,6 @@ sync_github_name = true
 
 [people.aleksei-suholita]
 real_name = "Oleksii Sukholita"
+
+[people.helenkwok]
+real_name = "Helen Kwok"

crates/collab-net/src/code_tests.rs

@@ -1,9 +1,9 @@
-//! Join codes over the network: a file shared on the local network joined by its code (two
-//! engine sessions over loopback), what the browser's driver does with an online code, a server
+//! Join codes over the network: a file shared on the local network joined by its code, and by
+//! its view-only code to look without editing (engine sessions over loopback), what the browser's driver does with an online code, a server
 //! older than join codes, and the links that name a code. (A `figcraft-server` handing codes out
 //! and resolving them is tested in its own crate, with the same link.)
 
-use std::net::{Ipv4Addr, TcpListener};
+use std::net::{IpAddr, Ipv4Addr, SocketAddr, TcpListener};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -18,8 +18,9 @@ use crate::driver::{Driver, Socket};
 use crate::guest::GuestConfig;
 use crate::inbox::Inbox;
 use crate::invite::{Endpoint, Invite, Lookup};
+use crate::link::reachable;
 use crate::loopback_tests::{fast_limits, quick};
-use crate::{NetLink, manage};
+use crate::{NetLink, lan_ip, manage};
 
 fn session(name: &str) -> Session {
     let mut s = Session::new();
@@ -53,6 +54,7 @@ fn layers(s: &Session) -> usize {
     s.doc().map_or(0, |d| d.node_count())
 }
 
+/// A local network share's code joins its session from another app, and edits sync both ways.
 #[test]
 fn a_local_share_is_joined_by_its_code_and_edits_sync() {
     let (mut host, mut guest) = (session("Hana"), session("Ada"));
@@ -65,7 +67,13 @@ fn a_local_share_is_joined_by_its_code_and_edits_sync() {
     assert_eq!(local.ip, Ipv4Addr::LOCALHOST);
     assert_eq!(shared["address"], format!("127.0.0.1:{}", local.port));
     assert_eq!(shared["link"], local.link(), "the code and the invite link name the same session");
-    assert!(shared["share"]["viewCode"].is_null(), "everyone edits on the local network");
+    // A view-only code too, with its own secret, and no comment code.
+    let view = shared["share"]["viewCode"].as_str().unwrap();
+    let Code::Local(viewing) = code::parse(view).unwrap() else { panic!("not a local code") };
+    assert_eq!((viewing.ip, viewing.port), (local.ip, local.port), "the same session");
+    assert_ne!(viewing.secret, local.secret, "a secret of its own");
+    assert_eq!(shared["share"]["viewLink"], viewing.link());
+    assert!(shared["share"]["commentCode"].is_null());
     // Typed the way people type: lower case, spaces for the dashes.
     let typed = shown.to_lowercase().replace('-', " ");
     assert_eq!(guest.execute("collab.join", &json!({"code": typed})).unwrap()["status"], "connecting");
@@ -93,6 +101,8 @@ fn a_local_share_is_joined_by_its_code_and_edits_sync() {
     assert!(label.contains("Couldn't join") || label.contains("The host refused"), "{label}");
 }
 
+/// A well-formed code with the wrong secret is refused by the host, a mistyped one never connects,
+/// and there is no comment code on the local network.
 #[test]
 fn a_local_code_with_the_wrong_secret_or_a_typo_doesnt_join() {
     let (mut host, mut guest) = (session("Hana"), session("Ada"));
@@ -112,11 +122,120 @@ fn a_local_code_with_the_wrong_secret_or_a_typo_doesnt_join() {
     *last = if *last == 'A' { 'B' } else { 'A' };
     let e = guest.execute("collab.join", &json!({"code": typo.iter().collect::<String>()})).unwrap_err().to_string();
     assert!(e.contains("typing mistake"), "{e}");
-    // A view-only code doesn't exist here, and says where it does.
-    let e = host.execute("collab.share", &json!({"access": "view"})).unwrap_err().to_string();
+    // A comment code doesn't exist here, and says where it does.
+    let e = host.execute("collab.share", &json!({"access": "comment"})).unwrap_err().to_string();
     assert!(e.contains("share it online"), "{e}");
 }
 
+/// A local network share started for looking only shows its view code: whoever joins with it sees
+/// every change and can't make one, the edit code (picked later) still edits, and stopping ends
+/// both.
+#[test]
+fn a_local_view_code_lets_people_look_and_not_edit() {
+    let (mut host, mut viewer, mut editor) = (session("Hana"), session("Ada"), session("Bo"));
+    let shared = host.execute("collab.share", &json!({"via": "local", "bind": "local", "access": "view"})).unwrap();
+    assert_eq!(shared["share"]["access"], "view");
+    let (shown, edit) = (shared["code"].as_str().unwrap().to_string(), shared["share"]["editCode"].as_str().unwrap().to_string());
+    assert_eq!(shared["share"]["viewCode"], shown, "the code shown is the view code");
+    assert_ne!(shown, edit);
+    viewer.execute("collab.join", &json!({"code": shown})).unwrap();
+    pump(&mut [&mut host, &mut viewer], "the viewer's join", |s| live(s[1]) && s[0].live().peers.len() == 1);
+    let summary = viewer.live_summary();
+    assert_eq!((&summary["access"], &summary["readOnly"]), (&json!("view"), &json!(true)));
+    // The host's edit reaches the viewer; the viewer's is refused before it leaves.
+    let before = layers(&host);
+    host.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 40, "height": 30})).unwrap();
+    pump(&mut [&mut host, &mut viewer], "the host's edit", |s| layers(s[1]) == before + 1);
+    let e = viewer.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap_err().to_string();
+    assert!(e.contains("View only"), "{e}");
+    // The edit code, picked now, still edits, and the viewer sees it.
+    assert_eq!(host.execute("collab.share", &json!({"access": "edit"})).unwrap()["code"], edit);
+    editor.execute("collab.join", &json!({"code": edit})).unwrap();
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the editor's join", |s| live(s[2]) && s[0].live().peers.len() == 2);
+    assert_eq!(editor.live_summary()["access"], "edit");
+    editor.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap();
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the editor's edit", |s| layers(s[0]) == before + 2 && layers(s[1]) == before + 2);
+    assert_eq!(viewer.live_summary()["readOnly"], true, "picking the edit code changes nothing for who joined to look");
+    assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the end", |s| !s[1].live().status.active() && !s[2].live().status.active());
+}
+
+/// A local network share's `link` and `url` are the ones that go with the code shown: started for
+/// looking only, whoever joins through either can't edit, and the session's line in `sessions`
+/// says the same.
+#[test]
+fn a_local_view_share_s_link_and_url_only_let_people_look() {
+    let mut host = session("Hana");
+    let shared = host.execute("collab.share", &json!({"via": "local", "bind": "local", "access": "view"})).unwrap();
+    for key in ["link", "url"] {
+        let way = shared[key].as_str().unwrap().to_string();
+        let mut viewer = session("Ada");
+        viewer.execute("collab.join", &json!({"link": way})).unwrap();
+        pump(&mut [&mut host, &mut viewer], "the join", |s| live(s[1]) && s[0].live().peers.len() == 1);
+        let summary = viewer.live_summary();
+        assert_eq!((&summary["access"], &summary["readOnly"]), (&json!("view"), &json!(true)), "joined with {key} {way}");
+        let before = layers(&host);
+        let e = viewer.execute("shape.ellipse", &json!({"x": 80, "y": 10, "width": 40, "height": 30})).unwrap_err().to_string();
+        assert!(e.contains("View only"), "{key}: {e}");
+        host.execute("shape.rectangle", &json!({"x": 10, "y": 10, "width": 40, "height": 30})).unwrap();
+        pump(&mut [&mut host, &mut viewer], "the host's edit", |s| layers(s[1]) == before + 1);
+        assert_eq!(layers(&host), before + 1, "nothing of the viewer's reached the host ({key})");
+        viewer.execute("collab.leave", &json!({})).unwrap();
+        pump(&mut [&mut host, &mut viewer], "the leave", |s| s[0].live().peers.is_empty());
+    }
+    // The link, the URL and the code name the same way in, wherever the session is listed.
+    let Code::Local(local) = code::parse(shared["code"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
+    assert_eq!((&shared["link"], &shared["share"]["viewLink"]), (&json!(local.link()), &json!(local.link())));
+    let url = shared["url"].as_str().unwrap();
+    assert!(url.starts_with("ws://") && url.ends_with(&format!("&token={}", local.token())), "{url}");
+    assert_eq!(shared["sessions"][0]["link"], shared["link"]);
+    // Picking the edit code makes them the edit ones too.
+    let edit = host.execute("collab.share", &json!({"access": "edit"})).unwrap();
+    assert_eq!((&edit["link"], &edit["sessions"][0]["link"]), (&edit["share"]["editLink"], &edit["share"]["editLink"]));
+    let edit_token = edit["link"].as_str().unwrap().rsplit("token=").next().unwrap();
+    assert!(edit["url"].as_str().unwrap().ends_with(&format!("&token={edit_token}")), "{}", edit["url"]);
+    assert_ne!((&edit["link"], &edit["url"]), (&shared["link"], &shared["url"]));
+    assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
+}
+
+/// A share listening on every interface (`bind` 0.0.0.0) names where others reach it, never
+/// 0.0.0.0: this machine's local network address (loopback without one) in its codes, links, URL
+/// and address, and its view code and edit link both join it.
+#[test]
+fn a_share_on_every_interface_names_an_address_others_reach() {
+    let (mut host, mut viewer, mut editor) = (session("Hana"), session("Ada"), session("Bo"));
+    let shared = host.execute("collab.share", &json!({"via": "local", "bind": "0.0.0.0", "access": "view"})).unwrap();
+    let Code::Local(viewing) = code::parse(shared["code"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
+    let at = lan_ip().unwrap_or(Ipv4Addr::LOCALHOST.into());
+    assert_eq!(IpAddr::from(viewing.ip), at);
+    let address = format!("{at}:{}", viewing.port);
+    assert_eq!(shared["address"], address);
+    let Code::Local(editing) = code::parse(shared["share"]["editCode"].as_str().unwrap()).unwrap() else { panic!("not a local code") };
+    assert_eq!((editing.ip, editing.port), (viewing.ip, viewing.port));
+    for way in [&shared["link"], &shared["url"], &shared["share"]["viewLink"], &shared["share"]["editLink"], &shared["sessions"][0]["link"]] {
+        let way = way.as_str().unwrap_or_default();
+        assert!(way.contains(&address) && !way.contains("0.0.0.0"), "{way}");
+    }
+    viewer.execute("collab.join", &json!({"code": shared["code"]})).unwrap();
+    editor.execute("collab.join", &json!({"link": shared["share"]["editLink"]})).unwrap();
+    pump(&mut [&mut host, &mut viewer, &mut editor], "the joins", |s| live(s[1]) && live(s[2]) && s[0].live().peers.len() == 2);
+    assert_eq!((&viewer.live_summary()["access"], &editor.live_summary()["access"]), (&json!("view"), &json!("edit")));
+    assert_eq!(host.execute("collab.stop", &json!({})).unwrap()["ended"], true);
+}
+
+/// A listener on one address is reached at it; one on every interface at an address of its own
+/// family, on its port.
+#[test]
+fn a_listener_on_every_interface_is_reached_at_an_address_of_its_family() {
+    let one: SocketAddr = "192.168.1.20:47900".parse().unwrap();
+    assert_eq!(reachable(one), one);
+    for any in ["0.0.0.0:47900", "[::]:47901"] {
+        let any: SocketAddr = any.parse().unwrap();
+        let at = reachable(any);
+        assert!(!at.ip().is_unspecified() && at.is_ipv4() == any.is_ipv4() && at.port() == any.port(), "{any}: {at}");
+    }
+}
+
 /// An invite naming only `server` (what a join code is asked at).
 fn code_at(server: &Endpoint) -> Invite {
     Invite { server: server.clone(), file: String::new(), token: String::new() }

crates/collab-net/src/driver.rs

@@ -391,7 +391,7 @@ impl<S: Socket> Driver<S> {
         match after(outcome, &self.cfg, self.was_live, &mut self.attempt, &self.inbox) {
             Next::Stop(e) => {
                 if let Some(e) = e {
-                    self.inbox.push(e);
+                    self.inbox.push(*e);
                 }
                 self.done = true;
             }

crates/collab-net/src/driver_tests.rs

@@ -419,6 +419,8 @@ fn pump(d: &mut Driver<Loopback>) {
     }
 }
 
+/// The browser's driver joins a real host over loopback, edits with it, sends presence and hears
+/// the session end.
 #[test]
 fn joins_a_real_host_and_edits_with_it() {
     let host_probe = Inbox::new(Arc::new(|| {}));
@@ -428,6 +430,7 @@ fn joins_a_real_host_and_edits_with_it() {
             any_port_if_taken: false,
             file: FILE.into(),
             token: TOKEN.into(),
+            view_token: None,
             doc: shared(),
             name: "Hana".into(),
             limits: fast_limits(),

crates/collab-net/src/guest.rs

@@ -67,7 +67,7 @@ impl Guest {
                     });
                 if let Err(o) = asked.and_then(|(file, token)| resolved(&mut cfg, file, token)) {
                     if let Next::Stop(Some(e)) = after(unresolved(&cfg, o), &cfg, false, &mut 0, &inbox) {
-                        inbox.push(e);
+                        inbox.push(*e);
                     }
                     return;
                 }
@@ -217,7 +217,7 @@ fn supervise(cfg: &GuestConfig, inbox: &Inbox, rx: &Receiver<Cmd>, me: &Sender<C
         match after(outcome, cfg, was_live, &mut attempt, inbox) {
             Next::Stop(e) => {
                 if let Some(e) = e {
-                    inbox.push(e);
+                    inbox.push(*e);
                 }
                 return;
             }

crates/collab-net/src/host.rs

@@ -1,7 +1,8 @@
 //! The session host the app embeds: the shared [hub](crate::hub) serving one file, the one the
-//! app shares, with the session's single token. The person hosting is in it without a socket:
-//! their presence goes in with [`Host::presence`], their edits with [`Host::send`], what others do
-//! comes out through their [`Inbox`]. When the host stops, the session ends for everyone.
+//! app shares, with the session's edit token and, for a share that has one, its view token. The
+//! person hosting is in it without a socket: their presence goes in with [`Host::presence`], their
+//! edits with [`Host::send`], what others do comes out through their [`Inbox`]. When the host
+//! stops, the session ends for everyone.
 
 use std::io;
 use std::net::{SocketAddr, TcpListener};
@@ -26,6 +27,9 @@ pub struct HostConfig {
     /// The file's session id and secret (both in the invite).
     pub file: String,
     pub token: String,
+    /// A second secret that lets its holders look and not edit (`None`: everyone who gets in
+    /// edits). It must differ from `token`.
+    pub view_token: Option<String>,
     /// The shared document (the session's authoritative copy starts from it).
     pub doc: Document,
     /// The host's own name (empty: "Host").
@@ -40,21 +44,28 @@ pub struct Host {
     me: Peer,
 }
 
-/// The app's one file and its token: everyone with the invite edits.
+/// The app's one file and its tokens: whoever has the edit token edits, whoever has the view
+/// token only looks (the server refuses their changes).
 struct OneFile {
     file: String,
     token: String,
+    view: Option<String>,
 }
 
 impl Backend for OneFile {
+    /// Let in a hello for `file` with `token`, with what its token allows.
     fn admit(&mut self, file: &str, token: &str) -> Result<Admission, String> {
         if file != self.file {
             return Err("this invite is for another file or an earlier session".into());
         }
-        if !same_secret(token, &self.token) {
-            return Err("wrong session token".into());
+        // Both tokens are compared, whichever matches, so the time taken doesn't tell them apart.
+        let edit = same_secret(token, &self.token);
+        let view = self.view.as_deref().is_some_and(|v| same_secret(token, v));
+        match (edit, view) {
+            (true, _) => Ok(Admission { access: Access::Edit, link: None }),
+            (false, true) => Ok(Admission { access: Access::View, link: None }),
+            (false, false) => Err("wrong session token".into()),
         }
-        Ok(Admission { access: Access::Edit, link: None })
     }
 
     fn open(&mut self, _: &str) -> Result<Server, String> {
@@ -69,6 +80,10 @@ impl Backend for OneFile {
 impl Host {
     /// Listen and start the hub; the host joins its own session as the first person.
     pub fn start(cfg: HostConfig, inbox: Inbox) -> io::Result<Host> {
+        // A view token equal to the edit token would let its holders edit: nobody gets in with it.
+        if cfg.view_token.as_deref().is_some_and(|v| same_secret(v, &cfg.token)) {
+            return Err(io::Error::other("the view-only secret is the same as the edit secret"));
+        }
         let listener = match TcpListener::bind(cfg.addr) {
             Ok(l) => l,
             Err(e) if e.kind() == io::ErrorKind::AddrInUse && cfg.any_port_if_taken => TcpListener::bind(SocketAddr::new(cfg.addr.ip(), 0))?,
@@ -99,7 +114,7 @@ impl Host {
             }
         }
         let me = server.peers().find(|p| p.client_id == me).cloned().ok_or_else(|| io::Error::other("the host didn't join its own session"))?;
-        let backend = OneFile { file: cfg.file.clone(), token: cfg.token };
+        let backend = OneFile { file: cfg.file.clone(), token: cfg.token, view: cfg.view_token };
         let local = Local { file: cfg.file, server, id: me.client_id, inbox };
         let hosting = Hosting::start(listener, backend, cfg.limits, Some(local))?;
         Ok(Host { hosting, me })

crates/collab-net/src/join.rs

@@ -137,8 +137,9 @@ pub(crate) fn closed(code: u16, reason: &str) -> Outcome {
 
 /// What a guest does after a connection ended.
 pub(crate) enum Next {
-    /// Done: tell the UI this (nothing when you left).
-    Stop(Option<Event>),
+    /// Done: tell the UI this (nothing when you left). Boxed: an event can be large (a welcome),
+    /// and this one is only ever a status or the end of the session.
+    Stop(Option<Box<Event>>),
     /// Connect again after this pause (the UI has been told: `Reconnecting`).
     Reconnect(Duration),
 }
@@ -147,12 +148,12 @@ pub(crate) enum Next {
 /// can't reach the host; a live connection that dropped tries again with growing pauses until the
 /// attempts run out.
 pub(crate) fn after(outcome: Outcome, cfg: &GuestConfig, was_live: bool, attempt: &mut u32, inbox: &Inbox) -> Next {
-    let failed = |reason: String| Next::Stop(Some(Event::Status(Status::Failed { reason })));
+    let failed = |reason: String| Next::Stop(Some(Box::new(Event::Status(Status::Failed { reason }))));
     match outcome {
         Outcome::Left => Next::Stop(None),
         Outcome::Refused(why) => failed(format!("The host refused: {why}")),
         Outcome::Failed(why) => failed(why),
-        Outcome::Ended(reason) => Next::Stop(Some(Event::Ended { reason })),
+        Outcome::Ended(reason) => Next::Stop(Some(Box::new(Event::Ended { reason }))),
         Outcome::Retry(why) if !was_live => failed(format!("Couldn't join the live session: {why}")),
         Outcome::Retry(why) => {
             *attempt += 1;
@@ -228,6 +229,7 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 address: inv.server.display(),
                 network: !inv.loopback(),
                 access,
+                view: None,
             };
             seen.peers = peers.clone();
             seen.info = Some(info.clone());

crates/collab-net/src/link.rs

@@ -1,6 +1,6 @@
 //! [`NetLink`]: the engine's [`LiveLink`] over the network.
 
-use std::net::{IpAddr, Ipv4Addr, SocketAddr, UdpSocket};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, UdpSocket};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::Duration;
@@ -9,7 +9,7 @@ use figcraft_collab::code;
 use figcraft_collab::message::{Access, Admin, AdminReply, ClientMsg, LibraryReply, LibraryReq, PluginReply, PluginReq};
 use figcraft_engine::live::{
     Bind, Event, HostInfo, HostOptions, LiveLink, NO_SESSION, NetReply, NetRequest, PageInfo, Presence, PublishOptions, Published, Resume, Role,
-    SessionId, SessionInfo, Shared,
+    SessionId, SessionInfo, Shared, WayIn,
 };
 
 use crate::guest::{Guest, GuestConfig, Publish, upload_file};
@@ -97,24 +97,62 @@ impl NetLink {
     }
 }
 
+/// A new secret for a hosted session: one a join code can carry (`short`: 44 bits, see
+/// `figcraft_collab::code`), else a full one.
+fn session_secret(short: bool) -> Result<String, String> {
+    match short {
+        true => Ok(code::Local::new(Ipv4Addr::UNSPECIFIED, 0, token::random()?).token()),
+        false => token::secret(),
+    }
+}
+
+/// A view-only secret for a session whose edit secret is `edit`: of the same kind, never the same.
+fn view_secret(short: bool, edit: &str) -> Result<String, String> {
+    for _ in 0..3 {
+        let view = session_secret(short)?;
+        if view != edit {
+            return Ok(view);
+        }
+    }
+    Err("couldn't make a view-only secret".into())
+}
+
 /// This machine's address on the local network: the interface the default route leaves by (no
 /// packet is sent).
 pub fn lan_ip() -> Option<IpAddr> {
-    let sock = UdpSocket::bind(SocketAddr::from((Ipv4Addr::UNSPECIFIED, 0))).ok()?;
     // Documentation and private ranges: only the route matters.
-    for probe in ["192.0.2.1:9", "10.255.255.255:9"] {
-        if sock.connect(probe).is_ok()
-            && let Ok(a) = sock.local_addr()
-            && !a.ip().is_loopback()
-            && !a.ip().is_unspecified()
-        {
-            return Some(a.ip());
-        }
-    }
-    None
+    route_ip(Ipv4Addr::UNSPECIFIED.into(), &["192.0.2.1:9", "10.255.255.255:9"])
+}
+
+/// The address of `any`'s family that the route to the first of `probes` that has one leaves by
+/// (no packet is sent): never a loopback, unspecified or IPv6 link-local one, which others can't
+/// reach this machine at.
+fn route_ip(any: IpAddr, probes: &[&str]) -> Option<IpAddr> {
+    let sock = UdpSocket::bind(SocketAddr::new(any, 0)).ok()?;
+    probes.iter().find_map(|probe| {
+        sock.connect(probe).ok()?;
+        let ip = sock.local_addr().ok()?.ip();
+        let link_local = matches!(ip, IpAddr::V6(v6) if v6.is_unicast_link_local());
+        (!ip.is_loopback() && !ip.is_unspecified() && !link_local).then_some(ip)
+    })
+}
+
+/// Where others reach a session listening on `addr`: `addr` itself, or for a listener on every
+/// interface (`0.0.0.0`, `::`) this machine's local network address of the same family (its
+/// loopback without one), on the same port. Links name it; the listener keeps every interface.
+pub(crate) fn reachable(addr: SocketAddr) -> SocketAddr {
+    let ip = match addr.ip() {
+        ip if !ip.is_unspecified() => ip,
+        IpAddr::V4(_) => lan_ip().unwrap_or(Ipv4Addr::LOCALHOST.into()),
+        // Documentation and unique local ranges, as for IPv4.
+        IpAddr::V6(_) => route_ip(Ipv6Addr::UNSPECIFIED.into(), &["[2001:db8::1]:9", "[fd00::1]:9"]).unwrap_or(Ipv6Addr::LOCALHOST.into()),
+    };
+    SocketAddr::new(ip, addr.port())
 }
 
 impl LiveLink for NetLink {
+    /// Host the open file on `o.bind`: a join code's short secret when `o.short`, and a second,
+    /// view-only secret with its invite link when `o.view`.
     fn host(&mut self, session: SessionId, o: HostOptions) -> Result<SessionInfo, String> {
         let ip = match o.bind {
             Bind::Local => IpAddr::V4(Ipv4Addr::LOCALHOST),
@@ -123,11 +161,10 @@ impl LiveLink for NetLink {
         };
         // A session shared with a join code: its secret is short enough to be typed with the
         // address (see `figcraft_collab::code`); the code and the invite link name the same session.
-        let (file, token) = if o.short {
-            (code::LOCAL_FILE.to_string(), code::Local::new(Ipv4Addr::UNSPECIFIED, 0, token::random()?).token())
-        } else {
-            (token::file_id()?, token::secret()?)
-        };
+        let file = if o.short { code::LOCAL_FILE.to_string() } else { token::file_id()? };
+        let token = session_secret(o.short)?;
+        // A way in for looking only: a second secret of the same kind, never the edit one.
+        let view_token = o.view.then(|| view_secret(o.short, &token)).transpose()?;
         let inbox = self.sessions.inbox();
         let doc = (*o.doc).clone();
         let pages = doc.pages.iter().map(|p| PageInfo { id: p.0, name: doc.node(*p).map(|n| n.name.clone()).unwrap_or_default() }).collect();
@@ -137,13 +174,17 @@ impl LiveLink for NetLink {
             any_port_if_taken: o.port.is_none(),
             file: file.clone(),
             token: token.clone(),
+            view_token: view_token.clone(),
             doc,
             name: o.name,
             limits: self.limits,
             core: figcraft_collab::Limits::default(),
         };
         let host = Host::start(cfg, inbox.clone()).map_err(|e| format!("can't listen on {ip}: {e}"))?;
-        let invite = Invite::new(host.addr().to_string(), file, token);
+        // Listening on every interface (`0.0.0.0`, `::`), the links name an address others reach.
+        let at = reachable(host.addr()).to_string();
+        let view = view_token.map(|v| Invite::new(at.clone(), file.clone(), v)).map(|v| WayIn { link: v.link(), url: v.url() });
+        let invite = Invite::new(at.clone(), file, token);
         let info = SessionInfo {
             role: Role::Host,
             me: host.me().client_id,
@@ -153,9 +194,10 @@ impl LiveLink for NetLink {
             pages,
             link: invite.link(),
             url: invite.url(),
-            address: host.addr().to_string(),
+            address: at,
             network: !ip.is_loopback(),
             access: Access::Edit,
+            view,
         };
         self.started(session, Active::Host(host), inbox);
         Ok(info)

crates/collab-net/src/loopback_tests.rs

@@ -7,7 +7,7 @@ use std::net::{SocketAddr, TcpStream};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
-use figcraft_collab::message::{self, CatchUp, ClientMsg, Hello, Presence, ServerMsg, Signal};
+use figcraft_collab::message::{self, Access, CatchUp, ClientMsg, Hello, Presence, ServerMsg, Signal};
 use figcraft_collab::{Client, Limits};
 use figcraft_doc::{Document, NodeId};
 use figcraft_engine::live::{Event, PEOPLE, Status, TOO_LARGE_TO_JOIN};
@@ -78,6 +78,7 @@ pub(crate) fn fast_limits() -> NetLimits {
     NetLimits { hello_timeout: Duration::from_secs(5), ..NetLimits::default() }
 }
 
+/// A host on a free loopback port with these limits, a probe of what it is told, and its invite.
 fn start_with(limits: NetLimits, core: Limits) -> (Host, Probe, Invite) {
     let probe = Probe::new();
     let mut doc = Document::new("Shared file");
@@ -87,6 +88,7 @@ fn start_with(limits: NetLimits, core: Limits) -> (Host, Probe, Invite) {
         any_port_if_taken: false,
         file: FILE.into(),
         token: TOKEN.into(),
+        view_token: None,
         doc,
         name: "Hana".into(),
         limits,
@@ -214,6 +216,7 @@ fn guests_join_and_see_each_other() {
     assert_eq!(host.connections(), 0);
 }
 
+/// A guest with the wrong token or for another file is refused, and the secret never shows.
 #[test]
 fn a_wrong_token_or_file_is_refused() {
     let (mut host, mut hp, invite) = start();
@@ -236,6 +239,57 @@ fn a_wrong_token_or_file_is_refused() {
     host.stop();
 }
 
+/// Join `addr` with `token` over a bare socket and make an edit: what the welcome allowed, and
+/// whether the host took the edit (`Changes`) or rejected it (`Reject`).
+fn join_and_edit(addr: SocketAddr, token: &str) -> (Access, ServerMsg) {
+    let mut raw = Raw::hello(addr, token);
+    let mut welcome = std::iter::from_fn(|| raw.next()).find(|m| matches!(m, ServerMsg::Welcome { .. })).expect("a welcome");
+    message::unpack(&mut welcome, 64 << 20).unwrap();
+    let ServerMsg::Welcome { access, .. } = welcome else { panic!("not a welcome: {welcome:?}") };
+    let mut client = Client::join(welcome).unwrap();
+    let mut doc = client.document().clone();
+    doc.add_page("Mine");
+    assert!(raw.send(&client.edit(&doc).unwrap().unwrap()));
+    let answer = std::iter::from_fn(|| raw.next()).find(|m| matches!(m, ServerMsg::Changes(_) | ServerMsg::Reject { .. })).expect("an answer");
+    (access, answer)
+}
+
+/// A session hosted with a view token as well (a local network share's view-only code): whoever
+/// joins with it is welcomed as a viewer and their edits are rejected, the edit token still edits,
+/// any other token is still refused, and a view token equal to the edit token isn't hosted.
+#[test]
+fn a_view_token_lets_people_look_and_not_edit() {
+    const VIEW: &str = "ViewOnlyViewOnlyView00";
+    let probe = Probe::new();
+    let cfg = |view: &str| {
+        let mut doc = Document::new("Shared file");
+        doc.repair();
+        HostConfig {
+            addr: SocketAddr::from(([127, 0, 0, 1], 0)),
+            any_port_if_taken: false,
+            file: FILE.into(),
+            token: TOKEN.into(),
+            view_token: Some(view.into()),
+            doc,
+            name: "Hana".into(),
+            limits: fast_limits(),
+            core: Limits::default(),
+        }
+    };
+    let same = Host::start(cfg(TOKEN), probe.inbox.clone()).err().expect("a view token equal to the edit token is refused");
+    assert!(same.to_string().contains("view-only"), "{same}");
+    let mut host = Host::start(cfg(VIEW), probe.inbox.clone()).unwrap();
+    let (access, answer) = join_and_edit(host.addr(), VIEW);
+    assert_eq!(access, Access::View);
+    assert!(matches!(&answer, ServerMsg::Reject { reason, .. } if reason.contains("view")), "{answer:?}");
+    let (access, answer) = join_and_edit(host.addr(), TOKEN);
+    assert_eq!(access, Access::Edit);
+    assert!(matches!(answer, ServerMsg::Changes(_)), "{answer:?}");
+    let refusal = Raw::hello(host.addr(), "WrongWrongWrongWrong00").refusal();
+    assert!(refusal.as_deref().is_some_and(|r| r.contains("token")), "{refusal:?}");
+    host.stop();
+}
+
 #[test]
 fn unreachable_hosts_fail_at_once() {
     // A port nothing listens on.
@@ -677,6 +731,7 @@ fn the_host_removes_someone_and_they_cant_come_back() {
     assert_eq!(host.connections(), 0);
 }
 
+/// A welcome larger than the guest takes says the file is too large to join.
 #[test]
 fn a_welcome_over_the_size_limit_says_the_file_is_too_large() {
     let mut doc = Document::new("B".repeat(1 << 20));
@@ -687,6 +742,7 @@ fn a_welcome_over_the_size_limit_says_the_file_is_too_large() {
         any_port_if_taken: false,
         file: FILE.into(),
         token: TOKEN.into(),
+        view_token: None,
         doc,
         name: "Hana".into(),
         limits: fast_limits(),

crates/doc/src/effects_tests.rs

@@ -49,6 +49,47 @@ fn glass_values_are_clamped_and_reach_their_backdrop() {
     assert_eq!(hidden.backdrop_radius(), 0.0);
 }
 
+#[test]
+fn glass_frost_stays_within_the_reference_range() {
+    // A file from before the 0–100 range draws its frost at 100, and reaches no further.
+    let g = Glass { frost: 150.0, ..Glass::default() };
+    assert_eq!(g.sanitized().frost, Glass::MAX_FROST);
+    let e = Effect { kind: EffectKind::Glass(g), visible: true };
+    let capped = Effect { kind: EffectKind::Glass(Glass { frost: Glass::MAX_FROST, ..Glass::default() }), visible: true };
+    assert_eq!(e.backdrop_radius(), capped.backdrop_radius());
+}
+
+#[test]
+fn glass_fields_take_bound_numbers_as_the_panel_shows_them() {
+    let mut g = Glass::default();
+    for (field, x) in [
+        ("lightAngle", 30.0),
+        ("lightIntensity", 25.0),
+        ("refraction", 40.0),
+        ("depth", 12.0),
+        ("dispersion", 10.0),
+        ("radius", 8.0),
+        ("splay", 50.0),
+    ] {
+        assert!(g.set_bound(field, x), "{field}");
+    }
+    assert_eq!((g.light_angle, g.light_intensity, g.refraction, g.depth, g.dispersion, g.frost, g.splay), (30.0, 0.25, 0.4, 12.0, 0.1, 8.0, 0.5));
+    // Out of range: clamped to the field's range.
+    for (field, x) in [("lightAngle", 270.0), ("lightIntensity", 250.0), ("depth", 0.0), ("radius", 150.0), ("splay", -5.0)] {
+        assert!(g.set_bound(field, x), "{field}");
+    }
+    assert_eq!((g.light_angle, g.light_intensity, g.depth, g.frost, g.splay), (180.0, 1.0, 1.0, Glass::MAX_FROST, 0.0));
+    // A field glass doesn't have, or a value that isn't a number, changes nothing.
+    let before = g.clone();
+    assert!(!g.set_bound("spread", 3.0));
+    assert!(!g.set_bound("splay", f64::NAN));
+    assert!(!g.set_bound("depth", f64::INFINITY));
+    assert_eq!(g, before);
+    for field in Glass::BOUND_FIELDS {
+        assert!(Glass::default().set_bound(field, 1.0), "{field}");
+    }
+}
+
 #[test]
 fn effect_colours() {
     let mut e = Effect::noise();

crates/doc/src/props.rs

@@ -660,9 +660,12 @@ pub struct Glass {
     pub depth: f64,
     /// Colour splitting along the curved edge (0–1).
     pub dispersion: f64,
-    /// Blur of the backdrop (a blur radius, document units).
+    /// Blur of the backdrop (a blur radius, document units, 0–[`Self::MAX_FROST`]).
     pub frost: f64,
-    /// How widely the light spreads over the glass (0–1).
+    /// Which way the curved edge bends the backdrop: towards the shape's core (0; along the edge's
+    /// normal for a shape too big to work one out) to away from the centre of the layer's bounds
+    /// (1; on a ring or an L, whose centre lies outside the shape, an inner edge bends towards the
+    /// hole, as the reference tool's does).
     pub splay: f64,
 }
 
@@ -673,6 +676,34 @@ impl Default for Glass {
 }
 
 impl Glass {
+    /// The most frost a glass takes, as the reference tool's Frost field (0–100).
+    pub const MAX_FROST: f64 = 100.0;
+
+    /// The fields a variable binds on a glass effect (`effects/<i>/<field>`), see [`Self::set_bound`].
+    pub const BOUND_FIELDS: [&'static str; 7] = ["lightAngle", "lightIntensity", "refraction", "depth", "dispersion", "radius", "splay"];
+
+    /// Sets `field` (one of [`Self::BOUND_FIELDS`]) from a bound number variable, read as the
+    /// Design panel's field shows it: intensity, refraction, dispersion and splay in percent, the
+    /// frost as `radius`, each clamped to the field's range. False for a field glass doesn't have
+    /// or a value that isn't finite (nothing changes).
+    pub fn set_bound(&mut self, field: &str, x: f64) -> bool {
+        if !x.is_finite() {
+            return false;
+        }
+        let pct = (x / 100.0).clamp(0.0, 1.0);
+        match field {
+            "lightAngle" => self.light_angle = x.clamp(-180.0, 180.0),
+            "lightIntensity" => self.light_intensity = pct,
+            "refraction" => self.refraction = pct,
+            "depth" => self.depth = x.clamp(1.0, 1000.0),
+            "dispersion" => self.dispersion = pct,
+            "radius" => self.frost = x.clamp(0.0, Self::MAX_FROST),
+            "splay" => self.splay = pct,
+            _ => return false,
+        }
+        true
+    }
+
     /// The values clamped to their ranges (non-finite ones at their defaults).
     pub fn sanitized(&self) -> Glass {
         let d = Glass::default();
@@ -683,15 +714,23 @@ impl Glass {
             refraction: ok(self.refraction, d.refraction, 0.0, 1.0),
             depth: ok(self.depth, d.depth, 1.0, 1000.0),
             dispersion: ok(self.dispersion, d.dispersion, 0.0, 1.0),
-            frost: ok(self.frost, d.frost, 0.0, 1000.0),
+            frost: ok(self.frost, d.frost, 0.0, Self::MAX_FROST),
             splay: ok(self.splay, d.splay, 0.0, 1.0),
         }
     }
 
-    /// Furthest the curved edge moves the backdrop (document units).
+    /// How far `dispersion` splits the colour channels, as a share of the bend: at full dispersion
+    /// red moves up to this much further and blue as much less. Matched to the reference tool:
+    /// across a black-to-white edge in the bend, red and blue part about 4.7 px at 100% and 2.4 px
+    /// at 50% (at 2×, depth 20, refraction 80%).
+    pub const DISPERSION_SPREAD: f64 = 0.16;
+
+    /// Furthest the curved edge moves the backdrop (document units): at most `depth` × `refraction`
+    /// (all of it a bevel in from the edge), and red's dispersion steps up to
+    /// [`Self::DISPERSION_SPREAD`] × `dispersion` times that again.
     pub fn max_bend(&self) -> f64 {
         let g = self.sanitized();
-        g.refraction * g.depth * (1.0 + g.dispersion * 0.25)
+        g.refraction * g.depth * (1.0 + Self::DISPERSION_SPREAD * g.dispersion)
     }
 }
 

crates/engine/src/assets/style_vars.rs

@@ -33,6 +33,7 @@ pub fn field_type(kind: &StyleKind, key: &str) -> Option<VariableType> {
             (EffectKind::DropShadow(_) | EffectKind::InnerShadow(_), "color") => Some(Color),
             (EffectKind::DropShadow(_) | EffectKind::InnerShadow(_), "radius" | "spread" | "offsetX" | "offsetY") => Some(Number),
             (EffectKind::LayerBlur(_) | EffectKind::BackgroundBlur(_), "radius" | "startRadius") => Some(Number),
+            (EffectKind::Glass(_), f) if figcraft_doc::Glass::BOUND_FIELDS.contains(&f) => Some(Number),
             _ => None,
         },
         (StyleKind::Grid { grids }, Some((BoundList::Grids, i, "size" | "count" | "gutter" | "offset"))) => grids.get(i).map(|_| Number),

crates/engine/src/binding_lists_tests.rs

@@ -98,6 +98,41 @@ fn effect_moves_and_removals_reject_junk() {
     assert_eq!(s.doc().unwrap().node(r).unwrap().effects.len(), 1);
 }
 
+fn glass(s: &Session, r: NodeId) -> figcraft_doc::Glass {
+    match s.doc().unwrap().node(r).unwrap().effects.first().map(|e| &e.kind) {
+        Some(EffectKind::Glass(g)) => g.clone(),
+        k => panic!("{k:?}"),
+    }
+}
+
+#[test]
+fn glass_fields_take_number_variables() {
+    let (mut s, r) = setup();
+    ex(&mut s, "effect.add", json!({"ids": [r], "type": "glass"}));
+    // Percent fields read the variable as the Design panel shows them; `radius` is the frost.
+    ex(&mut s, "variable.bind", json!({"ids": [r], "field": "effects/0/splay", "variable": "large"}));
+    ex(&mut s, "variable.bind", json!({"ids": [r], "field": "effects/0/radius", "variable": "small"}));
+    ex(&mut s, "variable.bind", json!({"ids": [r], "field": "effects/0/depth", "variable": "large"}));
+    let g = glass(&s, r);
+    assert_eq!((g.splay, g.frost, g.depth), (0.3, 2.0, 30.0));
+    // A new value follows, clamped to the field's range (frost stops at 100).
+    ex(&mut s, "variable.set", json!({"variable": "small", "value": 150}));
+    ex(&mut s, "variable.set", json!({"variable": "large", "value": 75}));
+    let g = glass(&s, r);
+    assert_eq!((g.splay, g.frost, g.depth), (0.75, figcraft_doc::Glass::MAX_FROST, 75.0));
+    // A colour variable doesn't fit a glass field.
+    assert!(s.execute("variable.bind", &json!({"ids": [r], "field": "effects/0/refraction", "variable": "brand"})).is_err());
+    // An effect style binds them too, and every layer using it follows.
+    let fx = ex_value(&mut s, "style.create", json!({"type": "effect", "name": "Pane", "from": r}))["id"].as_str().unwrap().to_string();
+    ex(&mut s, "style.bind", json!({"style": fx, "field": "effects/0/refraction", "variable": "large"}));
+    assert_eq!(glass(&s, r).refraction, 0.75);
+    assert!(s.execute("style.bind", &json!({"style": fx, "field": "effects/0/spread", "variable": "large"})).is_err(), "glass has no spread");
+}
+
+fn ex_value(s: &mut Session, cmd: &str, p: serde_json::Value) -> serde_json::Value {
+    s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
+}
+
 fn fill_hex(s: &Session, r: NodeId) -> Vec<String> {
     s.doc().unwrap().node(r).unwrap().fills.iter().filter_map(|p| p.solid_color()).map(|c| c.to_hex()).collect()
 }

crates/engine/src/cmd/arrange.rs

@@ -465,7 +465,8 @@ pub fn scale_node(doc: &mut Document, id: NodeId, k: f64) -> Result<()> {
                 }
                 EffectKind::Glass(g) => {
                     g.depth *= k;
-                    g.frost *= k;
+                    // From the frost it draws with (an older file's past 100 draws at 100).
+                    g.frost = (g.sanitized().frost * k).min(figcraft_doc::Glass::MAX_FROST);
                 }
             }
         }

crates/engine/src/cmd/styles.rs

@@ -53,7 +53,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "style.bind",
             "Bind variable in style",
-            "{style, field, variable? (id or name; none: unbind)}  bind a variable to a field of the style's value: a paint style's `fills/<i>/color` (or `fill`: its first paint) and `fills/<i>/stops/<j>/color`, an effect style's `effects/<i>/<color|radius|spread|offsetX|offsetY|startRadius>`, a grid style's `layoutGrids/<i>/<size|count|gutter|offset>`, a text style's `fontSize|lineHeight|letterSpacing` (numbers, px) and `fontFamily|fontStyle` (strings). Every layer using the style shows the field resolved in its own modes; the style keeps it resolved in the default modes",
+            "{style, field, variable? (id or name; none: unbind)}  bind a variable to a field of the style's value: a paint style's `fills/<i>/color` (or `fill`: its first paint) and `fills/<i>/stops/<j>/color`, an effect style's `effects/<i>/<color|radius|spread|offsetX|offsetY|startRadius>` (glass: `lightAngle|lightIntensity|refraction|depth|dispersion|radius|splay`), a grid style's `layoutGrids/<i>/<size|count|gutter|offset>`, a text style's `fontSize|lineHeight|letterSpacing` (numbers, px) and `fontFamily|fontStyle` (strings). Every layer using the style shows the field resolved in its own modes; the style keeps it resolved in the default modes",
             true,
             bind_style
         ),
@@ -196,7 +196,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "variable.bind",
             "Bind variable",
-            "{ids?, field (fill|stroke (first paint)|fills/<i>/color|strokes/<i>/color|fills/<i>/stops/<j>/color (gradient stops)|effects/<i>/<offsetX|offsetY|radius|startRadius|spread|color>|layoutGrids/<i>/<size|count|gutter|offset>|componentProperties/<name> (instances: boolean/text properties; variant properties take string variables naming a value)|width|height|opacity (percent)|cornerRadius|gap|paddingHorizontal|characters|visible|fontSize…; list indices bottom first), variable (null unbinds)}",
+            "{ids?, field (fill|stroke (first paint)|fills/<i>/color|strokes/<i>/color|fills/<i>/stops/<j>/color (gradient stops)|effects/<i>/<offsetX|offsetY|radius|startRadius|spread|color|lightAngle|lightIntensity|refraction|depth|dispersion|splay> (glass: `radius` is its frost; intensity, refraction, dispersion and splay in percent)|layoutGrids/<i>/<size|count|gutter|offset>|componentProperties/<name> (instances: boolean/text properties; variant properties take string variables naming a value)|width|height|opacity (percent)|cornerRadius|gap|paddingHorizontal|characters|visible|fontSize…; list indices bottom first), variable (null unbinds)}",
             true,
             bind
         ),
@@ -1304,6 +1304,9 @@ pub(crate) fn set_effect_field(effects: &mut [Effect], i: usize, prop: &str, val
         (EffectKind::DropShadow(s) | EffectKind::InnerShadow(s), "color", _, VariableValue::Color(c)) => s.color = *c,
         (EffectKind::LayerBlur(b) | EffectKind::BackgroundBlur(b), "radius", Some(x), _) => b.radius = x.max(0.0),
         (EffectKind::LayerBlur(b) | EffectKind::BackgroundBlur(b), "startRadius", Some(x), _) => b.start_radius = x.max(0.0),
+        (EffectKind::Glass(g), field, Some(x), _) => {
+            g.set_bound(field, x);
+        }
         _ => {}
     }
 }

crates/engine/src/comment_link_tests.rs

@@ -81,11 +81,12 @@ fn only_a_comment_link_leaves_the_comment_tool() {
     assert!(!tool_left(crate::live::PUBLISHING, ToolId::Comment));
 }
 
+/// A local network share has edit and view-only codes, not a comment code, and says where one is.
 #[test]
 fn a_local_share_has_no_comment_code() {
     let (mut s, _) = session();
     let e = s.execute("collab.share", &json!({"via": "local", "access": "comment"})).unwrap_err().to_string();
-    assert!(e.contains("can edit it"), "{e}");
+    assert!(e.contains("share it online for a comment code"), "{e}");
     let e = s.execute("collab.share", &json!({"access": "owner"})).unwrap_err().to_string();
     assert!(e.contains("\"comment\""), "{e}");
 }

crates/engine/src/dev/devinspect.rs

@@ -475,7 +475,7 @@ pub fn properties_with(doc: &Document, id: NodeId, fmt: ColorFormat) -> Vec<Sect
                     pct(g.refraction),
                     num(g.depth),
                     pct(g.dispersion),
-                    num(g.frost),
+                    num(g.sanitized().frost),
                     pct(g.splay)
                 ),
             ),

crates/engine/src/effects_tests.rs

@@ -95,6 +95,32 @@ fn scaling_scales_grain_and_glass() {
     assert_eq!((g.refraction, nz.density), (d.refraction, 0.5));
 }
 
+#[test]
+fn scaling_a_frost_from_an_older_file_starts_from_what_it_draws() {
+    // A frost of 150, saved before the 0–100 range, draws at 100: halved, it draws at 50.
+    let mut s = Session::new();
+    let r = rect(&mut s);
+    s.execute("effect.add", &json!({"ids": [r], "type": "glass"})).unwrap();
+    s.execute("effect.set", &json!({"ids": [r], "index": 0, "effect": {"type": "glass", "frost": 150}})).unwrap();
+    s.execute("transform.scale", &json!({"ids": [r], "factor": 0.5})).unwrap();
+    let EffectKind::Glass(g) = &s.doc().unwrap().node(r).unwrap().effects[0].kind else { panic!() };
+    assert_eq!(g.frost, 50.0);
+}
+
+#[test]
+fn inspect_shows_a_frost_from_an_older_file_as_it_draws() {
+    // A frost of 150, saved before the 0–100 range, draws at 100: Dev Mode says 100 as CSS does.
+    let mut s = Session::new();
+    let r = rect(&mut s);
+    s.execute("effect.add", &json!({"ids": [r], "type": "glass"})).unwrap();
+    s.execute("effect.set", &json!({"ids": [r], "index": 0, "effect": {"type": "glass", "frost": 150}})).unwrap();
+    let doc = s.doc().unwrap();
+    let sections = crate::devinspect::properties(doc, r);
+    let glass = &sections.iter().find(|s| s.title == "Effects").unwrap().rows[0];
+    assert!(glass.value.contains(" frost 100 "), "{}", glass.value);
+    assert!(code_for(doc, r, CodeLang::Css).contains("backdrop-filter: blur(50px);"));
+}
+
 #[test]
 fn inspect_and_css_show_the_new_effects() {
     let mut s = Session::new();

crates/engine/src/live_share_tests.rs

@@ -13,7 +13,7 @@ use serde_json::{Value, json};
 
 use crate::live::{
     Access, Bind, DEFAULT_SERVER, Event, HostOptions, LiveLink, Presence, PublishOptions, Published, Role, SessionInfo, Shared, SharedLink, Status,
-    join_target,
+    WayIn, join_target,
 };
 use crate::{EngineError, Session};
 
@@ -36,13 +36,23 @@ struct Link(Arc<Mutex<Script>>);
 
 /// Where the scripted host listens, and its session's secret.
 const HOST: Local = Local { ip: Ipv4Addr::new(192, 168, 1, 20), port: 47_900, secret: 0x123_4567_89AB };
+/// The same session's view-only secret.
+const VIEW: Local = Local { secret: 0xBA9_8765_4321, ..HOST };
+
+/// The WebSocket URL the scripted link gives with an invite `link` (the same secret).
+fn mock_url(link: &str) -> String {
+    link.replace("figcraft://join?host=", "ws://")
+}
 
 impl LiveLink for Link {
+    /// Host as the network link does: a code's short secret when shared with a code, and the
+    /// view-only link when asked for one.
     fn host(&mut self, session: u64, opts: HostOptions) -> Result<SessionInfo, String> {
         let mut s = self.0.lock().unwrap();
         s.session = session;
         // As the network link does: a short secret when the session is shared with a code.
         let link = if opts.short { HOST.link() } else { "figcraft://join?host=192.168.1.20:47900&file=f&token=AbCdEfGhIjKlMnOpQrStUv".to_string() };
+        let view = opts.view.then(|| WayIn { link: VIEW.link(), url: mock_url(&VIEW.link()) });
         s.hosted.push(opts);
         Ok(SessionInfo {
             role: Role::Host,
@@ -51,11 +61,12 @@ impl LiveLink for Link {
             color: "#0D99FF".into(),
             file_name: "Shared".into(),
             pages: vec![],
-            url: link.replace("figcraft://join?host=", "ws://"),
+            url: mock_url(&link),
             link,
             address: "192.168.1.20:47900".into(),
             network: true,
             access: Access::Edit,
+            view,
         })
     }
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
@@ -146,6 +157,7 @@ fn on_the_server(s: &mut Session, script: &Arc<Mutex<Script>>, codes: Option<(&s
         address: "wss://share.example:443/".into(),
         network: true,
         access: Access::Edit,
+        view: None,
     };
     let events = vec![Event::Published(published), Event::Shared(Ok(links(0, codes))), Event::Welcome { info, peers: vec![] }];
     script.lock().unwrap().events.extend(events);
@@ -352,6 +364,8 @@ fn online_sharing_is_off_without_a_server() {
     assert!(matches!(bare.execute("collab.join", &json!({"code": HOST.code()})), Err(EngineError::Disabled(..))));
 }
 
+/// A local network share shows the code that carries the host's address, has a view-only code
+/// for the same session, switches which shows without hosting again, and listens where told.
 #[test]
 fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     let (mut s, script) = session();
@@ -360,30 +374,48 @@ fn sharing_on_the_local_network_shows_a_code_that_carries_the_address() {
     let shown = r["code"].as_str().unwrap();
     assert_eq!(code::parse(shown), Ok(code::Code::Local(HOST)), "{shown}");
     assert_eq!(shown, code::grouped(&HOST.code()));
-    assert_eq!((&r["link"], &r["share"]["viewCode"]), (&json!(HOST.link()), &Value::Null));
+    assert_eq!(r["link"], json!(HOST.link()));
+    // A view-only code too, for the same session with its own secret; no comment code.
+    let view = code::grouped(&VIEW.code());
+    assert_eq!((&r["share"]["viewCode"], &r["share"]["viewLink"]), (&json!(view), &json!(VIEW.link())));
+    assert_eq!((&r["share"]["editLink"], &r["share"]["commentCode"]), (&json!(HOST.link()), &Value::Null));
     {
         let sc = script.lock().unwrap();
         let [h] = sc.hosted.as_slice() else { panic!("hosted {}", sc.hosted.len()) };
-        assert!(h.short && h.bind == Bind::Lan && h.port.is_none(), "the local network unless told otherwise");
+        assert!(h.short && h.view && h.bind == Bind::Lan && h.port.is_none(), "the local network unless told otherwise");
     }
-    // Everyone edits there.
-    assert!(err(&mut s, "collab.share", json!({"access": "view"})).contains("share it online"));
+    // Which code shows: the view code, then the edit code again (nothing is hosted twice).
+    // The link goes with the code: a view-only code's link doesn't edit.
+    let r = ex(&mut s, "collab.share", json!({"access": "view"}));
+    assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
+    assert_eq!((&r["link"], &r["url"], &r["sessions"][0]["link"]), (&json!(VIEW.link()), &json!(mock_url(&VIEW.link())), &json!(VIEW.link())));
+    let r = ex(&mut s, "collab.share", json!({"access": "edit"}));
+    assert_eq!((&r["code"], &r["link"], &r["url"]), (&json!(code::grouped(&HOST.code())), &json!(HOST.link()), &json!(mock_url(&HOST.link()))));
+    assert!(err(&mut s, "collab.share", json!({"access": "comment"})).contains("share it online"));
+    assert_eq!(script.lock().unwrap().hosted.len(), 1);
     assert_eq!(ex(&mut s, "collab.stop", json!({}))["ended"], true);
     assert!(script.lock().unwrap().asked.is_empty(), "no server to tell");
-    assert!(err(&mut s, "collab.share", json!({"via": "local", "access": "view"})).contains("share it online"));
+    // Shared for looking only from the start: the edit code isn't the one shown.
+    let r = ex(&mut s, "collab.share", json!({"via": "local", "access": "view"}));
+    assert_eq!((&r["code"], &r["share"]["access"]), (&json!(view), &json!("view")));
+    assert_eq!((&r["link"], &r["url"]), (&json!(VIEW.link()), &json!(mock_url(&VIEW.link()))), "the edit link and URL aren't handed out");
+    assert_eq!(r["sessions"][0]["link"], json!(VIEW.link()));
+    ex(&mut s, "collab.stop", json!({}));
+    assert!(err(&mut s, "collab.share", json!({"via": "local", "access": "comment"})).contains("share it online"));
     // Where to listen is the advanced part.
     ex(&mut s, "collab.share", json!({"via": "local", "bind": "local", "port": 5000}));
     let sc = script.lock().unwrap();
-    assert!(sc.hosted[1].bind == Bind::Local && sc.hosted[1].port == Some(5000));
+    assert!(sc.hosted[2].bind == Bind::Local && sc.hosted[2].port == Some(5000));
     drop(sc);
     ex(&mut s, "collab.stop", json!({}));
     for bad in [json!({"via": "post"}), json!({"via": "local", "port": 70000}), json!({"via": "local", "bind": "everywhere"})] {
         assert!(matches!(s.execute("collab.share", &bad), Err(EngineError::BadParams { .. })), "{bad}");
     }
-    // A plain `collab.host` session has an invite link, not a code.
+    // A plain `collab.host` session has an invite link, not a code, and everyone in it edits.
     let r = ex(&mut s, "collab.host", json!({}));
     assert_eq!((&r["code"], &r["share"]), (&Value::Null, &Value::Null));
-    assert!(!script.lock().unwrap().hosted[2].short);
+    let h = &script.lock().unwrap().hosted[3];
+    assert!(!h.short && !h.view);
 }
 
 #[test]

crates/engine/src/live_tests.rs

@@ -90,6 +90,7 @@ impl LiveLink for Mock {
     }
 }
 
+/// A session you are in as `role`, as client `me`, everyone in it editing.
 pub(crate) fn info(role: Role, me: u32) -> SessionInfo {
     SessionInfo {
         role,
@@ -103,6 +104,7 @@ pub(crate) fn info(role: Role, me: u32) -> SessionInfo {
         address: "127.0.0.1:47900".into(),
         network: false,
         access: crate::live::Access::Edit,
+        view: None,
     }
 }
 

crates/engine/src/online_tests.rs

@@ -136,6 +136,7 @@ fn edit_link(server: &str, file: &str) -> String {
     format!("figcraft://join?server={server}&file={file}&token={EDIT_TOKEN}")
 }
 
+/// A session you are in as `role` under `name`, invited with `link`.
 fn info(role: Role, name: &str, link: &str) -> SessionInfo {
     SessionInfo {
         role,
@@ -149,6 +150,7 @@ fn info(role: Role, name: &str, link: &str) -> SessionInfo {
         address: SERVER.into(),
         network: true,
         access: Access::Edit,
+        view: None,
     }
 }
 

crates/engine/src/sharing/live.rs

@@ -72,7 +72,7 @@ pub(crate) use join::start_join;
 pub use join::{can_remove_people, specs};
 pub use types::{
     Bind, DEFAULT_SERVER, Event, HostOptions, LiveLink, MAX_NAME, MAX_PEERS, MAX_SELECTION, NO_HOSTING, NO_SESSION, NetReply, NetRequest, ONLINE_OFF,
-    PEOPLE, PageInfo, PublishOptions, Published, Role, SessionId, SessionInfo, Share, Shared, SharedLink, Status, TOO_LARGE_TO_JOIN, Via,
+    PEOPLE, PageInfo, PublishOptions, Published, Role, SessionId, SessionInfo, Share, Shared, SharedLink, Status, TOO_LARGE_TO_JOIN, Via, WayIn,
     join_target, parse_color,
 };
 
@@ -147,6 +147,18 @@ impl Live {
         self.info.as_ref().map(|i| i.role)
     }
 
+    /// The session's invite link and WebSocket URL as `collab.peers` gives them. A file shared
+    /// on the local network gives the ones that go with the code shown: the session's own link
+    /// and URL are the edit way in, and a view-only share must not hand them out. Otherwise the
+    /// session's own (online, the owner's: `share` has the links for others).
+    pub fn invite(&self) -> (Option<&str>, Option<&str>) {
+        let info = self.info.as_ref();
+        match &self.share {
+            Some(sh) if sh.via == Via::Local => info.and_then(|i| i.way_in(sh.access)).unzip(),
+            _ => (info.map(|i| i.link.as_str()), info.map(|i| i.url.as_str())),
+        }
+    }
+
     /// Stop following. False when you weren't following anyone.
     fn unfollow(&mut self) -> bool {
         self.followed = None;

crates/engine/src/sharing/live/host.rs

@@ -36,14 +36,16 @@ pub(super) fn unavailable(cmd: &str) -> EngineError {
     )
 }
 
+/// `collab.host`: host the open file (on this machine unless `p` says where) with an invite link.
 pub(super) fn host(s: &mut Session, p: &Value) -> Result<Value> {
-    start_host(s, "collab.host", p, Bind::Local, false)?;
+    start_host(s, "collab.host", p, Bind::Local, false, false)?;
     Ok(s.live_summary())
 }
 
 /// Start hosting the open file for command `cmd` (on `bind` unless `p` says where; `short`: with
-/// a secret a join code can carry): the new session.
-fn start_host(s: &mut Session, cmd: &str, p: &Value, bind: Bind, short: bool) -> Result<SessionId> {
+/// a secret a join code can carry; `view`: with a second secret for looking only): the new
+/// session.
+fn start_host(s: &mut Session, cmd: &str, p: &Value, bind: Bind, short: bool, view: bool) -> Result<SessionId> {
     let port = match get(p, "port") {
         None => None,
         Some(v) => Some(v.as_u64().and_then(|n| u16::try_from(n).ok()).ok_or_else(|| bad(cmd, "`port` must be a whole number from 0 to 65535"))?),
@@ -55,7 +57,7 @@ fn start_host(s: &mut Session, cmd: &str, p: &Value, bind: Bind, short: bool) ->
         Some(other) => other.parse::<IpAddr>().map(Bind::Addr).map_err(|_| bad(cmd, "`bind` must be \"local\", \"lan\" or an IP address"))?,
     };
     let (doc, uid) = s.ds().map(|ds| (ds.doc.clone(), ds.uid))?;
-    let opts = HostOptions { port, bind, name: display_name(&s.prefs), doc, short };
+    let opts = HostOptions { port, bind, name: display_name(&s.prefs), doc, short, view };
     let (id, info) = s.live.start(cmd, |l, id| l.host(id, opts).map_err(|e| EngineError::Other(format!("couldn't start the live session: {e}"))))?;
     s.live.open(Live { id, status: Status::Live, info: Some(info), doc_uid: Some(uid), tab: Some(uid), ..Live::default() });
     Ok(id)
@@ -82,8 +84,9 @@ fn start_publish(s: &mut Session, cmd: &str, server: &str, p: &Value, share: boo
     Ok(id)
 }
 
-/// Why a local network share has no view-only or comment code.
-const LOCAL_EDITS: &str = "everyone who joins a file shared on the local network can edit it: share it online for a view-only or comment code";
+/// Why a local network share has no comment code.
+const LOCAL_COMMENTS: &str =
+    "a file shared on the local network has an edit code and a view-only code, not a comment code: share it online for a comment code";
 
 /// Why a share has no comment code.
 const NO_COMMENT_LINK: &str =
@@ -94,6 +97,8 @@ fn access_param(cmd: &str, p: &Value) -> Result<Option<Access>> {
     string(p, "access").map(|a| Access::parse(&a).ok_or_else(|| bad(cmd, "`access` must be \"edit\", \"comment\" or \"view\""))).transpose()
 }
 
+/// `collab.share`: share the open file with join codes, online or on the local network, or (shared
+/// already) switch which code shows.
 pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
     const CMD: &str = "collab.share";
     let via = match string(p, "via").as_deref().map(str::trim) {
@@ -112,8 +117,8 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
                 "this file is shared the other way already: stop sharing it first (collab.stop), or leave its session (collab.leave)",
             ));
         }
-        if access.is_some_and(|a| a != Access::Edit) && shared == Via::Local {
-            return Err(bad(CMD, LOCAL_EDITS));
+        if access == Some(Access::Comment) && shared == Via::Local {
+            return Err(bad(CMD, LOCAL_COMMENTS));
         }
         if let Some(req) = share_request(s, Vec::new(), true).filter(|_| s.live().share.as_ref().is_some_and(|sh| sh.links.is_none())) {
             let links = share_answer(s, req)?.ok_or_else(|| EngineError::Other("the server made no links".into()))?;
@@ -130,8 +135,8 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
     let access = access.unwrap_or_default();
     let mut server = String::new();
     let id = match via {
-        Via::Local if access != Access::Edit => return Err(bad(CMD, LOCAL_EDITS)),
-        Via::Local => start_host(s, CMD, p, Bind::Lan, true)?,
+        Via::Local if access == Access::Comment => return Err(bad(CMD, LOCAL_COMMENTS)),
+        Via::Local => start_host(s, CMD, p, Bind::Lan, true, true)?,
         Via::Online => {
             server = string(p, "server").unwrap_or_else(|| s.prefs.publish_server.clone()).trim().to_string();
             if server.is_empty() {
@@ -141,17 +146,25 @@ pub(super) fn share(s: &mut Session, p: &Value) -> Result<Value> {
         }
     };
     if let Some(live) = s.live.sessions.get_mut(&id) {
-        // On the local network the session's own link is what others join with, and the code says
-        // what the link says: where the session is and its secret. (Online they arrive with the file.)
-        let links = live.info.as_ref().filter(|_| via == Via::Local).map(|i| {
-            let code = code::Local::from_link(&i.link).map(|l| l.code());
-            Shared { edit: SharedLink { id: String::new(), link: i.link.clone(), code }, ..Shared::default() }
+        // On the local network the session's own links are what others join with (its view link
+        // only lets them look), and each code says what its link says: where the session is and
+        // that link's secret. (Online they arrive with the file.)
+        let links = live.info.as_ref().filter(|_| via == Via::Local).map(|i| Shared {
+            edit: local_link(&i.link),
+            view: i.view.as_ref().map(|v| local_link(&v.link)),
+            comment: None,
         });
         live.share = Some(Share { via, server, access, links });
     }
     Ok(s.live_summary())
 }
 
+/// A way into a session this app hosts: its invite link and the join code that stands for it
+/// (none when the link can't be put in one: a host without an IPv4 address).
+fn local_link(link: &str) -> SharedLink {
+    SharedLink { id: String::new(), link: link.to_string(), code: code::Local::from_link(link).map(|l| l.code()) }
+}
+
 /// What others join the open file's server file with changed: in its session and its record.
 pub(super) fn shared_now(s: &mut Session, links: Option<Shared>) {
     if let Some((server, file)) = s.live().server_file() {

crates/engine/src/sharing/live/join.rs

@@ -162,6 +162,7 @@ fn spotlight(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"spotlighting": s.live().spotlighting}))
 }
 
+/// The live session commands (`collab.*`).
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         spec!(
@@ -174,7 +175,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "collab.share",
             "Share with a join code",
-            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (online only: which code `code` is), server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` an invite link. Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
+            "{via?: \"online\" (default: the open file is kept on the server in Preferences, `pref.publishServer`, and the server hands out the codes) | \"local\" (this app hosts it for people on the same network; no server), access?: \"edit\" (default) | \"comment\" (online only: view and comment, not edit) | \"view\" (look only: their edits are refused): which code `code` is, server? (online: another server's address, with ?key=… when it needs its key), key? (online: the server's key, when the address has none), name? (online: the file's name there), port?, bind?: \"lan\" (default) | \"local\" (this machine only) | an IP address (local)} → the open file's session as `collab.peers` gives it: `code` is what others type to join (`collab.join {code}`, the Join field), `link` the invite link to give with it and `url` its WebSocket URL (local: the ones that go with `code`, so a view-only code's link and URL let people look only; online: your own link to the file, which edits: `share` has the link that goes with each code). Local: at once, the code carries the host's IPv4 address, port and secret (K7M2Q-…, 20 symbols), and `share` is {via, access, shared, editCode, viewCode, editLink, viewLink}: the edit and view-only ways in, each with its own secret (commentCode and commentLink null). Online: status \"connecting\" first; once live `code` is the server's (K7M-2QX-9TD) and `share` is {via, access, shared, editCode, viewCode, commentCode, editLink, viewLink, commentLink}: links made for others (commentCode and commentLink null from a server older than comment links) (the file's own links in `published` stay yours); `code` stays null when the server is older than join codes (give `share.editLink` / `share.viewLink` instead). Called again while shared: only switches which code `code` is (`access`). Called after `collab.stop` on a file that is still on the server: new links and codes for that same file (nothing is published twice). `collab.stop` stops sharing",
             false,
             share
         ),
@@ -230,7 +231,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "collab.peers",
             "People in this file",
-            "{} → the open file's session (each open file has its own or none): {available, canHost (false in the browser: it can only join), session (its id; null: this file isn't in a session), status: off|connecting|live|reconnecting|failed, reason?, role, me, name, color, fileName, pages, link, url, address, network, access: edit|view|comment (view: a server's view link, edits are refused; comment: its comment link, edits other than to comment threads are refused), readOnly (the open file can't be edited now: view only, comment only, or being published), published (a file you published: {server, file, name, edit, view}), code (the join code to give others, when the file was shared with `collab.share`; null otherwise or while it is on its way), share ({via: online|local, access, shared (false: a file of yours on a server that nobody else gets into now), editCode, viewCode, commentCode, editLink, viewLink, commentLink (what others join with; null when not shared)} or null), follow, syncing, document (index of the synced open document), editing (the text layer you type in: {node, layer, caret, selection}), peers: [{id, name, color, editing (theirs, same shape, or null), presence: {cursor: [page, x, y], selection, viewport: [page, x, y, w, h], editing_text}}], sessions: [{session, document (index of its open document; null for a join on its way), status, reason, role, fileName, link, peers (how many others)}] (every session of the app)}",
+            "{} → the open file's session (each open file has its own or none): {available, canHost (false in the browser: it can only join), session (its id; null: this file isn't in a session), status: off|connecting|live|reconnecting|failed, reason?, role, me, name, color, fileName, pages, link, url, address, network, access: edit|view|comment (view: a view link or code, a server's or a local network share's, edits are refused; comment: a server's comment link, edits other than to comment threads are refused), readOnly (the open file can't be edited now: view only, comment only, or being published), published (a file you published: {server, file, name, edit, view}), code (the join code to give others, when the file was shared with `collab.share`; null otherwise or while it is on its way), share ({via: online|local, access, shared (false: a file of yours on a server that nobody else gets into now), editCode, viewCode, commentCode, editLink, viewLink, commentLink (what others join with; null when not shared)} or null), follow, syncing, document (index of the synced open document), editing (the text layer you type in: {node, layer, caret, selection}), peers: [{id, name, color, editing (theirs, same shape, or null), presence: {cursor: [page, x, y], selection, viewport: [page, x, y, w, h], editing_text}}], sessions: [{session, document (index of its open document; null for a join on its way), status, reason, role, fileName, link, peers (how many others)}] (every session of the app)}",
             false,
             |s, _| Ok(s.live_summary())
         ),

crates/engine/src/sharing/live/sync.rs

@@ -283,6 +283,7 @@ impl Session {
             })
             .collect();
         let mine = synced.and_then(|d| d.text_edit.as_ref()).map(|t| editing(&editing_of(t)));
+        let (link, url) = l.invite();
         let sessions: Vec<Value> = self
             .live
             .iter()
@@ -295,7 +296,7 @@ impl Session {
                     "reason": reason(o),
                     "role": o.role(),
                     "fileName": info.map(|i| i.file_name.as_str()),
-                    "link": info.map(|i| i.link.as_str()),
+                    "link": o.invite().0,
                     "peers": o.peers.len(),
                 })
             })
@@ -313,8 +314,8 @@ impl Session {
             "color": info.map(|i| i.color.as_str()),
             "fileName": info.map(|i| i.file_name.as_str()),
             "pages": info.map(|i| &i.pages),
-            "link": info.map(|i| i.link.as_str()),
-            "url": info.map(|i| i.url.as_str()),
+            "link": link,
+            "url": url,
             "address": info.map(|i| i.address.as_str()),
             "network": info.map(|i| i.network),
             "access": l.client.as_ref().map(Client::access).or(info.map(|i| i.access)),

crates/engine/src/sharing/live/types.rs

@@ -119,9 +119,33 @@ pub struct SessionInfo {
     pub address: String,
     /// Reachable from other machines (the host listens on a network address, not loopback).
     pub network: bool,
-    /// What you may do: edit, only view (a server's view link), or view and comment (its comment
-    /// link).
+    /// What you may do: edit, only view (a view link or code), or view and comment (a server's
+    /// comment link).
     pub access: Access,
+    /// A session this app hosts with a way in for looking only ([`HostOptions::view`]): its
+    /// invite link and WebSocket URL, which carry the view secret (`None`: everyone who joins
+    /// edits, or you joined).
+    pub view: Option<WayIn>,
+}
+
+impl SessionInfo {
+    /// The invite link and WebSocket URL that let people into a session this app hosts with
+    /// `access` (its own link and URL edit). `None`: no way in gives that.
+    pub fn way_in(&self, access: Access) -> Option<(&str, &str)> {
+        match access {
+            Access::Edit => Some((&self.link, &self.url)),
+            Access::View => self.view.as_ref().map(|v| (v.link.as_str(), v.url.as_str())),
+            Access::Comment => None,
+        }
+    }
+}
+
+/// A way into a session this app hosts: an invite link and the WebSocket URL it connects to,
+/// which carry the same secret.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub struct WayIn {
+    pub link: String,
+    pub url: String,
 }
 
 /// A file you published to a server: where, and its first share links (they carry their tokens:
@@ -390,6 +414,9 @@ pub struct HostOptions {
     pub doc: Arc<Document>,
     /// Shared with a join code (`collab.share`): the session's secret is short enough to type.
     pub short: bool,
+    /// Also make a second secret whose holders only look: they see every change, and the session
+    /// refuses theirs ([`SessionInfo::view`]).
+    pub view: bool,
 }
 
 /// What [`LiveLink::publish`] needs to put the open file on a server.

crates/format/src/fig/export/paint.rs

@@ -234,7 +234,7 @@ impl<'d> Exporter<'d> {
             }
             EffectKind::Glass(g) => {
                 self.warn("glass effects keep only their frost");
-                f.extend([("type", e("GLASS")), ("radius", fl(g.frost))]);
+                f.extend([("type", e("GLASS")), ("radius", fl(g.sanitized().frost))]);
             }
         }
         o(f)

crates/format/src/fig/export_tests.rs

@@ -1243,6 +1243,25 @@ fn local_samples_round_trip() {
     }
 }
 
+#[test]
+fn a_glass_frost_is_written_as_it_draws() {
+    // A frost saved before the 0–100 range (or not a number) is written at what it draws: 100, or
+    // the default.
+    for (frost, written) in [(12.0, 12.0), (500.0, Glass::MAX_FROST), (f64::NAN, Glass::default().frost)] {
+        let mut doc = Document::new("glass");
+        let page = doc.first_page().unwrap();
+        let r = doc.create(page, NodeKind::Rectangle, "Pane", 0.0, 0.0, 24.0, 24.0).unwrap();
+        doc.get_mut(r).unwrap().effects = vec![Effect { kind: EffectKind::Glass(Glass { frost, ..Glass::default() }), visible: true }];
+        let (bytes, _) = export(&doc, None).unwrap();
+        let archive = Archive::open(&bytes).unwrap();
+        let (schema, message) = decode_canvas(&archive.canvas).unwrap();
+        let msg = schema.decode_message(schema.find("Message").unwrap(), &message).unwrap();
+        let pane = msg.get("nodeChanges").unwrap().list().iter().find(|nc| nc.get("name").and_then(Kv::str) == Some("Pane")).unwrap();
+        let radius = pane.get("effects").unwrap().list()[0].get("radius").and_then(Kv::f64).unwrap();
+        assert_eq!(radius, written, "frost {frost}");
+    }
+}
+
 #[test]
 fn a_vector_drawable_export_setting_is_written_as_svg_with_a_warning() {
     let mut doc = Document::new("vd");

crates/render/src/backdrop.rs

@@ -160,7 +160,7 @@ pub fn effects(n: &Node, frame: EffectFrame<'_>) -> Option<Pixmap> {
                 fx::mask_by(&mut l, cov.as_ref()?, false);
                 l
             }
-            EffectKind::Glass(g) => glass::glass(g, frame)?,
+            EffectKind::Glass(g) => glass::glass(g, frame, glass::RoundedRect::of(n))?,
             _ => continue,
         };
         match out.as_mut() {

crates/render/src/backdrop_tests.rs

@@ -254,16 +254,65 @@ fn glass_edges_bend_split_and_catch_the_light() {
     let (rim, middle) = changed(&split, &bent);
     assert!(rim > 0 && middle == 0, "dispersion: rim {rim}, middle {middle}");
 
-    // The light (from the top left by default) brightens the top-left rim more than the
-    // bottom-right one, and only near the edge.
+    // The light (from the top left by default) is a line on the 1-unit bevel: the top-left corner
+    // catches it all, the bottom-right one (facing away) 0.6 as much, the top side (45° from it)
+    // 0.574 and the bottom side 0.6 × 0.574, and the top-right corner (side on) none. Further in
+    // only the faint gradient across the curve shows, and nothing past `depth`.
     let (d, f, _) = glass_scene(Glass { light_intensity: 1.0, ..plain });
     let lit = render_node(&d, f, 1.0).unwrap();
     let gain = |x: u32, y: u32| i32::from(px(&lit, x, y)[1]) - i32::from(px(&flat, x, y)[1]);
-    assert!(gain(82, 42) > gain(197, 117), "{} vs {}", gain(82, 42), gain(197, 117));
-    assert!(gain(82, 42) > 40, "{}", gain(82, 42));
+    let (top_left, bottom_right, top, bottom, top_right) = (gain(80, 40), gain(199, 119), gain(140, 40), gain(140, 119), gain(199, 40));
+    assert!(
+        top_left > bottom_right && bottom_right > top && top > bottom && bottom > top_right.abs(),
+        "{top_left} {bottom_right} {top} {bottom} {top_right}"
+    );
+    assert!(top_left > 120 && top_right.abs() <= 2, "{top_left} {top_right}");
+    assert!(gain(140, 44).abs() <= 13, "4 px in: the gradient only, {}", gain(140, 44));
     assert_eq!(gain(140, 80), 0);
 }
 
+#[test]
+fn splay_turns_the_bend_towards_the_centre() {
+    // Refraction only, so the bend alone moves the stripes' edges.
+    let bend = Glass { frost: 0.0, refraction: 1.0, dispersion: 0.0, light_intensity: 0.0, depth: 16.0, ..Glass::default() };
+    let (d, f, _) = glass_scene(bend.clone());
+    let edge = render_node(&d, f, 1.0).unwrap();
+    let (d, f, _) = glass_scene(Glass { splay: 1.0, ..bend });
+    let centre = render_node(&d, f, 1.0).unwrap();
+    let diff = |xs: std::ops::Range<u32>, ys: std::ops::Range<u32>| {
+        let mut most = 0;
+        for y in ys {
+            for x in xs.clone() {
+                most = most.max(px(&edge, x, y).iter().zip(px(&centre, x, y)).map(|(a, b)| a.abs_diff(b)).max().unwrap());
+            }
+        }
+        most
+    };
+    // Halfway along the left side the edge's normal and the way from the centre (140, 80) agree:
+    // nearly the same pixels. In the top-left corner they part, and so does what shows there.
+    assert!(diff(80..96, 78..82) <= 8, "mid-left: {}", diff(80..96, 78..82));
+    assert!(diff(80..96, 40..56) > 40, "corner: {}", diff(80..96, 40..56));
+}
+
+/// Glass with nothing under it (an export of the pane alone): the light on the bevel still shows,
+/// the alpha rising with it, and the flat inside and the outside stay clear.
+#[test]
+fn glass_over_nothing_still_catches_the_light() {
+    let mut d = Document::new("glass");
+    let p = d.first_page().unwrap();
+    let pane = d.create(p, NodeKind::Rectangle, "Glass", 40.0, 30.0, 120.0, 80.0).unwrap();
+    let n = d.get_mut(pane).unwrap();
+    n.fills.clear();
+    n.effects = vec![Effect { kind: EffectKind::Glass(Glass { light_intensity: 1.0, ..Glass::default() }), visible: true }];
+    let out = render_area(&d, &[pane], Rect::new(0.0, 0.0, 200.0, 140.0), 1.0).unwrap();
+    // The top-left corner faces the light (from the top left): white, as opaque as it is bright.
+    let corner = px(&out, 40, 30);
+    assert!(corner[3] > 100 && corner.iter().all(|v| v.abs_diff(corner[3]) <= 2), "{corner:?}");
+    assert!(out.data().chunks_exact(4).all(|q| q[0] <= q[3] && q[1] <= q[3] && q[2] <= q[3]), "premultiplied");
+    assert_eq!(px(&out, 100, 70), [0; 4]);
+    assert_eq!(px(&out, 10, 10), [0; 4]);
+}
+
 #[test]
 fn glass_and_backdrop_blur_survive_bands_and_partial_renders() {
     let (d, _, _) = glass_scene(Glass::default());

crates/render/src/glass_cut_tests.rs

@@ -59,25 +59,31 @@ fn cut_diffs(d: &Document, p: NodeId) -> Vec<(u32, (u8, usize))> {
         .collect()
 }
 
-/// A pane deeper than the light may reach, over black and lit from the left: across its middle row
-/// each pixel is the light alone. It fades out smoothly where it stops, with no ring.
+/// A deep pane over black, lit from the left, at 2× (its 1-unit bevel 2 px wide): across its middle
+/// row the left rim catches the light, the right rim 0.6 as much, and in between only the faint
+/// gradient across the curve shows (black can't darken, so the lit half stays black), changing
+/// smoothly, with no ring.
 #[test]
-fn the_light_fades_out_where_it_stops() {
+fn the_light_is_a_line_on_the_bevel() {
     let mut d = Document::new("glass");
     let p = d.first_page().unwrap();
     let back = d.create(p, NodeKind::Rectangle, "Back", 0.0, 0.0, 700.0, 700.0).unwrap();
     d.get_mut(back).unwrap().fills = vec![Paint::solid(Color::BLACK)];
     let pane = d.create(p, NodeKind::Rectangle, "Glass", 50.0, 50.0, 600.0, 600.0).unwrap();
-    let g = Glass { depth: 300.0, splay: 1.0, light_angle: -90.0, light_intensity: 1.0, frost: 0.0, refraction: 0.0, ..Glass::default() };
+    let g = Glass { depth: 300.0, light_angle: -90.0, light_intensity: 1.0, frost: 0.0, refraction: 0.0, ..Glass::default() };
     let n = d.get_mut(pane).unwrap();
     n.fills.clear();
     n.effects = vec![Effect { kind: EffectKind::Glass(g), visible: true }];
     let full = render_view_single(&d, p, &View { origin: (0.0, 0.0), scale: 2.0, width: 1400, height: 1400 }, &Options::default()).unwrap();
     let row = &full.data()[700 * 1400 * 4..][..1400 * 4];
-    let red: Vec<u8> = row.chunks(4).map(|px| px[0]).skip(101).take(598).collect();
-    let step = red.windows(2).map(|w| w[0].abs_diff(w[1])).max().unwrap();
-    assert!(step <= 2, "the light jumps {step} levels between neighbouring pixels");
-    assert!(red[0] > 200 && red[597] < red[0], "lit at the edge, fading in: {} … {}", red[0], red[597]);
+    let red: Vec<u8> = row.chunks(4).map(|px| px[0]).collect();
+    // The pane covers pixels 100..1300 of the row.
+    let (left, right) = (red[100], red[1299]);
+    assert!(left > 230, "the left rim catches the light, less the gradient: {left}");
+    assert!((140..=175).contains(&right), "the right rim 0.6 as much, plus the gradient: {right}");
+    assert!(red[106] <= 14 && red[1293] <= 14, "3 units in, the gradient only: {} {}", red[106], red[1293]);
+    let step = red[104..1296].windows(2).map(|w| w[0].abs_diff(w[1])).max().unwrap();
+    assert!(step <= 2, "the gradient jumps {step} levels between neighbouring pixels");
 }
 
 /// Digests of glass renders over a spread of settings, scales and corners: compare two builds'
@@ -115,30 +121,39 @@ fn glass_digests() {
 
 #[test]
 fn a_cut_through_the_pane_matches_the_whole_render() {
-    // The last look is deep enough that the light is held to `MAX_LIGHT_PX`.
+    // The last two looks are deep, so the curve reaches far in from every cut: 60 units (at 2× a
+    // core 122 px in, which takes the widest margin a core gets) and 300 (too big for a core).
     let looks = [
         wide_light(),
         Glass::default(),
         Glass { splay: 0.5, frost: 0.0, refraction: 0.0, ..Glass::default() },
+        // Splay with the bend and dispersion on: the dispersed samples follow the turned bend.
+        Glass { splay: 1.0, frost: 0.0, ..Glass::default() },
+        Glass { depth: 60.0, ..Glass::default() },
         Glass { depth: 300.0, ..wide_light() },
     ];
     // Rounded corners without the pane's fill: a fill's curved edge rasters 1–2 levels apart in a
     // cut, and that is the fill, not the glass.
-    for radius in [0.0, 40.0] {
+    // Plain corners work out in closed form; smoothed ones (sharp ones too: any smoothing counts)
+    // from the coverage, the deepest look too big for a core and bending along its normals.
+    for (radius, smoothing) in [(0.0, 0.0), (40.0, 0.0), (0.0, 0.6), (40.0, 0.6)] {
         for g in &looks {
             let (mut d, p, pane) = pane_over_stripes(g.clone(), radius);
+            d.get_mut(pane).unwrap().corners.smoothing = smoothing;
             if radius > 0.0 {
                 d.get_mut(pane).unwrap().fills.clear();
             }
             for (cut, diff) in cut_diffs(&d, p) {
-                assert_eq!(diff, (0, 0), "cut at {cut} px, radius {radius}, with {g:?}");
+                assert_eq!(diff, (0, 0), "cut at {cut} px, radius {radius}, smoothing {smoothing}, with {g:?}");
             }
         }
     }
 }
 
 /// A `w` × `h` pane of glass `g` at (`x`, `y`) over stripes, alone on its page: (document, page,
-/// pane). Each test gives its own size, so tests running at once don't share cached shapes.
+/// pane). Each test gives its own size, so tests running at once don't share cached shapes. Its
+/// corners are smoothed, so its fields come from its coverage and are kept (a plain rounded
+/// rectangle's are worked out in closed form, with nothing to keep).
 fn pane(g: Glass, x: f64, y: f64, w: f64, h: f64) -> (Document, NodeId, NodeId) {
     let mut d = Document::new("glass");
     let p = d.first_page().unwrap();
@@ -150,6 +165,7 @@ fn pane(g: Glass, x: f64, y: f64, w: f64, h: f64) -> (Document, NodeId, NodeId)
     let n = d.get_mut(pane).unwrap();
     n.transform = Affine::translate((x, y));
     n.corners.radii = [12.0; 4];
+    n.corners.smoothing = 0.6;
     n.effects = vec![Effect { kind: EffectKind::Glass(g), visible: true }];
     (d, p, pane)
 }
@@ -165,6 +181,14 @@ fn computed(f: impl FnOnce()) -> u64 {
     crate::glass::glass_fields_computed() - before
 }
 
+/// How many glass shapes, and how many shapes' bend directions towards their core, `f` works out
+/// on this thread.
+fn computed_and_bent(f: impl FnOnce()) -> (u64, u64) {
+    let before = (crate::glass::glass_fields_computed(), crate::glass::glass_bends_computed());
+    f();
+    (crate::glass::glass_fields_computed() - before.0, crate::glass::glass_bends_computed() - before.1)
+}
+
 #[test]
 fn kept_fields_render_the_same_pixels_as_fresh_ones() {
     let (d, p, _) = pane(Glass::default(), 40.0, 30.0, 211.0, 137.0);
@@ -203,6 +227,13 @@ fn what_the_shape_depends_on_works_it_out_again_and_nothing_else_does() {
     assert_eq!(computed(|| drop(render(&d, p, (0.0, 0.0), 1.0))), 1, "part of a pixel");
     d.get_mut(pane).unwrap().width = 230.0;
     assert_eq!(computed(|| drop(render(&d, p, (0.0, 0.0), 1.0))), 1, "shape");
+    let _ = render(&d, p, (0.0, 0.0), 1.0);
+    // A depth a unit more keeps the same margin: the kept shape is reused, and only the bend
+    // towards the core, which moves with the depth, is worked out again, once (a Depth slider
+    // dragged works out nothing else).
+    set(&mut d, Glass { depth: 21.0, ..Glass::default() });
+    assert_eq!(computed_and_bent(|| drop(render(&d, p, (0.0, 0.0), 1.0))), (0, 1), "depth, within the same margin");
+    assert_eq!(computed_and_bent(|| drop(render(&d, p, (0.0, 0.0), 1.0))), (0, 0), "the same depth again");
     set(&mut d, Glass { depth: 70.0, ..Glass::default() });
     assert_eq!(computed(|| drop(render(&d, p, (0.0, 0.0), 1.0))), 1, "depth");
 }

crates/ui-egui/locales/en.toml

@@ -127,6 +127,7 @@ name = "English"
 "Another server, or one that needs its key. The usual server is set in Preferences." = "Another server, or one that needs its key. The usual server is set in Preferences."
 "Any status" = "Any status"
 "Anyone on your network with this code can edit the file, while this app stays open." = "Anyone on your network with this code can edit the file, while this app stays open."
+"Anyone on your network with this code can look at the file, not change it, while this app stays open." = "Anyone on your network with this code can look at the file, not change it, while this app stays open."
 "Anyone with the edit link can change the file; the view link only lets people look. The links carry their secrets: share them like passwords. `figcraft-server links` makes more and revokes them." = "Anyone with the edit link can change the file; the view link only lets people look. The links carry their secrets: share them like passwords. `figcraft-server links` makes more and revokes them."
 "Anyone with this code can edit the file." = "Anyone with this code can edit the file."
 "Anyone with this code can look at the file, not change it." = "Anyone with this code can look at the file, not change it."

crates/ui-egui/src/app/files.rs

@@ -6,12 +6,7 @@ use super::{
 impl FigApp {
     pub fn save_as_dialog(&mut self) {
         if self.services.downloads() {
-            if let Some(r) = self.run("file.saveAs", json!({"data": true}))
-                && self.download(r["name"].as_str().unwrap_or_default(), &r)
-            {
-                self.run("file.markSaved", json!({}));
-                dialogs::file_saved(self, &r);
-            }
+            self.save_download(None);
             return;
         }
         let Ok(name) = self.session.doc().map(|d| d.name.clone()) else { return };
@@ -43,6 +38,17 @@ impl FigApp {
         });
     }
 
+    /// Save by handing the file over as a download. `keep`: the name a Save of a host-opened
+    /// document keeps; `None` is a Save As, under the document's own name.
+    fn save_download(&mut self, keep: Option<&str>) {
+        if let Some(r) = self.run("file.saveAs", json!({"data": true}))
+            && self.download(keep.unwrap_or_else(|| r["name"].as_str().unwrap_or_default()), &r)
+        {
+            self.run("file.markSaved", json!({}));
+            dialogs::file_saved(self, &r);
+        }
+    }
+
     pub fn save(&mut self) {
         // A branch tab saves its main file.
         let tab = figcraft_engine::branches::file_tab(&self.session);
@@ -57,6 +63,9 @@ impl FigApp {
             if self.run("file.save", json!({})).is_some() {
                 self.toast(i18n::tr("Saved"));
             }
+        } else if let Some(name) = self.services.host_file().filter(|n| is_document_file(n)) {
+            // A host-opened document is saved as the file the host gave: the host updates that file.
+            self.save_download(Some(&name));
         } else {
             self.save_as_dialog();
         }
@@ -299,3 +308,8 @@ impl FigApp {
         failed
     }
 }
+
+/// A `.figcraft` file name: the document format a Save writes (a `.fig` is an export copy).
+fn is_document_file(name: &str) -> bool {
+    Path::new(name).extension().and_then(OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("figcraft"))
+}

crates/ui-egui/src/canvas.rs

@@ -195,21 +195,37 @@ fn pointer_event(app: &FigApp, kind: PointerKind, pos: Pos2, m: &egui::Modifiers
 /// labels, handles, comments, versions/branch/dev/live UI and the cursor.
 pub fn show(app: &mut FigApp, ui: &mut Ui, worker: &mut Worker) {
     let rect = ui.max_rect();
-    app.canvas.rect = rect;
+    let old_rect = std::mem::replace(&mut app.canvas.rect, rect);
     let ctx = ui.ctx().clone();
     let ppp = ctx.pixels_per_point();
     let resp = ui.interact(rect, ui.scope_id().with("canvas"), Sense::click_and_drag());
     let key_box = app.ui.key_box;
     crate::a11y::canvas(&mut app.ui.nav, &resp, || key_box.map_or_else(|| describe(&app.session), describe_box));
-    if let Ok(ds) = app.session.ds_mut()
-        && ((ds.view.vw - f64::from(rect.width())).abs() > 0.5 || (ds.view.vh - f64::from(rect.height())).abs() > 0.5)
-    {
-        // Keep the centre; the first sizing after opening re-fits.
+    if let Ok(ds) = app.session.ds_mut() {
+        let resized = (ds.view.vw - f64::from(rect.width())).abs() > 0.5 || (ds.view.vh - f64::from(rect.height())).abs() > 0.5;
+        // The first sizing after opening re-fits.
         let first = ds.view.vw == 1200.0 && ds.view.vh == 800.0;
-        ds.view.vw = f64::from(rect.width());
-        ds.view.vh = f64::from(rect.height());
-        if first {
-            ds.zoom_to_fit();
+        // While a button is held that went down on the canvas (a click that selects shows the
+        // right panel, minimized, and a click that deselects hides it; the left panel and rail
+        // can appear too) the page point under a still pointer stays where it is: the gesture's
+        // own pointer events would otherwise map to another page point and the move handling
+        // would take that for a drag. `to_page` is `origin + (p - rect.min) / z` with
+        // `origin = c - vw / 2 / z`, so the centre moves by half the size change plus the
+        // rect's own move, over the zoom.
+        let held = resp.is_pointer_button_down_on() && !first && old_rect.is_finite();
+        let z = ds.view.zoom.max(1e-9);
+        let (dw, dh) = if resized { (f64::from(rect.width()) - ds.view.vw, f64::from(rect.height()) - ds.view.vh) } else { (0.0, 0.0) };
+        if resized {
+            // Otherwise keep the centre.
+            ds.view.vw = f64::from(rect.width());
+            ds.view.vh = f64::from(rect.height());
+            if first {
+                ds.zoom_to_fit();
+            }
+        }
+        if held {
+            ds.view.cx += (dw / 2.0 + f64::from(rect.min.x - old_rect.min.x)) / z;
+            ds.view.cy += (dh / 2.0 + f64::from(rect.min.y - old_rect.min.y)) / z;
         }
     }
     let own_cursor = input(app, ui, &resp);

crates/ui-egui/src/canvas/handles.rs

@@ -185,6 +185,33 @@ fn drag_id() -> Id {
     Id::unique("figcraft_handle_drag")
 }
 
+/// Whether a gradient handle or stop on the canvas is being dragged, the press that starts it
+/// included: those are the open colour picker's own controls, so the picker stays through the drag
+/// instead of taking the press for one outside it (#1852).
+pub fn gradient_dragging(ctx: &egui::Context) -> bool {
+    matches!(ctx.data(|d| d.get_temp::<Drag>(drag_id())), Some(Drag::Gradient { .. }))
+}
+
+/// Whether the document has a gesture open: a handle drag edits only inside its own.
+fn gesture_open(app: &FigApp) -> bool {
+    app.session.ds().is_ok_and(|d| d.interaction.is_some())
+}
+
+/// A handle drag whose button went up wherever the pointer was (off the canvas, over a panel, the
+/// colour picker or a ruler, outside the window) ends as a release on the handle would: the edit
+/// commits now, instead of waiting, uncommitted, to move the handle to wherever the pointer next
+/// presses. So does one whose gesture Escape or Undo closed under the held button: it stops there
+/// rather than editing on with no gesture open, an undo step a frame. True when a drag ended.
+pub fn end_released_drag(app: &mut FigApp, ctx: &egui::Context) -> bool {
+    let stashed = ctx.data(|d| d.get_temp::<Drag>(drag_id())).is_some();
+    if !stashed || (ctx.input(|i| i.pointer.primary_down()) && gesture_open(app)) {
+        return false;
+    }
+    let _ = app.session.commit_interaction();
+    ctx.data_mut(|d| d.remove::<Drag>(drag_id()));
+    true
+}
+
 /// The gradient being edited (single node, picker open on a gradient paint).
 fn gradient_target(app: &FigApp) -> Option<(NodeId, bool, usize, figcraft_color::Gradient)> {
     let Some(PickerTarget::Paint { fills, index, ids }) = &app.ui.picker else { return None };
@@ -516,6 +543,11 @@ pub fn input(app: &mut FigApp, ctx: &egui::Context, pos: Pos2) -> bool {
     });
     let dragging: Option<Drag> = ctx.data(|d| d.get_temp(drag_id()));
     if let Some(drag) = dragging {
+        // Escape or Undo closed the gesture under the held button: the drag is over.
+        if !gesture_open(app) {
+            ctx.data_mut(|d| d.remove::<Drag>(drag_id()));
+            return true;
+        }
         if down {
             apply(app, &drag, pos, shift);
             ctx.set_cursor_icon(egui::CursorIcon::Grabbing);

crates/ui-egui/src/canvas/input.rs

@@ -183,6 +183,8 @@ pub(super) fn input(app: &mut FigApp, ui: &mut Ui, resp: &egui::Response) -> boo
         if !ctx.input(|i| i.pointer.button_down(egui::PointerButton::Middle) || i.pointer.primary_down()) {
             app.canvas.middle_pan = None;
         }
+        // So is a handle drag.
+        crate::handles::end_released_drag(app, &ctx);
         return true;
     };
     // A press on the canvas gives the keyboard back to it (arrows nudge again).
@@ -230,6 +232,12 @@ pub(super) fn input(app: &mut FigApp, ui: &mut Ui, resp: &egui::Response) -> boo
         }
         return true;
     }
+    // A handle drag whose button went up ends first, wherever on the canvas the pointer is: over a
+    // ruler or a comment pin, which take the pointer below, or over something drawn above the
+    // canvas (the colour picker, a card). The handle had the press, so it has the release too.
+    if crate::handles::end_released_drag(app, &ctx) {
+        return false;
+    }
     if !app.canvas.dragging && (resp.hovered() || app.ui.comments.dragging()) && crate::comments::input(app, &ctx, pos) {
         return false;
     }

crates/ui-egui/src/colorpicker_selection_tests.rs

@@ -215,3 +215,160 @@ fn a_press_in_the_gradient_variable_picker_keeps_the_colour_picker_open() {
     assert!(u.app.ui.picker.is_some(), "the child variable picker is part of the interaction");
     u.button(at, false);
 }
+
+#[test]
+fn dragging_a_gradient_handle_on_the_canvas_keeps_the_picker_open() {
+    // #1852: the handles belong to the picker, so the press that starts a drag is not a press
+    // outside it: the picker and the handles stay, the drag is one undo step, and a press elsewhere
+    // on the layer still closes it.
+    let mut s = Session::new();
+    let a = NodeId(s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 200, "height": 200})).unwrap()["id"].as_u64().unwrap());
+    s.execute("fill.set", &json!({"id": a, "paint": {"type": "linearGradient", "stops": ["#ff0000", "#0000ff"]}})).unwrap();
+    s.execute("select.set", &json!({"ids": [a]})).unwrap();
+    let mut u = Ui::new(s);
+    let target = PickerTarget::Paint { fills: true, index: 0, ids: vec![a] };
+    u.app.open_picker(target.clone(), None);
+    for _ in 0..5 {
+        u.frame(vec![]);
+    }
+    assert_eq!(u.app.ui.picker, Some(target.clone()));
+    let depth = u.app.session.undo_depth().0;
+    let from_handle = |u: &Ui| match &u.app.session.doc().unwrap().node(a).unwrap().fills[0].kind {
+        figcraft_color::PaintKind::Gradient(g) => g.from,
+        _ => panic!("the fill is a gradient"),
+    };
+    assert_eq!(from_handle(&u), (0.5, 0.0), "a linear gradient starts at the top middle");
+    // Drag the start handle from the top middle of the layer to its left middle.
+    let from = u.app.to_screen(200.0, 100.0);
+    let to = u.app.to_screen(100.0, 200.0);
+    u.button(from, true);
+    assert_eq!(u.app.ui.picker, Some(target.clone()), "the press on the handle keeps the picker open");
+    for _ in 0..2 {
+        u.frame(vec![egui::Event::PointerMoved(to)]);
+    }
+    assert_eq!(u.app.ui.picker, Some(target.clone()), "and so does the drag");
+    let (x, y) = from_handle(&u);
+    assert!(x.abs() < 0.02 && (y - 0.5).abs() < 0.02, "the handle followed the pointer: ({x}, {y})");
+    u.button(to, false);
+    u.frame(vec![]);
+    assert_eq!(u.app.ui.picker, Some(target.clone()), "released, the picker is still open");
+    assert_eq!(u.app.session.undo_depth().0, depth + 1, "the drag is one undo step");
+    // A press on the layer away from its handles is still a press outside the picker.
+    let body = u.app.to_screen(250.0, 250.0);
+    u.button(body, true);
+    u.button(body, false);
+    u.frame(vec![]);
+    assert!(u.app.ui.picker.is_none(), "a plain canvas press closes it");
+}
+
+#[test]
+fn a_gradient_drag_released_off_the_canvas_ends_there() {
+    // A handle drag whose button goes up over the sidebar or over the picker itself ends there:
+    // the edit commits, the picker stays, and the next press on the canvas is a plain press (it
+    // closes the picker) rather than a move of the handle to wherever it landed.
+    for over in ["sidebar", "picker"] {
+        let mut s = Session::new();
+        let a = NodeId(s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 200, "height": 200})).unwrap()["id"].as_u64().unwrap());
+        s.execute("fill.set", &json!({"id": a, "paint": {"type": "linearGradient", "stops": ["#ff0000", "#0000ff"]}})).unwrap();
+        s.execute("select.set", &json!({"ids": [a]})).unwrap();
+        let mut u = Ui::new(s);
+        let target = PickerTarget::Paint { fills: true, index: 0, ids: vec![a] };
+        u.app.open_picker(target.clone(), None);
+        for _ in 0..5 {
+            u.frame(vec![]);
+        }
+        let depth = u.app.session.undo_depth().0;
+        let from_handle = |u: &Ui| match &u.app.session.doc().unwrap().node(a).unwrap().fills[0].kind {
+            figcraft_color::PaintKind::Gradient(g) => g.from,
+            _ => panic!("the fill is a gradient"),
+        };
+        u.button(u.app.to_screen(200.0, 100.0), true);
+        u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0, 200.0))]);
+        assert!(crate::handles::gradient_dragging(&u.ctx), "{over}: the handle is being dragged");
+        let spot = match over {
+            "sidebar" => u.app.ui.right_panel_rect.unwrap().center(),
+            _ => u.app.ui.picker_popover.as_ref().unwrap().rect.center(),
+        };
+        if over == "picker" {
+            assert!(u.app.canvas.rect.contains(spot), "the picker lies over the canvas");
+        } else {
+            assert!(!u.app.canvas.rect.contains(spot), "the sidebar is off the canvas");
+        }
+        u.button(spot, false);
+        u.frame(vec![]);
+        assert!(!crate::handles::gradient_dragging(&u.ctx), "{over}: the release ended the drag");
+        assert_eq!(u.app.ui.picker, Some(target.clone()), "{over}: the picker is still open");
+        assert_eq!(u.app.session.undo_depth().0, depth + 1, "{over}: the drag is one undo step");
+        let moved = from_handle(&u);
+        assert!(moved.0.abs() < 0.02 && (moved.1 - 0.5).abs() < 0.02, "{over}: the handle stayed where it was dragged: {moved:?}");
+        // The next press on the layer is a plain one: the handle stays put and the picker closes.
+        let body = u.app.to_screen(250.0, 250.0);
+        u.button(body, true);
+        u.frame(vec![]);
+        assert_eq!(from_handle(&u), moved, "{over}: a later press doesn't move the handle");
+        assert!(u.app.ui.picker.is_none(), "{over}: a later press closes the picker as any outside press does");
+        u.button(body, false);
+    }
+}
+
+/// A rectangle with a linear gradient fill, selected, its picker open and the canvas settled; a
+/// second layer drawn after it leaves an undo step that isn't the gradient's. Rulers on or off.
+fn gradient_ui(rulers: bool) -> Ui {
+    let mut s = Session::new();
+    if rulers {
+        s.execute("view.rulers", &json!({"on": true})).unwrap();
+    }
+    let a = NodeId(s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 200, "height": 200})).unwrap()["id"].as_u64().unwrap());
+    s.execute("fill.set", &json!({"id": a, "paint": {"type": "linearGradient", "stops": ["#ff0000", "#0000ff"]}})).unwrap();
+    s.execute("shape.rectangle", &json!({"x": 400, "y": 100, "width": 20, "height": 20})).unwrap();
+    s.execute("select.set", &json!({"ids": [a]})).unwrap();
+    let mut u = Ui::new(s);
+    u.app.open_picker(PickerTarget::Paint { fills: true, index: 0, ids: vec![a] }, None);
+    for _ in 0..5 {
+        u.frame(vec![]);
+    }
+    u
+}
+
+#[test]
+fn a_gradient_drag_released_over_a_ruler_ends_there() {
+    // The rulers take the pointer on the canvas before the handles do: the release still ends the
+    // drag, as one undo step, instead of leaving it waiting for the next press.
+    let mut u = gradient_ui(true);
+    let depth = u.app.session.undo_depth().0;
+    u.button(u.app.to_screen(200.0, 100.0), true);
+    u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0, 200.0))]);
+    assert!(crate::handles::gradient_dragging(&u.ctx), "the handle is being dragged");
+    let r = u.app.canvas.rect;
+    let ruler = egui::Pos2::new(r.min.x + 5.0, r.center().y);
+    assert!(!u.app.ui.picker_popover.as_ref().unwrap().rect.contains(ruler), "the ruler is not under the picker");
+    u.button(ruler, false);
+    assert!(!crate::handles::gradient_dragging(&u.ctx), "the release over the ruler ended the drag");
+    assert_eq!(u.app.session.undo_depth().0, depth + 1, "the drag is one undo step");
+}
+
+#[test]
+fn a_gradient_drag_whose_gesture_closes_under_the_held_button_stops_editing() {
+    // Escape (the picker closes and commits) or Undo ends the gesture while the button is still
+    // down: moving on edits nothing more, rather than adding an undo step every frame.
+    for close in ["escape", "undo"] {
+        let mut u = gradient_ui(false);
+        u.button(u.app.to_screen(200.0, 100.0), true);
+        u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0, 200.0))]);
+        assert!(crate::handles::gradient_dragging(&u.ctx), "{close}: the handle is being dragged");
+        if close == "escape" {
+            crate::colorpicker::close(&mut u.app);
+        } else {
+            assert!(u.app.session.undo().unwrap(), "{close}: there is a step to undo");
+        }
+        let depth = u.app.session.undo_depth().0;
+        let doc = u.app.session.doc().unwrap().clone();
+        for k in 1..=4 {
+            u.frame(vec![egui::Event::PointerMoved(u.app.to_screen(100.0 + 20.0 * f64::from(k), 200.0))]);
+        }
+        assert!(!crate::handles::gradient_dragging(&u.ctx), "{close}: the drag is over");
+        assert_eq!(u.app.session.undo_depth().0, depth, "{close}: no undo step a frame");
+        assert!(*u.app.session.doc().unwrap() == doc, "{close}: the gradient stays where the gesture left it");
+        u.button(u.app.to_screen(180.0, 200.0), false);
+    }
+}

crates/ui-egui/src/dialogs/credits.rs

@@ -247,6 +247,8 @@ const SORT_ARROW_W: f32 = 12.0;
 /// Padding inside each cell, on each side.
 const CELL_PAD: f32 = 6.0;
 const NAME_MIN_W: f32 = 110.0;
+/// The narrowest a credits column can be dragged.
+const MIN_COLUMN: f32 = 28.0;
 
 /// About ▸ Contributors: a name toggle, a sort, and the list as a grab bag or a table.
 pub fn contributors_ui(ui: &mut egui::Ui) {
@@ -341,13 +343,17 @@ fn column_width<'a>(ui: &egui::Ui, header: &str, cells: impl Iterator<Item = &'a
 }
 
 /// A credits table: columns of `widths`, the `None` one taking what the others leave (at least
-/// `flex_min`). The header stays put while the rows scroll, within `height` (header included). Too
-/// narrow for every column, it scrolls sideways rather than clip one.
+/// [`NAME_MIN_W`]). The header stays put while the rows scroll, within `height` (header included). Too
+/// narrow for every column, it scrolls sideways rather than clip one. Every
+/// column edge can be dragged, down to [`MIN_COLUMN`] (the `None` column to [`NAME_MIN_W`]): widening
+/// a column grows the table, as in a spreadsheet, and only then does it scroll sideways. When the
+/// window, a column's width or `flex_text` (the width the `None` column's text needs) changes, the
+/// columns go back to this fit, dropping any dragged widths.
 fn credits_table(
     ui: &mut egui::Ui,
     id: &str,
     widths: &[Option<f32>],
-    flex_min: f32,
+    flex_text: f32,
     height: f32,
     header: impl FnOnce(egui_extras::TableRow<'_, '_>),
     body: impl FnOnce(egui_extras::TableBody<'_>),
@@ -358,21 +364,31 @@ fn credits_table(
     // The table puts a row gap under its header.
     let body_h = (height - TABLE_HEADER_H - ui.spacing().item_spacing.y).max(TABLE_ROW_H);
     egui::ScrollArea::horizontal().id_salt((id, "h")).auto_shrink([false, true]).show(ui, |ui| {
-        let flex = (ui.available_width() - fixed).max(flex_min);
+        let flex = (ui.available_width() - fixed).max(NAME_MIN_W);
         // No gaps between cells: their padding spaces them, and the header rule runs unbroken.
         ui.spacing_mut().item_spacing.x = 0.0;
+        // The table keeps its own column widths, so a change in what they were fitted to has to clear
+        // them. Scrolling can nudge the available width, so this compares the clip rect, which scrolling
+        // never moves.
+        let fit = egui::Id::unique(("credits_fit", id));
+        let measured = (widths.to_vec(), flex_text, ui.clip_rect().width());
+        let refit = ui.data_mut(|d| d.get_temp::<(Vec<Option<f32>>, f32, f32)>(fit)).as_ref() != Some(&measured);
+        ui.data_mut(|d| d.insert_temp(fit, measured));
         let mut b = egui_extras::TableBuilder::new(ui)
             .id_salt(id)
             .striped(true)
-            .resizable(false)
+            .resizable(true)
             .auto_shrink([false, false])
             .min_scrolled_height(body_h)
             .max_scroll_height(body_h)
             .cell_layout(egui::Layout::left_to_right(egui::Align::Center));
+        if refit {
+            b.reset();
+        }
         for w in widths {
             b = b.column(match w {
-                Some(w) => egui_extras::Column::exact(*w),
-                None => egui_extras::Column::exact(flex).clip(true),
+                Some(w) => egui_extras::Column::initial(*w).at_least(MIN_COLUMN).clip(true),
+                None => egui_extras::Column::initial(flex).at_least(NAME_MIN_W).clip(true),
             });
         }
         b.header(TABLE_HEADER_H, header).body(body);
@@ -395,11 +411,13 @@ fn table(ui: &mut egui::Ui, list: &[&Contributor], v: &mut View, height: f32) {
     let t = Tokens::get(ui.ctx());
     let names = v.names;
     let widths = contributor_widths(ui, list);
+    let shown: Vec<String> = list.iter().map(|c| c.name(names)).collect();
+    let name_text = column_width(ui, SortKey::Name.label().1, shown.iter().map(String::as_str));
     credits_table(
         ui,
         "credits_table",
         &widths,
-        NAME_MIN_W,
+        name_text,
         height,
         |mut header| {
             for k in SortKey::ALL {
@@ -522,12 +540,13 @@ fn models_in(ui: &mut egui::Ui, models: &[Model], total_commits: u64) {
     let total = total_commits.max(models.iter().map(|m| m.commits).max().unwrap_or(0));
     let rows: Vec<[String; 6]> = models.iter().map(|m| model_cells(m, total)).collect();
     let widths = model_widths(ui, &rows);
+    let model_text = column_width(ui, tr(MODEL_HEADS[1]), rows.iter().filter_map(|r| r.get(1)).map(String::as_str));
     let numeric = |i: usize| i >= 3;
     credits_table(
         ui,
         "credits_models",
         &widths,
-        NAME_MIN_W,
+        model_text,
         table_height(ui, rows.len()),
         |mut header| {
             for (i, h) in MODEL_HEADS.iter().enumerate() {

crates/ui-egui/src/dialogs/credits/ui_tests.rs

@@ -267,3 +267,122 @@ fn the_about_window_draws_every_tab() {
         assert_eq!(app.ui.about_tab, tab);
     }
 }
+
+const WINDOW: f32 = 640.5;
+const WIDTHS: [Option<f32>; 3] = [None, Some(80.0), Some(80.0)];
+const NAME: f32 = 120.0;
+
+/// One frame of a table long enough to scroll, in a window `width` wide; the rects of its header cells.
+fn table_frame(ctx: &egui::Context, width: f32, widths: &[Option<f32>], name: f32, events: Vec<egui::Event>) -> Vec<Rect> {
+    let screen_rect = Some(Rect::from_min_size(egui::Pos2::ZERO, vec2(width, 300.0)));
+    let raw = egui::RawInput { screen_rect, events, ..Default::default() };
+    let mut cells = Vec::new();
+    let out = ctx.run_ui(raw, |ui| {
+        cells.clear();
+        credits_table(
+            ui,
+            "test",
+            widths,
+            name,
+            240.0,
+            |mut header| {
+                for _ in widths {
+                    header.col(|ui| cells.push(ui.max_rect()));
+                }
+            },
+            |body| {
+                body.rows(TABLE_ROW_H, 40, |mut row| {
+                    for _ in widths {
+                        row.col(|ui| {
+                            ui.label("x");
+                        });
+                    }
+                });
+            },
+        );
+    });
+    out.drop_without_applying_deltas();
+    cells
+}
+
+/// [`table_frame`] at the usual size.
+fn settled_frame(ctx: &egui::Context) -> Vec<Rect> {
+    table_frame(ctx, WINDOW, &WIDTHS, NAME, Vec::new())
+}
+
+/// A new context with the table open and settled, and the rects of its header cells.
+fn opened_table() -> (egui::Context, Vec<Rect>) {
+    let ctx = egui::Context::default();
+    settled_frame(&ctx);
+    let cells = settled_frame(&ctx);
+    (ctx, cells)
+}
+
+/// Drags a column's right edge (cells have no gap between them), then lets go.
+fn drag_edge(ctx: &egui::Context, cell: Rect, by: f32) {
+    let start = egui::pos2(cell.right(), cell.center().y);
+    let halfway = start + vec2(by / 2.0, 0.0);
+    let end = start + vec2(by, 0.0);
+    let moved = egui::Event::PointerMoved;
+    let button = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    for event in [moved(start), button(start, true), moved(halfway), moved(end), button(end, false)] {
+        table_frame(ctx, WINDOW, &WIDTHS, NAME, vec![event]);
+    }
+}
+
+#[test]
+fn every_column_can_be_dragged_at_its_right_edge_and_stays_there() {
+    let (_, opened) = opened_table();
+    for (dragged, cell) in opened.iter().enumerate() {
+        let (ctx, _) = opened_table();
+        drag_edge(&ctx, *cell, -30.0);
+        settled_frame(&ctx);
+        let after = settled_frame(&ctx);
+        for (column, (was, now)) in opened.iter().zip(&after).enumerate() {
+            let want = if column == dragged { was.width() - 30.0 } else { was.width() };
+            assert!((now.width() - want).abs() < 1.0, "dragging column {dragged}: column {column} is {now:?}, was {was:?}");
+        }
+    }
+}
+
+#[test]
+fn a_changed_fit_replaces_the_column_widths() {
+    let (ctx, opened) = opened_table();
+    drag_edge(&ctx, opened[0], -30.0);
+    let longer_name = table_frame(&ctx, WINDOW, &WIDTHS, NAME + 80.0, Vec::new());
+    assert!((longer_name[0].width() - opened[0].width()).abs() < 1.0, "a longer name drops a dragged width: {longer_name:?}");
+    let wider = table_frame(&ctx, WINDOW, &[None, Some(200.0), Some(80.0)], NAME, Vec::new());
+    let widths: Vec<f32> = wider.iter().map(|c| c.width().round()).collect();
+    assert!(widths.ends_with(&[200.0, 80.0]), "a longer cell widens its column: {widths:?}");
+    // The table fills the window, which the layout rounds to whole points.
+    assert!(wider[2].right() <= WINDOW.ceil(), "the table still fits the window: {wider:?}");
+    let narrower = table_frame(&ctx, 400.0, &WIDTHS, NAME, Vec::new());
+    assert!(narrower[2].right() <= 400.0, "a narrower window refits the table: {narrower:?}");
+}
+
+#[test]
+fn scrolling_sideways_keeps_dragged_widths() {
+    let (ctx, opened) = opened_table();
+    drag_edge(&ctx, opened[0], 100.0);
+    settled_frame(&ctx);
+    let dragged = settled_frame(&ctx);
+    assert!((dragged[0].width() - opened[0].width() - 100.0).abs() < 1.0, "the drag took: {dragged:?}");
+    table_frame(&ctx, WINDOW, &WIDTHS, NAME, vec![egui::Event::PointerMoved(dragged[0].center())]);
+    let mut scrolled = false;
+    for delta in [-13.3, -27.77, -41.1, 30.6] {
+        let wheel = egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(delta, 0.0),
+            modifiers: egui::Modifiers::NONE,
+            phase: egui::TouchPhase::Move,
+        };
+        table_frame(&ctx, WINDOW, &WIDTHS, NAME, vec![wheel]);
+        for _ in 0..8 {
+            let cells = settled_frame(&ctx);
+            assert!((cells[0].width() - dragged[0].width()).abs() < 1.0, "scrolled by {delta}: {cells:?}");
+            scrolled |= cells[0].left() < dragged[0].left() - 1.0;
+        }
+    }
+    assert!(scrolled, "the wheel never moved the table sideways");
+}

crates/ui-egui/src/field_tests.rs

@@ -667,11 +667,11 @@ fn the_glass_light_intensity_field_has_a_label() {
     u.ctx.data_mut(|d| d.insert_temp(Id::unique(("fx_open", 0usize)), true));
     u.frame(vec![]);
     let shapes = u.frame_output(vec![]).shapes;
-    let lead = u.ctx.read_response(Id::unique(("fx_gi", 0usize)).with("lead")).expect("the intensity field is shown").rect;
+    let lead = u.ctx.read_response(Id::unique(("fx", "lightIntensity", 0usize)).with("lead")).expect("the intensity field is shown").rect;
     let labels: Vec<(String, bool)> =
         painted_texts(&shapes).into_iter().filter(|(_, _, at)| lead.contains(at.center())).map(|(text, cut, _)| (text, cut)).collect();
     assert_eq!(labels, [("Intensity".to_string(), false)], "labelled, and not cut short");
-    let field = u.ctx.read_response(Id::unique(("fx_gi", 0usize)).with("field")).expect("its value").rect;
+    let field = u.ctx.read_response(Id::unique(("fx", "lightIntensity", 0usize)).with("field")).expect("its value").rect;
     assert_eq!(field.max.x - lead.min.x, GLASS_FIELD_W, "the width the next test measures against");
 }
 

crates/ui-egui/src/host_save_tests.rs

@@ -0,0 +1,60 @@
+//! In a page host the browser hands files to the host: a Save of the document the host opened goes
+//! out under the host's file name, a Save As under the document's own name.
+
+use std::sync::{Arc, Mutex};
+
+use figcraft_engine::Session;
+use serde_json::json;
+
+use crate::{FigApp, Services};
+
+type Saved = Arc<Mutex<Vec<String>>>;
+
+/// Services that save by downloads, with a document file the host opened.
+struct Host {
+    got: Saved,
+    file: Option<&'static str>,
+}
+
+impl Services for Host {
+    fn downloads(&self) -> bool {
+        true
+    }
+    fn download(&mut self, name: &str, _bytes: &[u8]) -> bool {
+        self.got.lock().unwrap().push(name.to_string());
+        true
+    }
+    fn host_file(&self) -> Option<String> {
+        self.file.map(str::to_string)
+    }
+}
+
+fn app(file: Option<&'static str>) -> (FigApp, Saved) {
+    let got = Saved::default();
+    let mut app = FigApp::new(Session::empty(), Box::new(Host { got: got.clone(), file }));
+    app.session.execute("file.new", &json!({"name": "Original"})).unwrap();
+    (app, got)
+}
+
+#[test]
+fn save_keeps_the_name_the_host_opened() {
+    let (mut app, got) = app(Some("client.figcraft"));
+    app.save();
+    assert_eq!(got.lock().unwrap().as_slice(), ["client.figcraft"]);
+}
+
+#[test]
+fn save_as_uses_the_document_s_own_name() {
+    let (mut app, got) = app(Some("client.figcraft"));
+    app.save_as_dialog();
+    assert_eq!(got.lock().unwrap().as_slice(), ["Original.figcraft"]);
+}
+
+#[test]
+fn without_a_host_file_or_for_a_copy_format_save_is_a_save_as() {
+    for file in [None, Some("design.json"), Some("export.fig")] {
+        let (mut app, got) = app(file);
+        app.save();
+        assert_eq!(got.lock().unwrap().as_slice(), ["Original.figcraft"], "{file:?}");
+    }
+}

crates/ui-egui/src/lib.rs

@@ -124,6 +124,8 @@ mod home_recents_tests;
 #[cfg(test)]
 mod home_tests;
 #[cfg(test)]
+mod host_save_tests;
+#[cfg(test)]
 mod idle_tests;
 #[cfg(test)]
 mod ime_tests;

crates/ui-egui/src/live.rs

@@ -108,6 +108,9 @@ pub struct LiveUi {
     focus_join: bool,
     /// Share on the local network (else online, through the server in Preferences).
     pub local: bool,
+    /// What the code a local network share starts with lets people do: edit, or only look (the
+    /// edit code then doesn't show until it is picked).
+    pub local_access: Access,
     /// The Share popover's Advanced part shows; what it sets for a local network share: only
     /// this computer can join, and the port (empty: the usual one).
     pub advanced: bool,
@@ -852,6 +855,7 @@ fn start_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens) {
     }
     if local {
         widgets::label(ui, tr("People on your network join with a code. Nothing goes through a server."), t.text_secondary);
+        local_access_choice(app, ui);
     } else {
         online_note(app, ui, t, &server);
     }
@@ -861,10 +865,24 @@ fn start_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens) {
     join_and_advanced(app, ui, t, |app, ui, t| share_advanced(app, ui, t, local, &server));
 }
 
+/// What the code of a local network share lets people do, picked before it starts: edit the file
+/// or only look at it.
+fn local_access_choice(app: &mut FigApp, ui: &mut Ui) {
+    let levels: Vec<(Access, &str)> = LEVELS.into_iter().filter(|(a, _)| *a != Access::Comment).collect();
+    let labels: Vec<&str> = levels.iter().map(|(_, l)| tr(l)).collect();
+    let at = levels.iter().position(|(a, _)| *a == app.ui.live.local_access).unwrap_or_default();
+    if let Some((a, _)) = widgets::segmented_text(ui, &labels, at).and_then(|i| levels.get(i)) {
+        app.ui.live.local_access = *a;
+    }
+}
+
 /// Start sharing the open file on the local network, or online on `server` (the one in
 /// Preferences).
 fn start_sharing(app: &mut FigApp, local: bool, server: &str) {
     let mut params = json!({"via": if local { "local" } else { "online" }});
+    if local {
+        params["access"] = json!(app.ui.live.local_access.id());
+    }
     if local && app.ui.live.this_computer {
         params["bind"] = json!("local");
     }
@@ -1068,6 +1086,7 @@ fn share_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens, share: &Share) {
         (true, Access::View) => tr("Anyone with this code can look at the file, not change it."),
         (true, Access::Comment) => tr("Anyone with this code can look at the file and comment on it, not change it."),
         (true, Access::Edit) => tr("Anyone with this code can edit the file."),
+        (false, Access::View) => tr("Anyone on your network with this code can look at the file, not change it, while this app stays open."),
         (false, _) => tr("Anyone on your network with this code can edit the file, while this app stays open."),
     };
     widgets::label(ui, who, t.text_secondary);
@@ -1081,7 +1100,8 @@ fn share_ui(app: &mut FigApp, ui: &mut Ui, t: &Tokens, share: &Share) {
 }
 
 /// What the code shown lets people do, to pick from the levels the share has links for: a server
-/// has links (and codes) for looking only and for commenting; a session this app hosts doesn't.
+/// has links (and codes) for looking only and for commenting; a session this app hosts on the
+/// local network has one for looking only.
 fn access_choice(app: &mut FigApp, ui: &mut Ui, share: &Share) {
     let levels: Vec<(Access, &str)> = LEVELS.into_iter().filter(|(a, _)| share.links.as_ref().is_some_and(|l| l.of(*a).is_some())).collect();
     if levels.len() < 2 {

crates/ui-egui/src/live_docs_tests.rs

@@ -17,6 +17,7 @@ type Queue = Arc<Mutex<Vec<(u64, LiveEvent)>>>;
 struct Hosting(Queue);
 
 impl LiveLink for Hosting {
+    /// Host at once, with an invite link and nobody else in the session.
     fn host(&mut self, session: u64, _: HostOptions) -> Result<SessionInfo, String> {
         let address = format!("127.0.0.1:{}", 47_899 + session);
         Ok(SessionInfo {
@@ -31,6 +32,7 @@ impl LiveLink for Hosting {
             address,
             network: false,
             access: Access::Edit,
+            view: None,
         })
     }
     fn join(&mut self, _: u64, _: &str, _: &str) -> Result<(), String> {

crates/ui-egui/src/live_server_tests.rs

@@ -44,6 +44,7 @@ pub(crate) fn joined(h: &mut Harness, access: Access) {
         address: "127.0.0.1:47900".into(),
         network: false,
         access,
+        view: None,
     };
     h.send(vec![LiveEvent::Welcome { info, peers: vec![] }, LiveEvent::Sync(w)]);
     h.frames(2);

crates/ui-egui/src/live_share_tests.rs

@@ -1,7 +1,7 @@
 //! Sharing with a join code in the window: the Share popover not sharing (online or the local
 //! network, one Start button, the rest under Advanced), sharing online (the code large, copying,
 //! what it lets people do, who is here, stop: the file stays on the server, not shared, and can
-//! be shared again or removed), sharing on the local network, a server without
+//! be shared again or removed), sharing on the local network (to edit, or to look only), a server without
 //! codes, joining with the one join field (the popover, the home screen, the Join dialog), its
 //! errors, the server preference, and an idle popover asking for no frames.
 
@@ -13,7 +13,7 @@ use figcraft_engine::figcraft_collab::code::{self, Local};
 use figcraft_engine::figcraft_collab::message::ClientMsg;
 use figcraft_engine::live::{
     Access, DEFAULT_SERVER, Event as LiveEvent, HostOptions, LiveLink, NetReply, NetRequest, Peer, Presence, PublishOptions, Published, Role,
-    SessionInfo, Shared as SharedLinks, SharedLink, Status,
+    SessionInfo, Shared as SharedLinks, SharedLink, Status, WayIn,
 };
 use serde_json::json;
 
@@ -53,9 +53,12 @@ struct Link(Shared);
 
 /// Where the scripted host listens, and its session's secret.
 const HOST: Local = Local { ip: std::net::Ipv4Addr::new(192, 168, 1, 20), port: 47_900, secret: 0x123_4567_89AB };
+/// The same session's view-only secret.
+const VIEW: Local = Local { secret: 0xBA9_8765_4321, ..HOST };
 /// A link without a code in it (an address a code can't carry).
 const PLAIN: &str = "figcraft://join?host=[fd00::1]:47900&file=f&token=AbCdEfGhIjKlMnOpQrStUv";
 
+/// What the scripted link says about a session you are in as `role`, invited with `link`.
 fn info(role: Role, link: &str) -> SessionInfo {
     SessionInfo {
         role,
@@ -69,16 +72,20 @@ fn info(role: Role, link: &str) -> SessionInfo {
         address: "192.168.1.20:47900".into(),
         network: true,
         access: Access::Edit,
+        view: None,
     }
 }
 
 impl LiveLink for Link {
+    /// Host as the network link does: port 6 stands for an address a code can't carry, and a
+    /// share for looking only gets a view link too.
     fn host(&mut self, session: u64, opts: HostOptions) -> Result<SessionInfo, String> {
         let mut s = self.0.lock().unwrap();
         s.session = session;
-        let link = if opts.port == Some(6) { PLAIN.to_string() } else { HOST.link() };
+        let (link, view) = if opts.port == Some(6) { (PLAIN.to_string(), PLAIN.replace("AbCd", "View")) } else { (HOST.link(), VIEW.link()) };
+        let view = opts.view.then(|| WayIn { url: view.replace("figcraft://join?host=", "ws://"), link: view });
         s.hosted.push(opts);
-        Ok(info(Role::Host, &link))
+        Ok(SessionInfo { view, ..info(Role::Host, &link) })
     }
     fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> {
         let mut s = self.0.lock().unwrap();
@@ -208,6 +215,8 @@ fn document_arrives(h: &mut Harness, script: &Shared) {
     h.frames(3);
 }
 
+/// Not sharing: one way to start (online or the local network, which also offers Can edit / Can
+/// view) and one to join, with addresses, keys and ports under Advanced.
 #[test]
 fn not_sharing_the_popover_offers_one_way_to_start_and_one_to_join() {
     let (mut h, script) = harness();
@@ -223,9 +232,11 @@ fn not_sharing_the_popover_offers_one_way_to_start_and_one_to_join() {
     }
     let shapes = click(&mut h, &shapes, "Advanced");
     assert!(has_text(&shapes, "Publish to another server…") && !has_text(&shapes, "Port"));
-    // The local network: what it means, and its own advanced part.
+    assert!(!has_text(&shapes, "Can view"), "online, what the code lets people do is picked once shared");
+    // The local network: what it means, what the code lets people do, and its own advanced part.
     let shapes = click(&mut h, &shapes, "Local network");
     assert!(has_text(&shapes, "People on your network join with a code. Nothing goes through a server."));
+    assert!(has_text(&shapes, "Can edit") && has_text(&shapes, "Can view") && !has_text(&shapes, "Can comment"));
     assert!(has_text(&shapes, "This computer only") && has_text(&shapes, "Port") && !has_text(&shapes, "Publish to another server…"));
     assert!(!has_text(&shapes, "About this server"));
     assert_eq!(crate::live::inspect(&h.app)["local"], true);
@@ -377,6 +388,8 @@ fn a_file_that_is_not_shared_can_be_removed_from_the_server_after_asking() {
     assert!(has_text(&shapes, "Share this file") && has_text(&shapes, "Removed from the server"));
 }
 
+/// Sharing on the local network shows the longer code, copies it and its link, and Can view
+/// shows the view-only code; Advanced picks this computer only and a port.
 #[test]
 fn sharing_on_the_local_network_shows_its_longer_code() {
     let (mut h, script) = harness();
@@ -388,15 +401,24 @@ fn sharing_on_the_local_network_shows_its_longer_code() {
         assert!(has_text(&shapes, t), "sharing shows {t:?}");
     }
     assert!(has_text(&shapes, "Anyone on your network with this code can edit the file, while this app stays open."));
-    assert!(!has_text(&shapes, "Can view"), "everyone edits on the local network");
+    assert!(has_text(&shapes, "Can view") && !has_text(&shapes, "Can comment"), "a view-only code too, no comment code");
     {
         let s = script.lock().unwrap();
-        assert!(s.hosted[0].short && s.hosted[0].bind == figcraft_engine::live::Bind::Lan && s.hosted[0].port.is_none());
+        assert!(s.hosted[0].short && s.hosted[0].view && s.hosted[0].bind == figcraft_engine::live::Bind::Lan && s.hosted[0].port.is_none());
         assert!(s.published.is_empty(), "nothing goes to a server");
     }
     let shapes = click(&mut h, &shapes, "Copy code");
     let shapes = click(&mut h, &shapes, "Copy link");
-    assert_eq!(script.lock().unwrap().copied, [shown, HOST.link()]);
+    assert_eq!(script.lock().unwrap().copied, [shown.clone(), HOST.link()]);
+    // Can view shows the view-only code and link, and says what they let people do.
+    let shapes = click(&mut h, &shapes, "Can view");
+    let view = code::grouped(&VIEW.code());
+    assert!(has_text(&shapes, &view) && !has_text(&shapes, &shown));
+    assert!(has_text(&shapes, "Anyone on your network with this code can look at the file, not change it, while this app stays open."));
+    let shapes = click(&mut h, &shapes, "Copy code");
+    let shapes = click(&mut h, &shapes, "Copy link");
+    assert_eq!(script.lock().unwrap().copied[2..], [view, VIEW.link()]);
+    assert_eq!(script.lock().unwrap().hosted.len(), 1, "the same session");
     // Advanced: this computer only, on a port of your choosing.
     let shapes = click(&mut h, &shapes, "Stop sharing");
     let shapes = click(&mut h, &shapes, "Advanced");
@@ -407,6 +429,27 @@ fn sharing_on_the_local_network_shows_its_longer_code() {
     assert!(s.hosted[1].bind == figcraft_engine::live::Bind::Local && s.hosted[1].port == Some(6));
 }
 
+/// Can view picked before a local network share starts: the view-only code is the one shown, so
+/// the edit code isn't on the screen until Can edit is picked.
+#[test]
+fn a_local_share_can_start_for_looking_only() {
+    let (mut h, script) = harness();
+    let shapes = open(&mut h);
+    let shapes = click(&mut h, &shapes, "Local network");
+    let shapes = click(&mut h, &shapes, "Can view");
+    assert_eq!(h.app.ui.live.local_access, Access::View);
+    assert_eq!(h.app.session.live().status, Status::Off, "picking starts nothing");
+    let shapes = click(&mut h, &shapes, "Start sharing");
+    let (view, edit) = (code::grouped(&VIEW.code()), code::grouped(&HOST.code()));
+    assert!(has_text(&shapes, &view) && !has_text(&shapes, &edit));
+    assert!(has_text(&shapes, "Anyone on your network with this code can look at the file, not change it, while this app stays open."));
+    assert_eq!(crate::live::inspect(&h.app)["share"]["access"], "view");
+    assert!(script.lock().unwrap().hosted[0].view);
+    // Can edit shows the edit code.
+    let shapes = click(&mut h, &shapes, "Can edit");
+    assert!(has_text(&shapes, &edit) && has_text(&shapes, "Anyone on your network with this code can edit the file, while this app stays open."));
+}
+
 #[test]
 fn without_a_code_the_link_is_shared_instead() {
     // A server from before join codes.

crates/ui-egui/src/live_tests.rs

@@ -131,6 +131,7 @@ impl Harness {
             address: "127.0.0.1:47900".into(),
             network: false,
             access: figcraft_engine::live::Access::Edit,
+            view: None,
         };
         self.send(vec![LiveEvent::Welcome { info, peers: vec![Peer { client_id: 1, name: "Hana".into(), color: "#9747FF".into() }] }]);
     }

crates/ui-egui/src/online_tests.rs

@@ -48,6 +48,7 @@ type Shared = Arc<Mutex<Script>>;
 
 struct Link(Shared);
 
+/// A session you are in as `role` under `name`.
 fn info(role: Role, name: &str) -> SessionInfo {
     SessionInfo {
         role,
@@ -61,6 +62,7 @@ fn info(role: Role, name: &str) -> SessionInfo {
         address: "192.168.1.20:47900".into(),
         network: true,
         access: Access::Edit,
+        view: None,
     }
 }
 

crates/ui-egui/src/panel_width_tests.rs

@@ -346,3 +346,130 @@ fn a_narrow_window_shows_one_side_panel_at_a_time() {
     let wide = canvas_width(&mut app, vec2(1440.0, 900.0));
     assert!(wide > 600.0 && wide < 1100.0, "a wide window shows both panels beside the canvas ({wide})");
 }
+
+/// Five frames side by side at 46% zoom with the interface minimized and nothing selected.
+fn minimized_row() -> (Ui, Vec<figcraft_doc::NodeId>) {
+    let mut s = Session::new();
+    let mut ids = Vec::new();
+    for k in 0..5 {
+        let r = s.execute("frame.create", &json!({"x": k * 470, "y": 0, "width": 400, "height": 600})).unwrap();
+        ids.push(figcraft_engine::params::id_of(&r["id"]).unwrap());
+    }
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    let mut u = Ui::new(s);
+    u.app.run("view.minimize", json!({"on": true}));
+    u.app.run("view.set", json!({"zoom": 0.46, "cx": 1500, "cy": 300}));
+    for _ in 0..4 {
+        u.frame(vec![]);
+    }
+    (u, ids)
+}
+
+fn frame_x(u: &Ui, id: figcraft_doc::NodeId) -> f64 {
+    u.app.session.doc().unwrap().world_bounds(id).unwrap().x0
+}
+
+/// A click on a frame while minimized selects it and shows the right panel (the canvas gets
+/// narrower): the frame stays where it was, and no step is added to the history.
+#[test]
+fn a_click_that_shows_the_right_panel_does_not_move_the_frame() {
+    let (mut u, ids) = minimized_row();
+    assert!(u.app.ui.right_panel_rect.is_none(), "nothing selected: no right panel");
+    let wide = u.app.canvas.rect.width();
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    let p = u.app.to_screen(1880.0 + 200.0, 300.0);
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    u.frame(vec![]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() }]);
+    for _ in 0..4 {
+        u.frame(vec![]);
+    }
+    assert_eq!(u.app.session.selection(), vec![ids[4]], "the click selects the frame");
+    assert!(u.app.ui.right_panel_rect.is_some(), "the right panel shows");
+    assert!(u.app.canvas.rect.width() < wide - 100.0, "the canvas is narrower");
+    assert_eq!(frame_x(&u, ids[4]), 1880.0, "a click did not move the frame");
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps, "no history step");
+}
+
+/// A real drag still moves the frame, by the pointer's screen movement over the zoom, in one step.
+#[test]
+fn a_drag_after_the_right_panel_shows_moves_the_frame_by_the_pointer() {
+    let (mut u, ids) = minimized_row();
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    let p = u.app.to_screen(1880.0 + 200.0, 300.0);
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    u.frame(vec![Event::PointerMoved(p + vec2(50.0, 0.0))]);
+    u.frame(vec![Event::PointerMoved(p + vec2(100.0, 0.0))]);
+    u.frame(vec![Event::PointerButton {
+        pos: p + vec2(100.0, 0.0),
+        button: egui::PointerButton::Primary,
+        pressed: false,
+        modifiers: Default::default(),
+    }]);
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert!(u.app.ui.right_panel_rect.is_some(), "the right panel shows");
+    let moved = frame_x(&u, ids[4]) - 1880.0;
+    assert!((moved - 100.0 / 0.46).abs() < 6.0, "moved by 100 points over the zoom, got {moved}");
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps + 1, "one step");
+}
+
+/// Clicking empty canvas deselects and hides the right panel again; the marquee that starts there
+/// has no offset: nothing moves and nothing is selected.
+#[test]
+fn a_click_that_hides_the_right_panel_does_not_move_the_frame() {
+    let (mut u, ids) = minimized_row();
+    u.app.run("select.set", json!({"ids": [ids[4]]}));
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert!(u.app.ui.right_panel_rect.is_some());
+    let p = u.app.to_screen(1880.0 + 200.0, 1000.0);
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() }]);
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert!(u.app.ui.right_panel_rect.is_none(), "deselected: no right panel");
+    assert_eq!(frame_x(&u, ids[4]), 1880.0);
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps);
+}
+
+/// The left sidebar and rail appearing while a press is held (Minimize toggled off mid-press)
+/// moves the canvas's left edge: a still pointer keeps its page point, so the release moves nothing.
+#[test]
+fn a_held_press_keeps_its_page_point_when_the_canvas_moves() {
+    let (mut u, ids) = minimized_row();
+    u.app.run("select.set", json!({"ids": [ids[3]]}));
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    let steps = u.app.session.ds().unwrap().history.undo.len();
+    let left = u.app.canvas.rect.min.x;
+    let p = u.app.to_screen(1880.0 + 200.0, 300.0);
+    u.frame(vec![Event::PointerMoved(p)]);
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() }]);
+    u.frame(vec![]);
+    let before = u.app.to_page(p);
+    u.app.run("view.minimize", json!({"on": false}));
+    u.frame(vec![]);
+    u.frame(vec![]);
+    assert!(u.app.canvas.rect.min.x > left + 100.0, "the left sidebar and rail moved the canvas's edge");
+    let after = u.app.to_page(p);
+    assert!((after.x - before.x).abs() < 0.5 && (after.y - before.y).abs() < 0.5, "the pointer's page point moved: {before:?} to {after:?}");
+    u.frame(vec![Event::PointerButton { pos: p, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() }]);
+    for _ in 0..3 {
+        u.frame(vec![]);
+    }
+    assert_eq!(frame_x(&u, ids[4]), 1880.0, "the frame did not move");
+    assert_eq!(frame_x(&u, ids[3]), 1410.0);
+    assert_eq!(u.app.session.ds().unwrap().history.undo.len(), steps, "no history step");
+}

crates/ui-egui/src/panels/right/effects.rs

@@ -108,7 +108,22 @@ pub(crate) fn effect_open(ctx: &egui::Context, i: usize) -> bool {
 
 /// A number field of effect `i` that can be bound to a variable (`effects/<i>/<prop>`).
 fn fx_field(app: &mut FigApp, ui: &mut Ui, ids: &[NodeId], i: usize, prop: &str, lead: Lead, value: f64, width: f32) -> Option<FieldEdit> {
-    crate::variable_ui::number_field(app, ui, ids, &format!("effects/{i}/{prop}"), Id::unique(("fx", prop, i)), lead, Some(value), "", width)
+    fx_field_in(app, ui, ids, i, prop, lead, Some(value), "", width)
+}
+
+/// [`fx_field`] showing `value` as given (a glass percentage) with `suffix` after it.
+fn fx_field_in(
+    app: &mut FigApp,
+    ui: &mut Ui,
+    ids: &[NodeId],
+    i: usize,
+    prop: &str,
+    lead: Lead,
+    value: Option<f64>,
+    suffix: &str,
+    width: f32,
+) -> Option<FieldEdit> {
+    crate::variable_ui::number_field(app, ui, ids, &format!("effects/{i}/{prop}"), Id::unique(("fx", prop, i)), lead, value, suffix, width)
 }
 
 /// Draw type-specific effect fields for shadows, blurs, noise, texture and glass, using live
@@ -290,29 +305,30 @@ fn effect_settings(app: &mut FigApp, ui: &mut Ui, ids: &[NodeId], i: usize, e: &
                     }
                 })
             };
+            // Each field takes a variable (`effects/<i>/<field>`), read as the field shows it:
+            // percentages for the 0–1 values, and the frost as `radius` (see `Glass::set_bound`).
             let pct = |v: f64| Some((v * 100.0).round());
             let unit = |v: f64| (v / 100.0).clamp(0.0, 1.0);
             row(ui, 32.0, |ui| {
-                let ed =
-                    widgets::number_field(ui, Id::unique(("fx_gl", i)), Lead::Text(tr("Light|glass")), Some(g.light_angle.round()), "°", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "lightAngle", Lead::Text(tr("Light|glass")), Some(g.light_angle.round()), "°", half);
                 edit(app, ed, &|v| with(&|gl| gl.light_angle = v.clamp(-180.0, 180.0)));
-                let ed = widgets::number_field(ui, Id::unique(("fx_gi", i)), Lead::Text(tr("Intensity")), pct(g.light_intensity), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "lightIntensity", Lead::Text(tr("Intensity")), pct(g.light_intensity), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.light_intensity = unit(v)));
             });
             row(ui, 32.0, |ui| {
-                let ed = widgets::number_field(ui, Id::unique(("fx_gr", i)), Lead::Text(tr("Refraction")), pct(g.refraction), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "refraction", Lead::Text(tr("Refraction")), pct(g.refraction), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.refraction = unit(v)));
-                let ed = widgets::number_field(ui, Id::unique(("fx_gd", i)), Lead::Text(tr("Depth")), Some(g.depth), "", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "depth", Lead::Text(tr("Depth")), Some(g.depth), "", half);
                 edit(app, ed, &|v| with(&|gl| gl.depth = v.clamp(1.0, 1000.0)));
             });
             row(ui, 32.0, |ui| {
-                let ed = widgets::number_field(ui, Id::unique(("fx_gs", i)), Lead::Text(tr("Dispersion")), pct(g.dispersion), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "dispersion", Lead::Text(tr("Dispersion")), pct(g.dispersion), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.dispersion = unit(v)));
-                let ed = widgets::number_field(ui, Id::unique(("fx_gf", i)), Lead::Text(tr("Frost")), Some(g.frost), "", half, 1.0);
-                edit(app, ed, &|v| with(&|gl| gl.frost = v.clamp(0.0, 1000.0)));
+                let ed = fx_field_in(app, ui, ids, i, "radius", Lead::Text(tr("Frost")), Some(g.sanitized().frost), "", half);
+                edit(app, ed, &|v| with(&|gl| gl.frost = v.clamp(0.0, Glass::MAX_FROST)));
             });
             row(ui, 32.0, |ui| {
-                let ed = widgets::number_field(ui, Id::unique(("fx_gp", i)), Lead::Text(tr("Splay")), pct(g.splay), "%", half, 1.0);
+                let ed = fx_field_in(app, ui, ids, i, "splay", Lead::Text(tr("Splay")), pct(g.splay), "%", half);
                 edit(app, ed, &|v| with(&|gl| gl.splay = unit(v)));
             });
         }

crates/ui-egui/src/services.rs

@@ -24,6 +24,11 @@ pub trait Services {
     fn download(&mut self, _name: &str, _bytes: &[u8]) -> bool {
         false
     }
+    /// The document file a host page opened, where the app runs inside one (the browser's host
+    /// mode): a Save of that document keeps this name instead of the document's own.
+    fn host_file(&self) -> Option<String> {
+        None
+    }
     /// A folder to write several files into.
     fn pick_folder(&mut self, _title: &str) -> DialogFuture {
         Box::pin(std::future::ready(None))

crates/ui-egui/src/widgets/colorpicker.rs

@@ -977,7 +977,10 @@ pub fn show(app: &mut FigApp, ctx: &egui::Context) {
     // Sampling a colour from the canvas — the eyedropper this picker's own button started, or the
     // colour it just sampled — is the press, not a press outside: neither may close the picker.
     let picking = app.session.tool.pick_only || app.session.tool.picked.is_some();
-    pop = pop.close_on_outside(!picking);
+    // Nor may a press on the open gradient's handles or stops on the canvas: they are this picker's
+    // controls, and the canvas took the press before the picker drew (#1852).
+    let own = picking || crate::handles::gradient_dragging(ctx);
+    pop = pop.close_on_outside(!own);
     // Only the opening control is held out: any other sidebar or canvas press dismisses it.
     let mut held: Vec<Rect> = app.ui.picker_button.into_iter().collect();
     held.extend(crate::variable_ui::picker_rect(ctx));

docs/collab-protocol.md

@@ -597,8 +597,16 @@ resuming with its offline edits, and leaving the session going back to snapshot
   `local`), so a local share is protected by 44 bits, not 128: a code is guessed over the network
   at the rate the host accepts connections, which makes 44 bits years of trying, but treat it as
   a secret for the local network, not for the internet. The invite link names the same session.
-  Whoever sees the code learns the host's address. Everyone who joins edits; a host without an
-  IPv4 address gets no code and shares its link.
+  Whoever sees the code learns the host's address. The session has two secrets, so two codes:
+  the **edit code** and a **view-only code** (the same address and port, a 44-bit secret of its
+  own). The host welcomes whoever joins with the view secret as a viewer (`Access::View`): they
+  see every change and everyone's presence, the app makes the file read-only for them, and the
+  session refuses any batch they send anyway, as a server does for its view links. The Share
+  popover picks which code shows (Can edit / Can view, also before sharing starts, so the edit
+  code need never be on screen; `collab.share {access}`, whose `link` and `url` are the ones that
+  go with the code shown, so a view-only share never hands out the edit secret); picking one later changes
+  nothing for who already joined. There is no comment code on the local network. A host without an IPv4
+  address gets no codes and shares its links.
 - **In the browser** a code joins like a link (the page asks the server over its own WebSocket,
   then opens the session's); it shares online through the server in Preferences as the desktop
   app does, and not on the local network (a page can't listen).

docs/collaboration-parity.md

@@ -1,6 +1,6 @@
 # Collaboration parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-31 · **Change:** minor (a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); `figcraft-server` checks the server key by comparing SHA-256 digests, not the raw keys (#1130); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; `comment.list {mentions}` lists only the threads that @mention a name (#1415); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); an AI agent attached over MCP shows where it works (#1416); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); comment.list reports each message's @mentions (#1415); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); a refused batch's fixes take time linear in the batch (#1063); image entries are checked as they apply; branches in live sessions and branch history entries; server message limits follow `max_file_mb`; a damaged log generation field keeps flushed edits; the web build joins from a `#join=` link; removing someone from a live session; live-session revert guard; live sessions per document; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; cursor chat and spotlight in live sessions; branch version history and finer list merges; comments and version history behaviour suite and fixes; hosting the server: `wss://` in the desktop app, server releases, deployment guide; team libraries on the server and swap library; branches: create, update from main, review and merge; wording: the standalone server with share links to edit or view; numbers unchanged) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (a file shared on the local network can be shared to look at only: a view-only code next to the edit code, picked in the Share popover before or while sharing)
 
 Figma is multiplayer first; FigCraft is local first. **Ready ~13% (estimated):** comments, version
 history and branches (review and merge) work inside one file; the real-time collaboration core landed in #103 (sync model,
@@ -15,7 +15,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 | Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, reconnect with backoff), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/<key>` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 |
 | Live cursors, selections, viewports; follow / observation mode; spotlight | yes | **done, in live sessions**: named cursors (one name for live sessions and comments: Preferences ▸ Your name, also in the Share popover and the Join dialog, kept in the browser too; a rename shows at once in the sessions you're in, #1380), selection outlines, avatars (an AI agent attached over MCP also shows its avatar and an outline around the layers it last edited or selected while it works, in or out of a session, #1416), follow (click an avatar), others' text carets and selected characters with their names, a note when two people type in one layer; spotlight (your avatar's menu, `collab.spotlight`): everyone follows your view and page, people who join later too, anyone who moves their view stops following and a banner offers to follow again, a newer spotlight takes over. Left: polish (no accounts, so anyone in the session can spotlight) | 2–4 |
 | Cursor chat, audio, high-fives | yes | **partial, in live sessions**: cursor chat (`/` opens a bubble at your pointer; everyone sees it as you type, it fades a few seconds after the last change, Enter sends and Escape takes it back, 100 characters; `collab.cursorChat` for agents); sent as ephemeral presence the host checks and rate-limits, never stored. No audio, high-fives or emote reactions | 2–5 |
-| Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 |
+| Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address, with an edit code and a view-only code, picked before or while sharing, whose holders see every change and can't make one; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 |
 | Comments: pins on frames and layers, threads, reactions, @mentions, resolve, unread, search and filters, links, in the presenter | yes (shared) | **done, local**: stored in the file, your name from Preferences (an AI agent attached over MCP comments as its own name, marked Agent); a behaviour suite from the documentation (pinning and following layers, threads, own edits and deletes, mentions, reactions, C and Shift+C, stepping, filters, saving, copy and paste); restoring a version keeps them. `comment.list` (CLI, MCP) gives each message its `mentions` (`{name, known, you}`, by the highlighting rule). In a live session threads sync and anyone in it can reply, react and resolve (no accounts: a name is who you are) | (shared once multiplayer lands) |
 | Version history: named versions, autosave checkpoints, view before restore, restore, duplicate | yes (cloud) | **done**, saved in the `.figcraft` file: restoring keeps the replaced design as an autosave first, a titled autosave becomes a named version, merging a branch records the file before and after. Versions are per person in a live session (a shared history needs accounts); no comparing two versions (Dev Mode compares a ready-for-dev layer with its state when marked) | — |
 | Branching and merging | yes (paid plans) | **done, also in live sessions**: branches saved in the `.figcraft` file, each opened in its own tab; Review and merge shows both sides' changes since the branch was made and the conflicts (the same property on both sides, or a layer deleted on one side and edited on the other), each resolved for the branch or main; merge as one undo step (the branch is archived, the main file's history gets a version for the merge), update from main, archive. Each branch keeps its own version history (saved, viewed and restored on the branch tab, kept when it is merged or archived; entries for its creation and updates from main); fills, strokes, effects, layout grids, export settings, guides, interactions, annotations and Dev Mode resources merge item by item. In a live session a branch stays with its author (its ids in their own client space, far above the main file's) and merging it is one edit everyone gets; peers' edits merge against the branch's own base and conflicts resolve as offline; a view link refuses merging. Left: others in the session can't see or open your branches (the server would have to keep them); text runs conflict as a whole; a branch made offline that adds layers merges only outside a session | 1–2 |
@@ -26,6 +26,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-06 | minor | M9: a file shared on the local network can be shared read-only. The session the app hosts has a second secret, so a view-only code next to the edit code (same address and port, a 44-bit secret of its own); whoever joins with it is welcomed as a viewer, sees every change and presence, gets the "View only" badge and only the moving tools, and the session refuses their edits. The Share popover offers Can edit / Can view under Local network before sharing starts (the edit code then never shows) and while sharing; `collab.share {via: "local", access: "view"}` does the same (its `link` and `url`, like its `code`, are the view-only way in), and `share` in `collab.peers` lists both codes and links. No comment code on the local network. Numbers unchanged. |
 | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. |
 | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`<web_url>#join=…`). A browser build served beside its server names it with `<meta name="figcraft-server">`, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged |
 | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. |

docs/components-parity.md

@@ -1,6 +1,6 @@
 # Components, variants, styles and variables parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-01 · **Change:** minor (Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
 
 Design systems are why teams adopt Figma. **Components: breadth ~96%, ready ~72%. Styles and
 variables: breadth ~95%, ready ~76% (estimated).** QA'd with a synthetic design system of ~300
@@ -67,7 +67,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 | Modes: add, duplicate, rename, delete, set as default / reorder | done | layers on Auto follow a new default; explicit modes stay |
 | Deleting a bound variable or its collection | done | layers keep their last value and are unbound; aliases to it take its values and colour calculations reading it keep the colour they show |
 | Code syntax per platform (Web, iOS, Android) | done | generated CSS uses the Web name, SwiftUI the iOS one and Compose the Android one (a variable without one keeps its value there); in the variables JSON; ArkUI and Flutter have no platform of their own and write values |
-| Bindings: fills, strokes, effects, opacity, padding, gaps, sizes, radius, font family/style, font size/weight, line height, letter spacing, paragraph spacing/indent, text, visibility, layout grids, instance properties | done | type-checked per field; number variables fill text content; the Design panel's font family and font style menus start with Apply variable (string variables), and a bound one shows its variable in place of the menu; a colour variable bound to a solid paint brings its whole colour, alpha included, once (the paint's opacity restarts at 100% on binding, an opacity set while bound multiplies on top; unbinding moves the alpha back into the opacity) |
+| Bindings: fills, strokes, effects, opacity, padding, gaps, sizes, radius, font family/style, font size/weight, line height, letter spacing, paragraph spacing/indent, text, visibility, layout grids, instance properties | done | type-checked per field; glass fields too (light angle, intensity, refraction, depth, dispersion, frost and splay, percentages as the Design panel shows them); number variables fill text content; the Design panel's font family and font style menus start with Apply variable (string variables), and a bound one shows its variable in place of the menu; a colour variable bound to a solid paint brings its whole colour, alpha included, once (the paint's opacity restarts at 100% on binding, an opacity set while bound multiplies on top; unbinding moves the alpha back into the opacity) |
 | Explicit modes per frame, library collections' modes | done | stored variable and collection references resolve by exact id in export, library copies and swaps, imported aliases, alias deletion and cycle checks, Dev Inspect, the library mode picker and prototype playback; a collection or variable named like another's id no longer stands in for it there |
 | Gradient stops and variant properties bound to variables | done | a stop's binding follows it when earlier stops are removed |
 | Extended collections | done | this file's collections (Extend collection on a collection's row; following its edits at once, chains included) and library collections, including a library's own extended collections (chains through libraries); overrides per mode with reset; follow library updates, variables new to the library collection being an update of their own; modes inherited. Checked with synthetic libraries only ([gaps](gaps.md) #14) |
@@ -78,6 +78,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | M3, #1885: glass effects take variables, as the reference tool's do: its light angle, intensity, refraction, depth, dispersion, frost and splay bind to number variables on a layer (`variable.bind`, `effects/<i>/<lightAngle\|lightIntensity\|refraction\|depth\|dispersion\|radius\|splay>`, `radius` being the frost) and in an effect style (`style.bind`), and the Design panel's glass fields take a variable like the shadow and blur fields. A variable reads as the field shows it: intensity, refraction, dispersion and splay in percent. Tests: `binding_lists_tests::glass_fields_take_number_variables`, `effects_tests::glass_fields_take_bound_numbers_as_the_panel_shows_them`. Grade unchanged. |
 | 2026-11-01 | patch | M3: Delete on a layer inside an instance hides it (an override) instead of being refused ("You can't delete a layer or object from an instance. If you try, Figma will only toggle the layer's visibility instead of removing it", Guide to auto layout); `edit.delete` reports those ids under `hidden`, the structure and the main component stay as they were, one undo step; deleting the instance itself still removes it. Found by a documentation audit of the auto layout page. Test: `components_behaviour_tests::deleting_a_layer_inside_an_instance_hides_it_instead` (the refusal row for it is gone from `what_instances_cannot_override_is_refused`). Numbers unchanged |
 | 2026-10-31 | minor | M3, gap 10: library analytics cover styles and variables. A file reports how many of its layers use each of a library's styles and variables, and Show usage (`library.usage`) lists them beside the components, by a Type choice, with their layers and files. Layers inside instances count for their component. Insertions, detachments and modes aren't counted for them yet. Numbers unchanged. Tests: `library_assets_tests`. |
 | 2026-10-31 | minor | M6: as the help center describes code syntax, Dev Mode's SwiftUI and Compose code now writes a bound variable's iOS or Android code syntax in place of its value, as CSS already wrote the Web one: fills, strokes and their weight, sizes, corner radius, gaps, padding, opacity, the font family and size and the characters. A variable with no code syntax for the platform keeps the value, since a name made up here wouldn't exist in the code it lands in. ArkUI and Flutter have no code syntax platform and are unchanged. Test: `variables_behaviour_tests::swiftui_and_compose_name_variables_by_their_code_syntax`. Numbers unchanged. Grade unchanged |

docs/localization-parity.md

@@ -1,6 +1,6 @@
 # Localization parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (German coverage re-measured at 2,592 / 2,647 entries (97.9%, 2026-11-04); six German translations for the text-wrap control (M10): Auto, balanced and pretty wrapping; catalog remains a draft; Bosnian draft catalog, one/few/other plurals; German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; partial review, catalog remains a draft; Arabic draft catalog, count-neutral plurals and web font gate; Thai draft catalog and Thai UI fonts; a missing translation fails no check: `cargo xtask i18n-report` lists them; Vietnamese draft catalog; string counts re-measured: 2,352 entries; Russian and Turkish catalogs reviewed by native speakers, Russian one/few/many plurals; Czech and Indonesian drafts; the Japanese draft completed; counts re-measured; Windows UI language from the first preferred language; draft catalogs catch up: every draft translates every string again; Simplified Chinese draft catalog; macOS finds its downloadable CJK system fonts (#406); string counts re-measured: 2,272 entries, the drafts at 95–99%; Swedish command labels and menu wordings; Russian, Swedish, Turkish, Czech and Indonesian listed; a duplicated paragraph removed) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** minor (Bosnian draft catalog, one/few/other plurals; German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; partial review, catalog remains a draft; Arabic draft catalog, count-neutral plurals and web font gate; Thai draft catalog and Thai UI fonts; a missing translation fails no check: `cargo xtask i18n-report` lists them; Vietnamese draft catalog; string counts re-measured: 2,352 entries; Russian and Turkish catalogs reviewed by native speakers, Russian one/few/many plurals; Czech and Indonesian drafts; the Japanese draft completed; counts re-measured; Windows UI language from the first preferred language; draft catalogs catch up: every draft translates every string again; Simplified Chinese draft catalog; macOS finds its downloadable CJK system fonts (#406); string counts re-measured: 2,272 entries, the drafts at 95–99%; Swedish command labels and menu wordings; Russian, Swedish, Turkish, Czech and Indonesian listed; a duplicated paragraph removed) · **Target:** Figma Design (desktop app 126.10.7)
 
 FigCraft's interface has a localization layer with an English catalog, a Russian catalog reviewed
 by a native speaker, and Spanish (with a Latin American overlay), French, German, Brazilian
@@ -85,7 +85,7 @@ supported by both apps (CJK, Arabic and Devanagari shaping, IME); Figma has no v
 
 ## Languages
 
-| Language | Code | Translated catalog entries | Dialogs / tooltips / help | Script support | Native review | Status | Hours to full |
+| Language | Code | UI strings translated | Dialogs / tooltips / help | Script support | Native review | Status | Hours to full |
 |---|---|---|---|---|---|---|---|
 | English | en | 2,352 / 2,352 (100%, source) | yes | Latin | yes (source) | full | 0 |
 | Simplified Chinese (Mandarin) | zh-Hans | 2,216 / 2,352 (94.2%, draft) | yes | CJK text and IME in documents; UI text in an installed Chinese face, ahead of Japanese ones (web: the `FIGCRAFT_EMBED_CJK` build); no Traditional Chinese catalog (zh-TW, zh-HK read English) | no | draft | 1–2 (after native review) |
@@ -96,19 +96,11 @@ supported by both apps (CJK, Arabic and Devanagari shaping, IME); Figma has no v
 | Portuguese | pt-BR | 2,331 / 2,352 (99.1%, draft) | yes | Latin | no | draft | 1–2 (after native review) |
 | Indonesian | id | 2,292 / 2,352 (97.4%, draft) | yes | Latin | no | draft | 1–2 (after native review) |
 | Japanese | ja | 2,304 / 2,352 (98.0%, draft) | yes | CJK text and IME in documents; UI text in an installed Japanese face (web: the `FIGCRAFT_EMBED_CJK` build) | no | draft | 1–2 (after native review) |
-| German | de | 2,592 / 2,647 entries (97.9%, measured 2026-11-04) | yes | Latin; long words elide in narrow fields | no | draft | 1–2 (after native review) |
+| German | de | 2,226 / 2,352 (94.6%, draft) | yes | Latin; long words elide in narrow fields | no | draft | 1–2 (after native review) |
 | Korean | ko | 2,216 / 2,352 (94.2%, draft) | yes | Hangul text and IME in documents; UI text in an installed Korean face (web: the `FIGCRAFT_EMBED_CJK` build) | no | draft | 1–2 (after native review) |
 | Vietnamese | vi | 2,352 / 2,352 (100%, draft) | yes | Latin with stacked diacritics | no | draft | 1–2 (after native review) |
 | Thai | th | 1,791 / 1,791 UI strings, 589 of 598 command labels, 31 menu wordings (draft) | yes | Thai text in documents; UI text (and layer and page names in Thai, whatever the UI language) in an installed Thai face, desktop only; the web build leaves Thai out | no | draft | 1–2 (after native review) |
 
-German was re-measured on **2026-11-04** with `cargo xtask i18n-report`: **1,969 / 1,975 UI keys**,
-**594 / 641 command labels** and **29 / 31 menu wordings**, totaling **2,592 / 2,647 entries (97.9%)**.
-The report confirms 6 UI keys, 47 command labels and 2 menu wordings are missing. The denominator uses
-the report's key sets: English UI keys, the union of registered command ids and main-menu ids,
-and menu labels worded differently from their command. A plural entry counts as one key, and a
-present translation counts even when its wording matches English. This is catalog coverage;
-German remains a draft awaiting full native-speaker review. The other rows retain their dated measurements.
-
 Other languages (measured 2026-10-22): Russian (`ru`) 2,352 / 2,352 (100%), reviewed and approved
 by VanTan, one/few/many integer plurals; Swedish (`sv`) 2,314 / 2,352 (98.4%), its command labels and menu
 wordings added 2026-10-17 (#599), native review welcome; Turkish (`tr`) 2,291 / 2,352 (97.4%), whose header
@@ -133,8 +125,6 @@ Hindi and Arabic. Traditional Chinese is not planned (no catalog; its users see
 
 | Date | Change | Summary |
 |---|---|---|
-| 2026-11-04 | minor | German coverage re-measured with `cargo xtask i18n-report`: 1,969 / 1,975 UI keys, 594 / 641 command labels and 29 / 31 menu wordings; both language rows now show 2,592 / 2,647 (97.9%). Missing: 6 UI keys, 47 command labels, 2 menu wordings. Older measurements are dated; native review, grade and estimates unchanged |
-| 2026-11-04 | minor | six German translations for the text-wrap control (M10): Auto, balanced and pretty wrapping; catalog remains a draft. Six previously missing UI entries added to `de.toml`; command labels and menu wordings unchanged. Full native review is still pending; grade and estimates unchanged |
 | 2026-10-30 | minor | Bosnian (`bs`, Bosanski) draft catalog: every UI string (1,906), command label (629) and menu wording (31), machine-drafted in Latin script with ijekavian forms and marked as a draft awaiting native review. Bosnian plurals: one for 1, 21, 31… (not 11), few for 2–4, 22–24… (not 12–14), other for the rest. Grade and hours unchanged (Bosnian is not one of the twelve key languages) |
 | 2026-10-29 | minor | German terminology corrections (M10): gradient stops, OpenType stylistic sets and the Home-screen preference; partial review, catalog remains a draft. Nine existing translations corrected; keys, placeholders, coverage, grade and estimates unchanged |
 | 2026-10-28 | minor | Arabic draft: 1,857 UI entries, 620 command labels and 31 menu wordings, with count-neutral plurals. AI-assisted, native review pending. Desktop uses the existing Arabic fallback and bidi; web requires an embedded Arabic face. No panel mirroring or parity-grade increase claimed |

docs/target-app-parity.md

@@ -1,6 +1,6 @@
 # FigCraft parity with Figma
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-01 · **Change:** minor (bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hostingLine truncated
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (glass's docs say which centre splay bends away from and where a shape gets no core; glass bends towards its core, rounded rectangles in closed form; glass's light is a line on its bevel and splay turns the bend towards the centre; glass bends with a thick-lens profile and splits its colours over 8 steps, measured against the reference tool; bulleted lists use the same bullet at every level of indentation, as the help center says, instead of a white bullet and a square at the deeper levels; typing `1)` and a space at the start of a paragraph starts a numbered list, as `1.` does, both being the help center's creation characters; a link on text is underlined by default, as the help center says, and Underline takes the underline off while the link stays; a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; gap 6: widgets draw lines and SVG pictures (plugin API 6); gap 6: a widget opens its plugin's panel (plugin API 5), whose callbacks redraw it; the browser build uses the fonts installed on the computer once asked, each read when text uses it (#1051); plugin widgets have hover styles: a layer's `hover` fill, stroke, opacity or text colour shows while the pointer is over it (gap 6); Thai, Lao, Khmer and Burmese lines break between words (#1219); MCP and control calls name their document (#998); shadows of images with transparent pixels follow their alpha (#1289); Arabic draft catalog; truncated text fills its last line before the ellipsis and keeps truncating when resized; auto-height text with max lines (#1375, #1376, #1377), numbers unchanged; plugin widgets take text input and a property menu (plugin API 4); boards: templates and tables; boards: a shared timer and voting sessions; boards: the dot grid, connector ends dragged to re-attach, curved connectors; `.sketch` import, best effort: import/export breadth 86% → 87%, file formats 60% → 61%, headline numbers unchanged; Canvas & navigation's remaining work no longer lists outline mode's Include hidden layers and Include object bounds; boards: area 22 (weight 0, outside the weighted sum); CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke Line truncated
 
 The authoritative assessment of how close FigCraft is to Figma Design. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) is the ranked work list; the measured menu checklist is
@@ -596,7 +596,9 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
   that sees the whole backdrop, inside clipping frames, faded groups and masks too; both blurs
   uniform or progressive (the radius ramps between two points, dragged on the canvas); noise in
   mono, duo and multi colour with grain size, density and blend mode; texture with clip to shape;
-  glass with light angle and intensity, refraction, depth, dispersion, frost and splay; the same in
+  glass with light angle and intensity, refraction, depth, dispersion, frost and splay (a thick lens
+  bending towards the shape's core, its light a line on the bevel, matched to the reference tool on
+  synthetic files); the same in
   PNG, PDF and SVG exports, SVG embedding renders of noise grains, texture, progressive and
   background blur and glass); corner radii with
   smoothing; constraints; auto layout (horizontal, vertical, wrap, grid; hug/fill/fixed; min/max;
@@ -648,6 +650,10 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-06 | patch | M3: glass's docs say which centre `splay` bends away from: the centre of the layer's bounds, as the reference tool's, checked side by side on a ring and an L at Splay 0% and 100% (an inner edge bends towards the hole in both). And where a glass shape gets no core: past 4M px on the desktop and 1M on the web (`MAX_SHAPE_PX`) it bends along its edge normals, so a large glass text or vector can bend differently once zoomed into, in a 2× export, or on the web. Docs only. Grade unchanged. |
+| 2026-11-02 | minor | M3, #1885: glass bends towards its core, the shape shrunk by `depth` and the bevel, as the reference tool's: round a sharp corner the bend turns smoothly, and a thin part (a capsule, a letter's stroke) bends across itself, checked side by side on a capsule 44 units tall. Rounded rectangles work it out in closed form. A shape too big to keep whole at the zoom bends along its edge normals instead, so no render works out a core over more pixels than a kept shape holds. Tests: `glass::tests::a_sharp_corner_bends_round_towards_the_core`, `glass::tests::a_thin_part_bends_across_itself`, `glass::tests::a_shape_too_big_to_keep_bends_along_its_normals`, `glass_cut_tests::a_cut_through_the_pane_matches_the_whole_render`. Grade unchanged. |
+| 2026-11-02 | minor | M3, #1885: glass's light is a line on its 1-unit bevel added to the backdrop, as the reference tool's: fully where the edge faces the light, none below 0.35 of facing it, 0.6 as much on the opposite side, with a faint gradient across the curve. `splay` turns the bend from along the edge's normal towards the way away from the layer's centre and no longer widens the light, as in the reference tool. Checked side by side on synthetic files: a splay of 1 bends the backdrop towards the centre in both. Tests: `glass::tests::the_light_lies_on_the_bevel_and_the_gradient_across_the_curve`, `backdrop_tests::splay_turns_the_bend_towards_the_centre`, `glass_cut_tests::the_light_is_a_line_on_the_bevel`. Grade unchanged. |
+| 2026-11-02 | minor | M3, #1885: glass bends the backdrop with the reference tool's thick-lens profile (most a 1-unit bevel in from the edge, falling off as the 3.5th power of the way out of the curve to nothing `depth` further in) and splits its colours over 8 steps, red and blue 0.16 of the bend apart at 100% dispersion. Measured against the reference tool on synthetic files at 2×: the black band a pane pulls to its edge ends within 3 px of the reference tool's, and red and blue part 2.27 px at 50% dispersion and 4.66 px at 100% (2.38 and 4.69 there). Tests: `glass::tests::the_bend_follows_the_thick_lens_profile`, `glass::tests::dispersion_splits_the_channels_along_the_bend`. Grade unchanged. |
 | 2026-11-01 | patch | M4: bulleted lists draw the same bullet at every level of indentation ("Figma bullets will keep the same styling at all levels of indentation", Create bulleted and numbered lists); the deeper levels drew a white bullet and a small square, pinned as silent before. Numbered levels (1., a., i.) are unchanged. Found by a documentation audit of the text rules. Test: `tail_tests::list_numbering_by_level` (the bullets row). Numbers unchanged |
 | 2026-11-01 | patch | M4: typing `1)` followed by a space at the start of a plain paragraph starts a numbered list, as `1.` already did ("Enter one of the creation characters below followed by a Space: 1. 1)", Create bulleted and numbered lists). Found by a documentation audit of the text rules. Test: `text_tail_tests::typing_a_creation_character_and_a_space_starts_a_list`. Numbers unchanged |
 | 2026-11-01 | patch | M4: a link made with `text.link` (Cmd/Ctrl+K, Shift+Cmd/Ctrl+U) underlines the linked text unless it has a decoration of its own ("Links are styled with an underline by default. Use the keyboard shortcut to remove the underline", Add links to text); Underline (Cmd/Ctrl+U) takes the underline off and the link stays. Found by a documentation audit of the text rules. Test: `text_behaviour_tests::a_link_is_underlined_by_default_and_underline_takes_it_off`. Numbers unchanged |

docs/ui-parity.md

@@ -1,6 +1,6 @@
 # UI and interaction parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-02 · **Change:** minor (a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transform behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; boolean hit testingLine truncated
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** patch (a press on the open gradient's handles or stops on the canvas keeps the colour picker open through the drag, as its own control (#1852); a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what it picks; sidebar number and text fields keep their text vertically centered when focused, including typography spacing; with the pen out, Enter or a double-click ends the path and edits the vector with the Move tool instead of drawing on (#1430); the Actions palette offers only commands that run from it, and no second row reading like a menu item: Place image opens the file dialog (#1574); Preferences ▸ Scroll wheel zoom: a mouse wheel zooms the canvas about the pointer and Cmd/Ctrl+wheel scrolls (#1390); boolean operations refuse input past their caps, and a boolean group past them draws without its result (#1104); the selection and hover outlines of rounded rectangles and frames follow their corners (#1506); colour picker review fixes for text undo, fitted sidebars, moving controls and gradient variables; Corner smoothing: an original icon and the shared number-field drag gesture, preserving fractional baselines; guides snap to layers when dragged; Crop image: Object ▸ Crop image, the right-click menu and the image fill row enter crop mode (`image.crop`, #1464); the Design panel's sections on one grid — 16 / 8 margins, 88 + 8 + 88 + 8 + 24 columns, 24 pt rows, 4 pt between a row's buttons (#858); the toolbar on one 32 pt grid, without its Resources button (#1210); colour picker LCH and OKLCH models; an XML (Android Vector Drawable) export format; Context menus: the Menu key reaches egui 0.37 but is unbound (row done → partial); the Text on a path tool; board tool keys pinned; community fixes: the text box by dragging, the font picker keys, the pen path on leaving Design, a still canvas in vector edit mode, a scrolling pages list, colour emoji, readable new text in frames, system theme on first run; the Small caps sample in Type settings drawn from capitals; recent files as cards; vector edit mode: hovering, hatching, selecting and dragging filled regions; home screen: Templates tab, first-run templates and Getting started tips; number fields: scrub rates, arrow steps, arithmetic with brackets, relative edits of mixed values; outline mode's hidden layers and object bounds; Hide when publishing; cursors per tool and modifier; panel widths; dark pages for files made in the dark theme; drag threshold and double-clicks into text in groups; rotation origin on Alt+R and placing with Enter: no documented shortcut missing; keyboard shortcut parity suite and bindings; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and the vector edit tail; canvas navigation, guides and grids behaviour suite and fixes; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; layers panel keyboard: F2 rename, Shift+F10 context menu, F8 box selection; selection and transLine truncated
 
 Fine canvas control is what Figma users feel first: handles, snapping, nudging, modifier keys,
 drag behaviour, numeric precision. This checklist covers the tools, gestures and panels. Status:
@@ -30,7 +30,7 @@ interaction feel not yet compared.
 | Colour names in hex fields | done | every hex field (fills, strokes, text ranges, effects, layout grids, colour variables, page and prototype backgrounds, the colour picker's Hex) takes a CSS colour name as well: `red` becomes `FF0000`; case, spaces and hyphens are ignored (`Light Blue`); names are opaque and keep the colour's opacity; hex wins where both could match. The picker's CSS field takes every CSS name too (`Color::from_hex_or_name`, `color::named`) |
 | Fields select their text on focus | done | Number and text values keep their vertical position when their editor gains focus (including typography spacing; `sidebar_field_text_stays_in_place_on_focus`). a click or Tab into a one-line field selects all of its text, so typing replaces the value: hex and colour fields, number fields, inline fields (a fill's hex, variable values, renames), names, search boxes and dialog fields; a drag from the press selects only what it covers; multi-line fields (descriptions, comments) keep the caret where clicked. The first click into an inline field (a fill's hex) now takes the keyboard; it took a second click. A rename (double-click, F2, File ▸ Rename, a page) selects the whole name before its field first draws, so a key typed in that same frame replaces the name; it was appended (`widgets::select_all_on_focus`, `select_all_tests`, `layers_rename_tests`) |
 | Colour picker models | done | Hex, RGB, HSL, HSB, LCH, OKLCH and CSS; LCH and OKLCH keep lightness and hue when a colour leaves sRGB (chroma comes down); the values typed stay while the colour is theirs (a hue typed on a grey, a chroma sRGB can't hold); CSS reads `lch()` and `oklch()` with any hue unit and `none` (`figcraft_color::{Lch, Oklch}`). Values are the stored channels read as sRGB |
-| Colour picker placement and dismissal | done | Opens 8 pt beside the sidebar at the opening control, lifted to fit the screen; outside presses (including the sidebar), Escape and X close it. Reopening resets a dragged position; eyedropper sampling keeps it open. |
+| Colour picker placement and dismissal | done | Opens 8 pt beside the sidebar at the opening control, lifted to fit the screen; outside presses (including the sidebar), Escape and X close it. Reopening resets a dragged position; eyedropper sampling keeps it open, and so does a drag of the open gradient's handles or stops on the canvas (#1852). |
 | Colour picker image well | partial | the Image tab shows a checkered placeholder and Upload from computer until there is a file (no dialog at once); an image paint shows its asset preview; a file dropped on the open picker replaces the image, keeping the fill mode, crop, position and adjustments (`image.replace`). Layers' fills and strokes only (text ranges, styles and selection colours keep Upload). The Fill and Stroke swatches take no drop: a dragged file's position isn't known, so a drop with none goes to the open picker |
 | Colour picker on a new fill or stroke | done | + opens the picker on the new paint when the selection shares one paint list; on a mixed selection + adds a paint to each layer and no picker opens (#404) |
 | Blend mode menus: the layer's (Design panel) and each paint's (colour picker) | done | Pass through and Normal are distinct (Normal isolates a group's or frame's children); paints have no pass-through; plus darker drawn exactly on the canvas |
@@ -113,7 +113,7 @@ interaction feel not yet compared.
 | Masks: what a mask hides doesn't take clicks; a mask group's box is the mask's | done | |
 | Layout grids (Ctrl+G) | done | columns, rows and grid; stretch, left, centre, right; Auto count; several per frame; styles; not shown or snapped on a rotated frame; a nested frame's grids snap but only top-level frames draw them |
 | Gamut warnings for Display P3 files | done | colour picker note; View ▸ Soft-proof sRGB stripes what sRGB can't show (the canvas itself is sRGB) |
-| Gradient and padding/gap handles on the canvas | done | |
+| Gradient and padding/gap handles on the canvas | done | the gradient's handles and stops show while its picker is open, and dragging one keeps the picker open (#1852) |
 | Hover outline, selection colours, handle sizes | done | measured from UI3 screenshots; the outline follows the layer's geometry, rounded corners (each radius and the smoothing) included, whatever the stroke alignment (#1506) |
 | Cursors per tool and modifier | done | the engine names a cursor for every tool, modifier and hover target (`tool.overlay.cursor`, tabled in `cursor_tests`) and the UI shows the system's or draws its own at the pointer (`cursors.rs`, `cursors_tests`; original glyphs from lines and the code-drawn icons). Arrow for Move and Scale; two-headed arrows on the handles that follow the handle and the box's rotation; outside a corner a curved rotate arrow turned to that corner, turning with the pointer while rotating; crosshair for the frame, section, slice, shape, pencil and Text tools; the I-beam over a text with the Text tool and over the text being edited; the pen as a cross with what a click does beside it (nothing: a new point; a ring: closes, connects to or goes on from a point; a plus: adds a point on a segment, also Alt in vector edit mode; a curve: bends, the Bend tool or Cmd/Ctrl); open and closed hand for the Hand tool, Space and the middle button; zoom in and out (Alt) while Z is held; eyedropper; comment pin; the copy cursor with Alt over a selected layer and while Alt-dragging; not-allowed while a drag resizes, rotates or moves a layer inside an instance (it is undone on release) and over a layers row that takes no drop. Ruler guides and gradient, crop and padding handles keep their own cursors (the tool's used to replace them). `ui.inspect` reports `cursor`. Left: no cursor for removing a point with the pen (the pen doesn't remove points); the drawn cursors follow the pointer a frame behind the system's; not compared with Figma's side by side |
 | Multiplayer cursors, cursor chat, spotlight | partial | in live sessions: named cursors, chat bubbles that fade, `/` to chat, spotlight from your avatar's menu with a banner; no audio or reactions |
@@ -178,6 +178,7 @@ in the table. `crates/ui-egui/src/shortcut_keys_tests.rs` drives the keys a look
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-04 | patch | M1, #1852: a press on one of the open gradient's handles or stops on the canvas is the colour picker's own, not a press outside it (Figma keeps the picker and the handles up while a handle or stop is dragged; the stops are made to be dragged: "You can click and drag a stop to change its placement on the gradient", Use gradients as a fill or stroke). The canvas took the press and began the drag, then the picker, drawn later in the same frame, saw a press outside its card and closed, committing the drag's interaction at once; the handles vanished with it and the drag went on without an undo step of its own. Now the picker stays while a gradient handle or stop drags, and the drag is one undo step; a press elsewhere on the canvas still closes it. A handle drag whose button goes up off the canvas (over a panel or the picker) ends there too, instead of waiting, uncommitted, to move the handle to the next press on the canvas. Tests: `colorpicker_selection_tests::dragging_a_gradient_handle_on_the_canvas_keeps_the_picker_open`, `colorpicker_selection_tests::a_gradient_drag_released_off_the_canvas_ends_there`. |
 | 2026-11-02 | patch | M8, #1875: a click with the Bend tool on a sharp point between two segments gives it handles along the line between its neighbours, a third of the way to each ("Click on a point or path where you want to add a curve", Edit vector layers); a click on a curved point still makes it sharp, a drag still sets the handles by hand, an endpoint is left alone. Between a handle's end and a point both within reach of the pointer, the nearer one on the page is hit (the handle on a tie), so a short path's point (its handles a few pixels long) can be clicked again. Before, only a drag curved a point, and a short one left two tiny handles in its direction. Tests: `vectoredit::tests::short_handles_leave_their_point_clickable`, `vectoredit::tests::a_bend_click_curves_a_sharp_point_between_its_neighbours`, `bend_tool_smooths_and_sharpens_points`. Numbers unchanged. |
 | 2026-11-02 | minor | M4, #1827: wrap style on a text layer (`WrapStyle`: Auto, Balance, Pretty): Balance re-breaks each paragraph at the narrowest width that keeps its line count (bisection over the greedy breaker, as browsers balance), Pretty narrows one of the last four lines just enough so the last line isn't one word; `text.wrapStyle`, `node.set wrapStyle` (`textWrap` too), inspect `wrapStyle`, Dev Mode CSS `text-wrap` (Tailwind `text-balance` / `text-pretty`), the Type settings control under Vertical trim. Per-paragraph settings, text-style support and the `.fig` import/export mapping stay open. Test: `text_behaviour_tests::balance_and_pretty_wrap_styles_break_lines_as_documented`. |
 | 2026-11-02 | patch | M4: Backspace or Delete at the start of a list item takes its marker and keeps its level ("Use Backspace or Delete at the beginning of a list item to delete the counter, but keep the same level of indentation", Create bulleted and numbered lists): a plain paragraph may now carry a list level, and the text layout starts it where that level's item text starts (the gutters stay even when no list is left). Backspace used to drop the level too, and Delete at an item's start deleted the next character. Tab on such a paragraph types a tab, as outside a list. Tests: `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests::a_plain_paragraph_at_a_list_level_starts_where_the_items_text_does` |

packaging/web/README.md

@@ -107,6 +107,104 @@ Local test: `python3 -m http.server 8767` inside the folder, then open http://lo
   (`allow-popups` lets Help links open in a new tab).
 - Don't send `X-Frame-Options: DENY` or a `frame-ancestors` CSP that excludes the embedding page.
 
+## Host mode (`?host=parent`, or the page's own document)
+
+A page can embed FigCraft so that it hands files over instead of downloading them and reports
+unsaved changes. Two opt-in transports carry the same messages:
+
+- **`?host=parent`** on the iframe's URL (`https://example.com/figcraft/?host=parent`): a
+  **same-origin** framing page talks to the app over `postMessage`. Opened outside an iframe, the
+  URL gives the normal app with downloads; with a parent on another origin there is no host mode
+  either (messages to another origin are dropped silently, so saves would be lost while the
+  document looked saved).
+- **`data-host="page"`** (the exact value `page`) on the canvas: a page that loads the module into
+  its own document gets the same behaviour over DOM `CustomEvent`s on the canvas, with no iframe
+  (see below).
+
+| Message | Direction | Fields |
+|---|---|---|
+| `figcraft:ready` | app → page | `version`, `appVersion`: the app is running and listening; send a file now |
+| `figcraft:open` | page → app | `name`, `bytes` (an `ArrayBuffer` or `Uint8Array`): open like File › Open (a payload over the browser open limit of 512 MB is refused; anything malformed is ignored) |
+| `figcraft:save` | app → page | `name`, `saveAs`, `bytes` (a transferred `ArrayBuffer`): every file the app would otherwise download. The page stores it and reports failures itself. `saveAs` says whether the file becomes the document's file: `false` after Save of the file the page sent, under its own name; `true` for a document file (`.figcraft`, `.json`) under a name the page didn't send — Save As, or a Save of a document the page never sent — after which the next Save carries that name with `false`; `false` for copies and exports that don't become the document (rendered images, SVG, PDF, `.fig` copies, the variables exports) |
+| `figcraft:dirty` | app → page | `dirty`: unsaved changes appeared or went away |
+| `figcraft:failed` | app → page | `error`: the app couldn't start (no WebGPU or WebGL2, for example) |
+
+Files reach the page through the app's download service, the path this web build saves by: Save As
+(and a Save of a document with no file yet), the `.fig` copy, the export panel and its dialog,
+Export frames as PDF, plugin output and the variables export (Variables panel ▸ Export…). In host
+mode each arrives as `figcraft:save` instead of a download.
+
+In host mode the app starts with no document (the home screen), so the page sends the file to edit
+and guards leaving the page while changes are unsaved. `&author=` on the URL names the user for
+comments and board notes.
+
+### Same-document host mode
+
+The host application loads the wasm-bindgen module itself and gives FigCraft one of its own
+canvases, so there is no iframe and no `?host=parent`. It opts in with `data-host="page"` on that
+canvas — the exact value `page` — and the canvas keeps the id the app looks up
+(`id="figcraft_canvas"`):
+
+```html
+<canvas id="figcraft_canvas" data-host="page" style="width: 100%; height: 720px; display: block;"></canvas>
+```
+
+The page and the app then talk with DOM `CustomEvent`s on the canvas instead of `postMessage`. The
+app dispatches the same messages it would post to a parent — `figcraft:ready`, `figcraft:save`,
+`figcraft:dirty`, `figcraft:failed` — with the message fields (without the type) as the event's
+`detail`, and it opens a document when the page dispatches a `figcraft:open` event with
+`detail: { name, bytes }`. Events do not bubble, so listen on the canvas itself (two editors on
+one page can't hear each other).
+
+Add the listeners before `init`: the app announces itself with `figcraft:ready` while `init` is
+still running, and a file sent in reply would otherwise be missed.
+
+```js
+import init from "./figcraft-web-<hash>.js"; // the wasm-bindgen glue shipped with the app
+
+const canvas = document.getElementById("figcraft_canvas");
+
+canvas.addEventListener("figcraft:ready", async () => {
+  // The app is listening; hand it a document now, if you have one.
+  const bytes = await documentBytes(); // an ArrayBuffer or Uint8Array
+  canvas.dispatchEvent(new CustomEvent("figcraft:open", {
+    detail: { name: "Poster.figcraft", bytes },
+  }));
+});
+
+// Every file FigCraft would otherwise download arrives here.
+canvas.addEventListener("figcraft:save", (event) => {
+  const { name, saveAs, bytes } = event.detail; // bytes is an ArrayBuffer
+  // Store the file under `name`; `saveAs` says whether it becomes the document's file.
+  // Report your own errors.
+  storeFile(name, bytes, saveAs);
+});
+canvas.addEventListener("figcraft:dirty", (event) => {
+  unsaved = event.detail.dirty; // warn before leaving, as you like
+});
+canvas.addEventListener("figcraft:failed", (event) => {
+  showError(event.detail.error); // the app couldn't start
+});
+
+await init({ module_or_path: "./figcraft-web-<hash>_bg.wasm" });
+```
+
+- Saves are not downloads in this mode: the `bytes` in `figcraft:save` hold the file, and the host
+  decides where it goes.
+- `?author=` on the page's URL still names the user for comments and board notes.
+- An unframed page that uses `?host=parent` keeps the normal app with downloads.
+  `data-host="page"` turns this mode on only when `?host=parent` is absent: if `?host=parent` is
+  present it takes precedence, so a same-origin framed page uses the parent bridge, while an
+  unframed or cross-origin page gets no bridge and keeps normal downloads.
+
+The messages and both transports are the shared contract of [`craft-web-host`](https://github.com/storytold/craft-libs/tree/main/crates/web-host) (storytold/craft-libs#420), the same for every Craft app: its README lists every message, including `saved`, with the compatibility notes. In `figcraft:ready`, `version` is the contract's (`"1"`) and `appVersion` is this app's release. FigCraft reads bytes, so a host sends `bytes`, not a `File`.
+
+### Trust and limits
+
+- **Who is trusted.** In page host mode the page and FigCraft share one document, so any script on the page can drive the app: open files in it and receive what it saves. Use this mode only for a page you control. The iframe mode (`?host=parent`) answers only the parent window, on the page's own origin.
+- **Files from the host are untrusted input.** An opened file goes through the same reading as one picked with File ▸ Open or dropped on the window, with the same format limits; before it is copied into the app's memory, its size is checked against the host open limit (512 MB) and a larger file is refused, and a name is cut to 255 characters.
+- **The event and message names are the interface.** `figcraft:ready`, `figcraft:open`, `figcraft:save`, `figcraft:dirty` and `figcraft:failed`, and the fields they carry (the same as the `?host=parent` messages), stay stable; changing one is a breaking change.
+
 ## Renderer selection and fallback flags
 
 FigCraft renders with wgpu. It uses **WebGPU** when the browser has it and falls back to