Merge main into #2096

contributors/people.toml

@@ -115,3 +115,6 @@ display_name = "Hamza0101"
 
 [people.ashokram-si]
 real_name = "Ashok Ram"
+
+[people.GiovanniBot]
+sync_github_name = true

crates/collab-net/src/client_cap_tests.rs

@@ -4,7 +4,7 @@
 
 use std::sync::{Arc, Mutex};
 
-use figcraft_collab::message::{Peer, Presence, ServerMsg};
+use figcraft_collab::message::{Access, CatchUp, Peer, Presence, Processed, ServerMsg};
 use figcraft_engine::live::{Event, MAX_PEERS};
 
 use crate::guest::GuestConfig;
@@ -59,3 +59,39 @@ fn joins_past_the_cap_are_left_out_until_someone_leaves() {
     send(joined(over));
     assert!(matches!(inbox.drain().as_slice(), [Event::PeerLeft(7), Event::PeerJoined(p)] if p.client_id == over));
 }
+
+#[test]
+fn a_hosts_long_names_and_colours_are_cut_where_they_are_kept() {
+    let inbox = inbox();
+    let cfg = GuestConfig::new(Invite::new("127.0.0.1:47900", "0123456789abcdef", "AbCdEfGhIjKlMnOpQrStUv"), "Ada".into());
+    let resume = Mutex::new(None);
+    let mut seen = Seen::default();
+    let long = "x".repeat(100_000);
+    take(ServerMsg::PeerJoined(Peer { client_id: 1, name: long.clone(), color: long }), &cfg, &inbox, &mut seen, &resume, &|| {});
+    match inbox.drain().as_slice() {
+        [Event::PeerJoined(p)] => assert_eq!((p.name.as_str(), p.color.as_str()), ("x".repeat(256).as_str(), "x".repeat(32).as_str())),
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn the_welcome_handed_to_the_sync_client_carries_the_bounded_roster() {
+    let inbox = inbox();
+    let cfg = GuestConfig::new(Invite::new("127.0.0.1:47900", "0123456789abcdef", "AbCdEfGhIjKlMnOpQrStUv"), "Ada".into());
+    let resume = Mutex::new(None);
+    let long = "y".repeat(100_000);
+    let welcome = ServerMsg::Welcome {
+        session: 1,
+        client_id: 9,
+        seq: 0,
+        catch_up: CatchUp::Snapshot(Vec::new()),
+        processed: Processed::default(),
+        peers: vec![Peer { client_id: 1, name: long.clone(), color: long }],
+        access: Access::default(),
+        secret: 0,
+    };
+    take(welcome, &cfg, &inbox, &mut Seen::default(), &resume, &|| {});
+    let events = inbox.drain();
+    let Some(Event::Sync(ServerMsg::Welcome { peers, .. })) = events.iter().find(|e| matches!(e, Event::Sync(_))) else { panic!("{events:?}") };
+    assert_eq!(peers.first().map(|p| (p.name.chars().count(), p.color.chars().count())), Some((256, 32)));
+}

crates/collab-net/src/join.rs

@@ -226,6 +226,19 @@ pub(crate) struct Seen {
     peers: Vec<Peer>,
 }
 
+/// `p` with its name and colour cut to what the UI shows: the host is untrusted, and the roster is
+/// copied whenever someone's identity is updated.
+fn bounded(mut p: Peer) -> Peer {
+    p.name = p.name.chars().take(MAX_PEER_NAME).collect();
+    p.color = p.color.chars().take(MAX_COLOR).collect();
+    p
+}
+
+/// The most characters of a colour (`#rrggbb` and a few spellings more) kept for someone.
+const MAX_COLOR: usize = 32;
+/// The most characters of a name kept for someone.
+const MAX_PEER_NAME: usize = 256;
+
 /// What taking in one message from the host means for the connection.
 pub(crate) enum Taken {
     Continue,
@@ -251,7 +264,7 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 *r = Some(Resume { session, client_id, seq, secret });
             }
             // The sync client opens the document (and fills in its name and pages).
-            let peers: Vec<Peer> = peers.iter().take(MAX_PEERS).cloned().collect();
+            let peers: Vec<Peer> = peers.iter().take(MAX_PEERS).cloned().map(bounded).collect();
             let inv = &cfg.invite;
             let info = SessionInfo {
                 role: Role::Guest,
@@ -268,20 +281,24 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 view: None,
             };
             seen.peers = peers.clone();
+            // The sync client keeps the roster of the welcome it is handed: the bounded one.
+            if let ServerMsg::Welcome { peers: sent, .. } = &mut m {
+                sent.clone_from(&peers);
+            }
             seen.info = Some(info.clone());
             welcomed();
             inbox.push(Event::Welcome { info, peers });
             inbox.push(Event::Sync(m));
             return Taken::Welcomed;
         }
-        ServerMsg::PeerJoined(p) => match seen.info.as_mut() {
+        ServerMsg::PeerJoined(p) => match (seen.info.as_mut(), bounded(p)) {
             // The host tells you how you are shown.
-            Some(info) if p.client_id == info.me => {
+            (Some(info), p) if p.client_id == info.me => {
                 info.name = p.name;
                 info.color = p.color;
                 inbox.push(Event::Welcome { info: info.clone(), peers: seen.peers.clone() });
             }
-            _ => {
+            (_, p) => {
                 match seen.peers.iter().position(|q| q.client_id == p.client_id) {
                     Some(i) => {
                         seen.peers.remove(i);

crates/doc/src/board.rs

@@ -37,8 +37,8 @@ impl FileKind {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "camelCase")]
 pub enum BoardItem {
-    /// A sticky note: a frame whose first text layer is the note (its size shrinks as the note
-    /// grows) and, below it, who wrote it.
+    /// A sticky note: a frame whose first text layer is the note (its size stays fixed, the note
+    /// grows taller) and, below it, who wrote it.
     Sticky {
         #[serde(default, skip_serializing_if = "String::is_empty")]
         author: String,

crates/engine/src/assets/components.rs

@@ -60,7 +60,7 @@ pub use patch::sync_after_edit;
 pub(crate) use patch::{FULL_REBUILD, PATCHED};
 #[cfg(test)]
 use rebase::RebaseSources;
-pub use rebase::rebase_instance;
+pub use rebase::{MainPaths, rebase_instance, rebase_instance_with};
 pub use sync::keep_text_overrides;
 pub use variants::{default_variant, exposed_copies, find_variant, mirror_issues, variant_conflicts, variant_name, variant_options, variant_props};
 

crates/engine/src/assets/components/rebase.rs

@@ -165,10 +165,28 @@ impl<'a> RebaseSources<'a> {
 /// values (after detaching an outer instance, restoring a main, or copying a nested instance out):
 /// the look is kept exactly. Values a component property sets aren't overrides.
 pub fn rebase_instance(doc: &mut Document, inst: NodeId) {
+    rebase_instance_with(doc, inst, &mut MainPaths::new());
+}
+
+/// The layers of mains by path, kept across several [`rebase_instance_with`] calls. Rebasing only
+/// writes instances' `source` and `overrides`, never a main's layers or names, so a main's paths
+/// stay right for as long as the caller changes nothing else.
+pub type MainPaths = BTreeMap<NodeId, std::rc::Rc<BTreeMap<String, NodeId>>>;
+
+/// [`rebase_instance`], taking each main's path map from `mains` (and adding it there).
+pub fn rebase_instance_with(doc: &mut Document, inst: NodeId, mains: &mut MainPaths) {
     let Some(NodeKind::Instance { component, .. }) = doc.node(inst).map(|n| n.kind.clone()) else { return };
     let mine = path_map(doc, inst, true);
-    let theirs: BTreeMap<String, NodeId> =
-        if doc.contains(component) { path_map(doc, component, false).into_iter().map(|(k, v)| (v, k)).collect() } else { BTreeMap::new() };
+    let theirs = mains
+        .entry(component)
+        .or_insert_with(|| {
+            std::rc::Rc::new(if doc.contains(component) {
+                path_map(doc, component, false).into_iter().map(|(k, v)| (v, k)).collect()
+            } else {
+                BTreeMap::new()
+            })
+        })
+        .clone();
     let value_groups = |a: &Node, b: &Node| -> Vec<String> {
         diff_groups(a, b).into_iter().filter(|g| !matches!(*g, "size" | "position")).map(str::to_string).collect()
     };

crates/engine/src/assets/components/sync.rs

@@ -34,7 +34,7 @@ pub(super) fn sync_instance_depth(doc: &mut Document, inst: NodeId, depth: usize
         let nid = doc.alloc_id();
         map.insert(s, nid);
     }
-    let Copies { nodes: new_nodes, nested, mut remeasure } = copy_layers(doc, inst, &src, &map, &old, &edited, eff_props);
+    let Copies { nodes: new_nodes, nested, mut remeasure } = copy_layers(doc, inst, component, &src, &map, &old, &edited, eff_props);
     for n in new_nodes {
         let (id, parent) = (n.id, n.parent);
         if insert_linked(doc, n).is_err()
@@ -132,6 +132,7 @@ struct Copies {
 fn copy_layers(
     doc: &Document,
     inst: NodeId,
+    component: NodeId,
     src: &[NodeId],
     map: &BTreeMap<NodeId, NodeId>,
     old: &BTreeMap<NodeId, std::sync::Arc<Node>>,
@@ -139,7 +140,7 @@ fn copy_layers(
     props: BTreeMap<String, Value>,
 ) -> Copies {
     let mut enclosing: BTreeMap<NodeId, Vec<NodeId>> = BTreeMap::from([(inst, vec![inst])]);
-    let mut inst_props: BTreeMap<NodeId, BTreeMap<String, Value>> = BTreeMap::from([(inst, props)]);
+    let mut inst_props: BTreeMap<NodeId, (NodeId, BTreeMap<String, Value>)> = BTreeMap::from([(inst, (component, props))]);
     let mut out = Copies { nodes: Vec::new(), nested: Vec::new(), remeasure: Vec::new() };
     for s in src {
         let Some(orig) = doc.node(*s) else { continue };
@@ -164,12 +165,12 @@ fn copy_layers(
             // No longer a slot in the main: it mirrors the main again.
             n.overrides.remove(SLOT);
         }
-        // Component properties: the main layer's bindings use this instance's values; layers of
-        // nested instances use the nested instance's values (one level per source hop).
+        // Bindings use the enclosing instance of their defining component, even when slot
+        // content has fewer source hops than enclosing instances.
         let enc = enclosing.get(&parent).cloned().unwrap_or_default();
         apply_enclosing_props(doc, &mut n, orig, &enc, &inst_props);
         if let NodeKind::Instance { component: c, props } = &n.kind {
-            inst_props.insert(nid, props.clone());
+            inst_props.insert(nid, (*c, props.clone()));
             let mut e = enc;
             e.push(nid);
             enclosing.insert(nid, e);
@@ -253,14 +254,28 @@ fn rebuild_nested(doc: &mut Document, nested: Vec<NodeId>, old: &BTreeMap<NodeId
     }
 }
 
-fn apply_enclosing_props(doc: &Document, n: &mut Node, orig: &Node, enc: &[NodeId], inst_props: &BTreeMap<NodeId, BTreeMap<String, Value>>) {
+/// Apply bindings from their defining components, preserving explicit overrides and letting
+/// nearer source layers take precedence. Slot content need not have one source hop per instance.
+fn apply_enclosing_props(
+    doc: &Document,
+    n: &mut Node,
+    orig: &Node,
+    enc: &[NodeId],
+    inst_props: &BTreeMap<NodeId, (NodeId, BTreeMap<String, Value>)>,
+) {
     let mut chain: Vec<&Node> = vec![orig];
     while chain.len() < enc.len() {
         let Some(next) = chain.last().and_then(|c| c.source).and_then(|x| doc.node(x)) else { break };
         chain.push(next);
     }
     for (j, level) in chain.iter().enumerate().rev() {
-        let Some(props) = enc.get(j).and_then(|e| inst_props.get(e)) else { continue };
+        if level.prop_refs.is_empty() {
+            continue;
+        }
+        let Some(owner) = owning_component(doc, level.id) else { continue };
+        // Instance-owned slot content skips a source hop through the slot's component. Match
+        // the binding's defining component, not the position in the enclosing instance chain.
+        let Some((_, props)) = enc.iter().rev().filter_map(|e| inst_props.get(e)).find(|(component, _)| *component == owner) else { continue };
         for (field, prop) in &level.prop_refs {
             let g = field_group(field);
             if n.overrides.contains(g) || (j > 0 && orig.overrides.contains(g)) {

crates/engine/src/automation/file_access.rs

@@ -12,6 +12,11 @@
 //! existing folder is resolved and the rest must be plain names. The comparison is by whole
 //! components (`/work2` is not inside `/work`), and the I/O uses the resolved path, so what was
 //! checked is what is opened.
+//!
+//! On Windows, resolving a path opens it, and opening a path on another computer contacts that
+//! computer and may send it the signed-in user's credentials. So on Windows, before anything is
+//! resolved, a path on another computer whose share no root is on, a device path, or one reached
+//! through a link that leads to them is refused by how it is spelled (#1094).
 #![allow(clippy::disallowed_methods)]
 
 use std::cell::RefCell;
@@ -19,6 +24,8 @@ use std::ffi::{OsStr, OsString};
 use std::path::{Component, Path, PathBuf};
 use std::sync::Arc;
 
+use craft_docpath::Refused;
+
 use crate::{EngineError, Result};
 
 /// What a command does with a file.
@@ -58,6 +65,19 @@ impl Roots {
             Access::Read => ([self.read.as_slice(), self.write.as_slice()].concat(), "read"),
             Access::Write => (self.write.clone(), "written"),
         };
+        if cfg!(windows) {
+            match refused_unresolved(path, &roots) {
+                Some(Unresolved::Spelled(Refused::Network)) => {
+                    return Err(format!(
+                        "automation path rejected: {asked} is on another computer, and no folder that may be {what} is on its share"
+                    ));
+                }
+                Some(Unresolved::Spelled(_)) => return Err(format!("automation path rejected: {asked} names a device, not a file")),
+                // Where a link leads is only told by the usual message: it would say what is there.
+                Some(Unresolved::Linked) => return Err(outside(asked, &roots, what)),
+                None => {}
+            }
+        }
         match resolve(path) {
             Ok(resolved) if roots.iter().any(|r| resolved.starts_with(r)) => return Ok(resolved),
             Ok(_) => {}
@@ -65,11 +85,7 @@ impl Roots {
             Err(why) if inside_as_far_as_it_exists(path, &roots) => return Err(format!("automation path rejected: {asked}: {why}")),
             Err(_) => {}
         }
-        if roots.is_empty() {
-            return Err(format!("automation path rejected: no folder may be {what} (no root for it was given): {asked}"));
-        }
-        let shown: Vec<String> = roots.iter().map(|r| shown(r)).collect();
-        Err(format!("automation path rejected: {asked} is outside the folders that may be {what}: {}", shown.join(", ")))
+        Err(outside(asked, &roots, what))
     }
 
     /// The folders as JSON, resolved: `{read: [every folder that may be read], write: [the write roots]}`.
@@ -79,23 +95,165 @@ impl Roots {
     }
 }
 
+/// Why `asked` is refused: it is outside every one of `roots`, the folders that may be `what`
+/// ("read" or "written"). The message lists those folders, or says that no folder may be `what`
+/// when `roots` is empty.
+fn outside(asked: std::path::Display<'_>, roots: &[PathBuf], what: &str) -> String {
+    if roots.is_empty() {
+        return format!("automation path rejected: no folder may be {what} (no root for it was given): {asked}");
+    }
+    let shown: Vec<String> = roots.iter().map(|r| shown(r)).collect();
+    format!("automation path rejected: {asked} is outside the folders that may be {what}: {}", shown.join(", "))
+}
+
+/// Why a path is refused before it is resolved (#1094).
+#[derive(Debug, PartialEq, Eq)]
+enum Unresolved {
+    /// Its spelling leads to another computer ([`Refused::Network`]) or a device ([`Refused::Device`]).
+    Spelled(Refused),
+    /// A link on the way leads there, or the way there can't be looked at: a link or folder on it
+    /// can't be read, it has more than [`MAX_LINKS`] links, or the path can't be made absolute.
+    Linked,
+}
+
+/// How many links are followed on the way to a path before it is given up on, as on Linux.
+const MAX_LINKS: u8 = 40;
+
+/// Why `path` is refused before anything on the way to it is opened, if it is: resolving it would
+/// open a path on another computer, which on Windows contacts that computer and may send it the
+/// signed-in user's credentials, or open a device (#1094). That is the case when the path as
+/// given or made absolute is refused by its spelling ([`refused_spelling`]), or when a link on
+/// the way, or on the way on from where one leads, leads to such a path ([`link_refused`]). A path
+/// on the share of one of `roots` goes on to the usual check. A path that can't be made absolute
+/// is refused as well, rather than left to what comes next.
+fn refused_unresolved(path: &Path, roots: &[PathBuf]) -> Option<Unresolved> {
+    // Made absolute without looking at the disk (on Windows `GetFullPathNameW`, which also turns a
+    // bare device name such as `NUL` into `\\.\NUL`, as opening it would). Like opening, it takes
+    // `..` by name, so `link\..\x` is `x` and never goes through the link.
+    let Ok(abs) = std::path::absolute(path) else { return Some(Unresolved::Linked) };
+    if let Some(why) = [path, abs.as_path()].into_iter().find_map(|p| refused_spelling(&p.to_string_lossy(), roots)) {
+        return Some(Unresolved::Spelled(why));
+    }
+    link_refused(&abs, roots, MAX_LINKS, &on_disk).then_some(Unresolved::Linked)
+}
+
+/// What is at a path, looked at without following a link there.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Entry {
+    /// Nothing ([`nothing_there`]): resolving the path meets the same there and goes no further.
+    Missing,
+    /// Something that can't be looked at (no permission, for one). It may be a link that resolving
+    /// the path would still follow, so the path is refused.
+    Unreadable,
+    /// A file or a folder.
+    Plain,
+    /// A link, with where it leads (`None` when that can't be read).
+    Link(Option<PathBuf>),
+}
+
+/// What is at `p` on disk (see [`Entry`]), looked at with [`std::fs::symlink_metadata`], which
+/// doesn't follow a link there; a link's target is read with [`std::fs::read_link`].
+fn on_disk(p: &Path) -> Entry {
+    match std::fs::symlink_metadata(p) {
+        Ok(m) if m.is_symlink() => Entry::Link(std::fs::read_link(p).ok()),
+        Ok(_) => Entry::Plain,
+        Err(e) if nothing_there(&e) => Entry::Missing,
+        Err(_) => Entry::Unreadable,
+    }
+}
+
+/// Whether looking at a path failed with `e` because nothing is there: no such name, a file where
+/// a folder was expected, or a name no file can have. Any other failure says nothing about what is
+/// there.
+fn nothing_there(e: &std::io::Error) -> bool {
+    use std::io::ErrorKind::{InvalidFilename, NotADirectory, NotFound};
+    matches!(e.kind(), NotFound | NotADirectory | InvalidFilename)
+}
+
+/// Why path `p` is refused by its spelling alone, if it is (see [`craft_docpath::resolve`], which
+/// reads both `/` and `\` as separators and compares names ignoring case):
+/// - on another computer (`\\server\share`, `//server/share`, `\\?\UNC\…`, `\\.\UNC\…`, or a
+///   server without a share) and on no root's share;
+/// - a device path (`\\.\pipe\…`, `\\?\GLOBALROOT\…`, `\\.\C:\…`), other than a local volume's
+///   `\\?\Volume{…}\` or `\\.\Volume{…}\`, which a folder can be mounted as;
+/// - or with a device name (`CON`, `NUL`, `COM1.png`, `lpt1 `…) as any of its names: each folder on
+///   the way is opened in turn while the path is resolved, and the device behind a name such as
+///   `LPT1` can be a printer on another computer.
+fn refused_spelling(p: &str, roots: &[PathBuf]) -> Option<Refused> {
+    match craft_docpath::resolve(p, None) {
+        // With a root passed as the document path (what a link would be relative to), a path on
+        // that root's share is allowed.
+        Err(Refused::Network) if !roots.iter().any(|r| craft_docpath::resolve(p, Some(r)) != Err(Refused::Network)) => {
+            return Some(Refused::Network);
+        }
+        Err(Refused::Device) if !is_volume(p) => return Some(Refused::Device),
+        _ => {}
+    }
+    // `craft_docpath` stops at the first name it refuses, which may not be the device's.
+    p.split(['\\', '/']).any(device_name).then_some(Refused::Device)
+}
+
+/// Whether `p` is in a local volume by its `\\?\Volume{…}` (or `\\.\Volume{…}`) name.
+fn is_volume(p: &str) -> bool {
+    let mut names = p.split(['\\', '/']);
+    let (Some(""), Some(""), Some("?" | "."), Some(volume)) = (names.next(), names.next(), names.next(), names.next()) else {
+        return false;
+    };
+    volume.get(..7).is_some_and(|v| v.eq_ignore_ascii_case("Volume{")) && volume.ends_with('}')
+}
+
+/// Whether a link on the way to `abs` (an absolute path) leads to a path [`refused_spelling`]
+/// refuses, following at most `links` links: one that leads to another, or on through further
+/// links, is followed too, as resolving the path would. A link that can't be read, a name on the
+/// way that can't be looked at ([`Entry::Unreadable`]), or more links than that, are refused as
+/// well. Each name on the way is looked at with `look` ([`on_disk`]), which doesn't follow a
+/// link: where a link leads is looked at only once its spelling is known not to be refused.
+fn link_refused(abs: &Path, roots: &[PathBuf], links: u8, look: &dyn Fn(&Path) -> Entry) -> bool {
+    let mut at = PathBuf::new();
+    let mut rest = abs.components();
+    while let Some(c) = rest.next() {
+        at.push(c);
+        if !matches!(c, Component::Normal(_)) {
+            continue;
+        }
+        let target = match look(&at) {
+            Entry::Plain => continue,
+            // Nothing is below what isn't there, so no link either.
+            Entry::Missing => return false,
+            Entry::Unreadable => return true,
+            Entry::Link(target) => target,
+        };
+        let (Some(links), Some(target)) = (links.checked_sub(1), target) else { return true };
+        // A relative target is relative to the link's folder; an absolute one replaces it.
+        let next = lexical(&at.parent().unwrap_or(&at).join(target).join(rest.as_path()));
+        return refused_spelling(&next.to_string_lossy(), roots).is_some() || link_refused(&next, roots, links, look);
+    }
+    false
+}
+
+/// `p` with its `.` and `..` taken by name, as Windows takes them.
+fn lexical(p: &Path) -> PathBuf {
+    let mut out = PathBuf::new();
+    for c in p.components() {
+        match c {
+            Component::ParentDir => {
+                out.pop();
+            }
+            Component::CurDir => {}
+            c => out.push(c),
+        }
+    }
+    out
+}
+
 /// Whether `path` lies in one of `roots` once made absolute with its `.` and `..` taken by name and
 /// its longest leading part that exists resolved, so links on the way are followed as the roots'
 /// were (`/tmp/work/x` is inside root `/private/tmp/work`, a link out of a root leads out of it).
 fn inside_as_far_as_it_exists(path: &Path, roots: &[PathBuf]) -> bool {
     let Ok(abs) = std::path::absolute(path) else { return false };
-    let mut lexical = PathBuf::new();
-    for c in abs.components() {
-        match c {
-            Component::ParentDir => {
-                lexical.pop();
-            }
-            Component::CurDir => {}
-            c => lexical.push(c),
-        }
-    }
+    let folded = lexical(&abs);
     let mut rest: Vec<&OsStr> = Vec::new();
-    let mut at = lexical.as_path();
+    let mut at = folded.as_path();
     let resolved = loop {
         if let Ok(mut base) = std::fs::canonicalize(at) {
             base.extend(rest.iter().rev());
@@ -169,18 +327,24 @@ fn resolve(path: &Path) -> std::result::Result<PathBuf, String> {
 fn plain_name(name: &OsStr) -> std::result::Result<(), String> {
     if cfg!(windows) {
         let n = name.to_string_lossy();
-        let stem = n.split('.').next().unwrap_or_default().trim_end().to_ascii_uppercase();
-        let device = matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$")
-            || ((stem.starts_with("COM") || stem.starts_with("LPT"))
-                && stem.chars().count() == 4
-                && stem.chars().last().is_some_and(|c| c.is_ascii_digit() || matches!(c, '¹' | '²' | '³')));
-        if device || n.contains(':') {
+        if device_name(&n) || n.contains(':') {
             return Err(format!("`{n}` is a device or stream name, not a file"));
         }
     }
     Ok(())
 }
 
+/// Whether Windows opens a device for file or folder name `n`: `CON`, `PRN`, `AUX`, `NUL`,
+/// `CONIN$`, `CONOUT$`, `COM1`…`COM9` and `LPT1`…`LPT9` (also with `¹`, `²` or `³`), in any case,
+/// and with anything after a dot or a colon or trailing spaces (`nul.txt`, `COM1 .png`, `con:x`).
+fn device_name(n: &str) -> bool {
+    let stem = n.split(['.', ':']).next().unwrap_or_default().trim_end().to_ascii_uppercase();
+    matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$")
+        || ((stem.starts_with("COM") || stem.starts_with("LPT"))
+            && stem.chars().count() == 4
+            && stem.chars().last().is_some_and(|c| c.is_ascii_digit() || matches!(c, '¹' | '²' | '³')))
+}
+
 thread_local! {
     static ROOTS: RefCell<Option<Arc<Roots>>> = const { RefCell::new(None) };
 }

crates/engine/src/automation/file_access/tests.rs

@@ -191,6 +191,283 @@ fn windows_case_devices_and_streams() {
     assert!(!e.contains(r"\\?\"), "{e}");
 }
 
+/// How each spelling of a path on another computer or of a device is told apart from a local path
+/// (#1094), on every system: only Windows checks them, but they are spelled the same everywhere.
+#[test]
+fn spellings_of_other_computers_and_devices_are_refused() {
+    use super::refused_spelling;
+    use craft_docpath::Refused::{Device, Network};
+    let local = [PathBuf::from(r"C:\work")];
+    // On `\\192.0.2.1\share`.
+    let on_the_share = [
+        r"\\192.0.2.1\share\x.png",
+        "//192.0.2.1/share/x.png",
+        r"\/192.0.2.1/share\x.png",
+        r"\\?\UNC\192.0.2.1\share\x.png",
+        r"\\?\unc\192.0.2.1\share\x.png",
+        "//?/UNC/192.0.2.1/share/x.png",
+        r"\\.\UNC\192.0.2.1\share\x.png",
+    ];
+    let elsewhere = [
+        // A server without a share is contacted too.
+        r"\\192.0.2.1",
+        r"\\192.0.2.1\",
+        r"\\SERVER.\share \x.png",
+    ];
+    let network = [&on_the_share[..], &elsewhere[..]].concat();
+    let device = [
+        r"\\.\pipe\figcraft",
+        r"\\?\GLOBALROOT\Device\Mup\192.0.2.1\share\x.png",
+        r"\\.\C:\work\x.png",
+        r"\\.\COM1",
+        r"\??\UNC\192.0.2.1\share\x.png",
+        // A device name anywhere: each folder on the way is opened as the path is resolved.
+        r"C:\work\COM1",
+        r"C:\work\nul.txt",
+        r"C:\work\Com1 .png",
+        r"C:\work\lpt1.\x.png",
+        r"C:\work\LPT³\x.png",
+        r"C:\work\conout$",
+        r"C:\work\aux:stream",
+        // After a name `craft_docpath` refuses for another reason.
+        r"C:\work\a:b\prn.png",
+    ];
+    let fine = [
+        r"C:\work\x.png",
+        r"\\?\C:\work\x.png",
+        r"C:\work\console.png",
+        r"C:\work\com10.png",
+        r"C:\work\lpt.png",
+        r"C:\work\nul-ish.txt",
+        r"\\?\Volume{0b3b1c63-0000-0000-0000-100000000000}\x.png",
+        r"\\.\Volume{0b3b1c63-0000-0000-0000-100000000000}\x.png",
+        "/home/u/work/x.png",
+        "x.png",
+        r"..\x.png",
+    ];
+    for (paths, want) in [(&network[..], Some(Network)), (&device[..], Some(Device)), (&fine[..], None)] {
+        for p in paths {
+            assert_eq!(refused_spelling(p, &[]), want, "{p}");
+            assert_eq!(refused_spelling(p, &local), want, "{p} with a local root");
+        }
+    }
+    // A root on a share lets the paths on that share through, in any case and spelling, and only them:
+    // every spelling above of a path on `\\192.0.2.1\share`, but not the server without a share
+    // or another server.
+    for root in [r"\\?\UNC\192.0.2.1\share", r"\\192.0.2.1\share\work"] {
+        let on_share = [PathBuf::from(root)];
+        for p in on_the_share {
+            assert_eq!(refused_spelling(p, &on_share), None, "{p} with root {root}");
+        }
+        for p in elsewhere {
+            assert_eq!(refused_spelling(p, &on_share), Some(Network), "{p} with root {root}");
+        }
+    }
+    let shared = [PathBuf::from(r"\\?\UNC\Server\Share\work")];
+    for p in [r"\\server\SHARE\work\x.png", r"\\?\UNC\SERVER\share\elsewhere\x.png", "//Server/Share/work/x.png"] {
+        assert_eq!(refused_spelling(p, &shared), None, "{p}");
+    }
+    for p in [r"\\server\other\x.png", r"\\other\share\x.png", r"\\server", r"\\server.\share\x.png"] {
+        assert_eq!(refused_spelling(p, &shared), Some(Network), "{p}");
+    }
+    assert_eq!(refused_spelling(r"\\server\share\work\COM1", &shared), Some(Device));
+}
+
+/// The links on the way to a path are followed by their spelling before anything they lead to is
+/// opened (#1094). The links are made up here, so this runs where tests may not make links.
+#[test]
+fn links_on_the_way_are_followed_by_their_spelling_first() {
+    use super::{Entry, MAX_LINKS, link_refused};
+    use std::cell::RefCell;
+    use std::collections::HashMap;
+    let base = std::env::temp_dir().join("figcraft-links");
+    let at = |rel: &str| base.join(rel);
+    let mut links: HashMap<PathBuf, Option<PathBuf>> = HashMap::from([
+        // Relative to the link's folder, to a device name.
+        (at("root/dev"), Some(PathBuf::from("../outside/nul"))),
+        // To another link.
+        (at("root/hop"), Some(at("root/dev"))),
+        // Within the root.
+        (at("root/alias"), Some(PathBuf::from("sub"))),
+        (at("root/loop"), Some(at("root/loop"))),
+        (at("root/unreadable"), None),
+        // Below a name that isn't there: never looked at.
+        (at("missing/dev"), Some(PathBuf::from("nul"))),
+    ]);
+    if cfg!(windows) {
+        links.insert(at("root/remote"), Some(PathBuf::from(r"\\192.0.2.1\share")));
+        links.insert(at("root/far"), Some(at("root/remote/work")));
+    }
+    // Chains of `n` links, `root/<n>-1` to `root/<n>-2` and so on, the last one to `root/sub`.
+    for n in [MAX_LINKS - 1, MAX_LINKS, MAX_LINKS + 1] {
+        for i in 1..=n {
+            let next = if i == n { at("root/sub") } else { at(&format!("root/{n}-{}", i + 1)) };
+            links.insert(at(&format!("root/{n}-{i}")), Some(next));
+        }
+    }
+    let plain = [at("root"), at("root/sub"), at("outside")];
+    // What can't be looked at (no permission, say) may be a link, so it isn't taken for nothing.
+    let unreadable = at("root/locked");
+    let looked = RefCell::new(Vec::new());
+    let look = |p: &Path| {
+        looked.borrow_mut().push(p.to_path_buf());
+        match links.get(p) {
+            Some(target) => Entry::Link(target.clone()),
+            None if base.starts_with(p) || plain.iter().any(|q| q == p) => Entry::Plain,
+            None if p == unreadable => Entry::Unreadable,
+            None => Entry::Missing,
+        }
+    };
+    let refused = |rel: &str, roots: &[PathBuf]| link_refused(&at(rel), roots, MAX_LINKS, &look);
+    for rel in ["root/dev/x.png", "root/hop/x.png", "root/loop/x.png", "root/unreadable/x.png", "root/locked/x.png", "root/locked"] {
+        assert!(refused(rel, &[]), "{rel}");
+    }
+    for rel in ["root/alias/x.png", "root/sub/x.png", "root/x.png", "missing/dev/x.png"] {
+        assert!(!refused(rel, &[]), "{rel}");
+    }
+    // As many links as are followed lead on; one more is refused.
+    assert!(!refused(&format!("root/{}-1/x.png", MAX_LINKS - 1), &[]));
+    assert!(!refused(&format!("root/{MAX_LINKS}-1/x.png"), &[]));
+    assert!(refused(&format!("root/{}-1/x.png", MAX_LINKS + 1), &[]));
+    // A refused target isn't looked at, nor is anything below what isn't there.
+    let looked = looked.take();
+    assert!(!looked.contains(&at("outside/nul")) && !looked.contains(&at("missing/dev")), "{looked:?}");
+    if cfg!(windows) {
+        for rel in ["root/remote/x.png", "root/far/x.png"] {
+            assert!(refused(rel, &[]), "{rel}");
+            // Unless a root is on that share.
+            assert!(!refused(rel, &[PathBuf::from(r"\\?\UNC\192.0.2.1\share")]), "{rel}");
+        }
+    }
+}
+
+/// A path that can't be looked at is refused rather than taken for one with nothing there (#1094):
+/// only a failure that says nothing is there lets the walk stop, and a path that can't even be
+/// made absolute isn't left to the checks after it.
+#[test]
+fn what_cannot_be_looked_at_is_refused() {
+    use super::{Unresolved, nothing_there, refused_unresolved};
+    use std::io::{Error, ErrorKind};
+    for kind in [ErrorKind::NotFound, ErrorKind::NotADirectory, ErrorKind::InvalidFilename] {
+        assert!(nothing_there(&Error::from(kind)), "{kind:?}");
+    }
+    for kind in [ErrorKind::PermissionDenied, ErrorKind::ResourceBusy, ErrorKind::Interrupted, ErrorKind::Other] {
+        assert!(!nothing_there(&Error::from(kind)), "{kind:?}");
+    }
+    assert_eq!(refused_unresolved(Path::new(""), &[]), Some(Unresolved::Linked));
+}
+
+/// On Windows a path is classified as Windows opens it (#1094): with `..` taken by name before
+/// anything is opened (so a link followed by `..` is never gone through), and with names that
+/// aren't Unicode (a lone surrogate) still read for the parts that are spelled in ASCII.
+#[cfg(windows)]
+#[test]
+fn paths_are_classified_as_windows_opens_them() {
+    use super::{Unresolved, refused_unresolved};
+    use craft_docpath::Refused::{Device, Network};
+    use std::ffi::OsString;
+    use std::os::windows::ffi::OsStringExt;
+    assert_eq!(std::path::absolute(r"C:\work\remote\..\x.png").unwrap(), PathBuf::from(r"C:\work\x.png"));
+    // `before`, a lone surrogate, then `after`.
+    let odd = |before: &str, after: &str| {
+        let wide: Vec<u16> = before.encode_utf16().chain([0xD800]).chain(after.encode_utf16()).collect();
+        PathBuf::from(OsString::from_wide(&wide))
+    };
+    assert_eq!(refused_unresolved(&odd(r"\\192.0.2.1\share\", ".png"), &[]), Some(Unresolved::Spelled(Network)));
+    assert_eq!(refused_unresolved(&odd(r"C:\figcraft-no-such-folder\", r"\nul"), &[]), Some(Unresolved::Spelled(Device)));
+    assert_eq!(refused_unresolved(&odd(r"C:\figcraft-no-such-folder\", ".png"), &[]), None);
+    // A NUL can't be passed to Windows at all, so the path can't be made absolute.
+    assert_eq!(refused_unresolved(Path::new("C:\\work\\a\0b.png"), &[]), Some(Unresolved::Linked));
+}
+
+/// `..` after a link is taken by name, by the check and by Windows when it opens the path, so
+/// `root\j\..\in.txt` is `root\in.txt` and the link `j` is never gone through (#1094). Shown with
+/// a junction, a link any account can make: `j` leads out of the root to `outside`, and beside
+/// `outside` is another `in.txt`, which is what `..` would reach through the link.
+#[cfg(windows)]
+#[test]
+fn a_parent_after_a_link_is_taken_by_name() {
+    use super::{Entry, on_disk};
+    let f = Fixture::new("parent");
+    let r = f.rw();
+    std::fs::write(f.0.join("in.txt"), b"beside").unwrap();
+    let made = std::process::Command::new("cmd").args(["/C", "mklink", "/J"]).arg(f.0.join(r"root\j")).arg(f.0.join("outside")).output();
+    assert!(made.is_ok_and(|o| o.status.success()), "a junction can be made");
+    // The junction is a link to the check, and what is through it is outside.
+    assert!(matches!(on_disk(&f.0.join(r"root\j")), Entry::Link(Some(_))));
+    assert!(r.check(Path::new(&f.p(r"root\j\secret.txt")), Access::Read).is_err());
+    let through = f.p(r"root\j\..\in.txt");
+    assert_eq!(r.check(Path::new(&through), Access::Read), r.check(Path::new(&f.p(r"root\in.txt")), Access::Read));
+    assert!(r.check(Path::new(&through), Access::Read).is_ok());
+    assert_eq!(std::fs::read(&through).unwrap(), b"in", "Windows opens the file in the root");
+}
+
+/// A path on another computer and a device path are refused before anything is opened: resolving
+/// them made Windows contact the server, which may send it the signed-in user's credentials
+/// (#1094). Each is refused with a message that only the check before resolving gives: had the
+/// path been resolved, 192.0.2.1 (an address for documentation, where nothing answers) would have
+/// been contacted and the message would be the one for a path that can't be resolved.
+#[cfg(windows)]
+#[test]
+fn other_computers_and_devices_are_refused_before_anything_is_opened() {
+    let f = Fixture::new("network");
+    let r = f.rw();
+    let read_only = Roots::new(&[f.p("root")], &[]).unwrap();
+    let refused = |roots: &Roots, p: &str, access: Access| roots.check(Path::new(p), access).expect_err(p);
+    for p in
+        [r"\\192.0.2.1\share\x.png", "//192.0.2.1/share/x.png", r"\\?\UNC\192.0.2.1\share\x.png", r"\\.\UNC\192.0.2.1\share\x.png", r"\\192.0.2.1"]
+    {
+        for access in [Access::Read, Access::Write] {
+            let e = refused(&r, p, access);
+            assert!(e.contains("is on another computer, and no folder that may be"), "{p}: {e}");
+        }
+        let e = refused(&read_only, p, Access::Write);
+        assert!(e.ends_with("is on another computer, and no folder that may be written is on its share"), "{p}: {e}");
+    }
+    for p in [r"\\.\pipe\figcraft-roots", r"\\?\GLOBALROOT\Device\Mup\192.0.2.1\share\x.png", &f.p(r"root\COM1\x.png"), "nul"] {
+        for access in [Access::Read, Access::Write] {
+            let e = refused(&r, p, access);
+            assert!(e.ends_with("names a device, not a file"), "{p}: {e}");
+        }
+    }
+    // Local paths, in either spelling, are checked as before.
+    let inside = std::fs::canonicalize(f.p("root")).unwrap().join("in.txt");
+    assert!(r.check(&inside, Access::Read).is_ok());
+    assert!(r.check(Path::new(&f.p(r"root\in.txt")), Access::Read).is_ok());
+}
+
+/// A link in a root to another computer is refused before it is followed (#1094), also through
+/// another link, and with the message any path outside gets: it doesn't tell where the link
+/// leads. Had the link been followed, the message would be the one for a path that can't be
+/// resolved. This needs real links, which Windows lets only some accounts make: elsewhere it
+/// says so and checks nothing (`links_on_the_way_are_followed_by_their_spelling_first` covers the
+/// same walk with made-up links on every system).
+#[cfg(windows)]
+#[test]
+fn links_to_other_computers_are_refused_before_they_are_followed() {
+    let f = Fixture::new("network-links");
+    let r = f.rw();
+    if !symlink_dir(Path::new(r"\\192.0.2.1\share"), &f.0.join("root/remote")) || !symlink_dir(&f.0.join("root/remote/work"), &f.0.join("root/hop")) {
+        eprintln!("skipped: this system doesn't let tests make symbolic links");
+        return;
+    }
+    // Relative to the link's folder.
+    assert!(symlink_dir(Path::new(r"..\remote"), &f.0.join("root/sub/up")));
+    assert!(symlink_file(Path::new(r"\\.\pipe\figcraft-roots"), &f.0.join("root/pipe")));
+    let standard = |p: &str| format!("automation path rejected: {p} is outside the folders that may be");
+    for p in [f.p("root/remote/x.png"), f.p("root/hop/x.png"), f.p("root/sub/up/x.png"), f.p("root/pipe")] {
+        for access in [Access::Read, Access::Write] {
+            let e = r.check(Path::new(&p), access).expect_err(&p);
+            assert!(e.starts_with(&standard(&p)), "{p}: {e}");
+        }
+    }
+    // `..` after the link is taken by name, so the link isn't gone through.
+    assert!(r.check(Path::new(&f.p(r"root\remote\..\in.txt")), Access::Read).is_ok());
+    // A link to a folder in the root still leads there.
+    assert!(symlink_dir(&f.0.join("root/sub"), &f.0.join("root/alias")));
+    assert!(r.check(Path::new(&f.p("root/alias/x.png")), Access::Write).is_ok());
+}
+
 #[test]
 fn a_scope_confines_the_thread_and_ends_with_it() {
     let f = Fixture::new("scope");

crates/engine/src/board_tests.rs

@@ -7,7 +7,7 @@ use figcraft_doc::{
 use figcraft_geom::Point;
 use serde_json::{Value, json};
 
-use crate::board::{route, sticky_font_size};
+use crate::board::{STICKY_TEXT_SIZE, route};
 use crate::collab_live_tests::Room;
 use crate::tools::{PointerEvent, PointerKind, ToolId};
 use crate::{EngineError, Session};
@@ -77,7 +77,7 @@ fn board_commands_refuse_on_design_files_and_prototyping_refuses_on_boards() {
 }
 
 #[test]
-fn a_sticky_is_a_square_frame_whose_note_shrinks_as_it_grows() {
+fn a_sticky_is_a_square_frame_whose_note_grows_taller_as_it_fills() {
     let mut s = board();
     s.prefs.user_name = "Ada".into();
     let r = s.execute("board.sticky", &json!({"x": 10, "y": 20, "text": "Hi", "color": "blue"})).unwrap();
@@ -88,19 +88,75 @@ fn a_sticky_is_a_square_frame_whose_note_shrinks_as_it_grows() {
     assert_eq!(n.fills[0].solid_color(), board_color("blue"));
     assert!(n.layout.is_some() && !n.effects.is_empty());
     assert_eq!(n.children.len(), 2, "the note and its author");
-    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 24.0);
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 18.0);
     // A click on the note picks the sticky whole.
     let doc = s.doc().unwrap();
     assert_eq!(figcraft_doc::geometry::select_target(doc, note, &[], false), st);
-    // A long note takes a smaller size; a very long one grows the sticky past its square.
+    // A long note keeps the size; a very long one grows the sticky past its square.
     let long = "word ".repeat(120);
     s.execute("node.set", &json!({"id": note, "props": {"characters": long}})).unwrap();
-    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, sticky_font_size(&long));
-    assert!(sticky_font_size(&long) < 16.0);
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, STICKY_TEXT_SIZE);
     assert!(node(&s, st).width == 200.0 && node(&s, st).height >= 200.0);
-    // Undo puts the short note and its size back.
+    // Undo puts the short note back.
     s.execute("edit.undo", &json!({})).unwrap();
-    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 24.0);
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 18.0);
+}
+
+#[test]
+fn a_new_sticky_starts_at_18() {
+    let mut s = board();
+    for (cmd, p) in [("board.sticky", json!({"x": 0, "y": 0, "text": "Hi"})), ("board.sticky", json!({"x": 300, "y": 0}))] {
+        let note = id(&s.execute(cmd, &p).unwrap(), "text");
+        assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 18.0);
+    }
+    let next = id(&s.execute("board.nextSticky", &json!({})).unwrap(), "text");
+    assert_eq!(node(&s, next).kind.text().unwrap().style.font_size, 18.0);
+    assert_eq!(STICKY_TEXT_SIZE, 18.0);
+}
+
+#[test]
+fn a_sticky_keeps_its_text_size_as_text_is_added() {
+    // The note's growth needs text measured: without craft-fonts that is with a system font,
+    // scanned here rather than by whichever test happens to run first (#333).
+    figcraft_text::scan_system_fonts();
+    let mut s = board();
+    let r = s.execute("board.sticky", &json!({"x": 0, "y": 0, "text": "one"})).unwrap();
+    let (st, note) = (id(&r, "id"), id(&r, "text"));
+    let (height, text_height) = (node(&s, st).height, node(&s, note).height);
+    // Typing in the note: each step is a real edit that runs the normalize pass.
+    crate::board::edit_text(&mut s, st).unwrap();
+    for _ in 0..9 {
+        crate::textedit::key(&mut s, "Enter", false, false, false).unwrap();
+        crate::textedit::insert(&mut s, "another line").unwrap();
+    }
+    let ten = node(&s, note).kind.text().unwrap().clone();
+    assert_eq!(ten.characters.matches('\n').count(), 9, "ten lines");
+    assert_eq!(ten.style.font_size, 18.0);
+    assert!(node(&s, note).height > text_height, "ten lines make the text taller");
+    assert!(node(&s, st).height > height, "and the note");
+    assert_eq!(node(&s, st).child_layout.sizing_v, figcraft_doc::Sizing::Hug, "the note hugs its text");
+    let (w, h10) = (node(&s, st).width, node(&s, st).height);
+    crate::textedit::insert(&mut s, &"a long paragraph ".repeat(15)).unwrap();
+    crate::textedit::end(&mut s).unwrap();
+    let t = node(&s, note).kind.text().unwrap().clone();
+    assert!(t.characters.chars().count() >= 250);
+    assert_eq!(t.style.font_size, 18.0);
+    assert!(t.runs.iter().all(|r| r.style.font_size == 18.0));
+    assert_eq!(node(&s, st).width, w, "the note keeps its width");
+    assert!(node(&s, st).height > h10, "and grows taller");
+}
+
+#[test]
+fn a_sticky_saved_with_another_text_size_keeps_it() {
+    let mut s = board();
+    let r = s.execute("board.sticky", &json!({"x": 0, "y": 0, "text": "old"})).unwrap();
+    let (st, note) = (id(&r, "id"), id(&r, "text"));
+    s.execute("node.set", &json!({"id": note, "props": {"fontSize": 11}})).unwrap();
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 11.0);
+    s.execute("node.set", &json!({"id": note, "props": {"characters": "old and now much longer than it was"}})).unwrap();
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 11.0, "an edit");
+    s.execute("node.set", &json!({"id": st, "props": {"x": 40}})).unwrap();
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 11.0, "a move");
 }
 
 #[test]

crates/engine/src/boards/board.rs

@@ -69,8 +69,8 @@ pub(crate) use edit::{copied_items, copy_map, rejoin};
 use edit::{label_cmd, set_color, set_style};
 pub(crate) use items::add_text;
 pub use items::{CONNECTED_GAP, connected_place};
+pub use items::{STICKY_TEXT_SIZE, edit_text, owner_of_text, text_of};
 use items::{add_connected, ink_cmd, next_sticky, shape_cmd, stamp_cmd, sticky_cmd};
-pub use items::{edit_text, owner_of_text, sticky_font_size, text_of};
 pub(crate) use mindmap::settle_mind_maps;
 pub(crate) use reshape::path_handle_at;
 pub use reshape::selected_connector_handles;

crates/engine/src/boards/board/derived.rs

@@ -1,7 +1,6 @@
 use figcraft_doc::RouteEnd;
 
-use super::edit::set_font_size;
-use super::items::{owner_of_text, shape_padding, sticky_font_size, text_of};
+use super::items::shape_padding;
 use super::{
     Affine, BTreeSet, BezPath, BoardItem, Connector, Document, End, NodeId, NodeKind, PathEl, Point, Rect, Routing, Shape, VectorNetwork, is_board,
 };
@@ -9,26 +8,14 @@ use super::{
 // ---------------------------------------------------------------------------------------------
 // Derived data (the normalize pass).
 
-/// Before text is measured: a sticky's note takes the size its length calls for, and a resized
-/// shape keeps its text inside its outline.
+/// Before text is measured: a resized shape keeps its text inside its outline. A sticky's text
+/// keeps whatever size it has (FigJam's size is the note's own setting).
 pub(crate) fn settle_text(doc: &mut Document, before: &Document, touched: &BTreeSet<NodeId>) {
     if !is_board(doc) {
         return;
     }
     for &id in touched {
         let Some(n) = doc.node(id) else { continue };
-        if let Some(owner) =
-            owner_of_text(doc, id).or(Some(id)).filter(|o| doc.node(*o).is_some_and(|k| matches!(k.board, Some(BoardItem::Sticky { .. }))))
-            && let Some(t) = text_of(doc, owner)
-            && let Some(NodeKind::Text(td)) = doc.node(t).map(|k| &k.kind)
-        {
-            let size = sticky_font_size(&td.characters);
-            let off = td.style.font_size != size || td.runs.iter().any(|r| r.style.font_size != size);
-            if off && let Some(NodeKind::Text(td)) = doc.node_mut(t).map(|k| &mut k.kind) {
-                set_font_size(td, size);
-            }
-            continue;
-        }
         if let Some(BoardItem::Shape { shape }) = n.board
             && before.node(id).is_none_or(|b| (b.width, b.height) != (n.width, n.height))
         {

crates/engine/src/boards/board/items.rs

@@ -57,18 +57,9 @@ pub(crate) fn add_text(doc: &mut Document, parent: NodeId, text: &str, size: f64
     Ok(id)
 }
 
-/// The text size a sticky's note gets: smaller the more it holds (by characters and lines, so
-/// every copy of the file picks the same size whatever fonts it has).
-pub fn sticky_font_size(text: &str) -> f64 {
-    let weight = text.chars().count() + 24 * text.matches('\n').count();
-    match weight {
-        0..=24 => 24.0,
-        25..=64 => 20.0,
-        65..=140 => 16.0,
-        141..=280 => 13.0,
-        _ => 11.0,
-    }
-}
+/// The text size of a new sticky's note, FigJam's "Small" default (measured in the web app,
+/// 2026-11-09): it never changes as the note fills, the note grows taller instead.
+pub const STICKY_TEXT_SIZE: f64 = 18.0;
 
 /// A sticky note's layers: the frame, the note and (when known) its author.
 fn make_sticky(doc: &mut Document, parent: NodeId, at: (f64, f64), text: &str, color: Color, author: &str) -> Result<(NodeId, NodeId)> {
@@ -89,7 +80,7 @@ fn make_sticky(doc: &mut Document, parent: NodeId, at: (f64, f64), text: &str, c
         n.board = Some(BoardItem::Sticky { author: author.to_string() });
     })?;
     let inner = STICKY - 2.0 * STICKY_PAD;
-    let note = add_text(doc, id, text, sticky_font_size(text), INK, TextAlignH::Left, inner)?;
+    let note = add_text(doc, id, text, STICKY_TEXT_SIZE, INK, TextAlignH::Left, inner)?;
     if !author.is_empty() {
         let a = add_text(doc, id, author, 10.0, AUTHOR_INK, TextAlignH::Left, inner)?;
         if let Some(n) = doc.node_mut(a) {

crates/engine/src/brush_tests.rs

@@ -8,6 +8,7 @@ use crate::params::id_of;
 use crate::tools::{PointerEvent, PointerKind, pressure_profile};
 use figcraft_doc::{NodeId, NodeKind};
 use figcraft_geom::Point;
+use figcraft_geom::kurbo::PathEl;
 
 fn id(v: Value) -> NodeId {
     id_of(&v["id"]).unwrap()
@@ -149,3 +150,68 @@ fn the_pencil_draws_white_on_a_dark_background() {
         assert_eq!(stroke(&mut s, 0.0, 600.0).0, want, "on {bg}");
     }
 }
+
+/// A Pencil stroke stays where it was drawn: the fitted curve shot far off the stroke, a spike
+/// (#1741, its second point), where the stroke went out and back to the very point it left and
+/// where samples ran on nearly straight. Pointer pixels become fractional page points, so going
+/// back to a pixel lands on exactly the same point. Both sample runs are ones kurbo's fit took
+/// hundreds of units off.
+///
+/// Each stroke is drawn in a fresh session, with the Pencil and with the Marker and Highlighter
+/// of a board, whose ink comes from the same fit. Every point along the stroke drawn must lie
+/// within 1.5 (twice the fit's accuracy) of the polyline through the samples.
+#[test]
+fn the_pencil_keeps_its_stroke_where_it_was_drawn() {
+    let (p, q) = ((86.043_565_719_086_97, -173.744_402_349_100_94), (87.851_850_739_335_35, -179.202_846_445_954_52));
+    let back = [(80.0, -160.0), p, q, p, (95.0, -185.0)];
+    let straight = [
+        (204.0, -198.0),
+        (209.598_690_794_015_5, -204.909_328_119_739_88),
+        (211.277_914_263_870_97, -207.190_974_020_753_4),
+        (214.246_506_828_720_84, -211.228_827_590_623_24),
+        (218.0, -214.0),
+    ];
+    for tool in ["pencil", "marker", "highlighter"] {
+        for (what, samples) in [("out and back", &back[..]), ("nearly straight", &straight[..])] {
+            let what = format!("{tool}, {what}");
+            let mut s = if tool == "pencil" { Session::new() } else { crate::board_tests::board() };
+            s.execute("tool.set", &json!({"tool": tool})).unwrap();
+            let before: Vec<NodeId> = s.doc().unwrap().nodes().map(|n| n.id).collect();
+            let (first, last) = (samples[0], samples[samples.len() - 1]);
+            s.pointer(&PointerEvent::at(PointerKind::Down, first.0, first.1, 1.0)).unwrap();
+            for (x, y) in &samples[1..] {
+                s.pointer(&PointerEvent::at(PointerKind::Move, *x, *y, 1.0)).unwrap();
+            }
+            s.pointer(&PointerEvent::at(PointerKind::Up, last.0, last.1, 1.0)).unwrap();
+            // The layer the stroke made, and only it.
+            let doc = s.doc().unwrap();
+            let made: Vec<&figcraft_doc::Node> =
+                doc.nodes().filter(|n| !before.contains(&n.id) && matches!(n.kind, NodeKind::Vector { .. })).collect();
+            let [n] = made[..] else { panic!("{what}: {} vectors made", made.len()) };
+            let NodeKind::Vector { network } = &n.kind else { panic!("{what}: not a vector") };
+            let drawn = doc.world_transform(n.id) * network.stroke_path();
+            let polyline = figcraft_geom::BezPath::from_vec(
+                samples
+                    .iter()
+                    .enumerate()
+                    .map(|(k, (x, y))| if k == 0 { PathEl::MoveTo(Point::new(*x, *y)) } else { PathEl::LineTo(Point::new(*x, *y)) })
+                    .collect(),
+            );
+            let d = crate::vector_behaviour_tests::strays(&drawn, &polyline);
+            assert!(d <= 1.5, "{what}: the stroke strays {d} from the samples: {}", drawn.to_svg());
+            let samples_box = figcraft_geom::points_bounds(samples.iter().map(|(x, y)| Point::new(*x, *y))).unwrap();
+            let node_box = doc.world_bounds(n.id).unwrap();
+            if tool == "pencil" {
+                assert!(samples_box.inflate(1.5, 1.5).contains_rect(node_box), "{what}: the layer {node_box:?}, the samples {samples_box:?}");
+            }
+            // The turn is a point of the stroke, where it was drawn.
+            if samples == back {
+                let xf = doc.world_transform(n.id);
+                assert!(
+                    network.vertices.iter().any(|v| (xf * Point::new(v.x, v.y) - Point::new(q.0, q.1)).hypot() < 1e-6),
+                    "{what}: no point at the turn"
+                );
+            }
+        }
+    }
+}

crates/engine/src/canvas/tools/pen.rs

@@ -313,7 +313,8 @@ impl Session {
         if points.len() < 2 {
             return Ok(());
         }
-        // Smooth: fit a curve through the samples.
+        // Smooth: fit a curve through the samples, kept from shooting past them where the stroke
+        // turns back or runs nearly straight (#1741).
         let mut poly = figcraft_geom::BezPath::new();
         for (k, p) in points.iter().enumerate() {
             if k == 0 {
@@ -322,7 +323,7 @@ impl Session {
                 poly.line_to(*p);
             }
         }
-        let fitted = figcraft_geom::kurbo::simplify::simplify_bezpath(poly.iter(), 0.75, &Default::default());
+        let fitted = figcraft_geom::simplify_path(&poly, 0.75);
         let d = fitted.to_svg();
         if matches!(self.tool.tool, ToolId::Marker | ToolId::Highlighter) {
             return self.ink_finish(&d);

crates/engine/src/canvas/vectoredit.rs

@@ -638,7 +638,7 @@ fn index(cmd: &str, p: &Value, key: &str) -> Result<usize> {
 }
 
 /// Delete the points and segments of `parts` (`heal` keeps paths through deleted points closed).
-fn delete_selection(s: &mut Session, parts: Vec<EditPart>, heal: bool) -> Result<()> {
+pub(crate) fn delete_selection(s: &mut Session, parts: Vec<EditPart>, heal: bool) -> Result<()> {
     let doc = s.doc_mut()?;
     for EditPart { id, vertices: verts, segments: segs } in parts {
         edit(doc, id, |net| {

crates/engine/src/cmd/component.rs

@@ -24,8 +24,8 @@ use instance::{detach, make_slot, push_changes, remove_slot, reset_instance, res
 pub(crate) use instance::{swap_at, swap_instance};
 use props::{add_prop, bind_prop, delete_prop, edit_prop, set_props};
 pub(crate) use props::{apply_prop_bindings, check_prop_binding, describe_props};
-use variants::{add_variant, combine};
-pub use variants::{can_add_variant, can_combine_variants};
+use variants::{add_variant, combine, create_set};
+pub use variants::{can_add_variant, can_combine_variants, can_create_set};
 
 /// `component.hideWhenPublishing`: the leading `.` of the names of this file's components and
 /// sets (those `ids` are or are in), put on or taken off.
@@ -72,6 +72,13 @@ pub fn specs() -> Vec<CommandSpec> {
             s.set_selection(out.iter().filter_map(id_of).collect());
             Ok(json!({"ids": out}))
         }),
+        spec!(
+            "component.createSet",
+            "Create component set",
+            "{ids? (layers, not components, sets or instances)}  (each becomes a component, wrapped in place in a component set: variants \"Property 1=<name>\" left to right, 20 px around)",
+            true,
+            create_set
+        ),
         spec!(
             "component.combineVariants",
             "Combine as variants",

crates/engine/src/cmd/component/variants.rs

@@ -1,6 +1,6 @@
 use super::{
-    BTreeMap, BTreeSet, Document, EngineError, Node, NodeId, NodeKind, Result, Session, Value, bad, inside_instance, json, owning_instance,
-    req_targets, roots, set_name_from, string, targets, variant_name, variant_options, variant_props, variant_set, z_sorted,
+    BTreeMap, BTreeSet, Document, EngineError, Node, NodeId, NodeKind, Result, Session, Value, bad, create, id_of, inside_instance, json,
+    owning_instance, req_targets, roots, set_name_from, string, targets, variant_name, variant_options, variant_props, variant_set, z_sorted,
 };
 
 /// Wrap components in a new component set (named after the first) placed around them.
@@ -94,6 +94,75 @@ pub(super) fn combine(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"id": set}))
 }
 
+/// Why `ids` (distinct) can't each become a component of a new set (`component.createSet`), or
+/// `None` when they can: layers inside an instance, library copies, instances, components and
+/// component sets, and a layer inside another one of `ids`.
+fn create_set_refusal(doc: &Document, ids: &[NodeId]) -> Option<&'static str> {
+    if ids.iter().any(|i| inside_instance(doc, *i)) {
+        Some("layers inside an instance can't become components")
+    } else if ids.iter().any(|i| doc.is_remote(*i)) {
+        Some(crate::library::READ_ONLY)
+    } else if ids.iter().any(|i| {
+        doc.node(*i).is_some_and(|n| matches!(n.kind, NodeKind::Instance { .. } | NodeKind::Component { .. } | NodeKind::ComponentSet { .. }))
+    }) {
+        Some("select layers that aren't components, component sets or instances")
+    } else if roots(doc, ids).len() != ids.len() {
+        Some("a layer can't be in a set with one inside it")
+    } else {
+        None
+    }
+}
+
+/// Whether "Create component set" is on offer for `ids`: at least one layer that
+/// [`create_set_refusal`] lets through.
+pub fn can_create_set(doc: &Document, ids: &[NodeId]) -> bool {
+    let distinct: Vec<NodeId> = ids.iter().copied().collect::<BTreeSet<_>>().into_iter().collect();
+    !distinct.is_empty() && distinct.iter().all(|i| doc.contains(*i)) && create_set_refusal(doc, &distinct).is_none()
+}
+
+/// `component.createSet`: each target becomes a component (as `component.createMultiple` makes
+/// them) and all are wrapped in place in a component set, 20 px around, named as Figma names them:
+/// variants "Property 1=<layer name>" in left-to-right order (a name holding `=` is kept); layers
+/// that all share a name give a set of that name with "Property 1=Default" variants; otherwise the
+/// set is "Component N".
+pub(super) fn create_set(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "component.createSet";
+    let mut seen = BTreeSet::new();
+    let ids: Vec<NodeId> = req_targets(cmd, s, p)?.into_iter().filter(|i| seen.insert(*i)).collect();
+    let doc = s.doc()?;
+    if let Some(why) = create_set_refusal(doc, &ids) {
+        return Err(EngineError::Disabled(cmd.into(), why.into()));
+    }
+    let mut made = Vec::new();
+    for i in roots(doc, &ids) {
+        let r = create(s, &json!({"ids": [i]}))?;
+        made.push(id_of(&r["id"]).ok_or_else(|| bad(cmd, "component creation failed"))?);
+    }
+    let doc = s.doc_mut()?;
+    // Left to right by world x, ties by y: the variants' order, and the values' order.
+    let mut by_x: Vec<(NodeId, f64, f64)> = made.iter().map(|i| doc.world_bounds(*i).map_or((*i, 0.0, 0.0), |b| (*i, b.x0, b.y0))).collect();
+    by_x.sort_by(|a, b| a.1.total_cmp(&b.1).then(a.2.total_cmp(&b.2)));
+    let names: Vec<String> = by_x.iter().map(|(i, ..)| doc.node(*i).map(|n| n.name.clone()).unwrap_or_default()).collect();
+    let same = names.windows(2).all(|w| w.first() == w.get(1)) && names.first().is_some_and(|n| !n.is_empty() && !n.contains('='));
+    let set_name = match names.first() {
+        Some(n) if same => n.clone(),
+        _ => doc.next_name("Component"),
+    };
+    for ((i, ..), name) in by_x.iter().zip(&names) {
+        let node = doc.get_mut(*i)?;
+        if same {
+            node.name = "Property 1=Default".into();
+        } else if !name.contains('=') {
+            node.name = format!("Property 1={name}");
+        }
+    }
+    let ordered = z_sorted(doc, &made);
+    let set = wrap_in_set(cmd, doc, &ordered)?;
+    doc.get_mut(set)?.name = set_name;
+    s.set_selection(vec![set]);
+    Ok(json!({"id": set}))
+}
+
 /// Grow a component set so it wraps its variants with 20 px of padding (right and bottom).
 pub(super) fn fit_set(doc: &mut Document, set: NodeId) {
     let Some(kids) = doc.node(set).map(|n| n.children.clone()) else { return };

crates/engine/src/cmd/edit.rs

@@ -17,6 +17,10 @@ mod clipboard;
 mod props;
 pub(crate) use props::{edit_region_fills, fill_regions};
 mod select;
+mod vector_clipboard;
+pub use vector_clipboard::clipboard_svg;
+#[cfg(test)]
+mod vector_clipboard_tests;
 
 pub(crate) use clipboard::apply_copied_props;
 pub use clipboard::{CLIP_CLOSE, CLIP_OPEN, copy_to_clipboard, design_clipboard_buffer, paste_into};
@@ -117,12 +121,24 @@ pub fn specs() -> Vec<CommandSpec> {
             true,
             duplicate
         ),
-        spec!("edit.copy", "Copy", "{ids?}", false, copy),
-        spec!("edit.cut", "Cut", "{ids?}", true, cut),
+        spec!(
+            "edit.copy",
+            "Copy",
+            "{ids?}  in vector edit mode with points or segments selected (and no ids): just those, the segments touching a selected point, as a temporary vector on the clipboard (one per edited layer) with the edited layer's look, kept at its place on the page; points that touch no segment have nothing to copy, so Copy with only those is refused (Disabled). Returns {copied, segments}",
+            false,
+            copy
+        ),
+        spec!(
+            "edit.cut",
+            "Cut",
+            "{ids?}  in vector edit mode with points or segments selected (and no ids): copies them as Copy does, then removes them as Delete does; the path splits in the same layer and edit mode stays on. Returns {cut (layers), segments}. With only lone points (nothing to copy) it is refused (Disabled) and changes nothing, as Copy is; Delete removes lone points",
+            true,
+            cut
+        ),
         spec!(
             "edit.paste",
             "Paste",
-            "{parent?, x?, y? (page coordinates of the pasted top-left)}  a copied main component pastes as an instance of it within its file (cut ones, and pastes into other files, keep the component)",
+            "{parent?, x?, y? (page coordinates of the pasted top-left; give both or neither, one alone is refused)}  in vector edit mode (and no parent): the copied vectors' segments and the outlines of shapes, booleans and lines join the edited vector's network (at x/y when given, else in place), their points selected, as one undo step; layers with no outline (text, images, instances, frames, groups) are skipped and named in `skipped` (present only when some were), and when none has an outline the paste is refused (Disabled), as it is past 500,000 segments in one vector. Returns {ids: [] (always empty: no layer is created), edited (the vector's id), vertices (points added), skipped?}, unlike a paste outside edit mode, which returns the new layers' `ids`; a copied main component pastes as an instance of it within its file (cut ones, and pastes into other files, keep the component)",
             true,
             paste
         ),

crates/engine/src/cmd/edit/clipboard.rs

@@ -1,6 +1,6 @@
 use super::{
-    Affine, BTreeMap, BTreeSet, Document, EngineError, ImageData, Node, NodeId, NodeKind, Result, Session, Value, bad, delete, id, json, num, ok,
-    req_targets, roots, string, targets, z_sorted,
+    Affine, BTreeMap, BTreeSet, Document, EngineError, ImageData, Node, NodeId, NodeKind, Result, Session, Value, bad, delete, get, id, json, num,
+    ok, req_targets, roots, string, targets, vector_clipboard, z_sorted,
 };
 
 /// The copied form of the selection.
@@ -12,6 +12,18 @@ pub fn copy_to_clipboard(s: &mut Session, cmd: &str, ids: &[NodeId]) -> Result<(
         return Err(EngineError::Disabled(cmd.into(), "pages can't be copied; use page.duplicate".into()));
     }
     let (nodes, images, bounds) = copied(&ds.doc, &layers);
+    store_clipboard(s, cmd, nodes, images, bounds)
+}
+
+/// Make `nodes` (the copied layers, each root's transform in page space) the clipboard's layers.
+pub(super) fn store_clipboard(
+    s: &mut Session,
+    cmd: &str,
+    nodes: Vec<(NodeId, Vec<Node>)>,
+    images: BTreeMap<String, ImageData>,
+    bounds: Option<figcraft_geom::Rect>,
+) -> Result<()> {
+    let ds = s.ds()?;
     let (source, source_path, uid) = (ds.doc.clone(), ds.path.clone(), ds.uid);
     s.clipboard.source = Some(source);
     s.clipboard.source_path = source_path;
@@ -43,21 +55,26 @@ fn copied(doc: &Document, ids: &[NodeId]) -> Copied {
         if let Some(r) = sub.first_mut() {
             r.transform = world;
         }
-        for n in &sub {
-            for p in n.fills.iter().chain(n.strokes.iter()) {
-                if let figcraft_color::PaintKind::Image(img) = &p.kind
-                    && let Some(d) = doc.images.get(&img.image)
-                {
-                    images.insert(img.image.clone(), d.clone());
-                }
-            }
-        }
+        collect_images(doc, &sub, &mut images);
         nodes.push((*i, sub));
     }
     let bounds = doc.bounds_of(&ids);
     (nodes, images, bounds)
 }
 
+/// The images the paints of `nodes` use, taken from `doc` into `images`.
+pub(super) fn collect_images(doc: &Document, nodes: &[Node], images: &mut BTreeMap<String, ImageData>) {
+    for n in nodes {
+        for p in n.fills.iter().chain(n.strokes.iter()) {
+            if let figcraft_color::PaintKind::Image(img) = &p.kind
+                && let Some(d) = doc.images.get(&img.image)
+            {
+                images.insert(img.image.clone(), d.clone());
+            }
+        }
+    }
+}
+
 /// The markers around the copied layers in the clipboard's HTML, spelt as that format spells them.
 pub const CLIP_OPEN: &str = "(figma)";
 
@@ -167,13 +184,34 @@ fn layers_missing_images(doc: &figcraft_doc::Document, ids: &[NodeId]) -> Vec<St
     names
 }
 
+/// Whether the command names its layers (`ids` / `id`): it then acts on them even in vector edit mode.
+fn names_layers(p: &Value) -> bool {
+    get(p, "ids").is_some() || get(p, "id").is_some()
+}
+
 pub(super) fn copy(s: &mut Session, p: &Value) -> Result<Value> {
+    // In vector edit mode with points or segments selected, Copy takes just those (#1875).
+    if !names_layers(p)
+        && let Some(sel) = vector_clipboard::edit_selection(s)
+        && sel.any
+    {
+        // Only lone points selected: nothing to copy, and not the whole layer either.
+        return vector_clipboard::copy_selection(s, "edit.copy", sel);
+    }
     let ids = req_targets("edit.copy", s, p)?;
     copy_to_clipboard(s, "edit.copy", &ids)?;
     Ok(json!({"copied": s.clipboard.nodes.len()}))
 }
 
 pub(super) fn cut(s: &mut Session, p: &Value) -> Result<Value> {
+    // In vector edit mode with points or segments selected, Cut takes just those and stays in edit mode (#1875).
+    if !names_layers(p)
+        && let Some(sel) = vector_clipboard::edit_selection(s)
+        && sel.any
+    {
+        // Lone points with nothing to copy: `cut_selection` refuses, as Copy does.
+        return vector_clipboard::cut_selection(s, sel);
+    }
     let ids = req_targets("edit.cut", s, p)?;
     copy_to_clipboard(s, "edit.cut", &ids)?;
     let doc = s.doc()?;
@@ -238,6 +276,10 @@ pub fn paste_into(s: &mut Session, parent: NodeId, at: Option<(f64, f64)>) -> Re
 }
 
 pub(super) fn paste(s: &mut Session, p: &Value) -> Result<Value> {
+    // While editing a vector, the copied layers join its network (#1875); `parent` asks for layers.
+    if id(p, "parent").is_none() && s.ds()?.vector_edit.is_some() {
+        return vector_clipboard::paste_into_vector(s, p);
+    }
     let page = s.page()?;
     // Figma pastes into the selected frame (if one is selected), at the same position when it fits,
     // else in the frame's centre; otherwise in place on the page (or the viewport centre).

crates/engine/src/cmd/edit/vector_clipboard.rs

@@ -0,0 +1,303 @@
+//! Copy, cut and paste in vector edit mode (#1875).
+//!
+//! With points or segments selected, Copy and Cut take just those: a temporary vector holding the
+//! selected segments (and the segments touching a selected point) goes on the ordinary layer
+//! clipboard, kept at its place on the page, so a paste outside edit mode is a plain layer paste
+//! in place. Cut then removes the selection the way Delete does and stays in edit mode. Paste
+//! while editing adds the clipboard's layers to the edited vector's network, in place: a vector
+//! with its segments, a shape or boolean with its outline.
+
+use crate::bad;
+use figcraft_doc::{NodeKind, Region, VectorNetwork};
+
+use super::clipboard::{collect_images, store_clipboard};
+use super::{Affine, BTreeMap, BTreeSet, Document, EngineError, Node, NodeId, Result, Session, Value, json, num};
+use crate::canvas::vectoredit::{self, EditPart};
+
+/// The most segments a vector network takes through a paste.
+const MAX_SEGMENTS: usize = 500_000;
+
+/// What the edited layers have selected.
+pub(super) struct EditSelection {
+    /// Whether any edited layer has a point or a segment selected.
+    pub any: bool,
+    /// Each edited layer with something to copy, and the sub-network that is.
+    pub parts: Vec<(NodeId, VectorNetwork)>,
+    /// What Cut removes, per edited layer: the same points and segments the copy was built from.
+    pub delete: Vec<EditPart>,
+}
+
+/// The selection of the vector being edited (and the other layers edited with it), or `None` when
+/// not in vector edit mode.
+pub(super) fn edit_selection(s: &Session) -> Option<EditSelection> {
+    let ds = s.ds().ok()?;
+    let ve = ds.vector_edit.as_ref()?;
+    let mut sel = EditSelection { any: false, parts: Vec::new(), delete: Vec::new() };
+    for part in ve.parts() {
+        if part.vertices.is_empty() && part.segments.is_empty() {
+            continue;
+        }
+        sel.any = true;
+        let Some(net) = vectoredit::network(&ds.doc, part.id) else { continue };
+        let active = part.id == ve.id;
+        // Points selected only through a selected region don't pull in the segments touching
+        // them: the region's own segments are the selection.
+        let vertices: Vec<usize> = part.vertices.iter().copied().filter(|v| !active || !ve.region_vertices.contains(v)).collect();
+        let mut segments = part.segments.clone();
+        if active {
+            segments.extend(ve.regions.iter().filter_map(|r| net.regions.get(*r)).flat_map(|r| r.loops.iter().flatten().copied()));
+        }
+        sel.delete.push(EditPart { id: part.id, vertices: vertices.clone(), segments: segments.clone() });
+        if let Some(sub) = sub_network(net, &vertices, &segments) {
+            sel.parts.push((part.id, sub));
+        }
+    }
+    Some(sel)
+}
+
+/// The part of `net` that is the segments `segments` and those touching a point of `vertices`,
+/// with the points they join; `None` when there are none (a lone point with no segment draws
+/// nothing). The regions whose every segment is kept stay regions.
+fn sub_network(net: &VectorNetwork, vertices: &[usize], segments: &[usize]) -> Option<VectorNetwork> {
+    let picked: BTreeSet<usize> = vertices.iter().copied().collect();
+    let mut keep: BTreeSet<usize> = segments.iter().copied().filter(|i| *i < net.segments.len()).collect();
+    for (i, sg) in net.segments.iter().enumerate() {
+        if picked.contains(&sg.a) || picked.contains(&sg.b) {
+            keep.insert(i);
+        }
+    }
+    let used: BTreeSet<usize> = keep.iter().filter_map(|i| net.segments.get(*i)).flat_map(|sg| [sg.a, sg.b]).collect();
+    let vmap: BTreeMap<usize, usize> = used.iter().enumerate().map(|(new, old)| (*old, new)).collect();
+    let smap: BTreeMap<usize, usize> = keep.iter().enumerate().map(|(new, old)| (*old, new)).collect();
+    let mut out = VectorNetwork {
+        vertices: used.iter().filter_map(|v| net.vertices.get(*v).cloned()).collect(),
+        segments: keep
+            .iter()
+            .filter_map(|i| net.segments.get(*i))
+            .filter_map(|sg| {
+                let mut sg = *sg;
+                sg.a = *vmap.get(&sg.a)?;
+                sg.b = *vmap.get(&sg.b)?;
+                Some(sg)
+            })
+            .collect(),
+        regions: Vec::new(),
+    };
+    if out.segments.is_empty() || out.segments.len() != keep.len() || out.vertices.len() != used.len() {
+        return None;
+    }
+    for r in &net.regions {
+        let loops: Option<Vec<Vec<usize>>> = r.loops.iter().map(|l| l.iter().map(|i| smap.get(i).copied()).collect::<Option<Vec<usize>>>()).collect();
+        if let Some(loops) = loops.filter(|l| !l.is_empty()) {
+            out.regions.push(Region { loops, ..r.clone() });
+        }
+    }
+    Some(out)
+}
+
+/// The clipboard's layer for edited vector `id` holding `sub`: it keeps the layer's look (fills,
+/// strokes, effects, opacity, blend) and its place on the page. A variable width profile runs
+/// along the whole path, so it stays only when every segment is copied.
+fn clip_node(doc: &Document, id: NodeId, mut sub: VectorNetwork) -> Option<Node> {
+    let mut n = doc.node(id)?.clone();
+    let whole = vectoredit::network(doc, id).is_some_and(|all| all.segments.len() == sub.segments.len());
+    let b = sub.bounds().filter(|b| b.x0.is_finite() && b.y0.is_finite() && b.width().is_finite() && b.height().is_finite())?;
+    sub.translate(-b.x0, -b.y0);
+    n.transform = doc.world_transform(id) * Affine::translate((b.x0, b.y0));
+    n.width = b.width();
+    n.height = b.height();
+    n.kind = NodeKind::Vector { network: sub };
+    n.parent = None;
+    n.children.clear();
+    n.name = "Vector".into();
+    if !whole {
+        n.stroke.width_profile = None;
+    }
+    Some(n)
+}
+
+/// Put the selection's sub-networks on the layer clipboard. Returns how many segments went.
+fn copy_parts(s: &mut Session, cmd: &str, sel: &EditSelection) -> Result<usize> {
+    let doc = s.doc()?;
+    let mut nodes = Vec::new();
+    let mut images = BTreeMap::new();
+    let mut bounds: Option<figcraft_geom::Rect> = None;
+    let mut segments = 0;
+    for (id, sub) in &sel.parts {
+        segments += sub.segments.len();
+        let Some(n) = clip_node(doc, *id, sub.clone()) else { continue };
+        let r = figcraft_geom::transform_rect_bbox(n.transform, n.local_rect());
+        bounds = Some(bounds.map_or(r, |b| b.union(r)));
+        collect_images(doc, std::slice::from_ref(&n), &mut images);
+        nodes.push((*id, vec![n]));
+    }
+    if nodes.is_empty() {
+        return Err(EngineError::Disabled(cmd.into(), "the selection has nothing to copy".into()));
+    }
+    store_clipboard(s, cmd, nodes, images, bounds)?;
+    Ok(segments)
+}
+
+/// Copy the selected segments (see [`edit_selection`]).
+pub(super) fn copy_selection(s: &mut Session, cmd: &str, sel: EditSelection) -> Result<Value> {
+    let segments = copy_parts(s, cmd, &sel)?;
+    Ok(json!({"copied": s.clipboard.nodes.len(), "segments": segments}))
+}
+
+/// Cut: copy the selected segments, then remove the selection as Delete does (the path splits in
+/// the same layer and edit mode stays on). Cut is Copy plus Delete, so it is refused exactly where
+/// Copy is: a selection with nothing to copy (only lone points that touch no segment) is
+/// `Disabled` and changes nothing, clipboard included. Delete removes such points.
+pub(super) fn cut_selection(s: &mut Session, sel: EditSelection) -> Result<Value> {
+    if sel.parts.is_empty() {
+        return Err(EngineError::Disabled("edit.cut".into(), "the selection has nothing to copy (Delete removes lone points)".into()));
+    }
+    let cut = sel.parts.len();
+    let segments = copy_parts(s, "edit.cut", &sel)?;
+    vectoredit::delete_selection(s, sel.delete, false)?;
+    Ok(json!({"cut": cut, "segments": segments}))
+}
+
+/// The SVG of the layers a partial vector-edit copy or cut put on the clipboard, for the system
+/// clipboard: they are temporary layers that live only in the clipboard, so they are placed in a
+/// scratch document to export. `None` when the clipboard holds none or the export fails.
+pub fn clipboard_svg(s: &Session) -> Option<String> {
+    let mut scratch = Document::new("Clipboard");
+    let page = scratch.current_page?;
+    for (k, v) in &s.clipboard.images {
+        scratch.images.insert(k.clone(), v.clone());
+    }
+    let mut ids = Vec::new();
+    for (root, nodes) in &s.clipboard.nodes {
+        let map: BTreeMap<NodeId, NodeId> = nodes.iter().map(|n| (n.id, scratch.alloc_id())).collect();
+        ids.push(scratch.paste_nodes(nodes, &map, *root, page, None).ok()?);
+    }
+    let bytes = crate::cmd::file::export_bytes(&scratch, &ids, figcraft_doc::ExportFormat::Svg, 1.0).ok()?;
+    String::from_utf8(bytes).ok()
+}
+
+/// The network of the outline of copied layer `n` in its own coordinates: a vector's segments, a
+/// shape's or boolean's outline. `None` for the layers with no outline to add (text, images,
+/// frames, groups, instances, …). `doc` is the file the layer was copied from.
+fn outline_network(doc: &Document, n: &Node) -> Option<VectorNetwork> {
+    let net = match &n.kind {
+        NodeKind::Vector { network } => network.clone(),
+        k if k.is_shape() || matches!(k, NodeKind::BooleanOp { .. }) => {
+            let (path, rule) = figcraft_render::node_outline(doc, n)?;
+            let mut net = VectorNetwork::from_path(&path);
+            if matches!(n.kind, NodeKind::Line) {
+                net.regions.clear();
+            }
+            if rule == figcraft_render::FillRule::EvenOdd {
+                for r in &mut net.regions {
+                    r.winding = figcraft_doc::WindingRule::EvenOdd;
+                }
+            }
+            net
+        }
+        _ => return None,
+    };
+    (!net.segments.is_empty()).then_some(net)
+}
+
+/// `net` moved by `m` (points, handles, the regions' paint frames and the points' radii).
+fn placed(mut net: VectorNetwork, m: Affine) -> Option<VectorNetwork> {
+    let c = m.as_coeffs();
+    if !c.iter().all(|x| x.is_finite()) {
+        return None;
+    }
+    let linear = Affine::new([c[0], c[1], c[2], c[3], 0.0, 0.0]);
+    let scale = m.determinant().abs().sqrt();
+    for v in &mut net.vertices {
+        let p = m * v.point();
+        (v.x, v.y) = (p.x, p.y);
+        v.radius *= scale;
+    }
+    for sg in &mut net.segments {
+        let (ta, tb) = (linear * figcraft_geom::Point::new(sg.ta.0, sg.ta.1), linear * figcraft_geom::Point::new(sg.tb.0, sg.tb.1));
+        sg.ta = (ta.x, ta.y);
+        sg.tb = (tb.x, tb.y);
+    }
+    for r in &mut net.regions {
+        if let Some(frame) = r.paint_space.as_mut() {
+            frame.transform = m * frame.transform;
+        }
+    }
+    let finite = net.vertices.iter().all(|v| v.x.is_finite() && v.y.is_finite())
+        && net.segments.iter().all(|sg| [sg.ta.0, sg.ta.1, sg.tb.0, sg.tb.1].iter().all(|x| x.is_finite()));
+    finite.then_some(net)
+}
+
+/// Paste while editing a vector: the clipboard's layers join its network in place (with `x`, `y`:
+/// the copied top-left moved there), their points selected. Layers with no outline are skipped
+/// (named in `skipped`); when none has one, nothing is pasted.
+pub(super) fn paste_into_vector(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "edit.paste";
+    if s.clipboard.nodes.is_empty() {
+        return Err(EngineError::Disabled(CMD.into(), "the clipboard is empty".into()));
+    }
+    let target = vectoredit::editing(s)?.id;
+    let shift = match (num(p, "x"), num(p, "y"), s.clipboard.bounds) {
+        (Some(x), Some(y), Some(b)) => Affine::translate((x - b.x0, y - b.y0)),
+        (None, None, _) | (Some(_), Some(_), None) => Affine::IDENTITY,
+        _ => return Err(bad(CMD, "give both x and y, or neither")),
+    };
+    let live = s.doc()?;
+    // Borrow the clipboard (it holds the source document and the images) to build the pieces.
+    let clip = &s.clipboard;
+    let source: &Document = clip.source.as_deref().unwrap_or(live);
+    let to_local = live.world_transform(target).inverse() * shift;
+    let mut pieces = Vec::new();
+    let mut skipped: Vec<String> = Vec::new();
+    for (_, nodes) in &clip.nodes {
+        let Some(root) = nodes.first() else { continue };
+        match outline_network(source, root).and_then(|net| placed(net, to_local * root.transform)) {
+            Some(net) => pieces.push(net),
+            None => skipped.push(root.name.clone()),
+        }
+    }
+    if pieces.is_empty() {
+        return Err(EngineError::Disabled(
+            CMD.into(),
+            "none of the copied layers has an outline to add to the vector (text, frames and groups have none)".into(),
+        ));
+    }
+    let have = vectoredit::network(live, target).map_or(0, |n| n.segments.len());
+    if have.saturating_add(pieces.iter().map(|n| n.segments.len()).sum::<usize>()) > MAX_SEGMENTS {
+        return Err(EngineError::Disabled(CMD.into(), format!("a vector takes at most {MAX_SEGMENTS} segments")));
+    }
+    let mut pasted: Vec<usize> = Vec::new();
+    vectoredit::edit(s.doc_mut()?, target, |net| {
+        for piece in pieces {
+            let (vo, so) = (net.vertices.len(), net.segments.len());
+            pasted.extend(vo..vo + piece.vertices.len());
+            net.vertices.extend(piece.vertices);
+            net.segments.extend(piece.segments.into_iter().map(|mut sg| {
+                sg.a += vo;
+                sg.b += vo;
+                sg
+            }));
+            net.regions.extend(piece.regions.into_iter().map(|mut r| {
+                for i in r.loops.iter_mut().flatten() {
+                    *i += so;
+                }
+                r
+            }));
+        }
+    })?;
+    let selected = pasted.clone();
+    vectoredit::set_state(s, |ve| {
+        ve.clear_selection();
+        ve.clear_regions();
+        ve.vertices = selected;
+        ve.anchor = None;
+        ve.pen_out = None;
+        ve.width_point = None;
+    })?;
+    // `ids` stays empty: no layer is created, the pasted outlines joined layer `edited`.
+    let mut out = json!({"ids": [], "edited": target, "vertices": pasted.len()});
+    if !skipped.is_empty() {
+        out["skipped"] = json!(skipped);
+    }
+    Ok(out)
+}

crates/engine/src/cmd/edit/vector_clipboard_tests.rs

@@ -0,0 +1,442 @@
+//! Copy, cut and paste in vector edit mode (#1875), measured in Figma: Copy takes the selected
+//! segments (a lone point: the segments touching it) and a paste outside is a new vector in place;
+//! Cut removes them, splitting the path in the same layer; Paste while editing adds the clipboard's
+//! segments or a copied layer's outline to the vector's network in place, selected.
+
+use serde_json::{Value, json};
+
+use crate::{EngineError, Session, params};
+use figcraft_doc::{NodeId, NodeKind, VectorNetwork};
+
+fn ex(s: &mut Session, c: &str, p: Value) -> Value {
+    s.execute(c, &p).unwrap_or_else(|e| panic!("{c}: {e}"))
+}
+
+fn id_of(v: &Value) -> NodeId {
+    params::id_of(&v["id"]).unwrap()
+}
+
+/// Open path A-B-C-D (three segments) with a look of its own, in edit mode.
+fn path(s: &mut Session) -> NodeId {
+    let r = ex(s, "vector.create", json!({"points": [[100, 100], [200, 150], [300, 100], [400, 200]], "closed": false}));
+    let id = id_of(&r);
+    ex(s, "node.set", json!({"id": id, "props": {"strokeWeight": 7, "opacity": 0.5}}));
+    ex(s, "vector.edit.begin", json!({"id": id}));
+    id
+}
+
+fn net(s: &Session, id: NodeId) -> VectorNetwork {
+    crate::vectoredit::network(s.doc().unwrap(), id).unwrap().clone()
+}
+
+fn layers(s: &Session) -> Vec<NodeId> {
+    s.doc().unwrap().node(s.page().unwrap()).unwrap().children.clone()
+}
+
+/// The network's points on the page, rounded, in vertex order.
+fn page_points(s: &Session, id: NodeId) -> Vec<(i64, i64)> {
+    let w = s.doc().unwrap().world_transform(id);
+    net(s, id).vertices.iter().map(|v| w * v.point()).map(|p| (p.x.round() as i64, p.y.round() as i64)).collect()
+}
+
+/// The number of separate paths a network is made of.
+fn subpaths(n: &VectorNetwork) -> usize {
+    let mut group: Vec<usize> = (0..n.vertices.len()).collect();
+    fn root(g: &[usize], mut i: usize) -> usize {
+        while g[i] != i {
+            i = g[i];
+        }
+        i
+    }
+    for sg in &n.segments {
+        let (a, b) = (root(&group, sg.a), root(&group, sg.b));
+        group[a] = b;
+    }
+    (0..n.vertices.len()).filter(|i| root(&group, *i) == *i && n.segments.iter().any(|sg| root(&group, sg.a) == *i)).count()
+}
+
+fn select(s: &mut Session, vertices: &[usize], segments: &[usize]) {
+    ex(s, "vector.edit.select", json!({"vertices": vertices, "segments": segments}));
+}
+
+fn leave(s: &mut Session) {
+    ex(s, "vector.edit.end", json!({}));
+    assert!(s.ds().unwrap().vector_edit.is_none());
+}
+
+fn world_rect(s: &Session, id: NodeId) -> (f64, f64, f64, f64) {
+    let b = s.doc().unwrap().world_bounds(id).unwrap();
+    (b.x0, b.y0, b.width(), b.height())
+}
+
+#[test]
+fn a_copied_segment_pastes_outside_as_a_new_vector_in_place() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    let r = ex(&mut s, "edit.copy", json!({}));
+    assert_eq!(r["segments"], 1);
+    assert_eq!(net(&s, id).segments.len(), 3, "Copy changes nothing");
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let all = layers(&s);
+    assert_eq!(all.len(), 2);
+    let new = all[1];
+    let n = net(&s, new);
+    assert_eq!((n.vertices.len(), n.segments.len()), (2, 1));
+    assert_eq!(page_points(&s, new), vec![(200, 150), (300, 100)], "at the segment's own page position");
+    assert_eq!(world_rect(&s, new), (200.0, 100.0, 100.0, 50.0));
+    // The layer's look comes along (the width profile aside).
+    let node = s.doc().unwrap().node(new).unwrap();
+    assert_eq!((node.stroke.weight, node.opacity), (7.0, 0.5));
+    assert_eq!(s.selection(), vec![new]);
+}
+
+#[test]
+fn a_copied_point_takes_the_segments_touching_it() {
+    let mut s = Session::new();
+    path(&mut s);
+    select(&mut s, &[1], &[]);
+    ex(&mut s, "edit.copy", json!({}));
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    let n = net(&s, new);
+    assert_eq!((n.vertices.len(), n.segments.len()), (3, 2), "A-B and B-C");
+    assert_eq!(page_points(&s, new), vec![(100, 100), (200, 150), (300, 100)]);
+}
+
+#[test]
+fn nothing_selected_still_copies_the_whole_layer() {
+    let mut s = Session::new();
+    path(&mut s);
+    ex(&mut s, "edit.copy", json!({}));
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    assert_eq!(net(&s, new).segments.len(), 3);
+}
+
+#[test]
+fn cut_removes_the_segment_in_the_same_layer_and_stays_in_edit_mode() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.cut", json!({}));
+    assert_eq!(layers(&s), vec![id], "no new layer");
+    let n = net(&s, id);
+    assert_eq!(n.segments.len(), 2);
+    assert_eq!(subpaths(&n), 2, "the path split in two");
+    let ve = s.ds().unwrap().vector_edit.clone().expect("edit mode stays on");
+    assert!(ve.segments.is_empty() && ve.vertices.is_empty());
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let all = layers(&s);
+    assert_eq!(all.len(), 2);
+    let new = all[1];
+    assert_eq!(net(&s, new).segments.len(), 1);
+    assert_eq!(page_points(&s, new), vec![(200, 150), (300, 100)]);
+}
+
+#[test]
+fn cut_is_one_undo_step() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.cut", json!({}));
+    assert_eq!(net(&s, id).segments.len(), 2);
+    s.undo().unwrap();
+    assert_eq!(net(&s, id).segments.len(), 3);
+    assert_eq!(page_points(&s, id), vec![(100, 100), (200, 150), (300, 100), (400, 200)]);
+}
+
+#[test]
+fn a_cut_point_takes_its_segments_with_it() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[1], &[]);
+    ex(&mut s, "edit.cut", json!({}));
+    assert_eq!(net(&s, id).segments.len(), 1, "only C-D is left");
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    assert_eq!(net(&s, new).segments.len(), 2, "A-B and B-C");
+}
+
+#[test]
+fn pasting_segments_while_editing_adds_them_to_the_same_network_in_place() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    let r = ex(&mut s, "edit.paste", json!({}));
+    assert_eq!(r["vertices"], 2);
+    assert_eq!(layers(&s), vec![id], "no new layer");
+    let n = net(&s, id);
+    assert_eq!((n.vertices.len(), n.segments.len()), (6, 4));
+    assert_eq!(page_points(&s, id)[4..], [(200, 150), (300, 100)], "on top of the original");
+    let ve = s.ds().unwrap().vector_edit.clone().unwrap();
+    assert_eq!(ve.vertices, vec![4, 5], "the pasted points are selected");
+    assert!(ve.segments.is_empty());
+    // One undo reverts it.
+    s.undo().unwrap();
+    assert_eq!(net(&s, id).segments.len(), 3);
+    assert_eq!(net(&s, id).vertices.len(), 4);
+}
+
+#[test]
+fn pasting_at_a_point_moves_the_copied_top_left_there() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    ex(&mut s, "edit.paste", json!({"x": 0, "y": 0}));
+    assert_eq!(page_points(&s, id)[4..], [(0, 50), (100, 0)]);
+}
+
+#[test]
+fn pasting_a_rectangle_while_editing_adds_its_outline_in_the_vectors_coordinates() {
+    let mut s = Session::new();
+    let rect = id_of(&ex(&mut s, "shape.rectangle", json!({"x": 500, "y": 300, "width": 60, "height": 40})));
+    ex(&mut s, "select.set", json!({"ids": [rect]}));
+    ex(&mut s, "edit.copy", json!({}));
+    let id = path(&mut s);
+    let before = world_rect(&s, id);
+    ex(&mut s, "edit.paste", json!({}));
+    assert_eq!(layers(&s), vec![rect, id], "no new layer");
+    let n = net(&s, id);
+    assert_eq!((n.vertices.len(), n.segments.len()), (8, 7), "four corners, four sides, joined to the path");
+    let mut corners: Vec<(i64, i64)> = page_points(&s, id)[4..].to_vec();
+    corners.sort_unstable();
+    assert_eq!(corners, vec![(500, 300), (500, 340), (560, 300), (560, 340)]);
+    let ve = s.ds().unwrap().vector_edit.clone().unwrap();
+    assert_eq!(ve.vertices, vec![4, 5, 6, 7]);
+    let after = world_rect(&s, id);
+    assert!(after.2 > before.2 && after.3 > before.3, "the vector's bounds grow: {before:?} to {after:?}");
+    assert_eq!((after.0, after.1), (before.0, before.1));
+    assert_eq!(after.0 + after.2, 560.0);
+    s.undo().unwrap();
+    assert_eq!(net(&s, id).vertices.len(), 4);
+    assert_eq!(world_rect(&s, id), before);
+}
+
+#[test]
+fn a_rotated_vector_takes_pasted_points_in_its_own_coordinates() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    ex(&mut s, "node.set", json!({"id": id, "props": {"rotation": 90}}));
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    let before = page_points(&s, id);
+    assert_ne!(before[0], (100, 100), "the vector is rotated");
+    ex(&mut s, "edit.paste", json!({}));
+    let after = page_points(&s, id);
+    assert_eq!(after[4..], before[1..3]);
+}
+
+#[test]
+fn layers_with_no_outline_are_skipped_and_named() {
+    let mut s = Session::new();
+    let rect = id_of(&ex(&mut s, "shape.rectangle", json!({"x": 500, "y": 300, "width": 60, "height": 40})));
+    let text = id_of(&ex(&mut s, "text.create", json!({"text": "hello", "x": 500, "y": 400})));
+    let name = s.doc().unwrap().node(text).unwrap().name.clone();
+    // Only text: nothing to add, and nothing changes.
+    ex(&mut s, "select.set", json!({"ids": [text]}));
+    ex(&mut s, "edit.copy", json!({}));
+    let id = path(&mut s);
+    let err = s.execute("edit.paste", &json!({})).unwrap_err();
+    assert!(matches!(err, EngineError::Disabled(..)), "{err}");
+    assert_eq!(net(&s, id).vertices.len(), 4);
+    // The rectangle joins, the text is named as skipped.
+    leave(&mut s);
+    ex(&mut s, "edit.copy", json!({"ids": [rect, text]}));
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    let r = ex(&mut s, "edit.paste", json!({}));
+    assert_eq!(r["skipped"], json!([name]));
+    assert_eq!(net(&s, id).vertices.len(), 8);
+}
+
+#[test]
+fn a_parent_still_pastes_layers_while_editing() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    let page = s.page().unwrap();
+    ex(&mut s, "edit.paste", json!({"parent": page}));
+    assert_eq!(layers(&s).len(), 2);
+    assert_eq!(net(&s, id).segments.len(), 3);
+}
+
+#[test]
+fn an_empty_clipboard_refuses_to_paste_while_editing() {
+    let mut s = Session::new();
+    path(&mut s);
+    assert!(matches!(s.execute("edit.paste", &json!({})), Err(EngineError::Disabled(..))));
+}
+
+#[test]
+fn a_selected_face_copies_its_own_outline_with_the_fill() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "shape.rectangle", json!({"x": 100, "y": 100, "width": 80, "height": 60}));
+    let id = id_of(&r);
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    select(&mut s, &[], &[0, 1, 2, 3]);
+    ex(&mut s, "edit.copy", json!({}));
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    let n = net(&s, new);
+    assert_eq!((n.segments.len(), n.regions.len()), (4, 1), "the closed shape stays filled");
+    assert!(matches!(s.doc().unwrap().node(new).unwrap().kind, NodeKind::Vector { .. }));
+}
+
+/// Everything junk must not change when a command is refused: the vector, the layers, the edit
+/// selection and what the clipboard holds.
+fn state(s: &Session, id: NodeId) -> String {
+    let ve = s.ds().unwrap().vector_edit.clone();
+    let clip: Vec<String> = s.clipboard.nodes.iter().flat_map(|(_, n)| n).map(|n| format!("{:?}", n.kind)).collect();
+    format!("{:?}|{:?}|{:?}|{:?}|{}", net(s, id), layers(s), ve.map(|v| (v.vertices, v.segments)), clip, s.clipboard.layers_generation)
+}
+
+fn finite(n: &VectorNetwork) -> bool {
+    n.vertices.iter().all(|v| v.x.is_finite() && v.y.is_finite())
+        && n.segments.iter().all(|sg| [sg.ta.0, sg.ta.1, sg.tb.0, sg.tb.1].iter().all(|x| x.is_finite()))
+}
+
+#[test]
+fn copy_cut_and_paste_survive_junk_in_vector_edit_mode() {
+    let junk = [
+        json!({}),
+        json!(null),
+        json!([1, 2]),
+        json!({"ids": ["x", -1, 99999]}),
+        json!({"id": "nope", "x": "NaN", "y": 1e308}),
+        json!({"parent": "nope", "x": -1e308, "y": "x"}),
+        json!({"x": 1e308, "y": 1e308}),
+        json!({"x": 1e308}),
+    ];
+    for cmd in ["edit.copy", "edit.cut", "edit.paste", "edit.pasteOver", "edit.pasteReplace"] {
+        for j in &junk {
+            // Both a selection with a text layer next to it, and after a copy from the selection.
+            for copied in [false, true] {
+                let mut s = Session::new();
+                let id = path(&mut s);
+                if copied {
+                    select(&mut s, &[2], &[]);
+                    let _ = s.execute("edit.copy", &json!({}));
+                } else {
+                    select(&mut s, &[1], &[0]);
+                    ex(&mut s, "text.create", json!({"text": "t"}));
+                    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+                    select(&mut s, &[1], &[0]);
+                }
+                let before = state(&s, id);
+                match s.execute(cmd, j) {
+                    Err(EngineError::Internal { cmd, msg }) => panic!("{cmd} panicked on {j}: {msg}"),
+                    Err(_) => {
+                        if cmd != "edit.pasteOver" && cmd != "edit.pasteReplace" {
+                            assert_eq!(state(&s, id), before, "{cmd} {j} was refused but changed something");
+                        }
+                    }
+                    // Accepted: whatever it made has finite coordinates.
+                    Ok(_) => {
+                        if let Some(n) = crate::vectoredit::network(s.doc().unwrap(), id) {
+                            assert!(finite(n), "{cmd} {j} left non-finite coordinates");
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn a_huge_paste_position_is_refused_or_stays_finite() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[0]);
+    ex(&mut s, "edit.copy", json!({}));
+    let before = state(&s, id);
+    match s.execute("edit.paste", &json!({"x": 1e308, "y": 1e308})) {
+        Err(e) => {
+            assert!(!matches!(e, EngineError::Internal { .. }), "{e}");
+            assert_eq!(state(&s, id), before, "a refused paste changed something");
+        }
+        // It is accepted here: 1e308 plus a few hundred is still finite, so the points are too.
+        Ok(_) => assert!(finite(&net(&s, id)), "the points are finite"),
+    }
+}
+
+#[test]
+fn cut_with_only_lone_points_is_refused_like_copy_and_changes_nothing() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    // A point no segment touches.
+    crate::vectoredit::edit(s.doc_mut().unwrap(), id, |n| n.vertices.push(figcraft_doc::Vertex::new(50.0, 50.0))).unwrap();
+    // Something on the clipboard first, then only the lone point selected.
+    select(&mut s, &[0], &[]);
+    ex(&mut s, "edit.copy", json!({}));
+    select(&mut s, &[4], &[]);
+    let before = state(&s, id);
+    for cmd in ["edit.copy", "edit.cut"] {
+        let err = s.execute(cmd, &json!({})).expect_err(cmd);
+        assert!(matches!(err, EngineError::Disabled(..)), "{cmd}: {err}");
+        assert_eq!(state(&s, id), before, "{cmd} changed something");
+    }
+    // Delete is the way to remove it.
+    ex(&mut s, "vector.edit.delete", json!({}));
+    assert_eq!(net(&s, id).vertices.len(), 4);
+}
+
+#[test]
+fn only_one_of_x_and_y_is_refused_and_pastes_nothing() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[0]);
+    ex(&mut s, "edit.copy", json!({}));
+    let before = state(&s, id);
+    for p in [json!({"x": 10}), json!({"y": 10})] {
+        let err = s.execute("edit.paste", &p).expect_err("one coordinate");
+        assert!(err.to_string().contains("give both x and y, or neither"), "{err}");
+        assert_eq!(state(&s, id), before);
+    }
+    ex(&mut s, "edit.paste", json!({"x": 10, "y": 10}));
+}
+
+#[test]
+fn a_partial_copy_has_an_svg_for_the_system_clipboard() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "shape.rectangle", json!({"x": 100, "y": 100, "width": 80, "height": 60}));
+    assert!(crate::cmd::edit::clipboard_svg(&s).is_none(), "nothing copied yet");
+    ex(&mut s, "vector.edit.begin", json!({"id": id_of(&r)}));
+    select(&mut s, &[], &[0, 1, 2, 3]);
+    ex(&mut s, "edit.copy", json!({}));
+    let svg = crate::cmd::edit::clipboard_svg(&s).expect("svg");
+    assert!(svg.contains("<svg") && svg.contains("<path"), "{svg}");
+}
+
+#[test]
+fn cutting_a_selected_region_deletes_exactly_the_segments_it_copies_and_keeps_a_tail() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "vector.create", json!({"points": [[100, 100], [200, 100], [150, 200]], "closed": true}));
+    let id = id_of(&r);
+    // A tail: one open segment from the first corner to a new point.
+    crate::vectoredit::edit(s.doc_mut().unwrap(), id, |n| {
+        n.vertices.push(figcraft_doc::Vertex::new(20.0, 20.0));
+        let tail = n.vertices.len() - 1;
+        crate::vectoredit::ops::connect(n, 0, tail, (0.0, 0.0), (0.0, 0.0));
+    })
+    .unwrap();
+    assert_eq!((net(&s, id).segments.len(), net(&s, id).regions.len()), (4, 1));
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    ex(&mut s, "vector.edit.select", json!({"regions": [0]}));
+    ex(&mut s, "edit.cut", json!({}));
+    let n = net(&s, id);
+    assert_eq!(n.segments.len(), 1, "only the tail is left");
+    assert!(n.regions.is_empty());
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    assert_eq!(net(&s, new).segments.len(), 3, "the copy holds the region's three segments, not the tail");
+}

crates/engine/src/cmd/file/load.rs

@@ -399,11 +399,19 @@ pub(crate) fn load_fig(bytes: &[u8], name: &str) -> Option<Result<figcraft_forma
     }))
 }
 
+/// The most layers all of a Penpot file's raw SVG placeholders may expand to together.
+const MAX_PENPOT_SVG_LAYERS: usize = 100_000;
+
 /// Turn Penpot raw SVG placeholders into editable FigCraft SVG content, using the
 /// normal SVG importer. The parser (figcraft-format) only stores bounded XML so it
 /// does not need to depend on the SVG crate; the engine does this second pass.
 /// Any failure leaves the original placeholder and XML data intact for later use.
 fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
+    expand_penpot_raw_svgs_within(doc, notes, MAX_PENPOT_SVG_LAYERS);
+}
+
+/// [`expand_penpot_raw_svgs`] with at most `room` layers made in all.
+fn expand_penpot_raw_svgs_within(doc: &mut Document, notes: &mut Vec<String>, mut room: usize) {
     let layers = doc
         .nodes()
         .filter_map(|node| {
@@ -413,12 +421,24 @@ fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
         })
         .collect::<Vec<_>>();
     let mut ok_count = 0usize;
+    // The SVG importer caps its own layers per file; `room` is the cap over all of a file's placeholders.
     for (id, name, width, height, xml, empty) in layers {
+        if room == 0 {
+            if let Some(n) = doc.node_mut(id) {
+                n.plugin_data.insert("penpot.svgRawStatus".into(), "not-expanded".into());
+            }
+            if notes.len() < 100 {
+                notes.push(format!("Penpot SVG '{name}': not converted, the file's SVG layers are over the limit; the original markup is preserved"));
+            }
+            continue;
+        }
         if !empty {
             notes.push(format!("Penpot SVG '{name}': has separate child layers; the original tree was preserved to prevent duplicate rendering"));
             continue;
         }
-        match figcraft_svg::import_svg_with_notes(doc, xml.as_bytes(), id, 0.0, 0.0, &name) {
+        let before = doc.node_count();
+        let imported = figcraft_svg::import_svg_with_notes(doc, xml.as_bytes(), id, 0.0, 0.0, &name);
+        match imported {
             Ok(imported) => {
                 // An SVG can be syntactically valid yet contain no supported drawable
                 // elements. Do not claim success or leave an empty extra frame.
@@ -432,6 +452,21 @@ fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
                     }
                     continue;
                 }
+                // Charged once the empty ones are gone; one that doesn't fit is taken out again.
+                let added = doc.node_count().saturating_sub(before);
+                if added > room {
+                    let _ = doc.remove(imported.frame);
+                    if let Some(n) = doc.node_mut(id) {
+                        n.plugin_data.insert("penpot.svgRawStatus".into(), "not-expanded".into());
+                    }
+                    if notes.len() < 100 {
+                        notes.push(format!(
+                            "Penpot SVG '{name}': not converted, the file's SVG layers are over the limit; the original markup is preserved"
+                        ));
+                    }
+                    continue;
+                }
+                room -= added;
                 let size = doc.node(imported.frame).map(|n| (n.width, n.height));
                 if let Some((svg_w, svg_h)) = size
                     && svg_w.is_finite()
@@ -470,6 +505,28 @@ fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
     }
 }
 
+/// Whether some of the first `len` characters are in none of `runs`. Where runs start and stop
+/// covering is summed once, so runs overlapping any number of times cost no more than their count.
+fn has_uncovered(len: usize, runs: &[figcraft_doc::StyleRun]) -> bool {
+    let mut change = vec![0i64; len + 1];
+    for run in runs {
+        let (start, end) = (run.start.min(len), run.end.min(len));
+        if start < end {
+            if let Some(c) = change.get_mut(start) {
+                *c += 1;
+            }
+            if let Some(c) = change.get_mut(end) {
+                *c -= 1;
+            }
+        }
+    }
+    let mut open = 0i64;
+    change.iter().take(len).any(|c| {
+        open += c;
+        open <= 0
+    })
+}
+
 /// Non-destructive font diagnostic for the action palette, CLI and control API.
 /// Includes styled runs, not just the default typeface of each text layer.
 pub(super) fn font_report(doc: &Document) -> Value {
@@ -485,21 +542,15 @@ fn font_report_with_families(doc: &Document, installed: &[String]) -> Value {
         if text.characters.is_empty() {
             continue;
         }
-        let mut covered = vec![false; text.characters.chars().count().min(100_000)];
+        let len = text.characters.chars().count().min(100_000);
         let mut used = BTreeSet::new();
         for run in &text.runs {
-            let start = run.start.min(covered.len());
-            let end = run.end.min(covered.len());
-            if start < end {
-                if !run.style.font_family.trim().is_empty() {
-                    used.insert(run.style.font_family.clone());
-                }
-                for entry in covered.iter_mut().take(end).skip(start) {
-                    *entry = true;
-                }
+            if run.start.min(len) < run.end.min(len) && !run.style.font_family.trim().is_empty() {
+                used.insert(run.style.font_family.clone());
             }
         }
-        if covered.iter().any(|entry| !entry) {
+        let uncovered = has_uncovered(len, &text.runs);
+        if uncovered {
             used.insert(text.style.font_family.clone());
         }
         for family in used {
@@ -599,19 +650,14 @@ fn missing_penpot_font_warnings(doc: &Document, families: &[String]) -> Vec<Stri
         if text_len == 0 {
             continue;
         }
-        let mut covered = vec![false; text_len.min(100_000)];
+        let len = text_len.min(100_000);
         let mut used = BTreeSet::new();
         for run in &text.runs {
-            let start = run.start.min(covered.len());
-            let end = run.end.min(covered.len());
-            if start < end {
+            if run.start.min(len) < run.end.min(len) {
                 used.insert(run.style.font_family.clone());
-                for flag in covered.iter_mut().take(end).skip(start) {
-                    *flag = true;
-                }
             }
         }
-        if covered.iter().any(|present| !present) {
+        if has_uncovered(len, &text.runs) {
             used.insert(text.style.font_family.clone());
         }
         for family in used {
@@ -652,8 +698,10 @@ fn link_instances(doc: &mut Document) {
     let mut insts: Vec<(usize, NodeId)> =
         doc.nodes().filter(|n| matches!(n.kind, NodeKind::Instance { .. })).map(|n| (doc.ancestors(n.id).len(), n.id)).collect();
     insts.sort_by_key(|a| std::cmp::Reverse(a.0));
+    // Rebasing leaves the mains alone, so each main's layer paths are worked out once.
+    let mut mains = crate::components::MainPaths::new();
     for (_, i) in insts {
-        crate::components::rebase_instance(doc, i);
+        crate::components::rebase_instance_with(doc, i, &mut mains);
     }
 }
 
@@ -790,6 +838,47 @@ mod penpot_svg_v10_tests {
     use super::*;
     use figcraft_doc::TextData;
 
+    #[test]
+    fn placeholders_share_one_layer_allowance() {
+        let mut doc = Document::new("Two SVGs");
+        let page = doc.first_page().unwrap();
+        let svg = r#"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><rect width="5" height="5" fill="red"/><rect x="5" width="5" height="5" fill="blue"/></svg>"#;
+        let ids: Vec<NodeId> = (0..2)
+            .map(|i| {
+                let id = doc.create(page, NodeKind::Frame, &format!("S{i}"), 0.0, 0.0, 10.0, 10.0).unwrap();
+                let layer = doc.node_mut(id).unwrap();
+                layer.plugin_data.insert("penpot.svgRawXml".into(), svg.into());
+                layer.plugin_data.insert("penpot.svgRawStatus".into(), "pending".into());
+                id
+            })
+            .collect();
+        let mut warnings = Vec::new();
+        let nodes = doc.node_count();
+        expand_penpot_raw_svgs_within(&mut doc, &mut warnings, 4);
+        assert!(doc.node_count() - nodes <= 4, "never more layers than the allowance");
+        let status = |i: usize| doc.node(ids[i]).unwrap().plugin_data.get("penpot.svgRawStatus").cloned();
+        assert_eq!(status(0).as_deref(), Some("expanded"), "the first uses the allowance");
+        assert_eq!(status(1).as_deref(), Some("not-expanded"));
+        assert!(doc.node(ids[1]).unwrap().children.is_empty());
+        assert!(warnings.iter().any(|w| w.contains("over the limit")), "{warnings:?}");
+    }
+
+    #[test]
+    fn many_overlapping_style_runs_are_summed_once() {
+        use figcraft_doc::StyleRun;
+        let mut doc = Document::new("Runs");
+        let page = doc.first_page().unwrap();
+        let mut t = TextData::new("x".repeat(100_000));
+        t.style.font_family = "Unused Base".into();
+        let mut run = t.style.clone();
+        run.font_family = "Run Font".into();
+        t.runs = (0..50_000).map(|_| StyleRun { start: 0, end: 100_000, style: run.clone() }).collect();
+        doc.create(page, NodeKind::Text(t), "Long", 0.0, 0.0, 100.0, 30.0).unwrap();
+        let report = font_report_with_families(&doc, &[]);
+        assert_eq!(report["fonts"].as_array().map(Vec::len), Some(1), "{report}");
+        assert_eq!(report["fonts"][0]["family"], "Run Font");
+    }
+
     #[test]
     fn expands_inline_svg_into_editable_shapes_without_discarding_source() {
         let mut doc = Document::new("SVG fixture");

crates/engine/src/cmd/file/open.rs

@@ -30,8 +30,9 @@ pub(super) fn open_recent(s: &mut Session, p: &Value) -> Result<Value> {
             allow(&path, Access::Read)?;
             Some(path)
         }
-        (None, Some(i)) => {
-            Some(s.prefs.recent_files.iter().filter(|r| listed(r)).nth(i.max(0.0) as usize).cloned().ok_or_else(|| bad(CMD, "no such recent file"))?)
+        (None, Some(_)) => {
+            let i = req_index(CMD, p, "index")?;
+            Some(s.prefs.recent_files.iter().filter(|r| listed(r)).nth(i).cloned().ok_or_else(|| bad(CMD, "no such recent file"))?)
         }
         _ => None,
     };

crates/engine/src/cmd/image.rs

@@ -5,7 +5,7 @@ use figcraft_doc::{Document, ImagePreset, Node};
 use serde_json::{Value, json};
 
 use super::{CommandSpec, ok};
-use crate::params::{f64_of, get, num, req_index, req_string, req_targets, string, targets};
+use crate::params::{f64_of, get, req_index, req_string, req_targets, string, targets};
 use crate::{EngineError, Result, Session, bad, spec};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -236,7 +236,10 @@ fn save_preset(s: &mut Session, p: &Value) -> Result<Value> {
         Some(v) => with_values(cmd, ImageFilters::NONE, v)?,
         None => {
             let stroke = strokes(cmd, p)?;
-            let index = num(p, "index").filter(|k| k.is_finite() && *k >= 0.0).map(|k| k as usize);
+            let index = match get(p, "index") {
+                None | Some(Value::Null) => None,
+                Some(_) => Some(req_index(cmd, p, "index")?),
+            };
             let doc = s.doc()?;
             targets(s, p)
                 .iter()

crates/engine/src/cmd/structure.rs

@@ -799,7 +799,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
                     WindingRule::NonZero
                 };
                 let path = drawn.fill_path();
-                let path = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                let path = figcraft_geom::simplify_path(&path, tol);
                 let (path, output_winding) = match figcraft_pathops::simplify_with_rule(&path, winding == WindingRule::EvenOdd) {
                     Ok(path) => (path, WindingRule::EvenOdd),
                     Err(_) => (path, winding),
@@ -809,7 +809,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
             } else {
                 for (index, region) in source.regions.iter().enumerate() {
                     let Some(path) = drawn.region_path(index) else { continue };
-                    let path = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                    let path = figcraft_geom::simplify_path(&path, tol);
                     let path = figcraft_pathops::simplify_with_rule(&path, region.winding == WindingRule::EvenOdd).unwrap_or(path);
                     append_region_path(&mut net, &path, region, region.winding);
                 }
@@ -826,7 +826,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
                 open.regions.clear();
                 if !open.segments.is_empty() {
                     let path = open.stroke_path();
-                    let simplified = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                    let simplified = figcraft_geom::simplify_path(&path, tol);
                     let mut loose = VectorNetwork::from_path(&simplified);
                     loose.regions.clear();
                     append_network(&mut net, loose);
@@ -834,7 +834,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
             }
             if source.regions.is_empty() {
                 let path = source.stroke_path();
-                let simplified = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                let simplified = figcraft_geom::simplify_path(&path, tol);
                 net = VectorNetwork::from_path(&simplified);
                 net.regions.clear();
             }

crates/engine/src/components_behaviour_tests.rs

@@ -7,6 +7,7 @@
 use serde_json::{Value, json};
 
 use crate::Session;
+use crate::automation::params::id_of;
 use crate::components::tests::{chars, copy_of, ex, fill, healthy, idv, kids, node};
 use figcraft_doc::*;
 
@@ -1000,3 +1001,245 @@ fn deleting_a_layer_inside_an_instance_hides_it_instead() {
     s.execute("edit.delete", &json!({"ids": [k.inst]})).unwrap();
     assert!(s.doc().unwrap().node(k.inst).is_none());
 }
+
+/// Create multiple components (#2088): each selected layer becomes its own component in place,
+/// keeping its name and position; all stay selected and one undo reverts them all.
+#[test]
+fn create_multiple_components_keeps_names_and_places_and_is_one_undo_step() {
+    let mut s = Session::new();
+    let mut frames = Vec::new();
+    for (i, name) in ["Card", "Badge", "Tile"].into_iter().enumerate() {
+        let x = 150.0 * i as f64;
+        let v = s.execute("frame.create", &json!({"x": x, "y": 20, "width": 100, "height": 60})).unwrap();
+        let f = id_of(&v["id"]).unwrap();
+        s.execute("object.rename", &json!({"ids": [f], "name": name})).unwrap();
+        frames.push(f);
+    }
+    let before = undo_len(&s);
+    let out = s.execute("component.createMultiple", &json!({"ids": frames})).unwrap();
+    assert_eq!(undo_len(&s), before + 1, "one undo step");
+    let made: Vec<NodeId> = out["ids"].as_array().unwrap().iter().filter_map(id_of).collect();
+    assert_eq!(made.len(), 3);
+    assert_eq!(s.selection(), made, "all of them stay selected");
+    let doc = s.doc().unwrap();
+    for (i, (c, name)) in made.iter().zip(["Card", "Badge", "Tile"]).enumerate() {
+        let n = doc.node(*c).unwrap();
+        assert!(matches!(n.kind, NodeKind::Component { .. }), "{name} is a component");
+        assert_eq!(n.name, name);
+        let b = doc.world_bounds(*c).unwrap();
+        assert_eq!((b.x0, b.y0), (150.0 * i as f64, 20.0), "{name} stays in place");
+    }
+    s.undo().unwrap();
+    let doc = s.doc().unwrap();
+    assert!(frames.iter().all(|f| matches!(doc.node(*f).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo restores the frames");
+}
+
+/// Frames named `names` at x = 150 * i (mirrored when `reverse`), y 20, 100 x 60.
+fn named_frames(s: &mut Session, names: &[&str], reverse: bool) -> Vec<NodeId> {
+    let n = names.len();
+    names
+        .iter()
+        .enumerate()
+        .map(|(i, name)| {
+            let x = 150.0 * if reverse { n - 1 - i } else { i } as f64;
+            let v = s.execute("frame.create", &json!({"x": x, "y": 20, "width": 100, "height": 60})).unwrap();
+            let f = id_of(&v["id"]).unwrap();
+            s.execute("object.rename", &json!({"ids": [f], "name": name})).unwrap();
+            f
+        })
+        .collect()
+}
+
+/// The set's name and its children's names in layer order.
+fn set_names(s: &Session, set: NodeId) -> (String, Vec<String>) {
+    let doc = s.doc().unwrap();
+    let n = doc.node(set).unwrap();
+    (n.name.clone(), n.children.iter().map(|c| doc.node(*c).unwrap().name.clone()).collect())
+}
+
+/// The set's variant names ordered by world x.
+fn names_by_x(s: &Session, set: NodeId) -> Vec<String> {
+    let doc = s.doc().unwrap();
+    let mut v: Vec<(f64, String)> =
+        doc.node(set).unwrap().children.iter().map(|c| (doc.world_bounds(*c).unwrap().x0, doc.node(*c).unwrap().name.clone())).collect();
+    v.sort_by(|a, b| a.0.total_cmp(&b.0));
+    v.into_iter().map(|(_, n)| n).collect()
+}
+
+/// Create component set (#2088, measured in Figma): variants "Property 1=<name>" in left-to-right
+/// order, the set "Component 1", wrapped in place 20 px around, selected, one undo step.
+#[test]
+fn create_set_names_variants_by_layer_name_and_wraps_in_place() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Primary", "Secondary", "Ghost"], false);
+    let before = undo_len(&s);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    assert_eq!(undo_len(&s), before + 1, "one undo step");
+    let set = id_of(&out["id"]).unwrap();
+    assert_eq!(s.selection(), vec![set], "the set is selected");
+    assert_eq!(set_names(&s, set).0, "Component 1");
+    assert_eq!(names_by_x(&s, set), ["Property 1=Primary", "Property 1=Secondary", "Property 1=Ghost"]);
+    let doc = s.doc().unwrap();
+    for (i, c) in doc.node(set).unwrap().children.iter().enumerate() {
+        assert!(matches!(doc.node(*c).unwrap().kind, NodeKind::Component { .. }));
+        let b = doc.world_bounds(*c).unwrap();
+        assert_eq!((b.x0, b.y0), (150.0 * i as f64, 20.0), "frames stay put");
+    }
+    let sb = doc.world_bounds(set).unwrap();
+    assert_eq!((sb.x0, sb.y0, sb.x1, sb.y1), (-20.0, 0.0, 420.0, 100.0), "20 px on every side");
+    s.undo().unwrap();
+    let doc = s.doc().unwrap();
+    assert!(doc.node(set).is_none());
+    assert!(frames.iter().all(|f| matches!(doc.node(*f).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo restores the frames");
+}
+
+#[test]
+fn create_set_orders_left_to_right_whatever_the_selection_order() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B", "C"], true);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    let set = id_of(&out["id"]).unwrap();
+    assert_eq!(names_by_x(&s, set), ["Property 1=C", "Property 1=B", "Property 1=A"]);
+    let (_, kids) = set_names(&s, set);
+    assert_eq!(kids.len(), 3);
+}
+
+#[test]
+fn create_set_keeps_names_already_in_prop_value_form() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Size=Small", "Size=Large", "Size=Medium"], false);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    let set = id_of(&out["id"]).unwrap();
+    assert_eq!(set_names(&s, set).0, "Component 1");
+    assert_eq!(names_by_x(&s, set), ["Size=Small", "Size=Large", "Size=Medium"]);
+}
+
+#[test]
+fn create_set_with_one_shared_name_names_the_set_and_makes_default_variants() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Card", "Card", "Card"], false);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    let set = id_of(&out["id"]).unwrap();
+    let (name, kids) = set_names(&s, set);
+    assert_eq!(name, "Card");
+    assert_eq!(kids, ["Property 1=Default", "Property 1=Default", "Property 1=Default"]);
+}
+
+#[test]
+fn create_set_refuses_instances_and_leaves_the_document_alone() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B"], false);
+    let c = s.execute("component.create", &json!({"ids": [frames[0]]})).unwrap();
+    let comp = id_of(&c["id"]).unwrap();
+    let inst = s.execute("instance.create", &json!({"component": comp})).unwrap();
+    let inst = id_of(&inst["id"]).unwrap();
+    let before = undo_len(&s);
+    let e = s.execute("component.createSet", &json!({"ids": [inst, frames[1]]})).unwrap_err();
+    assert!(matches!(e, crate::EngineError::Disabled(..)), "{e:?}");
+    assert_eq!(undo_len(&s), before);
+    assert!(matches!(s.doc().unwrap().node(frames[1]).unwrap().kind, NodeKind::Frame));
+}
+
+#[test]
+fn create_set_refuses_a_target_inside_another_target_and_leaves_the_document_alone() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Outer", "Inner"], false);
+    s.execute("node.reparent", &json!({"ids": [frames[1]], "parent": frames[0]})).unwrap();
+    let before = undo_len(&s);
+    let e = s.execute("component.createSet", &json!({"ids": [frames[0], frames[1]]})).unwrap_err();
+    assert!(matches!(e, crate::EngineError::Disabled(..)), "{e:?}");
+    assert_eq!(undo_len(&s), before);
+    let doc = s.doc().unwrap();
+    assert!(matches!(doc.node(frames[0]).unwrap().kind, NodeKind::Frame));
+    assert!(matches!(doc.node(frames[1]).unwrap().kind, NodeKind::Frame));
+}
+
+/// Every node's id, parent, name and kind, to compare a document before and after a refused command.
+fn snapshot(s: &Session) -> Vec<String> {
+    s.doc().unwrap().nodes().map(|n| format!("{:?}|{:?}|{}|{:?}", n.id, n.parent, n.name, n.kind)).collect()
+}
+
+/// A refused `component.createSet`: `Disabled`, no undo step, the document and the selection as they were.
+fn assert_create_set_refused(s: &mut Session, ids: &[NodeId]) {
+    let (before, undo, selection) = (snapshot(s), undo_len(s), s.selection());
+    let e = s.execute("component.createSet", &json!({"ids": ids})).unwrap_err();
+    assert!(matches!(e, crate::EngineError::Disabled(..)), "{e:?}");
+    assert_eq!(undo_len(s), undo, "no undo step");
+    assert_eq!(snapshot(s), before, "the document is unchanged");
+    assert_eq!(s.selection(), selection, "the selection is unchanged");
+}
+
+/// Nothing to wrap is refused before anything is created.
+#[test]
+fn create_set_refuses_no_layers_and_leaves_the_document_alone() {
+    let mut s = Session::new();
+    named_frames(&mut s, &["A"], false);
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    assert_create_set_refused(&mut s, &[]);
+}
+
+/// One layer is allowed: a set of one variant, as many layers would make.
+#[test]
+fn create_set_with_one_layer_makes_a_one_variant_set() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Solo"], false);
+    let before = undo_len(&s);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    assert_eq!(undo_len(&s), before + 1, "one undo step");
+    let set = id_of(&out["id"]).unwrap();
+    let doc = s.doc().unwrap();
+    assert_eq!(doc.node(set).unwrap().children.len(), 1);
+    assert_eq!(names_by_x(&s, set), ["Property 1=Default"], "a lone layer shares its name with itself");
+    assert!(matches!(doc.node(doc.node(set).unwrap().children[0]).unwrap().kind, NodeKind::Component { .. }));
+    s.undo().unwrap();
+    assert!(matches!(s.doc().unwrap().node(frames[0]).unwrap().kind, NodeKind::Frame));
+}
+
+/// Each refusal branch of `create_set`, with `can_create_set` agreeing with it.
+#[test]
+fn create_set_refuses_every_ineligible_selection_and_leaves_the_document_alone() {
+    use crate::cmd::component::can_create_set;
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B", "C"], false);
+    let comp = id_of(&s.execute("component.create", &json!({"ids": [frames[0]]})).unwrap()["id"]).unwrap();
+    let inst = id_of(&s.execute("instance.create", &json!({"component": comp})).unwrap()["id"]).unwrap();
+    let set_frames = named_frames(&mut s, &["V1", "V2"], false);
+    let set = id_of(&s.execute("component.createSet", &json!({"ids": set_frames})).unwrap()["id"]).unwrap();
+    // A layer inside the instance (its copy of the card's content).
+    let in_inst = s.doc().unwrap().node(inst).unwrap().children.first().copied();
+    // A library copy.
+    let remote = {
+        let doc = s.doc_mut().unwrap();
+        let store = doc.ensure_library_store();
+        let remote = doc.alloc_id();
+        doc.insert(Node::new(remote, NodeKind::Frame, "Remote", 10.0, 10.0), store, None).unwrap();
+        remote
+    };
+    let ok = frames[1];
+    assert!(can_create_set(s.doc().unwrap(), &[ok, frames[2]]));
+    assert!(!can_create_set(s.doc().unwrap(), &[]));
+    let mut cases = vec![("instance", inst), ("library copy", remote), ("component", comp), ("component set", set)];
+    if let Some(i) = in_inst {
+        cases.push(("inside an instance", i));
+    }
+    for (what, bad) in cases {
+        assert!(!can_create_set(s.doc().unwrap(), &[ok, bad]), "{what}: not offered");
+        assert_create_set_refused(&mut s, &[ok, bad]);
+        assert_create_set_refused(&mut s, &[bad]);
+    }
+}
+
+/// A command that fails leaves no trace: the checks before the creation loop catch every
+/// refusal the loop's own commands could hit, and `Session::execute` restores the document, the
+/// selection and the undo stack on any error, so no half-made components can survive.
+#[test]
+fn a_failing_create_set_leaves_no_components_behind() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B"], false);
+    let (before, undo, selection) = (snapshot(&s), undo_len(&s), s.selection());
+    let e = s.execute("component.createSet", &json!({"ids": [frames[0], NodeId(u64::MAX)]}));
+    assert!(e.is_err());
+    assert_eq!(undo_len(&s), undo);
+    assert_eq!(snapshot(&s), before);
+    assert_eq!(s.selection(), selection);
+}

crates/engine/src/design_paste_tests.rs

@@ -106,3 +106,67 @@ fn other_content_is_refused_without_changes() {
     assert_eq!(s.doc().unwrap().nodes().count(), before);
     assert!(s.clipboard.nodes.is_empty());
 }
+
+// The next three pin the paste-placement rules measured in Figma's web app on 2026-11-08 (a
+// synthetic file): in place when the original is in view, at the view's centre when it is off
+// screen, and in a selected frame's centre when the frame is elsewhere. The fourth pins
+// FigCraft's own branch for a selected frame that contains the original (in place inside it),
+// which was not measured.
+
+fn copied_rect(s: &mut Session) -> NodeId {
+    let r = id(&s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 50, "height": 50})).unwrap());
+    s.execute("edit.copy", &json!({"ids": [r]})).unwrap();
+    r
+}
+
+fn pasted(s: &mut Session) -> NodeId {
+    let r = s.execute("edit.paste", &json!({})).unwrap();
+    params::id_of(&r["ids"][0]).unwrap()
+}
+
+#[test]
+fn paste_with_the_original_in_view_lands_in_place_above_it() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let r = copied_rect(&mut s);
+    s.execute("view.set", &json!({"zoom": 1, "cx": 125, "cy": 125})).unwrap();
+    let c = pasted(&mut s);
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.x0, b.y0), (100.0, 100.0));
+    assert_eq!(s.selection(), [c]);
+    assert_eq!(s.doc().unwrap().node(page).unwrap().children, [r, c]);
+}
+
+#[test]
+fn paste_with_the_original_off_screen_lands_at_the_view_centre() {
+    let mut s = Session::new();
+    copied_rect(&mut s);
+    s.execute("view.set", &json!({"zoom": 1, "cx": 5000, "cy": 3000})).unwrap();
+    let c = pasted(&mut s);
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.center().x, b.center().y), (5000.0, 3000.0));
+}
+
+#[test]
+fn paste_into_a_selected_far_frame_lands_at_its_centre() {
+    let mut s = Session::new();
+    copied_rect(&mut s);
+    let f = id(&s.execute("frame.create", &json!({"x": 2000, "y": 1000, "width": 300, "height": 300})).unwrap());
+    s.execute("select.set", &json!({"ids": [f]})).unwrap();
+    let c = pasted(&mut s);
+    assert_eq!(s.doc().unwrap().node(c).unwrap().parent, Some(f));
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.center().x, b.center().y), (2150.0, 1150.0));
+}
+
+#[test]
+fn paste_into_a_selected_frame_holding_the_original_keeps_its_place() {
+    let mut s = Session::new();
+    copied_rect(&mut s);
+    let f = id(&s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 500, "height": 500})).unwrap());
+    s.execute("select.set", &json!({"ids": [f]})).unwrap();
+    let c = pasted(&mut s);
+    assert_eq!(s.doc().unwrap().node(c).unwrap().parent, Some(f));
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.x0, b.y0), (100.0, 100.0));
+}

crates/engine/src/extensions/widgets.rs

@@ -41,6 +41,8 @@ const FIELD: &str = "figcraft.widget.field";
 const HOVER: &str = "figcraft.widget.hover";
 /// Images in a widget are at most this many pixels on a side.
 const MAX_IMAGE_SIDE: u32 = 4096;
+/// All images of one widget together are at most this many pixels once decoded (four of the largest).
+const MAX_IMAGES_PIXELS: u64 = 4 * 4096 * 4096;
 
 /// Whether `n` is a widget's own layer.
 pub fn is_widget(n: &Node) -> bool {
@@ -259,8 +261,9 @@ fn build(s: &mut Session, plugin: &str, w: NodeId, r: &WidgetRender) -> Result<(
         _ => n.plugin_data.remove(MENU),
     };
     set_hover(n, r.root.hover.as_ref());
+    let mut pixels = 0;
     for c in &r.root.children {
-        add(doc, w, c, cmd)?;
+        add(doc, w, c, cmd, &mut pixels)?;
     }
     // An SVG brings as many layers as it describes.
     if doc.subtree(w).len() > MAX_NODES {
@@ -271,7 +274,7 @@ fn build(s: &mut Session, plugin: &str, w: NodeId, r: &WidgetRender) -> Result<(
 }
 
 /// Add layer `d` (and what it holds) inside `parent`, locked.
-fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str) -> Result<()> {
+fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str, pixels: &mut u64) -> Result<()> {
     let (kind, name) = match d.kind {
         WidgetKind::Frame => (NodeKind::Frame, "Frame"),
         WidgetKind::Text => (NodeKind::Text(TextData { characters: d.text.clone(), ..TextData::default() }), "Text"),
@@ -292,6 +295,16 @@ fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str) -> Result<
         if bytes.len() > MAX_IMAGE_BYTES {
             return Err(bad(cmd, format!("an image is larger than {} KB", MAX_IMAGE_BYTES / 1024)));
         }
+        // From the header, before anything is decoded: a small file can hold billions of pixels.
+        if let Some((w, h)) = figcraft_render::images::dimensions(&bytes) {
+            if w > MAX_IMAGE_SIDE || h > MAX_IMAGE_SIDE {
+                return Err(bad(cmd, format!("an image is larger than {MAX_IMAGE_SIDE} pixels on a side")));
+            }
+            *pixels += u64::from(w) * u64::from(h);
+            if *pixels > MAX_IMAGES_PIXELS {
+                return Err(bad(cmd, format!("the images are larger than {MAX_IMAGES_PIXELS} pixels together")));
+            }
+        }
         let (hash, iw, ih) = crate::cmd::create::add_readable_image(doc, bytes).map_err(|e| bad(cmd, e))?;
         if iw > MAX_IMAGE_SIDE || ih > MAX_IMAGE_SIDE {
             return Err(bad(cmd, format!("an image is larger than {MAX_IMAGE_SIDE} pixels on a side")));
@@ -302,7 +315,7 @@ fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str) -> Result<
     }
     doc.insert(n, parent, None)?;
     crate::cmd::props::apply(cmd, doc, id, &props(d, false))?;
-    d.children.iter().try_for_each(|c| add(doc, id, c, cmd))
+    d.children.iter().try_for_each(|c| add(doc, id, c, cmd, pixels))
 }
 
 /// Add SVG layer `d` inside `parent`: a frame of the picture's own size holding its layers, locked
@@ -604,3 +617,32 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("widget.list", "List widgets", "{} → {widgets: [{id, plugin, name, page, state, targets, fields, menu}]}", false, list),
     ]
 }
+
+#[cfg(test)]
+mod pixel_budget_tests {
+    use super::*;
+    use base64::Engine as _;
+
+    /// A `side` x `side` blank PNG (a few KB however many pixels).
+    fn png(side: u32) -> String {
+        let pix = figcraft_render::Pixmap::new(side, side).unwrap();
+        base64::engine::general_purpose::STANDARD.encode(figcraft_render::encode_png(&pix).unwrap())
+    }
+
+    #[test]
+    fn images_of_a_widget_share_a_decoded_pixel_budget() {
+        let mut doc = Document::new("t");
+        let page = doc.first_page().unwrap();
+        let data = png(4096);
+        let image = |i: usize| serde_json::from_value::<WidgetNode>(json!({"type": "image", "name": format!("I{i}"), "data": data})).unwrap();
+        let mut pixels = 0;
+        for i in 0..4 {
+            add(&mut doc, page, &image(i), "widget.insert", &mut pixels).unwrap();
+        }
+        let err = add(&mut doc, page, &image(4), "widget.insert", &mut pixels).unwrap_err().to_string();
+        assert!(err.contains("together"), "{err}");
+        // A header past the side limit is refused before it is decoded.
+        let wide = serde_json::from_value::<WidgetNode>(json!({"type": "image", "data": png(4097)})).unwrap();
+        assert!(add(&mut doc, page, &wide, "widget.insert", &mut 0).unwrap_err().to_string().contains("pixels on a side"));
+    }
+}

crates/engine/src/menu_gaps_tests.rs

@@ -84,3 +84,20 @@ fn outlined_layers_draw_as_outlines_and_the_rest_normally() {
     assert_eq!(outlined.pixel(20, 20).unwrap(), empty, "only its outline");
     assert_eq!(outlined.pixel(80, 20).unwrap(), plain.pixel(80, 20).unwrap(), "the other layer draws normally");
 }
+
+#[test]
+fn open_recent_rejects_negative_and_fractional_index() {
+    let dir = std::env::temp_dir().join(format!("figcraft-recent-bad-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let a = dir.join("a.figcraft").to_string_lossy().to_string();
+    let b = dir.join("b.figcraft").to_string_lossy().to_string();
+    let mut s = Session::new();
+    s.execute("file.save", &json!({"path": a})).unwrap();
+    s.execute("file.saveAs", &json!({"path": b})).unwrap();
+    let recent = s.prefs.recent_files.clone();
+    for i in [json!(-1), json!(1.5), json!(-0.5)] {
+        assert!(s.execute("file.openRecent", &json!({"index": i})).is_err(), "index {i} must be an error");
+    }
+    assert_eq!(s.prefs.recent_files, recent);
+    let _ = std::fs::remove_dir_all(&dir);
+}

crates/engine/src/paint_tests.rs

@@ -135,6 +135,16 @@ fn image_adjust_refuses_what_it_cannot_do() {
     assert_eq!(s.execute("image.adjust", &json!({"ids": [plain, r], "index": 1, "preset": "vivid"})).unwrap()["changed"], 1);
 }
 
+#[test]
+fn save_preset_rejects_bad_index() {
+    let mut s = Session::new();
+    let r = image_rect(&mut s);
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": 0})).is_err());
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": -1})).is_err(), "negative index accepted");
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": 1.5})).is_err(), "fractional index accepted");
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": 1})).is_ok());
+}
+
 #[test]
 fn saved_image_presets() {
     let mut s = Session::new();

crates/engine/src/slot_tests.rs

@@ -376,6 +376,265 @@ fn slots_of_nested_instances_fill_from_the_outer_main_and_its_instances() {
     assert_eq!(fill(&s, *kids(&s, nslot).first().unwrap()), "CCCCCC", "content no longer follows the Card main");
 }
 
+/// Wrap a component instance in another main, keeping the nested instance addressable.
+fn slot_text_wrapper(s: &mut Session, component: NodeId, name: &str) -> (NodeId, NodeId) {
+    let frame = idv(&ex(s, "frame.create", json!({"width": 300, "height": 200, "name": name})));
+    let nested = idv(&ex(s, "instance.create", json!({"component": component, "parent": frame})));
+    (idv(&ex(s, "component.create", json!({"ids": [frame]}))), nested)
+}
+
+/// Content.Label binds Text; Composition holds Base, whose Body uses default or own Content.
+/// Returns (Content main, Label, Base main, Composition main, nested Content instance).
+fn slot_text_composition(s: &mut Session, own: bool) -> (NodeId, NodeId, NodeId, NodeId, NodeId) {
+    let frame = idv(&ex(s, "frame.create", json!({"width": 100, "height": 40, "name": "Content"})));
+    let label = idv(&ex(s, "text.create", json!({"text": "Default", "parent": frame, "props": {"name": "Label"}})));
+    let content = idv(&ex(s, "component.create", json!({"ids": [frame]})));
+    ex(s, "component.addProperty", json!({"id": content, "name": "Text", "type": "text", "default": "Default", "layer": label}));
+    let frame = idv(&ex(s, "frame.create", json!({"width": 200, "height": 100, "name": "Base"})));
+    let body = idv(&ex(s, "frame.create", json!({"width": 180, "height": 80, "name": "Body", "parent": frame})));
+    let default = (!own).then(|| idv(&ex(s, "instance.create", json!({"component": content, "parent": body}))));
+    let base = idv(&ex(s, "component.create", json!({"ids": [frame]})));
+    ex(s, "component.makeSlot", json!({"id": body}));
+    let (composition, nested_base) = slot_text_wrapper(s, base, "Composition");
+    let nested_content = if let Some(default) = default {
+        copy_of(s, nested_base, default)
+    } else {
+        idv(&ex(s, "instance.slotInsert", json!({"id": nested_base, "slot": "Body", "component": content})))
+    };
+    (content, label, base, composition, nested_content)
+}
+
+fn assert_slot_text(s: &mut Session, instance: NodeId, expected: &str) {
+    let children = kids(s, instance);
+    assert_eq!(children.len(), 1, "Content {instance} must have exactly one Label");
+    let label = children[0];
+    assert_eq!(node(s, label).name, "Label");
+    let characters = node(s, label).kind.text().expect("Content's only child must be text").characters.clone();
+    let html = ex(s, "inspect.code", json!({"id": instance, "language": "html"}))["code"].as_str().unwrap().to_string();
+    assert_eq!(characters, expected, "slot Label characters; HTML: {html}");
+    assert_eq!(html.matches("<p ").count(), 1, "slot Label HTML must contain exactly one paragraph: {html}");
+    assert_eq!(html.matches("</p>").count(), 1, "slot Label HTML must contain exactly one paragraph: {html}");
+    assert!(html.contains(&format!(">{expected}</p>")), "slot Label HTML: {html}");
+}
+
+fn assert_local_slot_text(s: &mut Session, instance: NodeId, expected: &str) {
+    assert!(
+        matches!(&node(s, instance).kind, NodeKind::Instance { props, .. } if props.get("Text") == Some(&json!(expected))),
+        "instance {instance} must store its own Text value {expected:?}: {:?}",
+        node(s, instance).kind
+    );
+    let properties = props_of(s, instance);
+    let text = properties.iter().find(|p| p["name"] == "Text").unwrap_or_else(|| panic!("instance {instance} has no Text property: {properties:?}"));
+    assert_eq!(text["value"], expected, "instance {instance} Text property");
+}
+
+/// Exercise the same ownership contract for default slot content and content supplied by the
+/// Composition main; separate tests identify which route regresses.
+fn check_slot_text_properties_stay_local(own: bool) {
+    let mut s = Session::new();
+    let (content, label, _base, composition, main_content) = slot_text_composition(&mut s, own);
+    let a = idv(&ex(&mut s, "instance.create", json!({"component": composition, "x": 400})));
+    let b = idv(&ex(&mut s, "instance.create", json!({"component": composition, "x": 800})));
+    let ac = copy_of(&s, a, main_content);
+    let bc = copy_of(&s, b, main_content);
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Text": "Custom"}}));
+    assert_local_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_local_slot_text(&mut s, bc, "Default");
+    assert_slot_text(&mut s, bc, "Default");
+    assert_local_slot_text(&mut s, main_content, "Default");
+    assert_slot_text(&mut s, main_content, "Default");
+    assert_eq!(node(&s, label).kind.text().unwrap().characters, "Default");
+    // Main property edits propagate without replacing another instance's local value.
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Text": "Main value"}}));
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, bc, "Main value");
+    assert_slot_text(&mut s, main_content, "Main value");
+    ex(&mut s, "component.editProperty", json!({"id": content, "name": "Text", "default": "New default"}));
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, bc, "Main value");
+    assert_local_slot_text(&mut s, main_content, "Main value");
+    assert_slot_text(&mut s, main_content, "Main value");
+    healthy(&s);
+}
+
+#[test]
+fn slot_text_properties_stay_local_in_default_content() {
+    check_slot_text_properties_stay_local(false);
+}
+
+#[test]
+fn slot_text_properties_stay_local_in_own_content() {
+    check_slot_text_properties_stay_local(true);
+}
+
+#[test]
+fn slot_text_properties_do_not_read_an_unbound_base_property() {
+    let mut s = Session::new();
+    let (_content, _label, base, composition, main_content) = slot_text_composition(&mut s, true);
+    ex(&mut s, "component.addProperty", json!({"id": base, "name": "Text", "type": "text", "default": "Wrong owner"}));
+    let i = idv(&ex(&mut s, "instance.create", json!({"component": composition, "x": 400})));
+    let nested_base = kids(&s, i)[0];
+    assert_local_slot_text(&mut s, nested_base, "Wrong owner");
+    let nested = copy_of(&s, i, main_content);
+    assert_local_slot_text(&mut s, nested, "Default");
+    assert_slot_text(&mut s, nested, "Default");
+    ex(&mut s, "instance.setProperties", json!({"ids": [nested], "properties": {"Text": "Custom"}}));
+    assert_local_slot_text(&mut s, nested, "Custom");
+    assert_slot_text(&mut s, nested, "Custom");
+    assert_local_slot_text(&mut s, nested_base, "Wrong owner");
+    assert_slot_text(&mut s, main_content, "Default");
+    healthy(&s);
+}
+
+#[test]
+fn slot_text_properties_survive_inherited_own_content_and_persistence() {
+    let mut s = Session::new();
+    let (_content, _label, _base, composition, main_content) = slot_text_composition(&mut s, true);
+    let (outer, inherited) = slot_text_wrapper(&mut s, composition, "Outer composition");
+    let inherited_content = copy_of(&s, inherited, main_content);
+    let a = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 400})));
+    let b = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 800})));
+    let ac = copy_of(&s, a, inherited_content);
+    let bc = copy_of(&s, b, inherited_content);
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Text": "Custom"}}));
+    assert_local_slot_text(&mut s, ac, "Custom");
+    assert_local_slot_text(&mut s, bc, "Default");
+    assert_local_slot_text(&mut s, inherited_content, "Default");
+    assert_local_slot_text(&mut s, main_content, "Default");
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    let (back, _) = figcraft_format::load_bytes(&bytes).unwrap();
+    let mut s = Session::with_document(back);
+    assert_local_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, bc, "Default");
+    assert_slot_text(&mut s, inherited_content, "Default");
+    assert_slot_text(&mut s, main_content, "Default");
+    // Explicit characters override the bound property, even after a main update.
+    let alabel = kids(&s, ac)[0];
+    ex(&mut s, "text.set", json!({"id": alabel, "characters": "Explicit"}));
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Text": "Later"}}));
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Text": "Main value"}}));
+    assert_local_slot_text(&mut s, ac, "Later");
+    assert_slot_text(&mut s, ac, "Explicit");
+    assert_slot_text(&mut s, bc, "Main value");
+    ex(&mut s, "component.resetOverride", json!({"id": alabel, "group": "characters"}));
+    assert_slot_text(&mut s, ac, "Later");
+    s.undo().unwrap();
+    assert_slot_text(&mut s, ac, "Explicit");
+    healthy(&s);
+}
+
+/// Check both the stored property and the Label it drives, not just one representation.
+fn assert_slot_visibility(s: &mut Session, instance: NodeId, expected: bool) {
+    assert!(
+        matches!(&node(s, instance).kind, NodeKind::Instance { props, .. } if props.get("Visible") == Some(&json!(expected))),
+        "instance {instance} must store Visible={expected}: {:?}",
+        node(s, instance).kind
+    );
+    let properties = props_of(s, instance);
+    let visible =
+        properties.iter().find(|p| p["name"] == "Visible").unwrap_or_else(|| panic!("instance {instance} has no Visible property: {properties:?}"));
+    assert_eq!(visible["value"], expected, "instance {instance} Visible property");
+    let children = kids(s, instance);
+    assert_eq!(children.len(), 1, "Content {instance} must have exactly one Label");
+    assert_eq!(node(s, children[0]).name, "Label");
+    assert_eq!(node(s, children[0]).visible, expected, "instance {instance} Label visibility");
+}
+
+#[test]
+fn slot_boolean_properties_stay_local_in_inherited_own_content() {
+    let mut s = Session::new();
+    let (content, label, base, composition, main_content) = slot_text_composition(&mut s, true);
+    ex(&mut s, "component.addProperty", json!({"id": content, "name": "Visible", "type": "boolean", "default": true, "layer": label}));
+    ex(&mut s, "component.addProperty", json!({"id": base, "name": "Visible", "type": "boolean", "default": false}));
+    let (outer, inherited) = slot_text_wrapper(&mut s, composition, "Outer composition");
+    let inherited_base = kids(&s, inherited)[0];
+    let inherited_content = copy_of(&s, inherited, main_content);
+    let a = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 400})));
+    let b = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 800})));
+    let ac = copy_of(&s, a, inherited_content);
+    let bc = copy_of(&s, b, inherited_content);
+    let abase = copy_of(&s, a, inherited_base);
+    assert!(matches!(&node(&s, abase).kind, NodeKind::Instance { props, .. } if props.get("Visible") == Some(&json!(false))));
+    assert_slot_visibility(&mut s, ac, true);
+    assert_slot_visibility(&mut s, bc, true);
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Visible": false}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, inherited_content, true);
+    assert_slot_visibility(&mut s, main_content, true);
+    // A main update must not replace either instance's local value with the Base's homonym.
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Visible": false}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, false);
+    ex(&mut s, "instance.setProperties", json!({"ids": [bc], "properties": {"Visible": true}}));
+    ex(&mut s, "node.set", json!({"id": content, "props": {"fill": "#abcdef"}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, main_content, false);
+    healthy(&s);
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    let (back, _) = figcraft_format::load_bytes(&bytes).unwrap();
+    let mut s = Session::with_document(back);
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, inherited_content, false);
+    assert_slot_visibility(&mut s, main_content, false);
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Visible": true}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, main_content, true);
+    healthy(&s);
+}
+
+#[test]
+fn same_component_in_own_slot_keeps_independent_text_properties() {
+    let mut s = Session::new();
+    let frame = idv(&ex(&mut s, "frame.create", json!({"width": 200, "height": 100, "name": "Card"})));
+    let label = idv(&ex(&mut s, "text.create", json!({"text": "Default", "parent": frame, "props": {"name": "Label"}})));
+    let body = idv(&ex(&mut s, "frame.create", json!({"width": 180, "height": 60, "y": 40, "name": "Body", "parent": frame})));
+    let card = idv(&ex(&mut s, "component.create", json!({"ids": [frame]})));
+    ex(&mut s, "component.addProperty", json!({"id": card, "name": "Text", "type": "text", "default": "Default", "layer": label}));
+    ex(&mut s, "component.makeSlot", json!({"id": body}));
+    // Only page instance content holds another Card: the main never contains itself.
+    let outer = idv(&ex(&mut s, "instance.create", json!({"component": card, "x": 400})));
+    let inner = idv(&ex(&mut s, "instance.slotInsert", json!({"id": outer, "slot": "Body", "component": card})));
+    let check = |s: &mut Session, outer_text: &str, inner_text: &str| {
+        assert_local_slot_text(s, outer, outer_text);
+        assert_local_slot_text(s, inner, inner_text);
+        assert_eq!(node(s, copy_of(s, outer, label)).kind.text().unwrap().characters, outer_text);
+        assert_eq!(node(s, copy_of(s, inner, label)).kind.text().unwrap().characters, inner_text);
+        let outer_body = copy_of(s, outer, body);
+        assert!(slot_edited(s.doc().unwrap(), outer_body));
+        assert_eq!(kids(s, outer_body), vec![inner]);
+        assert!(kids(s, copy_of(s, inner, body)).is_empty());
+        assert!(kids(s, body).is_empty(), "the main's slot must remain empty");
+        healthy(s);
+    };
+    ex(&mut s, "instance.setProperties", json!({"ids": [outer], "properties": {"Text": "Outer"}}));
+    check(&mut s, "Outer", "Default");
+    ex(&mut s, "instance.setProperties", json!({"ids": [inner], "properties": {"Text": "Inner"}}));
+    check(&mut s, "Outer", "Inner");
+    ex(&mut s, "text.set", json!({"id": label, "characters": "New default"}));
+    ex(&mut s, "node.set", json!({"id": card, "props": {"fill": "#abcdef"}}));
+    check(&mut s, "Outer", "Inner");
+    assert_eq!(fill(&s, outer), "ABCDEF");
+    assert_eq!(fill(&s, inner), "ABCDEF");
+    ex(&mut s, "instance.setProperties", json!({"ids": [outer], "properties": {"Text": "Outer updated"}}));
+    check(&mut s, "Outer updated", "Inner");
+    ex(&mut s, "instance.setProperties", json!({"ids": [inner], "properties": {"Text": "Inner updated"}}));
+    check(&mut s, "Outer updated", "Inner updated");
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    let (back, _) = figcraft_format::load_bytes(&bytes).unwrap();
+    let mut s = Session::with_document(back);
+    check(&mut s, "Outer updated", "Inner updated");
+    ex(&mut s, "node.set", json!({"id": card, "props": {"fill": "#123456"}}));
+    check(&mut s, "Outer updated", "Inner updated");
+    assert_eq!(fill(&s, outer), "123456");
+    assert_eq!(fill(&s, inner), "123456");
+}
+
 /// Random slot edits, main edits and resets keep every instance mirroring its main.
 #[test]
 fn random_slot_edits_keep_instances_consistent() {

crates/engine/src/vector_behaviour_tests.rs

@@ -326,6 +326,58 @@ fn ex_to_vector(doc: &mut figcraft_doc::Document, id: NodeId) {
     doc.get_mut(id).unwrap().kind = NodeKind::Vector { network };
 }
 
+/// How far `path` strays from `from`: the largest distance from a point sampled along `path` to
+/// the nearest segment of `from`.
+pub(crate) fn strays(path: &BezPath, from: &BezPath) -> f64 {
+    use figcraft_geom::kurbo::ParamCurveNearest;
+    let segs: Vec<_> = from.segments().collect();
+    path.segments()
+        .flat_map(|seg| (0..=32).map(move |i| seg.eval(f64::from(i) / 32.0)))
+        .map(|p| segs.iter().map(|s| s.nearest(p, 1e-6).distance_sq).fold(f64::INFINITY, f64::min).sqrt())
+        .fold(0.0, f64::max)
+}
+
+/// Simplify path keeps nearly collinear points, and a stroke that goes out and back, near where
+/// they were: kurbo's fit, which Simplify path and the Pencil share, ran a handle hundreds of units
+/// on along the line (#1741). That holds for each way the command simplifies a layer: an open
+/// stroke, a filled shape, a region with its own fill, and a stroke beside a filled shape.
+#[test]
+fn simplify_keeps_nearly_collinear_points_near_them() {
+    // The points exactly as sampled.
+    let straight = "M209.5986907940155 -204.90932811973988 L211.27791426387097 -207.1909740207534 L214.24650682872084 -211.22882759062324";
+    let back =
+        "M80 -160 L86.04356571908697 -173.74440234910094 L87.85185073933535 -179.20284644595452 L86.04356571908697 -173.74440234910094 L95 -185";
+    let shape = format!("{straight} L260 -150 Z");
+    let cases = [
+        ("an open stroke", straight.to_string(), false),
+        ("a filled shape", shape.clone(), false),
+        ("a region with its own fill", shape.clone(), true),
+        ("a stroke beside a filled shape", format!("{shape} {back}"), false),
+    ];
+    for (what, d, own_fill) in cases {
+        let mut s = Session::new();
+        let id = id_of(&ex(&mut s, "vector.create", json!({"path": "M0 0 L10 10"}))["id"]).unwrap();
+        // At the page origin, as given (`vector.create` would move the points).
+        let mut network = VectorNetwork::from_path(&BezPath::from_svg(&d).unwrap());
+        if own_fill {
+            network.regions[0].fills = Some(vec![figcraft_color::Paint::solid(figcraft_color::Color::from_hex("#FF0000").unwrap())]);
+        }
+        {
+            let n = s.doc_mut().unwrap().get_mut(id).unwrap();
+            n.transform = figcraft_geom::Affine::IDENTITY;
+            n.kind = NodeKind::Vector { network };
+        }
+        let before = net(&s, id);
+        ex(&mut s, "vector.simplify", json!({"ids": [id], "tolerance": 0.75}));
+        let after = s.doc().unwrap().world_transform(id) * net(&s, id).stroke_path();
+        let gone = strays(&after, &before.stroke_path());
+        assert!(gone <= 1.5, "{what}: strays {gone}: {}", after.to_svg());
+        let (b0, b1) = (before.stroke_path().bounding_box(), after.bounding_box());
+        assert!(b0.inflate(1.5, 1.5).contains_rect(b1), "{what}: {b1:?} past {b0:?}: {}", after.to_svg());
+        assert_eq!(net(&s, id).regions.len(), before.regions.len(), "{what}: the fill is kept");
+    }
+}
+
 fn ex(s: &mut Session, cmd: &str, p: Value) -> Value {
     s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
 }

crates/format/src/fig/export/shape.rs

@@ -207,7 +207,9 @@ impl<'d> Exporter<'d> {
                 .enumerate()
                 .map(|(i, v)| {
                     let mut st: Fields = Vec::new();
-                    if v.radius > 0.0 {
+                    // A point without a radius of its own is drawn with the layer's, so a sharp
+                    // point on a rounded layer says so.
+                    if v.radius > 0.0 || n.corners.radii[0] > 0.0 {
                         st.push(("cornerRadius", fl(v.radius)));
                     }
                     if let Some(m) = v.mirror {

crates/format/src/fig/export_tests.rs

@@ -955,6 +955,25 @@ fn closed_vector_geometry_is_written_with_its_corner_smoothing() {
     assert_eq!(radii, vec![20.0, 0.0, 10.0, 0.0], "each point keeps its own radius");
 }
 
+#[test]
+fn sharp_points_on_a_rounded_vector_stay_sharp() {
+    // A point without a radius takes the layer's when read, so a sharp point on a vector with a
+    // layer radius is written with its own zero.
+    let mut doc = Document::new("sharp point");
+    let page = doc.first_page().unwrap();
+    let mut network = VectorNetwork::from_points(&[(0.0, 0.0), (100.0, 0.0), (100.0, 100.0), (0.0, 100.0)].map(|(x, y)| Point::new(x, y)), true);
+    for (v, r) in network.vertices.iter_mut().zip([8.0, 0.0, 8.0, 0.0]) {
+        v.radius = r;
+    }
+    let id = doc.create(page, NodeKind::Vector { network }, "V", 0.0, 0.0, 100.0, 100.0).unwrap();
+    doc.node_mut(id).unwrap().corners.radii = [8.0; 4];
+    let (back, _) = round_trip(&doc, "sharp point");
+    let v = back.nodes().find(|n| matches!(n.kind, NodeKind::Vector { .. })).unwrap();
+    let NodeKind::Vector { network } = &v.kind else { panic!("vector") };
+    let radii: Vec<f64> = network.vertices.iter().map(|x| x.radius).collect();
+    assert_eq!(radii, vec![8.0, 0.0, 8.0, 0.0]);
+}
+
 #[test]
 fn the_written_schema_parses_and_round_trips() {
     let schema = Schema::parse(export::SCHEMA).unwrap();

crates/format/src/fig/map.rs

@@ -356,8 +356,9 @@ struct Mapper<'a> {
     /// holding it) name it by `vectorNetworkRef`. Kept out of the JSON, where a large file's
     /// networks took gigabytes.
     networks: Vec<Option<VectorNetwork>>,
-    /// Index in `networks` by its blob, position scale, style table and point-radius scale.
-    network_ids: HashMap<(usize, u64, u64, usize, u64), usize>,
+    /// Index in `networks` by its blob, position scale, style table, point-radius scale and the
+    /// layer's corner radius (which points without one of their own take).
+    network_ids: HashMap<(usize, u64, u64, usize, u64, u64), usize>,
     /// Region paint elements (paints and gradient stops) read so far: one budget for the whole
     /// file, since layers with region paints don't share their network.
     region_paint_elements: usize,

crates/format/src/fig/map/layer.rs

@@ -668,6 +668,8 @@ impl<'a> Mapper<'a> {
             size.zip(norm).filter(|(s, n)| s.is_finite() && *n > 1e-9).map_or(1.0, |(s, n)| s / n)
         };
         let (sx, sy) = (scale("x"), scale("y"));
+        // A point whose style doesn't set a radius takes the layer's, as the editor draws it.
+        let layer_radius = v.len("cornerRadius");
         let vertices: Vec<Value> = net
             .vertices
             .iter()
@@ -676,7 +678,7 @@ impl<'a> Mapper<'a> {
                 let st = style(p.style);
                 // Point radii are lengths in this row's space, unlike the normalized positions.
                 // An override/derived row already carries the instance's scale.
-                if let Some(r) = st.and_then(|s| num(s, "cornerRadius")).and_then(|r| scaled(r, radius_scale)).filter(|r| *r > 0.0) {
+                if let Some(r) = st.and_then(|s| num(s, "cornerRadius")).and_then(|r| scaled(r, radius_scale)).or(layer_radius).filter(|r| *r > 0.0) {
                     out["radius"] = json!(r);
                 }
                 match st.and_then(|s| s.get("handleMirroring")).and_then(Kv::str) {
@@ -793,7 +795,8 @@ impl<'a> Mapper<'a> {
             return true;
         }
         // A resized instance and a K-scaled one can have the same box but different radii.
-        let key = (blob_id, sx.to_bits(), sy.to_bits(), std::ptr::from_ref(vd) as usize, radius_scale.to_bits());
+        let key =
+            (blob_id, sx.to_bits(), sy.to_bits(), std::ptr::from_ref(vd) as usize, radius_scale.to_bits(), layer_radius.unwrap_or(0.0).to_bits());
         let id = match self.network_ids.get(&key) {
             Some(id) => *id,
             None => {

crates/format/src/fig/tail_tests.rs

@@ -521,6 +521,96 @@ fn network_of<'d>(doc: &'d figcraft_doc::Document, name: &str) -> &'d figcraft_d
     }
 }
 
+#[test]
+fn vector_points_without_a_radius_of_their_own_take_the_layers() {
+    // A vector rounded from the layer's corner radius: the editor rounds every point whose
+    // style doesn't set a radius (no style, or one without `cornerRadius`) with the layer's,
+    // while a point's own radius, zero included, wins.
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let wave = nodes.iter_mut().find(|node| node.get("name").and_then(Kv::str) == Some("Wave")).unwrap();
+    let Kv::Object(fields) = wave else { panic!() };
+    fields.push(("cornerRadius", f(6.0)));
+    let vector_data = field_mut(wave, "vectorData").unwrap();
+    let Kv::Array(styles) = field_mut(vector_data, "styleOverrideTable").unwrap() else { panic!() };
+    let Kv::Object(sharp) = styles.get_mut(2).unwrap() else { panic!() };
+    sharp.push(("cornerRadius", f(0.0)));
+    let (doc, _) = import(&canvas(&schema(), &message), "Rounded").unwrap();
+    let radii: Vec<f64> = network_of(&doc, "Wave").vertices.iter().map(|v| v.radius).collect();
+    assert_eq!(radii, [6.0, 4.0, 6.0, 0.0], "no style, own radius, style without one, own zero");
+    // Without a layer radius, the points without one of their own stay sharp.
+    let (doc, _) = import(&tail_canvas(), "Tail").unwrap();
+    let radii: Vec<f64> = network_of(&doc, "Wave").vertices.iter().map(|v| v.radius).collect();
+    assert_eq!(radii, [0.0, 4.0, 0.0, 0.0]);
+}
+
+#[test]
+fn an_instance_that_rounds_a_vector_keeps_its_own_points() {
+    // An instance's copy shares its main's vector data; overriding the layer's radius must not
+    // reuse the main's network, nor hand the instance's to the main.
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let wave = nodes.iter_mut().find(|node| node.get("name").and_then(Kv::str) == Some("Wave")).unwrap();
+    *field_mut(wave, "parentIndex").unwrap() = o(vec![("guid", g(50)), ("position", s("!"))]);
+    *field_mut(wave, "transform").unwrap() = at(0.0, 0.0);
+    let rounded = o(vec![("guidPath", o(vec![("guids", arr(vec![g(30)]))])), ("cornerRadius", f(6.0))]);
+    nodes.push(node(50, Some((1, "~")), "SYMBOL", "Mark", vec![("size", xy(200.0, 100.0)), ("transform", at(700.0, 0.0))]));
+    nodes.push(node(
+        51,
+        Some((1, "~!")),
+        "INSTANCE",
+        "Rounded mark",
+        vec![
+            ("size", xy(200.0, 100.0)),
+            ("transform", at(700.0, 400.0)),
+            ("symbolData", o(vec![("symbolID", g(50)), ("symbolOverrides", arr(vec![rounded]))])),
+        ],
+    ));
+    let (doc, _) = import(&canvas(&schema(), &message), "Instance").unwrap();
+    let radii_under = |parent: &str| -> Vec<f64> {
+        let p = named(&doc, parent);
+        let wave = p.children.iter().map(|c| doc.node(*c).unwrap()).find(|n| n.name == "Wave").unwrap();
+        let NodeKind::Vector { network } = &wave.kind else { panic!() };
+        network.vertices.iter().map(|v| v.radius).collect()
+    };
+    assert_eq!(radii_under("Mark"), [0.0, 4.0, 0.0, 0.0]);
+    assert_eq!(radii_under("Rounded mark"), [6.0, 4.0, 6.0, 6.0]);
+}
+
+#[test]
+fn a_scaled_instance_scales_its_vectors_point_radii() {
+    // Point radii are lengths: an instance scaled with the Scale tool draws its main's, from a
+    // point's own style or from the layer, times the factor (#2091).
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let wave = nodes.iter_mut().find(|node| node.get("name").and_then(Kv::str) == Some("Wave")).unwrap();
+    *field_mut(wave, "parentIndex").unwrap() = o(vec![("guid", g(50)), ("position", s("!"))]);
+    *field_mut(wave, "transform").unwrap() = at(0.0, 0.0);
+    let Kv::Object(fields) = wave else { panic!() };
+    fields.push(("cornerRadius", f(3.0)));
+    nodes.push(node(50, Some((1, "~")), "SYMBOL", "Mark", vec![("size", xy(200.0, 100.0)), ("transform", at(700.0, 0.0))]));
+    nodes.push(node(
+        51,
+        Some((1, "~!")),
+        "INSTANCE",
+        "Big mark",
+        vec![
+            ("size", xy(400.0, 200.0)),
+            ("transform", at(700.0, 400.0)),
+            ("symbolData", o(vec![("symbolID", g(50)), ("uniformScaleFactor", f(2.0))])),
+        ],
+    ));
+    let (doc, _) = import(&canvas(&schema(), &message), "Scaled").unwrap();
+    let radii_under = |parent: &str| -> Vec<f64> {
+        let p = named(&doc, parent);
+        let wave = p.children.iter().map(|c| doc.node(*c).unwrap()).find(|n| n.name == "Wave").unwrap();
+        let NodeKind::Vector { network } = &wave.kind else { panic!() };
+        network.vertices.iter().map(|v| v.radius).collect()
+    };
+    assert_eq!(radii_under("Mark"), [3.0, 4.0, 3.0, 3.0]);
+    assert_eq!(radii_under("Big mark"), [6.0, 8.0, 6.0, 6.0]);
+}
+
 #[test]
 fn vectors_import_as_editable_networks() {
     let (doc, warnings) = import(&tail_canvas(), "Tail").unwrap();

crates/geom/src/lib.rs

@@ -12,7 +12,9 @@ use kurbo::ParamCurve;
 use std::f64::consts::{FRAC_PI_2, PI, TAU};
 
 pub mod measure;
+mod simplify;
 mod transform;
+pub use simplify::simplify_path;
 pub use transform::*;
 
 /// Corner radii in clockwise order from the top-left: `[tl, tr, br, bl]`.

crates/geom/src/simplify.rs

@@ -0,0 +1,140 @@
+//! Path simplification that keeps to its input where kurbo's fit would shoot past it.
+
+use kurbo::{BezPath, ParamCurve, ParamCurveNearest, PathEl, PathSeg, Point, Vec2};
+
+/// How far, as a multiple of the accuracy asked for, a fitted run may stray from the run it
+/// replaces before the run is kept as it was. kurbo's own fits stay within about the accuracy; its
+/// failures stray by tens to hundreds of units, so twice the accuracy tells them apart without
+/// undoing fits that are merely a little over.
+const STRAY: f64 = 2.0;
+
+/// `path` simplified to within `accuracy` by kurbo's [`simplify_bezpath`], kept from straying
+/// far from `path` where kurbo's fit does.
+///
+/// Two inputs made kurbo's fit shoot far past the path it simplified (#1741, a Pencil stroke with
+/// a spike off it), and both are common in pointer samples:
+/// - A join where the path turns straight back (samples going down and back up the same line):
+///   kurbo keeps two segments in one smooth fit when their tangents are parallel whichever way
+///   they point (`|cross| <= |dot| * angle_thresh`), so it fits a smooth curve through the cusp.
+///   The path is cut where it turns back by more than a right angle, each run between the cuts is
+///   simplified on its own, and the runs are joined again, so the turn stays a sharp corner. Any
+///   other join that isn't straight within kurbo's threshold is a corner to kurbo already, so the
+///   cut changes nothing there.
+/// - A run of nearly collinear segments: kurbo measures its error across the path, not along it, so
+///   a fitted cubic whose handle runs hundreds of units on along the line passes its check. Each
+///   fitted run is measured against the run it replaces, and one that strays more than
+///   twice `accuracy` from it is kept as it was instead.
+///
+/// Subpaths and closes are kept, and a closing segment stays implicit, as kurbo leaves it.
+///
+/// [`simplify_bezpath`]: kurbo::simplify::simplify_bezpath
+pub fn simplify_path(path: &BezPath, accuracy: f64) -> BezPath {
+    let mut out = BezPath::new();
+    let mut run = BezPath::new();
+    // Where the current subpath started, where the pen is, and the last segment's end tangent.
+    let mut start = Point::ZERO;
+    let mut at = Point::ZERO;
+    let mut last_tan: Option<Vec2> = None;
+    // Whether the next run that draws anything has to start the subpath with its move.
+    let mut fresh = true;
+    for el in path.elements() {
+        let seg = match *el {
+            PathEl::MoveTo(p) => {
+                flush(&mut out, &mut run, accuracy, &mut fresh);
+                (start, at, last_tan, fresh) = (p, p, None, true);
+                run.move_to(p);
+                continue;
+            }
+            PathEl::ClosePath => {
+                flush(&mut out, &mut run, accuracy, &mut fresh);
+                if !fresh {
+                    out.close_path();
+                }
+                // A segment after a close starts a new subpath at the closed one's start.
+                (at, last_tan, fresh) = (start, None, true);
+                run.move_to(start);
+                continue;
+            }
+            PathEl::LineTo(p) => PathSeg::Line(kurbo::Line::new(at, p)),
+            PathEl::QuadTo(p1, p2) => PathSeg::Quad(kurbo::QuadBez::new(at, p1, p2)),
+            PathEl::CurveTo(p1, p2, p3) => PathSeg::Cubic(kurbo::CubicBez::new(at, p1, p2, p3)),
+        };
+        if run.elements().is_empty() {
+            run.move_to(at);
+        }
+        let Some((t0, t1)) = tangents(seg) else { continue };
+        if last_tan.is_some_and(|last| last.dot(t0) < 0.0) {
+            flush(&mut out, &mut run, accuracy, &mut fresh);
+            run.move_to(at);
+        }
+        run.push(*el);
+        at = seg.end();
+        last_tan = Some(t1);
+    }
+    flush(&mut out, &mut run, accuracy, &mut fresh);
+    out
+}
+
+/// Simplify `run` (one move and the segments after it) with kurbo and append it to `out`; the
+/// run's move is kept only when it starts a subpath (`fresh`), else the run carries on from the
+/// last point drawn. `run` is left empty.
+fn flush(out: &mut BezPath, run: &mut BezPath, accuracy: f64, fresh: &mut bool) {
+    if run.elements().len() > 1 {
+        let fitted = kurbo::simplify::simplify_bezpath(run.iter(), accuracy, &Default::default());
+        let fitted = if keeps_to(&fitted, run, STRAY * accuracy) { fitted } else { std::mem::take(run) };
+        for el in fitted.elements() {
+            match el {
+                PathEl::MoveTo(_) if !*fresh => {}
+                _ => {
+                    out.push(*el);
+                    *fresh = false;
+                }
+            }
+        }
+    }
+    *run = BezPath::new();
+}
+
+/// Whether every point of `fitted` lies within `tol` of `source`: one subpath each, from the same
+/// start to the same end, `fitted` being kurbo's simplification of `source`.
+///
+/// kurbo ends each fitted segment on the source, so the two are walked together: for each fitted
+/// segment, the source segments from where it starts to the first one its end lies on are the only
+/// ones its sample points are measured against. The work is linear in the two lengths. A fitted end
+/// found on no source segment counts as straying.
+fn keeps_to(fitted: &BezPath, source: &BezPath, tol: f64) -> bool {
+    /// Parts each fitted segment is cut into: the points between them are the ones measured.
+    const SAMPLES: u32 = 16;
+    let src: Vec<PathSeg> = source.segments().collect();
+    // kurbo puts each end on the source by evaluating it: off by rounding at most.
+    let on2 = (tol * 1e-3).powi(2);
+    let (tol2, mut cur) = (tol * tol, 0);
+    for seg in fitted.segments() {
+        let Some(last) = (cur..src.len()).find(|&i| src.get(i).is_some_and(|s| s.nearest(seg.end(), 1e-9).distance_sq <= on2)) else {
+            return false;
+        };
+        let near = src.get(cur..=last).unwrap_or_default();
+        for i in 1..SAMPLES {
+            let p = seg.eval(f64::from(i) / f64::from(SAMPLES));
+            if !near.iter().any(|s| s.nearest(p, 1e-6).distance_sq <= tol2) {
+                return false;
+            }
+        }
+        cur = last;
+    }
+    true
+}
+
+/// The directions `seg` leaves its start and reaches its end, skipping control points that sit on
+/// an end; `None` for a segment of no length, which kurbo skips too.
+fn tangents(seg: PathSeg) -> Option<(Vec2, Vec2)> {
+    let pts: Vec<Point> = match seg {
+        PathSeg::Line(l) => vec![l.p0, l.p1],
+        PathSeg::Quad(q) => vec![q.p0, q.p1, q.p2],
+        PathSeg::Cubic(c) => vec![c.p0, c.p1, c.p2, c.p3],
+    };
+    let (first, last) = (*pts.first()?, *pts.last()?);
+    let t0 = pts.iter().map(|p| *p - first).find(|d| d.hypot2() > 0.0)?;
+    let t1 = pts.iter().rev().map(|p| last - *p).find(|d| d.hypot2() > 0.0)?;
+    Some((t0, t1))
+}

crates/geom/src/tests.rs

@@ -366,3 +366,277 @@ fn svg_path_refuses_numbers_past_the_limit_before_parsing() {
     assert!(number_past("M0 0L-2.5.5 1e-3-4e3z", 1e3));
     assert!(number_past("M.5.5e10", 1e3));
 }
+
+/// A path through `pts` with straight lines (pencil samples).
+fn polyline(pts: &[(f64, f64)]) -> BezPath {
+    let mut p = BezPath::new();
+    for (k, (x, y)) in pts.iter().enumerate() {
+        if k == 0 { p.move_to((*x, *y)) } else { p.line_to((*x, *y)) }
+    }
+    p
+}
+
+/// How far `out` strays from `input`: the largest distance from a point sampled along `out` to the
+/// nearest segment of `input` (closing segments included).
+fn deviation(out: &BezPath, input: &BezPath) -> f64 {
+    use kurbo::{ParamCurve, ParamCurveNearest};
+    let segs: Vec<kurbo::PathSeg> = input.segments().collect();
+    out.segments()
+        .flat_map(|seg| (0..=32).map(move |i| seg.eval(f64::from(i) / 32.0)))
+        .map(|p| segs.iter().map(|s| s.nearest(p, 1e-6).distance_sq).fold(f64::INFINITY, f64::min).sqrt())
+        .fold(0.0, f64::max)
+}
+
+/// Pencil strokes kurbo's fit shot far past keep to their samples (#1741): a stroke that goes out
+/// and back to the very point it left, nearly collinear samples, and strokes that turn back along
+/// their own line. The first two are from fuzzing pencil-like strokes, where kurbo's curve went
+/// about 390 and 160 units off; at whole-pixel coordinates the same shapes happened to fit well.
+#[test]
+fn simplifying_keeps_to_strokes_kurbo_shot_past() {
+    let cases: [(&str, &[(f64, f64)]); 5] = [
+        (
+            "out and back to the same point",
+            &[
+                (86.043_565_719_086_97, -173.744_402_349_100_94),
+                (87.851_850_739_335_35, -179.202_846_445_954_52),
+                (86.043_565_719_086_97, -173.744_402_349_100_94),
+            ],
+        ),
+        (
+            "nearly collinear",
+            &[
+                (209.598_690_794_015_5, -204.909_328_119_739_88),
+                (211.277_914_263_870_97, -207.190_974_020_753_4),
+                (214.246_506_828_720_84, -211.228_827_590_623_24),
+            ],
+        ),
+        (
+            "a dip straight down and back up",
+            &[(0.0, 0.0), (10.0, 0.0), (20.0, 2.0), (30.0, 6.0), (30.0, 12.0), (30.0, 6.0), (40.0, 2.0), (50.0, 0.0)],
+        ),
+        ("a slip back at the end", &[(0.0, 0.0), (10.0, 3.0), (20.0, 8.0), (30.0, 15.0), (30.0, 25.0), (30.0, 22.0)]),
+        (
+            "a near reversal in a curve",
+            &[(0.0, 0.0), (8.0, 2.0), (16.0, 6.0), (24.0, 12.0), (32.0, 20.0), (24.0, 12.000_01), (16.0, 6.0), (8.0, 2.0)],
+        ),
+    ];
+    for (what, pts) in cases {
+        keeps_to_one_stroke(what, &polyline(pts));
+    }
+}
+
+/// Accuracies the simplification is checked at: fine, the Pencil's, and coarse.
+const ACCURACIES: [f64; 3] = [0.1, 0.75, 8.0];
+
+/// Check that `input` (one open subpath), simplified at each of [`ACCURACIES`], strays no more
+/// than twice the accuracy from it and leaves no part of it further off than that, stays in its
+/// box grown by as much, and is still one subpath from its start to its end.
+fn keeps_to_one_stroke(what: &str, input: &BezPath) {
+    for accuracy in ACCURACIES {
+        let out = simplify_path(input, accuracy);
+        let (svg, limit) = (out.to_svg(), 2.0 * accuracy);
+        let d = deviation(&out, input);
+        assert!(d <= limit, "{what} at {accuracy}: strays {d} from the input: {svg}");
+        let left = deviation(input, &out);
+        assert!(left <= limit, "{what} at {accuracy}: leaves the input {left} off: {svg}");
+        let (inb, outb) = (input.bounding_box(), out.bounding_box());
+        assert!(inb.inflate(limit, limit).contains_rect(outb), "{what} at {accuracy}: {outb:?} past {inb:?}");
+        let moves = out.elements().iter().filter(|e| matches!(e, kurbo::PathEl::MoveTo(_))).count();
+        assert_eq!(moves, 1, "{what} at {accuracy}: {svg}");
+        // From its start to its end: kurbo evaluates a fitted end on the input, so it is off by
+        // rounding at most.
+        let ends = |p: &BezPath| p.segments().next().map(|s| s.start()).zip(p.segments().last().map(|s| s.end()));
+        let ((start, end), (start_in, end_in)) = (ends(&out).unwrap(), ends(input).unwrap());
+        assert!((start - start_in).hypot() < 1e-9 && (end - end_in).hypot() < 1e-9, "{what} at {accuracy}: {svg}");
+    }
+}
+
+/// Strokes made of curves keep to them as polylines do (#1741): a quadratic or a cubic that goes
+/// out and comes straight back, one whose control points sit on its ends (so its direction is
+/// read from the control point after them), and nearly collinear curves.
+#[test]
+fn simplifying_keeps_to_curves_that_turn_back_or_run_straight() {
+    let (p, q, r) = (
+        (209.598_690_794_015_5, -204.909_328_119_739_88),
+        (211.277_914_263_870_97, -207.190_974_020_753_4),
+        (214.246_506_828_720_84, -211.228_827_590_623_24),
+    );
+    // The nearly collinear samples, each line as a cubic with its handles a third of the way along.
+    let third = |a: (f64, f64), b: (f64, f64), t: f64| (a.0 + (b.0 - a.0) * t, a.1 + (b.1 - a.1) * t);
+    let mut straight_cubics = BezPath::new();
+    straight_cubics.move_to(p);
+    for (a, b) in [(p, q), (q, r)] {
+        straight_cubics.curve_to(third(a, b, 1.0 / 3.0), third(a, b, 2.0 / 3.0), b);
+    }
+    let mut straight_quads = BezPath::new();
+    straight_quads.move_to(p);
+    straight_quads.quad_to(third(p, q, 0.5), q);
+    straight_quads.quad_to(third(q, r, 0.5), r);
+    let cases = [
+        ("a quadratic out and back", BezPath::from_svg("M0 0 Q15 10 30 0 Q15 10 0 0 Q-15 10 -30 0").unwrap()),
+        ("a cubic out and back", BezPath::from_svg("M0 0 C10 8 20 8 30 0 C20 8 10 8 0 0 C-10 8 -20 8 -30 0").unwrap()),
+        ("handles on the ends", BezPath::from_svg("M0 0 C0 0 30 4 30 4 C30 4 0 0 0 0 L-30 -4").unwrap()),
+        ("a cubic dip down and back up", BezPath::from_svg("M0 0 L10 0 C15 0 20 5 20 12 C20 5 25 0 30 0 L40 0").unwrap()),
+        ("nearly collinear cubics", straight_cubics),
+        ("nearly collinear quadratics", straight_quads),
+    ];
+    for (what, input) in cases {
+        keeps_to_one_stroke(what, &input);
+    }
+}
+
+/// `sides` simplified by kurbo one at a time and joined into one subpath.
+fn fitted_apart(sides: &[&BezPath], accuracy: f64) -> BezPath {
+    let mut out = BezPath::new();
+    for side in sides {
+        let fit = kurbo::simplify::simplify_bezpath(side.iter(), accuracy, &Default::default());
+        let skip = usize::from(!out.elements().is_empty());
+        out.extend(fit.elements().iter().copied().skip(skip));
+    }
+    out
+}
+
+/// `curve` cut into `n` cubics, drawn on from where `path` is: forwards, or back from its end.
+fn in_pieces(path: &mut BezPath, curve: kurbo::CubicBez, n: u32, back: bool) {
+    use kurbo::ParamCurve;
+    for i in 0..n {
+        let i = if back { n - 1 - i } else { i };
+        let c = curve.subsegment(f64::from(i) / f64::from(n)..f64::from(i + 1) / f64::from(n));
+        if back { path.curve_to(c.p2, c.p1, c.p0) } else { path.curve_to(c.p1, c.p2, c.p3) }
+    }
+}
+
+/// Where a path turns straight back it is cut, so the result is kurbo's fit of each side on its
+/// own, with a point of the path at the turn. Fitted as one, kurbo rounds the turn off: its curve
+/// passes the stray check, but falls short of the turn or takes more segments. A cubic whose
+/// control points sit on its ends turns back as a line does.
+#[test]
+fn simplifying_fits_each_side_of_a_turn_back_on_its_own() {
+    use kurbo::ParamCurve;
+    let svg = |d: &str| BezPath::from_svg(d).unwrap();
+    let s = kurbo::CubicBez::new((0.0, 0.0), (40.0, -60.0), (80.0, 60.0), (120.0, 0.0));
+    let (mut s_out, mut s_back) = (BezPath::new(), BezPath::new());
+    s_out.move_to(s.p0);
+    in_pieces(&mut s_out, s, 8, false);
+    s_back.move_to(s.p3);
+    in_pieces(&mut s_back, s, 8, true);
+    let cases = [
+        ("lines", svg("M0 0 L10 0 L20 0 L30 0"), svg("M30 0 L20 0 L10 0")),
+        ("handles on the ends", svg("M0 0 L10 0 L20 0 C20 0 30 0 30 0"), svg("M30 0 C30 0 20 0 20 0 L10 0")),
+        ("a curve in pieces", s_out, s_back),
+    ];
+    for (what, out_side, back_side) in cases {
+        let turn = out_side.segments().last().map(|seg| seg.end()).unwrap();
+        let mut input = out_side.clone();
+        input.extend(back_side.elements().iter().copied().skip(1));
+        for accuracy in ACCURACIES {
+            let ours = simplify_path(&input, accuracy);
+            let apart = fitted_apart(&[&out_side, &back_side], accuracy);
+            assert_eq!(ours.elements(), apart.elements(), "{what} at {accuracy}");
+            assert!(ours.segments().any(|seg| (seg.end() - turn).hypot() < 1e-9), "{what} at {accuracy}: {}", ours.to_svg());
+        }
+    }
+}
+
+/// Where a path never turns back and kurbo's fit holds, the result is kurbo's own, element for
+/// element: smooth runs, corners sharper than a right angle, closed subpaths and several subpaths.
+/// A fit counts as holding up to twice the accuracy asked for, whatever that is: the large wave's
+/// is further off at the coarse accuracy than the Pencil's limit of 1.5.
+#[test]
+fn simplifying_is_kurbos_where_its_fit_holds() {
+    let wave: Vec<(f64, f64)> = (0..=60).map(|i| (f64::from(i) * 4.0, (f64::from(i) / 6.0).sin() * 30.0)).collect();
+    let zigzag: Vec<(f64, f64)> = (0..=8).map(|i| (f64::from(i) * 10.0, if i % 2 == 0 { 0.0 } else { 40.0 })).collect();
+    let mut closed = polyline(&wave[..20]);
+    closed.close_path();
+    let mut several = polyline(&wave);
+    several.extend(polyline(&zigzag).elements().iter().map(|e| match *e {
+        kurbo::PathEl::MoveTo(p) => kurbo::PathEl::MoveTo(p + Vec2::new(0.0, 100.0)),
+        kurbo::PathEl::LineTo(p) => kurbo::PathEl::LineTo(p + Vec2::new(0.0, 100.0)),
+        e => e,
+    }));
+    let curves = BezPath::from_svg("M0 0 C10 -20 30 -20 40 0 C50 20 70 20 80 0 Q100 -30 120 0 L140 10 Z M200 0 L240 0").unwrap();
+    // A sine 300 high in 40 smooth cubics.
+    let sine = |x: f64| ((x / 120.0).sin() * 300.0, (x / 120.0).cos() * 2.5);
+    let mut large = BezPath::new();
+    large.move_to((0.0, 0.0));
+    for i in 0..40 {
+        let (x0, x1) = (f64::from(i) * 40.0, f64::from(i + 1) * 40.0);
+        let ((y0, d0), (y1, d1)) = (sine(x0), sine(x1));
+        large.curve_to((x0 + 40.0 / 3.0, y0 + d0 * 40.0 / 3.0), (x1 - 40.0 / 3.0, y1 - d1 * 40.0 / 3.0), (x1, y1));
+    }
+    let coarse = simplify_path(&large, 8.0);
+    assert!(coarse.elements().len() < 10 && (1.5..=8.0).contains(&deviation(&coarse, &large)), "{}", deviation(&coarse, &large));
+    for (what, input) in [
+        ("a wave", polyline(&wave)),
+        ("a zigzag", polyline(&zigzag)),
+        ("closed", closed),
+        ("two subpaths", several),
+        ("curves", curves),
+        ("a large wave", large),
+    ] {
+        for accuracy in ACCURACIES {
+            let ours = simplify_path(&input, accuracy);
+            let theirs = kurbo::simplify::simplify_bezpath(input.iter(), accuracy, &Default::default());
+            assert_eq!(ours.elements(), theirs.elements(), "{what} at {accuracy}");
+        }
+    }
+}
+
+/// A closed path with a reversal in it stays one closed subpath, and each subpath of several keeps
+/// its own start.
+#[test]
+fn simplifying_keeps_closes_and_subpaths_across_a_reversal() {
+    let mut input = polyline(&[(0.0, 0.0), (40.0, 0.0), (40.0, 30.0), (40.0, 20.0), (0.0, 30.0)]);
+    input.close_path();
+    input.extend(polyline(&[(100.0, 0.0), (100.0, 20.0), (100.0, 10.0)]).elements().iter().copied());
+    let out = simplify_path(&input, 0.75);
+    let els = out.elements();
+    let moves: Vec<Point> = els.iter().filter_map(|e| if let kurbo::PathEl::MoveTo(p) = e { Some(*p) } else { None }).collect();
+    assert_eq!(moves, [Point::new(0.0, 0.0), Point::new(100.0, 0.0)], "{}", out.to_svg());
+    assert_eq!(els.iter().filter(|e| matches!(e, kurbo::PathEl::ClosePath)).count(), 1, "{}", out.to_svg());
+    let close = els.iter().position(|e| matches!(e, kurbo::PathEl::ClosePath)).unwrap();
+    assert!(matches!(els[close + 1], kurbo::PathEl::MoveTo(_)), "the first subpath closes before the second starts");
+    assert!(deviation(&out, &input) <= 1.5, "{}", out.to_svg());
+    // Nothing to draw: nothing out, not a stray move or close.
+    let mut empty = BezPath::new();
+    empty.move_to((5.0, 5.0));
+    empty.line_to((5.0, 5.0));
+    empty.close_path();
+    assert!(simplify_path(&empty, 0.75).elements().is_empty());
+    for d in ["", "M5 5", "M5 5 M6 6", "M5 5 Z"] {
+        let input = if d.is_empty() { BezPath::new() } else { BezPath::from_svg(d).unwrap() };
+        assert!(simplify_path(&input, 0.75).elements().is_empty(), "{d:?}");
+    }
+}
+
+/// The subpaths simplified keep their starts: a move with nothing drawn from it between two
+/// subpaths leaves no trace, and a segment drawn on from a close starts a subpath where the closed
+/// one started, as it does in the path given.
+#[test]
+fn simplifying_keeps_where_each_subpath_starts() {
+    let starts =
+        |p: &BezPath| -> Vec<Point> { p.elements().iter().filter_map(|e| if let kurbo::PathEl::MoveTo(p) = e { Some(*p) } else { None }).collect() };
+    let between = BezPath::from_svg("M0 0 L10 0 L20 5 M50 50 M100 0 L110 0 L120 5").unwrap();
+    let out = simplify_path(&between, 0.75);
+    assert_eq!(starts(&out), [Point::new(0.0, 0.0), Point::new(100.0, 0.0)], "{}", out.to_svg());
+    assert!(deviation(&out, &between) <= 1.5, "{}", out.to_svg());
+    // After the close, the pen is back at (0, 0): the next segments start there, also across a
+    // reversal.
+    use kurbo::PathEl::{ClosePath, LineTo, MoveTo};
+    let on = BezPath::from_vec(vec![
+        MoveTo(Point::new(0.0, 0.0)),
+        LineTo(Point::new(10.0, 0.0)),
+        LineTo(Point::new(10.0, 10.0)),
+        ClosePath,
+        LineTo(Point::new(20.0, 20.0)),
+        LineTo(Point::new(30.0, 20.0)),
+        LineTo(Point::new(20.0, 20.0)),
+    ]);
+    let out = simplify_path(&on, 0.75);
+    let els = out.elements();
+    let close = els.iter().position(|e| matches!(e, kurbo::PathEl::ClosePath)).unwrap();
+    assert_eq!(els.get(close + 1), Some(&kurbo::PathEl::MoveTo(Point::new(0.0, 0.0))), "{}", out.to_svg());
+    assert_eq!(starts(&out), [Point::new(0.0, 0.0), Point::new(0.0, 0.0)], "{}", out.to_svg());
+    assert_eq!(out.segments().last().map(|s| kurbo::ParamCurve::end(&s)), Some(Point::new(20.0, 20.0)));
+    assert!(deviation(&out, &on) <= 1.5, "{}", out.to_svg());
+}

crates/layout/src/depth_tests.rs

@@ -93,3 +93,15 @@ fn deeply_nested_fill_frames_lay_out_without_running_out_of_stack() {
         assert_eq!(width(&d, chain[DEEP - 1]), 10.0, "past the nesting the layout follows, layers stay");
     });
 }
+
+#[test]
+fn snap_lines_are_bounded_across_a_frames_grids() {
+    use figcraft_doc::{Document, GridKind, LayoutGrid, NodeKind};
+    let mut d = Document::new("t");
+    let p = d.first_page().unwrap();
+    let f = d.create(p, NodeKind::Frame, "F", 0.0, 0.0, 4000.0, 4000.0).unwrap();
+    d.get_mut(f).unwrap().grids = vec![LayoutGrid { kind: GridKind::Grid, size: 1.0, visible: true, ..LayoutGrid::default() }; 1000];
+    let (xs, ys) = crate::grid_snap_lines(&d, f);
+    assert!(xs.len() + ys.len() <= 200_000, "{}", xs.len() + ys.len());
+    assert!(xs.len() > 4000 && ys.len() > 4000, "the first grids still give their lines");
+}

crates/layout/src/lib.rs

@@ -1159,6 +1159,9 @@ pub fn grid_snap_lines(doc: &Document, frame: NodeId) -> (Vec<f64>, Vec<f64>) {
     grid_snap_lines_in(doc, frame, doc.world_transform(frame))
 }
 
+/// The most snap coordinates a frame's grids give together (a few dozen grids' worth of lines).
+const MAX_SNAP_LINES: usize = 200_000;
+
 /// [`grid_snap_lines`] mapped from the frame's coordinates by `xf` (the frame's world transform
 /// for page lines).
 pub fn grid_snap_lines_in(doc: &Document, frame: NodeId, xf: Affine) -> (Vec<f64>, Vec<f64>) {
@@ -1166,7 +1169,13 @@ pub fn grid_snap_lines_in(doc: &Document, frame: NodeId, xf: Affine) -> (Vec<f64
     let mut xs = Vec::new();
     let mut ys = Vec::new();
     for g in f.grids.iter().filter(|g| g.visible) {
-        for r in grid_lines(g, f.width, f.height) {
+        // A frame-wide budget: each grid adds up to ~17,000 lines, and a file can hold any number of grids;
+        // a grid that would pass it is left out whole.
+        let lines = grid_lines(g, f.width, f.height);
+        if xs.len() + ys.len() + 2 * lines.len() > MAX_SNAP_LINES {
+            break;
+        }
+        for r in lines {
             let a = xf * Point::new(r.x0, r.y0);
             let b = xf * Point::new(r.x1, r.y1);
             match g.kind {

crates/svg/src/import.rs

@@ -704,13 +704,36 @@ fn simple_hash(b: &[u8]) -> String {
 /// Deepest element nesting the parser is given: deeper documents would exhaust the stack.
 const MAX_NESTING: usize = 512;
 
+/// The most attributes one element may have. The XML parser checks each attribute against the
+/// earlier ones, so a huge count is quadratic work; real elements have a few dozen at most.
+const MAX_ATTRIBUTES: usize = 4096;
+
 /// How deep elements nest in `data`: a scan of its tags (comments, CDATA, declarations and quoted
 /// attribute values skipped) that stops once past `limit`.
 pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
+    scan(data, limit).0
+}
+
+/// The most the parser's duplicate-attribute checks may cost over a whole document, as the sum of
+/// each element's attribute count squared (a real file with 100,000 elements of 20 attributes is
+/// 40 million).
+const MAX_ATTRIBUTE_WORK: usize = 1 << 28;
+
+/// Whether an element of `data` has more than [`MAX_ATTRIBUTES`] attributes, or all of them cost
+/// more than [`MAX_ATTRIBUTE_WORK`] (counted as quoted values, before the parser sees them; the
+/// declarations of a DTD count as one element, as entities can hold elements).
+pub(crate) fn too_wide(data: &[u8]) -> bool {
+    let (_, widest, work) = scan(data, usize::MAX);
+    widest > MAX_ATTRIBUTES || work > MAX_ATTRIBUTE_WORK
+}
+
+/// [`nesting`], the most attribute values on one element and the attribute work (see
+/// [`MAX_ATTRIBUTE_WORK`]); stops once any is past its limit.
+fn scan(data: &[u8], limit: usize) -> (usize, usize, usize) {
     let find = |from: usize, pat: &[u8]| -> usize {
         data.get(from..).and_then(|r| r.windows(pat.len()).position(|w| w == pat)).map_or(data.len(), |p| from + p + pat.len())
     };
-    let (mut depth, mut max, mut i) = (0usize, 0usize, 0usize);
+    let (mut depth, mut max, mut i, mut widest, mut work) = (0usize, 0usize, 0usize, 0usize, 0usize);
     while let Some(off) = data.get(i..).and_then(|r| r.iter().position(|b| *b == b'<')) {
         i += off;
         let rest = data.get(i..).unwrap_or(&[]);
@@ -718,6 +741,19 @@ pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
             i = find(i + 4, b"-->");
         } else if rest.starts_with(b"<![CDATA[") {
             i = find(i + 9, b"]]>");
+        } else if rest.starts_with(b"<!DOCTYPE") {
+            // To the `]>` closing its subset (the first `>` when it has none).
+            let end = match (rest.iter().position(|b| *b == b'['), rest.iter().position(|b| *b == b'>')) {
+                (Some(o), Some(g)) if o < g => find(i, b"]>"),
+                _ => find(i, b">"),
+            };
+            let quotes = data.get(i..end).unwrap_or(&[]).iter().filter(|b| matches!(**b, b'"' | b'\'')).count();
+            widest = widest.max(quotes / 2);
+            work = work.saturating_add((quotes / 2).saturating_mul(quotes / 2));
+            if widest > MAX_ATTRIBUTES || work > MAX_ATTRIBUTE_WORK {
+                return (max, widest, work);
+            }
+            i = end;
         } else if rest.starts_with(b"<?") || rest.starts_with(b"<!") {
             i = find(i + 2, b">");
         } else if rest.starts_with(b"</") {
@@ -725,12 +761,15 @@ pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
             i = find(i + 2, b">");
         } else {
             // A start tag: to its `>` outside quotes; `/>` closes it.
-            let (mut quote, mut j, mut closed) = (None, i + 1, false);
+            let (mut quote, mut j, mut closed, mut attrs) = (None, i + 1, false, 0usize);
             while let Some(&c) = data.get(j) {
                 match quote {
                     Some(q) if c == q => quote = None,
                     Some(_) => {}
-                    None if c == b'"' || c == b'\'' => quote = Some(c),
+                    None if c == b'"' || c == b'\'' => {
+                        quote = Some(c);
+                        attrs += 1;
+                    }
                     None if c == b'>' => {
                         closed = data.get(j.wrapping_sub(1)) == Some(&b'/');
                         break;
@@ -739,17 +778,22 @@ pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
                 }
                 j += 1;
             }
+            widest = widest.max(attrs);
+            work = work.saturating_add(attrs * attrs);
+            if widest > MAX_ATTRIBUTES || work > MAX_ATTRIBUTE_WORK {
+                return (max, widest, work);
+            }
             if !closed {
                 depth += 1;
                 max = max.max(depth);
                 if max > limit {
-                    return max;
+                    return (max, widest, work);
                 }
             }
             i = j + 1;
         }
     }
-    max
+    (max, widest, work)
 }
 
 /// Whether `data` nests elements more than [`MAX_NESTING`] deep: the byte scan first, then the
@@ -883,6 +927,9 @@ fn import_within(
 ) -> Result<Imported, ImportError> {
     // SVGZ is unpacked here, within a budget, so every check below sees the real document.
     let data = budget::document(data, &limits).map_err(ImportError)?;
+    if too_wide(&data) {
+        return Err(ImportError(format!("an element has more than {MAX_ATTRIBUTES} attributes")));
+    }
     if too_deep(&data) {
         return Err(ImportError(format!("elements nested more than {MAX_NESTING} deep")));
     }

crates/svg/src/import/budget.rs

@@ -87,7 +87,7 @@ fn embedded(used: &Used, limits: &Limits, data: &[u8], opts: &Options) -> Option
         }
     };
     used.bytes.fetch_add(plain.len(), Ordering::Relaxed);
-    if super::too_deep(&plain) {
+    if super::too_wide(&plain) || super::too_deep(&plain) {
         return None;
     }
     used.depth.fetch_add(1, Ordering::Relaxed);

crates/svg/src/import/hostile_tests.rs

@@ -181,3 +181,27 @@ fn entity_expansion_cannot_bypass_the_nesting_limit() {
     let err = import_svg(&mut d, data.as_bytes(), p, 0.0, 0.0, "x").err().map(|e| e.to_string()).unwrap_or_default();
     assert!(err.contains("nested more than 512 deep"), "{err:?}");
 }
+
+#[test]
+fn an_element_with_thousands_of_attributes_is_refused_before_parsing() {
+    use super::too_wide;
+    let many = |n: usize| (0..n).map(|i| format!(" a{i}=\"1\"")).collect::<String>();
+    assert!(!too_wide(format!("<svg{}/>", many(4096)).as_bytes()));
+    assert!(too_wide(format!("<svg><g{}/></svg>", many(4097)).as_bytes()));
+    assert!(!too_wide(format!("<svg>{}</svg>", "<g a='1' b='2'/>".repeat(10_000)).as_bytes()), "per element, not per file");
+    let mut d = Document::new("t");
+    let p = d.first_page().unwrap();
+    assert!(import_svg(&mut d, &svg(&format!("<g{}/>", many(100_000))), p, 0.0, 0.0, "x").is_err());
+}
+
+#[test]
+fn attribute_work_is_bounded_over_the_whole_document_and_its_dtd() {
+    use super::too_wide;
+    let many = |n: usize| (0..n).map(|i| format!(" a{i}=\"1\"")).collect::<String>();
+    let tag = format!("<g{}/>", many(4000));
+    assert!(!too_wide(format!("<svg>{}</svg>", tag.repeat(10)).as_bytes()));
+    assert!(too_wide(format!("<svg>{}</svg>", tag.repeat(40)).as_bytes()), "each element is within the limit, all together are not");
+    let dtd = format!("<!DOCTYPE svg [<!ENTITY e '<g{}/>'>]><svg>&e;</svg>", many(5000));
+    assert!(too_wide(dtd.as_bytes()), "entities can hold elements");
+    assert!(!too_wide(b"<?xml version='1.0'?><!DOCTYPE svg [<!ENTITY ns 'http://www.w3.org/2000/svg'>]><svg/>"));
+}

crates/svg/src/import/text.rs

@@ -195,7 +195,7 @@ pub(crate) fn text(cx: &mut Ctx, t: &usvg::Text, parent: NodeId, base: Affine, d
         let x = chunk.x().map_or(pen_x, f64::from) + d(t.dx());
         let y = chunk.y().map_or(pen_y, f64::from) + d(t.dy());
         char_at += count;
-        let ci = |b: usize| text.get(..b).map_or(count, |p| p.chars().count());
+        let ci = char_index(text, chunk.spans().iter().flat_map(|sp| [sp.start(), sp.end()]));
         let spans: Vec<_> = chunk.spans().iter().map(|sp| (ci(sp.start()), ci(sp.end()), sp, span_style(sp, s, fonts))).collect();
         if spans.is_empty() {
             continue;
@@ -229,6 +229,32 @@ pub(crate) fn text(cx: &mut Ctx, t: &usvg::Text, parent: NodeId, base: Affine, d
     }
 }
 
+/// The characters of `text` before each of the byte `offsets` (all of them for an offset that is
+/// past the end or inside a character): one pass over the text, whatever the number of spans.
+fn char_index(text: &str, offsets: impl IntoIterator<Item = usize>) -> impl Fn(usize) -> usize {
+    let mut want: Vec<usize> = offsets.into_iter().collect();
+    want.sort_unstable();
+    want.dedup();
+    let mut found: Vec<(usize, usize)> = Vec::with_capacity(want.len());
+    let mut wanted = want.into_iter().peekable();
+    let mut count = 0;
+    for (i, _) in text.char_indices() {
+        while let Some(&o) = wanted.peek() {
+            match o.cmp(&i) {
+                std::cmp::Ordering::Equal => found.push((o, count)),
+                std::cmp::Ordering::Greater => break,
+                std::cmp::Ordering::Less => {}
+            }
+            wanted.next();
+        }
+        count += 1;
+    }
+    if wanted.any(|o| o == text.len()) {
+        found.push((text.len(), count));
+    }
+    move |b| found.binary_search_by_key(&b, |f| f.0).ok().and_then(|k| found.get(k)).map_or(count, |f| f.1)
+}
+
 /// The text of `lines` (one per line, stacked at their pitch; `s`: their scale): characters, the
 /// first span's style and a run per span, fills still to come.
 fn text_data(lines: &[Line], s: f64) -> TextData {
@@ -262,8 +288,7 @@ fn on_path(cx: &mut Ctx, t: &usvg::Text, world: Affine, parent: NodeId) -> bool
     let Some(len) = figcraft_geom::measure::polylines(&path).and_then(|l| l.first().map(|l| l.length())).filter(|l| *l > 1e-9) else { return false };
     let fonts = cx.fonts.get_or_insert_with(Fonts::load);
     let text = chunk.text();
-    let count = text.chars().count();
-    let ci = |b: usize| text.get(..b).map_or(count, |p| p.chars().count());
+    let ci = char_index(text, chunk.spans().iter().flat_map(|sp| [sp.start(), sp.end()]));
     let spans: Vec<_> = chunk.spans().iter().map(|sp| (ci(sp.start()), ci(sp.end()), sp, span_style(sp, 1.0, fonts))).collect();
     let line = Line { x: 0.0, y: 0.0, anchor: chunk.anchor(), text: text.to_string(), spans };
     let mut td = text_data(std::slice::from_ref(&line), 1.0);

crates/svg/src/import/text_tests.rs

@@ -30,3 +30,11 @@ fn css_system_font_names_keep_their_name_where_the_system_font_is() {
     assert_eq!(family(&named(&["-apple-system", "BlinkMacSystemFont", "system-ui", "sans-serif"]), &elsewhere), "Inter");
     assert_eq!(family(&named(&["-apple-system"]), &elsewhere), "-apple-system", "nothing installed: the first name it gives");
 }
+
+#[test]
+fn char_index_counts_the_characters_before_a_byte_offset() {
+    let t = "aé😀b";
+    let ci = super::char_index(t, [0, 1, 3, 7, 8, 2, 4, 99]);
+    assert_eq!([ci(0), ci(1), ci(3), ci(7), ci(8)], [0, 1, 2, 3, 4]);
+    assert_eq!([ci(2), ci(4), ci(99)], [4, 4, 4], "inside a character or past the end: all of them");
+}

crates/text/src/fontdb.rs

@@ -92,6 +92,10 @@ pub struct Face {
     pub italic: bool,
     pub bytes: FontBytes,
     pub index: u32,
+    /// 0 for a built-in or installed face; else the order it was loaded in with `text.loadFont`
+    /// ([`FontDb::add_loaded`]). A loaded face wins over any other of its family and style, the
+    /// latest load over earlier ones (#2092).
+    pub loaded: u32,
     pub upem: f64,
     /// Ascent and descent in font units, both positive.
     pub ascent: f64,
@@ -207,6 +211,7 @@ impl Face {
             family,
             style,
             index,
+            loaded: 0,
             upem,
             ascent,
             descent,
@@ -620,6 +625,8 @@ pub struct FontDb {
     loaded_files: std::collections::BTreeSet<(std::path::PathBuf, u32)>,
     /// Font files added as bytes (hash and length → families), so loading one again adds nothing.
     loaded_bytes: std::collections::HashMap<(u64, usize), Vec<String>>,
+    /// Loads so far ([`Face::loaded`]).
+    load_seq: u32,
     system_scanned: bool,
     /// Browser fonts text asked for and not yet taken by the browser layer.
     wanted: Vec<usize>,
@@ -716,8 +723,20 @@ impl FontDb {
         face
     }
 
+    /// [`add`](Self::add) a face loaded explicitly (`text.loadFont`): it wins over the other faces
+    /// of its family and style, and over those loaded before it.
+    pub fn add_loaded(&mut self, mut face: Face) -> Arc<Face> {
+        self.load_seq += 1;
+        face.loaded = self.load_seq;
+        self.add(face)
+    }
+
     /// Add font file bytes (all faces of a collection). Returns the faces added.
     pub fn add_bytes(&mut self, bytes: Vec<u8>) -> Vec<Arc<Face>> {
+        self.add_bytes_with(bytes, false)
+    }
+
+    fn add_bytes_with(&mut self, bytes: Vec<u8>, loaded: bool) -> Vec<Arc<Face>> {
         let shared = Arc::new(bytes);
         let count = match FileRef::new(shared.as_slice()) {
             // A collection's header may name any number of faces, each a few bytes pointing at
@@ -727,7 +746,10 @@ impl FontDb {
             Ok(FileRef::Font(_)) => 1,
             Err(_) => 0,
         };
-        (0..count).filter_map(|i| Face::from_bytes(FontBytes::Shared(shared.clone()), i, None, None)).map(|f| self.add(f)).collect()
+        (0..count)
+            .filter_map(|i| Face::from_bytes(FontBytes::Shared(shared.clone()), i, None, None))
+            .map(|f| if loaded { self.add_loaded(f) } else { self.add(f) })
+            .collect()
     }
 
     /// The family and style of the face whose PostScript name is `ps` (ignoring case), loaded or
@@ -1035,7 +1057,9 @@ impl FontDb {
     /// The loaded face of `family` nearest `style`.
     fn best(&self, family: &str, style: &str) -> Option<Arc<Face>> {
         let (_, idx) = self.families.get(&self.key(family))?;
-        let faces: Vec<&Arc<Face>> = idx.iter().filter_map(|i| self.faces.get(*i)).collect();
+        let mut faces: Vec<&Arc<Face>> = idx.iter().filter_map(|i| self.faces.get(*i)).collect();
+        // A loaded font comes first (the latest load first): of faces as near, the first wins.
+        faces.sort_by_key(|f| std::cmp::Reverse(f.loaded));
         let want = norm_style(style);
         if let Some(f) = faces.iter().find(|f| norm_style(&f.style) == want).or_else(|| faces.iter().find(|f| has_style(f, style))) {
             return Some((*f).clone());
@@ -1595,7 +1619,7 @@ pub fn load_font_bytes(bytes: Vec<u8>) -> Vec<String> {
     if let Some(families) = db.loaded_bytes.get(&key) {
         return families.clone();
     }
-    let faces = db.add_bytes(bytes);
+    let faces = db.add_bytes_with(bytes, true);
     let mut families: Vec<String> = faces.iter().map(|f| f.family.clone()).collect();
     families.dedup();
     if !families.is_empty() {

crates/text/src/fontdb_tests.rs

@@ -382,6 +382,45 @@ fn font_bytes_load_into_the_db() {
     }
 }
 
+/// #2092: a font loaded with `text.loadFont` wins over the built-in and installed faces of its family
+/// and style, the latest load over earlier ones; other styles resolve as before.
+#[test]
+fn a_loaded_face_wins_over_the_built_in_one_of_its_family_and_style() {
+    // Any embedded or installed font stands in for the faces (none without craft-fonts on CI).
+    let stand_in = CRAFT_FONTS.first().map(|f| f.bytes.to_vec()).or_else(|| {
+        let mut installed = BTreeMap::new();
+        for dir in system_font_dirs() {
+            scan_dir(&dir, 0, &mut installed);
+        }
+        installed.values().flat_map(|(_, v)| v).find_map(|p| std::fs::read(&p.path).ok())
+    });
+    let Some(bytes) = stand_in.map(Arc::new) else {
+        eprintln!("skipping: no font to stand in");
+        return;
+    };
+    let face = |style: &str, name: &str| {
+        let mut f = Face::from_bytes(FontBytes::Shared(bytes.clone()), 0, Some("Brand Sans"), Some(style)).unwrap();
+        f.instances.clear();
+        f.postscript = Some(name.into());
+        f
+    };
+    let name = |db: &FontDb, style: &str| db.best("Brand Sans", style).and_then(|f| f.postscript.clone());
+    let mut db = FontDb::default();
+    db.add(face("Regular", "Built-in-Regular"));
+    db.add(face("Bold", "Built-in-Bold"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Built-in-Regular"));
+    db.add_loaded(face("Regular", "Loaded-Regular"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Loaded-Regular"));
+    // Bold wasn't loaded: the built-in one stays. Nor does the loaded Regular stand in for it.
+    assert_eq!(name(&db, "Bold").as_deref(), Some("Built-in-Bold"));
+    // The latest load wins.
+    db.add_loaded(face("Regular", "Loaded-Regular-2"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Loaded-Regular-2"));
+    // A face added after a load, not loaded, doesn't displace it.
+    db.add(face("Regular", "Installed-Regular"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Loaded-Regular-2"));
+}
+
 /// Apple's system font answers to the names designs and CSS use for it (SF Pro, SF UI Text,
 /// system-ui, …), unless a font of that name is installed.
 #[test]

crates/ui-egui/locales/ar.toml

@@ -2009,6 +2009,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "جمع كتنويعات"
 "component.create" = "إنشاء مكوّن"
 "component.createMultiple" = "إنشاء مكونات متعددة"
+"component.createSet" = "إنشاء مجموعة مكونات"
 "component.deleteProperty" = "حذف خاصية المكوّن"
 "component.detach" = "فصل النسخة المثيلة"
 "component.editProperty" = "تحرير خاصية المكوّن"

crates/ui-egui/locales/bs.toml

@@ -2038,6 +2038,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Kombinuj kao varijante"
 "component.create" = "Kreiraj komponentu"
 "component.createMultiple" = "Kreiraj više komponenti"
+"component.createSet" = "Kreiraj skup komponenti"
 "component.deleteProperty" = "Izbriši svojstvo komponente"
 "component.detach" = "Odvoji instancu"
 "component.editProperty" = "Uredi svojstvo komponente"

crates/ui-egui/locales/cs.toml

@@ -1913,6 +1913,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Sloučit jako varianty"
 "component.create" = "Vytvořit komponentu"
 "component.createMultiple" = "Vytvořit více komponent"
+"component.createSet" = "Vytvořit sadu komponent"
 "component.deleteProperty" = "Smazat vlastnost komponenty"
 "component.detach" = "Odpojit instanci"
 "component.editProperty" = "Upravit vlastnost komponenty"

crates/ui-egui/locales/de.toml

@@ -2079,6 +2079,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Als Varianten kombinieren"
 "component.create" = "Komponente erstellen"
 "component.createMultiple" = "Mehrere Komponenten erstellen"
+"component.createSet" = "Komponentensatz erstellen"
 "component.deleteProperty" = "Komponenteneigenschaft löschen"
 "component.detach" = "Instanz lösen"
 "component.editProperty" = "Komponenteneigenschaft bearbeiten"

crates/ui-egui/locales/es.toml

@@ -2002,6 +2002,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combinar como variantes"
 "component.create" = "Crear componente"
 "component.createMultiple" = "Crear varios componentes"
+"component.createSet" = "Crear conjunto de componentes"
 "component.deleteProperty" = "Eliminar propiedad de componente"
 "component.detach" = "Separar instancia"
 "component.editProperty" = "Editar propiedad de componente"

crates/ui-egui/locales/fi.toml

@@ -126,6 +126,7 @@ status = "draft — needs native review"
 "Another server, or one that needs its key. The usual server is set in Preferences." = "Toinen palvelin tai avainta tarvitseva palvelin. Tavallinen palvelin asetetaan asetuksissa."
 "Any status" = "Kaikki tilat"
 "Anyone on your network with this code can edit the file, while this app stays open." = "Kuka tahansa lähiverkossasi voi muokata tiedostoa tällä koodilla niin kauan kuin sovellus on auki."
+"Anyone on your network with this code can look at the file, not change it, while this app stays open." = "Kuka tahansa verkossasi oleva voi tällä koodilla katsoa tiedostoa muttei muuttaa sitä, niin kauan kuin tämä sovellus on auki."
 "Anyone with the edit link can change the file; the view link only lets people look. The links carry their secrets: share them like passwords. `figcraft-server links` makes more and revokes them." = "Kuka tahansa muokkauslinkin saanut voi muuttaa tiedostoa. Katselulinkillä voi vain katsella. Linkit sisältävät salaiset tunnisteet: jaa niitä kuin salasanoja. `figcraft-server links` luo lisää linkkejä ja peruu niitä."
 "Anyone with this code can edit the file." = "Kuka tahansa tämän koodin saanut voi muokata tiedostoa."
 "Anyone with this code can look at the file, not change it." = "Kuka tahansa tämän koodin saanut voi katsella tiedostoa, mutta ei muuttaa sitä."
@@ -160,6 +161,7 @@ status = "draft — needs native review"
 "Auto layout" = "Automaattinen asettelu"
 "Auto rows" = "Automaattiset rivit"
 "Auto width" = "Automaattinen leveys"
+"Auto: by the first letter with a direction" = "Automaattinen: ensimmäisen suunnallisen kirjaimen mukaan"
 "Back" = "Takaisin"
 "Back to Ready for dev" = "Palauta kehitysvalmiiksi"
 "Back to Ready for dev: the next change compares with how it is now" = "Palauta kehitysvalmiiksi: seuraavaa muutosta verrataan nykyiseen tilaan"
@@ -224,6 +226,7 @@ status = "draft — needs native review"
 "Changed {date}" = "Muutettu {date}"
 "CMYK colour" = "CMYK-väri"
 "CSS custom properties…" = "CSS:n mukautetut ominaisuudet…"
+"Ctrl+click a padding field" = "Ctrl+napsauta sisämarginaalikenttää"
 "Dart constants for Flutter…" = "Dart-vakiot Flutterille…"
 "Calculated from other variables; it follows them" = "Lasketaan muista muuttujista ja seuraa niitä"
 "Can edit" = "Voi muokata"
@@ -419,6 +422,7 @@ status = "draft — needs native review"
 "Delete the style (layers keep their values)" = "Poista tyyli (tasojen arvot säilyvät)"
 "Delete thread" = "Poista keskustelu"
 "Delete variable" = "Poista muuttuja"
+"Delete {n} variables" = { one = "Poista {n} muuttuja", other = "Poista {n} muuttujaa" }
 "Delete “{name}”? This can't be undone." = "Poistetaanko ”{name}”? Tätä ei voi kumota."
 "Density" = "Tiheys"
 "Depth" = "Syvyys"
@@ -450,6 +454,9 @@ status = "draft — needs native review"
 "Dimensions" = "Mitat"
 "Direction" = "Suunta"
 "Disconnect from code" = "Katkaise yhteys koodiin"
+"Disconnected. Reconnecting…" = "Yhteys katkesi. Yhdistetään uudelleen…"
+"Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…" = "Yhteys katkesi. Muokkauksesi säilyvät täällä ja synkronoituvat, kun yhteys palaa. Yhdistetään uudelleen…"
+"Dismiss" = "Ohita"
 "Dispersion" = "Hajonta"
 "Display name" = "Näyttönimi"
 "Dissolve" = "Häivytys"
@@ -489,6 +496,7 @@ status = "draft — needs native review"
 "Edit dev resource" = "Muokkaa kehittäjäresurssia"
 "Edit link" = "Muokkaa linkkiä"
 "Edit link copied" = "Muokkauslinkki kopioitu"
+"Edit padding on all sides" = "Muokkaa sisämarginaalia kaikilta sivuilta"
 "Edit style" = "Muokkaa tyyliä"
 "Edit variable" = "Muokkaa muuttujaa"
 "Edit with the builder" = "Muokkaa rakentimella"
@@ -509,6 +517,7 @@ status = "draft — needs native review"
 "End vote" = "Lopeta äänestys"
 "Ends the session; everyone keeps their copy" = "Lopettaa istunnon. Kaikki säilyttävät oman kopionsa."
 "Enter" = "Enter"
+"Enter / Shift+Enter" = "Enter / Shift+Enter"
 "Enter the address of a figcraft-server and press Browse to see the plugins it offers." = "Anna figcraft-server-palvelimen osoite ja näytä sen tarjoamat liitännäiset painamalla Selaa."
 "Enter to save · Esc to cancel" = "Tallenna Enterillä · peruuta Escillä"
 "Eraser" = "Pyyhekumi"
@@ -784,6 +793,7 @@ status = "draft — needs native review"
 "Left padding" = "Vasen sisämarginaali"
 "Left side" = "Vasen puoli"
 "Left side width" = "Vasemman puolen leveys"
+"Left to right" = "Vasemmalta oikealle"
 "Letter case" = "Kirjainkoko"
 "Letter spacing" = "Merkkiväli"
 "Libraries" = "Kirjastot"
@@ -829,13 +839,36 @@ status = "draft — needs native review"
 "Main menu" = "Päävalikko"
 "Make a component" = "Luo komponentti"
 "Make slot" = "Luo sisältöpaikka"
+"Move out of any group" = "Siirrä pois kaikista ryhmistä"
+"Move to group {group}" = "Siirrä ryhmään {group}"
+"Move up or down while dragging its label" = "Siirrä ylös tai alas vetämällä sen otsikkoa"
 "Nobody shares a file there now." = "Kukaan ei jaa siellä nyt tiedostoa."
 "New collection" = "Uusi kokoelma"
+"Not connected: {reason}. Your work is still in this tab." = "Ei yhteyttä: {reason}. Työsi on yhä tässä välilehdessä."
+"Nothing to pick: the page is empty" = "Ei mitään poimittavaa: sivu on tyhjä"
 "Pasted design layers" = "Liitetyt suunnittelutasot"
 "Pasted design layers; the clipboard didn't carry the images of: {layers}" = "Suunnittelutasot liitetty; leikepöydällä ei ollut näiden kuvia: {layers}"
+"Pick select: Tab and Shift+Tab move between layers, Enter goes into one, Shift+Enter out, Space selects, Escape cancels" = "Poimintavalinta: Tab ja Shift+Tab siirtävät tasojen välillä, Enter siirtyy tason sisään, Shift+Enter ulos, välilyönti valitsee, Escape peruuttaa"
+"Pick select: into a layer, out to its parent" = "Poimintavalinta: tason sisään, ulos sen ylätasoon"
+"Pick select: next or previous layer" = "Poimintavalinta: seuraava tai edellinen taso"
+"Pick select: select the picked layer" = "Poimintavalinta: valitse poimittu taso"
 "Remove these results from the file" = "Poista nämä tulokset tiedostosta"
+"Retry now" = "Yritä nyt uudelleen"
+"Right to left" = "Oikealta vasemmalle"
+"Same as file ({profile})" = "Sama kuin tiedostossa ({profile})"
+"Save a copy…" = "Tallenna kopio…"
+"Scope: all supported properties" = "Käyttöalue: kaikki tuetut ominaisuudet"
+"Scope: hidden from pickers" = "Käyttöalue: piilotettu valitsimista"
+"Scope: only {scope}" = "Käyttöalue: vain {scope}"
 "Scroll wheel zoom" = "Zoomaus hiiren rullalla"
+"Scrub a field faster (2x) or slower (1/2, 1/4)" = "Säädä kenttää vetämällä nopeammin (2x) tai hitaammin (1/2, 1/4)"
+"Scrubbing at 1/2" = "Vetosäätö nopeudella 1/2"
+"Scrubbing at 1/4" = "Vetosäätö nopeudella 1/4"
+"Scrubbing at 1x" = "Vetosäätö nopeudella 1x"
+"Scrubbing at 2x" = "Vetosäätö nopeudella 2x"
+"Selection box: switch to pick select" = "Valintalaatikko: vaihda poimintavalintaan"
 "Shared by your team on {server}" = "Tiimisi jakama palvelimella {server}"
+"Show and move the placement crosshair (its tool chosen, nothing selected)" = "Näytä ja siirrä sijoitusristikkoa (sen työkalu valittuna, ei valintaa)"
 "Slot name" = "Sisältöpaikan nimi"
 "Mar" = "maalisk."
 "Margin" = "Marginaali"
@@ -977,7 +1010,10 @@ status = "draft — needs native review"
 "Check for updates…" = "Tarkista päivitykset…"
 "Not checked yet" = "Ei vielä tarkistettu"
 "Someone who left" = "Joku, joka lähti"
+"Space" = "Välilyönti"
+"Tab or Ctrl+Space again" = "Tab tai Ctrl+välilyönti uudelleen"
 "Take the results off the board; they stay in the file" = "Poista tulokset taululta; ne jäävät tiedostoon"
+"Text direction" = "Tekstin suunta"
 "This file uses team libraries on servers you haven't used here. They aren't contacted until you check them." = "Tämä tiedosto käyttää tiimikirjastoja palvelimilla, joita et ole käyttänyt täällä. Niihin ei oteta yhteyttä ennen kuin tarkistat ne."
 "Not shared" = "Ei jaettu"
 "Note {n}" = "Huomautus {n}"
@@ -1886,6 +1922,7 @@ status = "draft — needs native review"
 "{name} · published version {v}" = "{name} · julkaistu versio {v}"
 "{name} · version {v} on the server" = "{name} · versio {v} palvelimella"
 "{name} ×{n}" = "{name} ×{n}"
+"{name}, disconnected from its live session" = "{name}, irrotettu live-istunnostaan"
 "{name}, in a live session" = "{name}, reaaliaikaisessa istunnossa"
 "{name}, online, open only to you" = "{name}, verkossa, vain sinun käytössäsi"
 "{name}, {kind}, {w} by {h}, selected" = "{name}, {kind}, {w} × {h}, valittu"
@@ -1944,9 +1981,12 @@ status = "draft — needs native review"
 "← → ↑ ↓" = "← → ↑ ↓"
 "→, Space or N" = "→, Space or N"
 "↵" = "↵"
+"↵ / ⇧↵" = "↵ / ⇧↵"
 "⇥ / ⇧⇥" = "⇥ / ⇧⇥"
+"⇥ or ⌥ Space again" = "⇥ tai ⌥ välilyönti uudelleen"
 "⌘ arrows" = "⌘ arrows"
 "⌘ click" = "⌘ click"
+"⌘ click a padding field" = "⌘-napsauta sisämarginaalikenttää"
 "⌘ scroll" = "⌘ scroll"
 "⌥ drag" = "⌥ drag"
 "1 year" = "1 vuosi"
@@ -1968,7 +2008,7 @@ status = "draft — needs native review"
 "Hide UI" = "Piilota käyttöliittymä"
 "Past 30 days" = "Viimeiset 30 päivää"
 "Past 90 days" = "Viimeiset 90 päivää"
-"Past year" = "Viimeinen vuosi"
+"Past year" = "Viimeiset 12 kuukautta"
 "Nothing counted yet" = "Mitään ei ole vielä laskettu"
 "Rotate a degree (Shift: 15)" = "Kierrä asteen verran (Shift: 15)"
 "⌥⌘ ← ↑ → ↓" = "⌥⌘ ← ↑ → ↓"
@@ -2057,6 +2097,7 @@ status = "draft — needs native review"
 "collab.openFile" = "Avaa verkkotiedosto"
 "collab.peers" = "Tämän tiedoston käyttäjät"
 "collab.publish" = "Julkaise palvelimelle"
+"collab.reconnect" = "Yhdistä live-istuntoon uudelleen"
 "collab.recoverFile" = "Palauta verkkotiedosto"
 "collab.registerLinks" = "Avaa kutsulinkit FigCraftissa"
 "collab.removePerson" = "Poista istunnosta"
@@ -2086,6 +2127,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Yhdistä varianteiksi"
 "component.create" = "Luo komponentti"
 "component.createMultiple" = "Luo useita komponentteja"
+"component.createSet" = "Luo komponenttijoukko"
 "component.deleteProperty" = "Poista komponentin ominaisuus"
 "component.detach" = "Irrota ilmentymä"
 "component.editProperty" = "Muokkaa komponentin ominaisuutta"
@@ -2348,6 +2390,7 @@ status = "draft — needs native review"
 "selection.applyColorStyle" = "Käytä valinnan värityyliä"
 "selection.bindColorVariable" = "Käytä valinnan värimuuttujaa"
 "selection.colors" = "Valinnan värit"
+"selection.createColorStyle" = "Luo valinnan värityyli"
 "selection.detachColor" = "Irrota valinnan väri"
 "selection.selectColor" = "Valitse tämänväriset tasot"
 "selection.setPaint" = "Muuta valinnan väriä"
@@ -2392,6 +2435,10 @@ status = "draft — needs native review"
 "text.caseUpper" = "Isot kirjaimet"
 "text.create" = "Teksti"
 "text.decoration" = "Koristelu"
+"text.direction" = "Tekstin suunta"
+"text.directionAuto" = "Tekstin suunta: automaattinen"
+"text.directionLtr" = "Tekstin suunta: vasemmalta oikealle"
+"text.directionRtl" = "Tekstin suunta: oikealta vasemmalle"
 "text.edit.begin" = "Muokkaa tekstiä"
 "text.edit.caret" = "Aseta kohdistin"
 "text.edit.end" = "Lopeta tekstin muokkaus"
@@ -2437,6 +2484,7 @@ status = "draft — needs native review"
 "tool.arrow" = "Nuoli"
 "tool.comment" = "Kommentti"
 "tool.connector" = "Yhdistin"
+"tool.crosshair" = "Siirrä sijoitusristikkoa"
 "tool.ellipse" = "Ellipsi"
 "tool.eraser" = "Pyyhekumi"
 "tool.frame" = "Kehys"
@@ -2647,6 +2695,9 @@ status = "draft — needs native review"
 "text.alignJustify" = "Tasaa tekstin molemmat reunat"
 "text.alignLeft" = "Tasaa teksti vasemmalle"
 "text.alignRight" = "Tasaa teksti oikealle"
+"text.directionAuto" = "Automaattinen"
+"text.directionLtr" = "Vasemmalta oikealle"
+"text.directionRtl" = "Oikealta vasemmalle"
 "view.assets" = "Resurssit"
 "view.design" = "Suunnittelu"
 "view.layers" = "Tasot"

crates/ui-egui/locales/fr.toml

@@ -1958,6 +1958,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combiner en variantes"
 "component.create" = "Créer un composant"
 "component.createMultiple" = "Créer plusieurs composants"
+"component.createSet" = "Créer un ensemble de composants"
 "component.deleteProperty" = "Supprimer la propriété de composant"
 "component.detach" = "Détacher l’instance"
 "component.editProperty" = "Modifier la propriété de composant"

crates/ui-egui/locales/id.toml

@@ -1917,6 +1917,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Gabungkan sebagai variant"
 "component.create" = "Buat component"
 "component.createMultiple" = "Buat beberapa component"
+"component.createSet" = "Buat set component"
 "component.deleteProperty" = "Hapus properti component"
 "component.detach" = "Lepaskan instance"
 "component.editProperty" = "Edit properti component"

crates/ui-egui/locales/it.toml

@@ -1861,6 +1861,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combina come varianti"
 "component.create" = "Crea componente"
 "component.createMultiple" = "Crea più componenti"
+"component.createSet" = "Crea set di componenti"
 "component.deleteProperty" = "Elimina proprietà del componente"
 "component.detach" = "Scollega istanza"
 "component.editProperty" = "Modifica proprietà del componente"

crates/ui-egui/locales/ja.toml

@@ -1938,6 +1938,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "バリアントとして結合"
 "component.create" = "コンポーネントを作成"
 "component.createMultiple" = "複数のコンポーネントを作成"
+"component.createSet" = "コンポーネントセットを作成"
 "component.deleteProperty" = "コンポーネントプロパティを削除"
 "component.detach" = "インスタンスを切り離す"
 "component.editProperty" = "コンポーネントプロパティを編集"

crates/ui-egui/locales/ka.toml

@@ -2013,6 +2013,7 @@ status = "draft — reviewed by a native speaker, awaiting a maintainer's approv
 "component.combineVariants" = "ვარიანტებად გაერთიანება"
 "component.create" = "კომპონენტის შექმნა"
 "component.createMultiple" = "რამდენიმე კომპონენტის შექმნა"
+"component.createSet" = "კომპონენტების ნაკრების შექმნა"
 "component.deleteProperty" = "კომპონენტის თვისების წაშლა"
 "component.detach" = "ინსტანსის გამოყოფა"
 "component.editProperty" = "კომპონენტის თვისების რედაქტირება"

crates/ui-egui/locales/ko.toml

@@ -1978,6 +1978,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "배리언트로 결합"
 "component.create" = "컴포넌트 만들기"
 "component.createMultiple" = "여러 컴포넌트 만들기"
+"component.createSet" = "컴포넌트 세트 만들기"
 "component.deleteProperty" = "컴포넌트 속성 삭제"
 "component.detach" = "인스턴스 분리"
 "component.editProperty" = "컴포넌트 속성 편집"

crates/ui-egui/locales/nl.toml

@@ -1956,6 +1956,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combineren als varianten"
 "component.create" = "Component maken"
 "component.createMultiple" = "Meerdere componenten maken"
+"component.createSet" = "Componentenset maken"
 "component.deleteProperty" = "Componenteigenschap verwijderen"
 "component.detach" = "Instance loskoppelen"
 "component.editProperty" = "Componenteigenschap bewerken"

crates/ui-egui/locales/pl.toml

@@ -1970,6 +1970,7 @@ name = "Polski"
 "component.combineVariants" = "Połącz jako warianty"
 "component.create" = "Utwórz komponent"
 "component.createMultiple" = "Utwórz wiele komponentów"
+"component.createSet" = "Utwórz zestaw komponentów"
 "component.deleteProperty" = "Usuń właściwość komponentu"
 "component.detach" = "Odłącz instancję"
 "component.editProperty" = "Edytuj właściwość komponentu"

crates/ui-egui/locales/pt-BR.toml

@@ -1975,6 +1975,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combinar como variantes"
 "component.create" = "Criar componente"
 "component.createMultiple" = "Criar vários componentes"
+"component.createSet" = "Criar conjunto de componentes"
 "component.deleteProperty" = "Excluir propriedade de componente"
 "component.detach" = "Desvincular instância"
 "component.editProperty" = "Editar propriedade de componente"

crates/ui-egui/locales/ru.toml

@@ -1970,6 +1970,7 @@ name = "Русский"
 "component.combineVariants" = "Объединить в варианты"
 "component.create" = "Создать компонент"
 "component.createMultiple" = "Создать несколько компонентов"
+"component.createSet" = "Создать набор компонентов"
 "component.deleteProperty" = "Удалить свойство компонента"
 "component.detach" = "Отсоединить экземпляр"
 "component.editProperty" = "Изменить свойство компонента"

crates/ui-egui/locales/sv.toml

@@ -2077,6 +2077,7 @@ name = "Svenska"
 "component.combineVariants" = "Kombinera som varianter"
 "component.create" = "Skapa komponent"
 "component.createMultiple" = "Skapa flera komponenter"
+"component.createSet" = "Skapa komponentuppsättning"
 "component.deleteProperty" = "Radera komponentegenskap"
 "component.detach" = "Koppla bort instans"
 "component.editProperty" = "Redigera komponentegenskap"

crates/ui-egui/locales/th.toml

@@ -1934,6 +1934,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "รวมเป็นแวเรียนต์"
 "component.create" = "สร้างคอมโพเนนต์"
 "component.createMultiple" = "สร้างหลายคอมโพเนนต์"
+"component.createSet" = "สร้างชุดคอมโพเนนต์"
 "component.deleteProperty" = "ลบพร็อพเพอร์ตีของคอมโพเนนต์"
 "component.detach" = "ถอดอินสแตนซ์"
 "component.editProperty" = "แก้ไขพร็อพเพอร์ตีของคอมโพเนนต์"

crates/ui-egui/locales/tr.toml

@@ -1918,6 +1918,7 @@ name = "Türkçe"
 "component.combineVariants" = "Varyant olarak birleştir"
 "component.create" = "Bileşen oluştur"
 "component.createMultiple" = "Birden çok bileşen oluştur"
+"component.createSet" = "Bileşen kümesi oluştur"
 "component.deleteProperty" = "Bileşen özelliğini sil"
 "component.detach" = "Örneği ayır"
 "component.editProperty" = "Bileşen özelliğini düzenle"

crates/ui-egui/locales/vi.toml

@@ -1862,6 +1862,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Kết hợp thành các biến thể"
 "component.create" = "Tạo thành phần"
 "component.createMultiple" = "Tạo nhiều thành phần"
+"component.createSet" = "Tạo bộ thành phần"
 "component.deleteProperty" = "Xóa thuộc tính thành phần"
 "component.detach" = "Tách bản thể"
 "component.editProperty" = "Chỉnh sửa thuộc tính thành phần"

crates/ui-egui/locales/zh-Hans.toml

@@ -1871,6 +1871,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "合并为变体"
 "component.create" = "创建组件"
 "component.createMultiple" = "创建多个组件"
+"component.createSet" = "创建组件集"
 "component.deleteProperty" = "删除组件属性"
 "component.detach" = "分离实例"
 "component.editProperty" = "编辑组件属性"

crates/ui-egui/locales/zh-Hant.toml

@@ -2089,6 +2089,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "合併為變體"
 "component.create" = "建立元件"
 "component.createMultiple" = "建立多個元件"
+"component.createSet" = "建立元件集"
 "component.deleteProperty" = "刪除元件屬性"
 "component.detach" = "分離實例"
 "component.editProperty" = "編輯元件屬性"

crates/ui-egui/src/create_multiple_menu_tests.rs

@@ -0,0 +1,165 @@
+//! With two or more layers selected the Design panel's component button opens a menu (Create
+//! component, Create multiple components, Create component set); one layer keeps the plain click (#2088): drawn headless.
+
+use egui::accesskit::Node;
+use egui::{Event, PointerButton, Pos2, Rect, pos2};
+use figcraft_doc::{NodeId, NodeKind};
+use figcraft_engine::Session;
+use serde_json::json;
+
+use crate::layers_drag_tests::Ui;
+
+const NAMES: [&str; 3] = ["Card", "Badge", "Tile"];
+
+fn id(v: serde_json::Value) -> NodeId {
+    serde_json::from_value(v["id"].clone()).unwrap()
+}
+
+/// Frames named `NAMES[..n]`, all selected, headless.
+fn frames(n: usize) -> (Ui, Vec<NodeId>) {
+    let mut s = Session::new();
+    let mut ids = Vec::new();
+    for (i, name) in NAMES.into_iter().take(n).enumerate() {
+        let f = id(s.execute("frame.create", &json!({"x": 150 * i, "y": 0, "width": 100, "height": 60})).unwrap());
+        s.execute("object.rename", &json!({"ids": [f], "name": name})).unwrap();
+        ids.push(f);
+    }
+    s.execute("select.set", &json!({"ids": ids})).unwrap();
+    let mut u = Ui::new(s);
+    u.frame(vec![]);
+    (u, ids)
+}
+
+fn nodes(u: &mut Ui) -> Vec<Node> {
+    u.ctx.enable_accesskit();
+    u.frame(vec![]);
+    u.frame_output(vec![]).platform_output.accesskit_update.expect("an AccessKit update").nodes.into_iter().map(|(_, n)| n).collect()
+}
+
+fn bounds(n: &Node) -> Rect {
+    let b = n.bounds().unwrap();
+    Rect::from_min_max(pos2(b.x0 as f32, b.y0 as f32), pos2(b.x1 as f32, b.y1 as f32))
+}
+
+fn click(u: &mut Ui, at: Pos2) {
+    for pressed in [true, false] {
+        u.frame(vec![
+            Event::PointerMoved(at),
+            Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Default::default() },
+        ]);
+    }
+}
+
+fn settle(u: &mut Ui) {
+    for _ in 0..10 {
+        u.frame(vec![]);
+    }
+}
+
+/// The header's component button (its tooltip may carry the shortcut).
+fn click_button(u: &mut Ui) {
+    let all = nodes(u);
+    let button = all.iter().find(|n| n.label().is_some_and(|l| l.starts_with("Create component"))).expect("the Design panel's component button");
+    click(u, bounds(button).center());
+    settle(u);
+}
+
+fn undo_len(u: &Ui) -> usize {
+    u.app.session.ds().unwrap().history.undo.len()
+}
+
+#[test]
+fn several_layers_open_a_menu_and_create_multiple_components_in_one_undo_step() {
+    let (mut u, ids) = frames(3);
+    let before = undo_len(&u);
+    click_button(&mut u);
+    assert_eq!(undo_len(&u), before, "opening the menu changes nothing");
+    let all = nodes(&mut u);
+    // The menu's rows share an x with Create multiple components: exactly these two, in this order.
+    let multiple = all.iter().find(|n| n.label() == Some("Create multiple components")).expect("the menu's second entry");
+    let mb = bounds(multiple);
+    let mut rows: Vec<(f32, String)> = all
+        .iter()
+        .filter(|n| n.label().is_some() && (bounds(n).min.x - mb.min.x).abs() < 1.0 && (bounds(n).min.y - mb.min.y).abs() < 90.0)
+        .map(|n| (bounds(n).min.y, n.label().unwrap_or("").to_owned()))
+        .collect();
+    rows.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let labels: Vec<&str> = rows.iter().map(|(_, l)| l.as_str()).collect();
+    assert_eq!(labels, ["Create component", "Create multiple components", "Create component set"], "the menu's entries");
+    click(&mut u, bounds(multiple).center());
+    settle(&mut u);
+    let sel = u.app.session.selection();
+    assert_eq!(sel.len(), 3);
+    let doc = u.app.session.doc().unwrap();
+    let names: Vec<&str> = sel.iter().map(|i| doc.node(*i).unwrap().name.as_str()).collect();
+    assert_eq!(names, NAMES);
+    assert!(sel.iter().all(|i| matches!(doc.node(*i).unwrap().kind, NodeKind::Component { .. })));
+    assert_eq!(undo_len(&u), before + 1);
+    u.app.session.undo().unwrap();
+    let doc = u.app.session.doc().unwrap();
+    assert!(ids.iter().all(|i| matches!(doc.node(*i).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo reverts all three");
+}
+
+#[test]
+fn one_layer_keeps_the_plain_button() {
+    let (mut u, ids) = frames(1);
+    click_button(&mut u);
+    let all = nodes(&mut u);
+    assert!(all.iter().all(|n| n.label() != Some("Create multiple components")), "no menu opens");
+    let sel = u.app.session.selection();
+    assert_eq!(sel.len(), 1);
+    let doc = u.app.session.doc().unwrap();
+    assert!(matches!(doc.node(sel[0]).unwrap().kind, NodeKind::Component { .. }));
+    assert_eq!(doc.node(sel[0]).unwrap().name, NAMES[0]);
+    let _ = ids;
+}
+
+#[test]
+fn the_third_entry_creates_one_component_set() {
+    let (mut u, ids) = frames(3);
+    let before = undo_len(&u);
+    click_button(&mut u);
+    let all = nodes(&mut u);
+    let entry = all.iter().find(|n| n.label() == Some("Create component set")).expect("the menu's third entry");
+    click(&mut u, bounds(entry).center());
+    settle(&mut u);
+    let sel = u.app.session.selection();
+    assert_eq!(sel.len(), 1, "the set is selected");
+    let doc = u.app.session.doc().unwrap();
+    let set = doc.node(sel[0]).unwrap();
+    assert!(matches!(set.kind, NodeKind::ComponentSet { .. }));
+    assert_eq!(set.children.len(), 3);
+    assert_eq!(undo_len(&u), before + 1);
+    u.app.session.undo().unwrap();
+    let doc = u.app.session.doc().unwrap();
+    assert!(ids.iter().all(|i| matches!(doc.node(*i).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo reverts it all");
+}
+
+/// The component button's width in the Design panel: wider with a dropdown chevron beside the icon.
+fn button_width(u: &mut Ui) -> f32 {
+    let all = nodes(u);
+    let button = all.iter().find(|n| n.label().is_some_and(|l| l.starts_with("Create component"))).expect("the Design panel's component button");
+    bounds(button).width()
+}
+
+#[test]
+fn the_dropdown_chevron_is_there_only_for_several_layers() {
+    let (mut one, _) = frames(1);
+    let (mut two, _) = frames(2);
+    let (single, several) = (button_width(&mut one), button_width(&mut two));
+    assert_eq!(single, 24.0, "one layer: the plain icon button");
+    assert_eq!(several, 34.0, "several layers: room for the chevron");
+}
+
+#[test]
+fn create_component_set_is_offered_only_where_it_works() {
+    let (mut u, ids) = frames(3);
+    // Make the first a component: the set can't take it, so the entry is left out.
+    u.app.session.execute("component.create", &json!({"ids": [ids[0]]})).unwrap();
+    u.app.session.execute("select.set", &json!({"ids": ids})).unwrap();
+    u.frame(vec![]);
+    click_button(&mut u);
+    let all = nodes(&mut u);
+    assert!(all.iter().any(|n| n.label() == Some("Create multiple components")), "the menu is open");
+    assert!(all.iter().all(|n| n.label() != Some("Create component set")), "left out for a selection with a component");
+}

crates/ui-egui/src/lib.rs

@@ -88,6 +88,8 @@ mod context_menu_tests;
 #[cfg(test)]
 mod corner_individual_tests;
 #[cfg(test)]
+mod create_multiple_menu_tests;
+#[cfg(test)]
 mod crop_image_tests;
 #[cfg(test)]
 mod cursors_tests;

crates/ui-egui/src/menus.rs

@@ -197,13 +197,24 @@ pub fn invoke(app: &mut FigApp, id: &str) {
             let ids = app.session.selection();
             // For other apps: text layers' text, other layers as SVG; taken before a cut removes them.
             let doc = app.session.doc().ok();
-            let mirror = doc.and_then(|d| text_layers_text(d, &ids).or_else(|| figcraft_svg_export(d, &ids)));
-            app.run(id, json!({}));
+            // Points or segments selected in vector edit mode copy just those: the whole vector's
+            // SVG would misdescribe them.
+            let partial = app
+                .session
+                .ds()
+                .ok()
+                .and_then(|d| d.vector_edit.as_ref())
+                .is_some_and(|ve| ve.parts().iter().any(|p| !p.vertices.is_empty() || !p.segments.is_empty()));
+            let mirror = doc.filter(|_| !partial).and_then(|d| text_layers_text(d, &ids).or_else(|| figcraft_svg_export(d, &ids)));
+            let ran = app.run(id, json!({}));
+            // A partial copy put temporary layers on the engine clipboard; mirror their SVG.
+            let refused = partial && ran.is_none();
+            let mirror = if partial { ran.and_then(|_| figcraft_engine::cmd::edit::clipboard_svg(&app.session)) } else { mirror };
             // Mirror to the system clipboard (text or SVG, else a marker) and remember it, so a
             // later paste knows whether the clipboard still holds our layers. Control-channel
             // gestures keep the engine's copy but never replace the user's clipboard; `run` then
             // invalidates the old mirror because it no longer describes the engine clipboard.
-            if !app.control_synthetic {
+            if !app.control_synthetic && !refused {
                 let text = mirror.unwrap_or_else(|| format!("figcraft://clipboard/{}", ids.len()));
                 app.clipboard_set_text(&text);
                 app.ui.last_copy = Some(text);

crates/ui-egui/src/panels/right.rs

@@ -497,7 +497,10 @@ fn header(app: &mut FigApp, ui: &mut Ui, doc: &Document, sel: &[NodeId]) {
     // Layers in boolean groups, or one boolean group: the operation they use (checked in the menu).
     let current = figcraft_engine::booleans::shown_op(doc, sel);
     for (icon, label, cmd) in actions.into_iter().rev() {
-        let br = Rect::from_min_size(pos2(x - 24.0, r.center().y - 12.0), vec2(24.0, 24.0));
+        // With several layers the component button is a dropdown: a small chevron sits beside its icon.
+        let dropdown = cmd == "component.create" && sel.len() > 1;
+        let bw = if dropdown { 34.0 } else { 24.0 };
+        let br = Rect::from_min_size(pos2(x - bw, r.center().y - 12.0), vec2(bw, 24.0));
         let tip = if cmd == "bool.union" { label } else { crate::shortcuts::tip(label, cmd) };
         let bresp = ui.interact(br, ui.scope_id().with(("qa", cmd)), Sense::click()).tip(tip);
         if bresp.hovered() {
@@ -508,7 +511,11 @@ fn header(app: &mut FigApp, ui: &mut Ui, doc: &Document, sel: &[NodeId]) {
             ("bool.union", Some(op)) => crate::layers::op_icon(op),
             _ => icon,
         };
-        icons::paint(ui.painter(), br.shrink(5.0), icon, t.icon);
+        let icon_rect = Rect::from_min_size(br.min, vec2(24.0, 24.0)).shrink(5.0);
+        icons::paint(ui.painter(), icon_rect, icon, t.icon);
+        if dropdown {
+            icons::paint(ui.painter(), Rect::from_center_size(pos2(br.max.x - 6.0, br.center().y), vec2(8.0, 8.0)), Icon::Chevron, t.icon_secondary);
+        }
         if cmd == "bool.union" {
             menu_popup(&bresp).width(180.0).show(|ui| {
                 for (op, c) in [
@@ -533,10 +540,35 @@ fn header(app: &mut FigApp, ui: &mut Ui, doc: &Document, sel: &[NodeId]) {
                     ui.close();
                 }
             });
+        } else if cmd == "component.create" && sel.len() > 1 {
+            // Several layers: the button opens a menu, as Figma's does (#2088). One layer keeps the plain click.
+            let create = crate::i18n::command("component.create", "Create component");
+            let multiple = crate::i18n::command("component.createMultiple", "Create multiple components");
+            let set = crate::i18n::command("component.createSet", "Create component set");
+            // Like the layers menu, leave out what the selection can't use.
+            let can_set = figcraft_engine::cmd::component::can_create_set(doc, sel);
+            let mut entries = vec![("component.create", &create), ("component.createMultiple", &multiple)];
+            if can_set {
+                entries.push(("component.createSet", &set));
+            }
+            // Wide enough for the longest translated label (the rows grow with it, the menu never clips).
+            let widest = entries
+                .iter()
+                .map(|(_, l)| ui.painter().layout_no_wrap(l.to_string(), regular(11.5), Color32::PLACEHOLDER).size().x)
+                .fold(0.0f32, f32::max);
+            menu_popup(&bresp).width(menu::menu_row_width(widest, 0.0).ceil().max(160.0)).show(|ui| {
+                for (c, label) in &entries {
+                    let key = crate::shortcuts::shortcut(c).unwrap_or("");
+                    if menu_item(ui, label, key) {
+                        app.run(c, json!({}));
+                        ui.close();
+                    }
+                }
+            });
         } else if bresp.clicked() {
             app.run(cmd, json!({}));
         }
-        x -= 26.0;
+        x -= bw + 2.0;
     }
     crate::component_panel::instance_section(app, ui, doc, sel);
 }

crates/ui-egui/src/shortcuts.rs

@@ -178,7 +178,7 @@ pub(crate) fn handle_input(
                 let props = ctx.input(|i| i.modifiers.alt);
                 crate::menus::invoke(app, if props { "edit.copyProperties" } else { "edit.copy" });
             }
-            Event::Cut => cut(app),
+            Event::Cut => cut(app, ctx.input(|i| i.modifiers)),
             Event::Paste(text) if !paste.drop_text => crate::menus::paste(app, Some(text), None),
             Event::Key { key, physical_key, pressed: true, modifiers, repeat }
                 if key_event(app, *key, *physical_key, *modifiers, *repeat, now, ctx) =>
@@ -192,13 +192,18 @@ pub(crate) fn handle_input(
 
 /// Cut: usually the layers. Windows sends Shift+Delete (remove the points and heal the path)
 /// as a cut command and never as a key, so in vector edit mode the selection is points: they are
-/// removed, a heal joining the path through them.
-fn cut(app: &mut FigApp) {
+/// removed, a heal joining the path through them. Ctrl/Cmd+X is the real Cut: with points or
+/// segments selected the engine copies them and removes them, staying in edit mode (#1875).
+fn cut(app: &mut FigApp, modifiers: egui::Modifiers) {
     let Some(ve) = app.session.ds().ok().and_then(|d| d.vector_edit.clone()) else {
         crate::menus::invoke(app, "edit.cut");
         return;
     };
-    if ve.parts().iter().any(|p| !p.vertices.is_empty()) {
+    if modifiers.command {
+        if ve.parts().iter().any(|p| !p.vertices.is_empty() || !p.segments.is_empty()) {
+            crate::menus::invoke(app, "edit.cut");
+        }
+    } else if ve.parts().iter().any(|p| !p.vertices.is_empty()) {
         app.run("vector.deleteHeal", json!({}));
     } else if ve.parts().iter().any(|p| !p.segments.is_empty()) {
         app.run("vector.edit.delete", json!({}));

crates/ui-egui/src/vector_keys_tests.rs

@@ -49,6 +49,18 @@ fn a_cut_command_in_edit_mode_takes_the_selected_points_not_the_layer() {
     assert_eq!(net(&u, path).vertices.len(), 2, "it takes the selected point");
 }
 
+#[test]
+fn ctrl_x_on_selected_segments_puts_them_on_the_clipboard_and_keeps_the_layer() {
+    let mut u = Ui::new(Session::new());
+    let path = abc(&mut u);
+    u.app.session.execute("vector.edit.select", &json!({"segments": [0]})).unwrap();
+    u.frame_with(vec![Event::Cut], Modifiers::COMMAND);
+    assert!(u.app.session.doc().unwrap().node(path).is_some(), "Ctrl+X keeps the layer");
+    assert_eq!(net(&u, path).segments.len(), 1, "the segment is gone");
+    assert_eq!(u.app.session.clipboard.nodes.len(), 1, "and on the clipboard");
+    assert!(u.app.session.ds().unwrap().vector_edit.is_some(), "edit mode stays on");
+}
+
 #[test]
 fn a_cut_command_in_edit_mode_with_nothing_selected_keeps_the_layer() {
     let mut u = Ui::new(Session::new());

docs/boards-parity.md

@@ -1,6 +1,6 @@
 # Boards parity
 
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-10 · **Change:** minor (mind maps, first step: a first node with three children on curved branches, laid out again after every edit (`board.mindMap`, `board.mindMapAdd`, #2226); a `.jam` elbowed connector saved with its path keeps it on import instead of being routed again (#1910); a "+" handle dragged carries the preview: the next shape is made where it is let go, or a connector joins the object it is let go on (#1919); a connector attached to a side starts 4 pt outside the border, so its stroke never lies on the fill (#1916); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-10 · **Change:** minor (a sticky's text stays 18 and the note grows taller instead of the text shrinking, as measured in FigJam's web app (#2157); mind maps, first step: a first node with three children on curved branches, laid out again after every edit (`board.mindMap`, `board.mindMapAdd`, #2226); a `.jam` elbowed connector saved with its path keeps it on import instead of being routed again (#1910); a "+" handle dragged carries the preview: the next shape is made where it is let go, or a connector joins the object it is let go on (#1919); a connector attached to a side starts 4 pt outside the border, so its stroke never lies on the fill (#1916); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre)
 
 **Breadth ~47%, ready ~29% (estimated, erring low).** A board is a FigCraft file of its own kind
 (`file.newBoard`) with a dot grid on the page, sticky notes, shapes with text, connectors that
@@ -17,8 +17,8 @@ design product). The work item is gap 24 in [`gaps.md`](gaps.md).
 Board objects are ordinary layers with a small `board` field on the node (`figcraft_doc::BoardItem`),
 so rendering, hit testing, undo, saving, SVG/PNG/PDF export, copy and paste and live sessions work
 on them unchanged. The file kind (`Document.kind`) is saved in `.figcraft` and reaches people who
-join a live session in their snapshot. What follows from the metadata (a sticky's text size, a
-shape's text room, connector routes and their labels) is recomputed in the engine's normalize pass,
+join a live session in their snapshot. What follows from the metadata (a shape's text
+room, connector routes and their labels) is recomputed in the engine's normalize pass,
 deterministically from the document, so local edits, undo and edits from others in a live session
 all end with the same geometry.
 
@@ -30,7 +30,7 @@ all end with the same geometry.
 | Board toolbar at the bottom | done | Move/Hand, Marker/Highlighter/Eraser, Sticky (colour flyout), Shapes (flyout), Connector, Text, Section, Stamp (flyout), Comment, Actions, then the templates and the Design panel's buttons — on the same 32 pt grid as a design file's (no Resources button, as there) |
 | Design panel hidden by default; a contextual bar above the selection | done | colour, shape, text size (S/M/L/XL); for connectors straight/elbow/curved, the start and end points (none, round, square, line arrow, triangle arrow, reversed triangle, circle, diamond), solid or dashed, the weight, and any colour in the colour picker beside the board colours (#1596); each control says what it is on hover; the Design panel opens with its button or View ▸ Design panel |
 | Prototyping and Developer Mode refuse on boards | done | `proto.*`, `dev.*`, `view.prototype`, `view.devMode` say why |
-| Sticky notes | done | a square frame (200 wide, growing taller through auto layout), 8 soft colours, a soft shadow, the note's text size shrinking as it grows (24 → 11, by characters and lines), the author's name at the bottom; a click places one and starts typing; Enter or a double-click edits; Shift+Cmd/Ctrl+Enter adds the next one beside it |
+| Sticky notes | done | a square frame (200 wide, growing taller through auto layout), 8 soft colours, a soft shadow, the note's text 18 by default and fixed (FigJam's "Small"): the note grows taller as it fills and never shrinks its text, measured in FigJam's web app, 2026-11-09; stickies saved with another size keep it, and there is no size menu yet (#2157), the author's name at the bottom; a click places one and starts typing; Enter or a double-click edits; Shift+Cmd/Ctrl+Enter adds the next one beside it |
 | Sticky options: hide the author, change size presets, sticky stacks | partial | `board.sticky {author: false}`; no size presets or stacks |
 | Shapes with text | done | rectangle, rounded rectangle, ellipse, diamond, triangle, speech bubble, chevron; text centred and wrapping inside the outline; shape type and text size from the contextual bar |
 | Shape auto-fit to its text, more shapes (cylinder, cross, star…), shape libraries | missing | |
@@ -72,6 +72,7 @@ all end with the same geometry.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-09 | patch | M12, #2157: a sticky's text is 18 and stays 18 (measured in FigJam's web app: ten lines, then a long paragraph, never changed it; the note kept its width and grew taller). The normalize pass no longer resets a sticky's text to a size by its length (24 down to 11 before), so stickies in saved files keep their size. Size presets (Small to Huge) are still missing. Tests: `a_new_sticky_starts_at_18`, `a_sticky_keeps_its_text_size_as_text_is_added`, `a_sticky_saved_with_another_text_size_keeps_it` |
 | 2026-11-10 | minor | M12, #2226 (step 1 of 4): mind maps in the document and engine. A mind map node is a board object of its own (`BoardItem::MindNode`: text with no box) and a branch is a connector marked `branch`; the map's shape is read from its branches. `board.mindMap` places a first node with three children and `board.mindMapAdd` adds a child or a sibling, each one undo step. The normalize pass lays a touched map out again from its first node (`board::settle_mind_maps`, `figcraft_doc::mind_layout`): 88 between columns, 48 between siblings, each stack centred on its parent, numbers from a FigJam file saved and decoded. Tests: `board_mindmap_tests` in doc (five) and engine (eight). Numbers unchanged (no toolbar entry yet). |
 | 2026-11-03 | minor | M12, #1919: as the quick create help says ("Click to select and create the next shape in that direction, or drag the preview to any location on your board"; "A new shape is created with a connector and its text field active"), a "+" beside the selected sticky or shape can be dragged: the preview follows the pointer and, let go on empty board, the next one is made there, centred on the pointer, and joined by a connector leaving by the handle's side and arriving by the side facing it (`board.addConnected` gains `at: [x, y]`, a point of the page placed in the parent's coordinates); let go on another sticky or shape, inside a section or frame too (`board::sticky_or_shape_at`), a connector joins the two instead (`board.connector`), that object outlined while the pointer is over it; let go off the canvas or over the toolbar, nothing, and the bar above the selection stays away meanwhile, as for any drag. The click is as before. A shape picker on drop and choosing the connector type are not done (the help doesn't describe them). Tests: `board_connect_tests` (the drag ones), engine `board_connected_tests::the_next_one_goes_where_it_is_dropped`. Numbers unchanged. |
 | 2026-11-04 | minor | M12, #1916: a connector end attached to a side starts 4 pt outside the border (`board_route::END_GAP`), as FigJam's do (the issue's screenshots: the line starts a few pixels outside, with a round cap), so the stroke never lies on the fill; elbows leaving one side share their first run along its normal, curves leave tangent to it and straight ones fan out from the same point; the `.jam` importer's routes, re-attached ends, path handles and labels follow the route's points; an end placed by hand with Cmd/Ctrl held keeps its exact point. Tests: `board_route_tests` (three). Numbers unchanged. |

docs/components-parity.md

@@ -1,6 +1,6 @@
 # Components, variants, styles and variables parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (the Local variables window selects several variables (click, Shift+click for a range, Cmd/Ctrl+click to toggle, Escape to clear) and delete, move to a group and scope act on the selected local variables in one undo step (#2002); text styles carry paragraph spacing and indent, the list style and the OpenType features, as the Supported in text styles table of Create and apply text styles says (#1829); a layer's effect binding takes only a field its effect has; Go to main component on an instance of a library component opens the library file in a tab and selects the main there; glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-07 · **Change:** minor (with several layers selected the Design panel header's component button offers Create multiple components (#2088); the Local variables window selects several variables (click, Shift+click for a range, Cmd/Ctrl+click to toggle, Escape to clear) and delete, move to a group and scope act on the selected local variables in one undo step (#2002); text styles carry paragraph spacing and indent, the list style and the OpenType features, as the Supported in text styles table of Create and apply text styles says (#1829); a layer's effect binding takes only a field its effect has; Go to main component on an instance of a library component opens the library file in a tab and selects the main there; glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
 
 Design systems are why teams adopt Figma. **Components: breadth ~96%, ready ~72%. Styles and
 variables: breadth ~95%, ready ~76% (estimated).** QA'd with a synthetic design system of ~300
@@ -12,7 +12,7 @@ accounts).
 
 | Feature | Status | Notes |
 |---|---|---|
-| Create component, instances, detach, reset, go to main, restore main, push changes | done | push from a nested layer goes to the outer main |
+| Create component, instances, detach, reset, go to main, restore main, push changes | done | push from a nested layer goes to the outer main; with two or more layers selected the Design panel header's component button opens a menu with Create component, Create multiple components (each layer its own component in place, one undo step) and Create component set (each layer a component, wrapped in place in a set 20 px around: variants `Property 1=<layer name>` left to right, `prop=value` names kept, layers that all share a name give a set of that name with `Property 1=Default` variants; measured in Figma), one layer keeps the plain click (#2088) |
 | Per-layer overrides with reset; kept across main edits, nested swaps, copy/paste | done | main edits match a full rebuild exactly at 2,000 instances |
 | What an instance overrides: fills, strokes, effects, visibility, layer names, text content and every text property (resizing included), auto layout padding, gap and alignment, layout grids, export settings, prototype interactions, nested swaps and property values; the size and resizing (hug, fill, fixed, min and max) of layers inside it | done | each kept when the main changes that property, reset per group; opacity and corner radius too (documentation silent); size and resizing are kept through relayout, undo, save, `.fig` and REST import and detach, and stay with the instance on push |
 | What it doesn't: position, rotation, constraints and absolute or grid placement of layers inside it, its auto layout direction and other settings, its structure | done | refused with a message, the fields greyed out (Delete on a layer inside an instance hides it instead of removing it, as the help center says it does); the instance itself resizes and its layers follow the main's constraints |
@@ -79,6 +79,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-07 | patch | M3, #2088: with two or more layers selected the Design panel header's component button opens a menu with Create component, Create multiple components and Create component set (`component.createSet`, naming measured in Figma), as Figma's does; one layer keeps the plain button. Tests: `create_multiple_menu_tests`, `components_behaviour_tests::create_multiple_components_keeps_names_and_places_and_is_one_undo_step`, `components_behaviour_tests::create_set_*`. Grade unchanged. |
 | 2026-11-05 | minor | M3, #2002: the Local variables window selects several variables, as the Layers panel selects layers. A click selects one row, Shift+click the range from the anchor through the rows shown, Cmd/Ctrl+click toggles a row, Escape or a click on the empty space below the rows clears; selected rows use the sidebar's selected-row colour. Right-clicking a row that is part of a selection of several offers Delete, Move to group and Scope (all supported properties, hidden from pickers, or only one scope) for the selected local variables, each sent as one `command.batch`, so one undo step; no engine command changed. Renaming and value edits stay single-row. Tests: `variables_select_tests` (headless UI). Grade unchanged |
 | 2026-11-02 | minor | M3, #1829: text styles carry paragraph spacing and indent, the list style and the OpenType features ("Supported in text styles": "Paragraph spacing and indentation", "Lists", "OpenType features", Create and apply text styles) beside the character properties: `style.create` takes them from the layer (or the selected paragraphs' list) or from a `value` (`paragraphSpacing`, `paragraphIndent`, `listStyle`, `features`), `style.apply` sets them (on a range, the list goes to the paragraphs touched; the rest is the layer's, as in Figma), `style.update` moves them on every linked layer, editing one on a styled text unlinks it as editing its font does, the style editor lists them, and a `.fig` file keeps them with the style (its sample layer). Grade unchanged. |
 | 2026-11-06 | patch | M3: a glass's light angle bound to a number past ±180 turns round to the same direction (270 is -90), as the angle drawn from it does, instead of stopping at 180. Tests: `effects_tests::a_bound_light_angle_turns_round_instead_of_stopping`. Grade unchanged. |

docs/file-format-parity.md

@@ -188,6 +188,7 @@ scales and empty-style clears; they have not been checked in other software.
 | | Figma | FigCraft |
 |---|---|---|
 | Local fonts | yes (font helper / desktop app) | yes (system scan) |
+| Conflicting fonts | an uploaded organization font comes first, then fonts installed on the device, then Figma's web fonts (help center, "Manage conflicting fonts") | a font loaded with `text.loadFont` wins over the built-in and installed faces of the same family and style, the latest load over earlier ones (#2092); installed versus built-in order is unchanged, and browser local fonts count as installed |
 | Bundled/shared fonts | Google Fonts in the cloud | optional `CRAFT_FONTS_DIR` build input (storytold/craft-fonts) |
 | Variable fonts | yes | yes (axes, named instances, per-range axis values) |
 | Missing-font replacement on open | yes | listed, not replaced: in the desktop app the Missing fonts window opens after a file that uses them opens and from Text ▸ Missing fonts (`text.missingFonts`; `figcraft-cli info` prints `missing font` lines), and their text draws in a fallback font. A family the font store has (Google Fonts, Noto) downloads from the window once the user allows downloading fonts (`font.download`, #754): pinned, checksum-verified files into the Craft apps' shared font folder, after which the text draws in it. A family is found however a file names it: by the legacy name of one of its weights ("Family Medium") or by the typographic name of a family installed one family per weight, and spelt with other case, spaces or hyphens (#1292). No substitute picker |
@@ -196,6 +197,7 @@ scales and empty-style clears; they have not been checked in other software.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-07 | patch | Fonts, #2092: a font loaded with `text.loadFont` is the counterpart of a font uploaded to the organization, which Figma's help center ("Manage conflicting fonts") ranks first, ahead of installed fonts and the web fonts. FigCraft chose the first face added for a family and style, so the built-in Inter 4.x kept Regular, SemiBold and Bold after Inter 3.19 was loaded and only Medium refitted. A loaded face now wins over the other faces of its family and style, the latest load over earlier ones; style matching and fallbacks are unchanged, and `refitted` lists the text whose size changes. Installed versus built-in order is not changed here. Test: `fontdb::tests::a_loaded_face_wins_over_the_built_in_one_of_its_family_and_style`. Numbers unchanged. |
 | 2026-11-08 | minor | M6, #2097 follow-up: per-point vector corner radii take the scale of the row supplying `vectorData`, including nested instance rows; override and derived rows are not scaled twice. Network caching distinguishes the instance scale even when resizing gives two vectors the same final box. Synthetic tests cover missing/unit factors, half/double scale, derived size alone, overridden and derived vector data, nested scale and equal-size cache separation. Layer-radius fallback remains the separate #2115 change. Numbers unchanged. |
 | 2026-11-08 | patch | #2097 / #2100: scaled-instance lengths reset to the unscaled main value survive export/import as explicit overrides. Dimensionless values and zero do not gain scale overrides. Exported factors stay within the importer's 0.001–1000 range; larger or smaller ratios use explicit values instead. Effect/grid payload rows above an inherited style link take precedence at their own scale, including nested instances and empty-list clears, without detaching styles. Synthetic regressions cover corners, dashes/shadows, layout/grids and bounds, typography and styled runs, linked text and nested styles. Numbers unchanged. |
 | 2026-11-07 | minor | `.fig` import, #2091 item 1: an instance scaled with the Scale tool stores `symbolData.uniformScaleFactor`, which the import never read, so the layers of a 128 px instance of a 256 px component came in at 256 px with the main's radii, strokes and spacing. The layers of an instance now take the main's lengths times the factor (composed through nested instances, so 0.5 inside 0.5 is 0.25 for the inner layers), the lengths the Scale tool scales: sizes and places, corner radii, stroke weights and dashes, effect radii, spreads and offsets, auto layout gaps and paddings, grid gaps, min and max sizes, layout grids, font sizes, pixel line heights and letter spacings, paragraph spacing and indent. A value an override or derived row gives is taken as written, already at the instance's scale; the instance's own size is the file's; a missing, non-finite, non-positive or out-of-range factor (outside 0.001 to 1000) changes nothing. Not scaled: vector outline paths (a network's points follow the layer's size), per-point corner radii, fixed grid tracks, image tile scales and glass effects. Tests: `fig::tests::a_scaled_instance_draws_its_layers_at_the_factor` and `fig::scale_factor_tests`. Numbers unchanged |

docs/ui-parity.md

@@ -1,6 +1,6 @@
 # UI and interaction parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-10 · **Change:** minor (Shift while rotating lands on absolute multiples of 15°, measured in Figma; M8, #2146: K focuses the Scale tool's factor field with its text selected, so K, 2, Enter scales the selection by two about the panel's origin (FigCraft's starts at the top left; Figma's grid starts at the centre, left for a follow-up because the origin also sets where a handle drag pivots, which is not measured) in one undo step, after which the tool returns to Move with the selection kept; Escape in the field closes it with the tool back on Move and nothing changed (measured in Figma's web app, 2026-11-09; `pressing_k_focuses_the_scale_field_with_its_text_selected`, `k_two_enter_scales_the_selection_by_two`, `escape_in_the_scale_field_closes_it_and_changes_nothing`); the main menu and its submenus stay inside the window, moving up to fit and scrolling when taller (#2217); locked layers ignore the arrow keys and a locked parent's children can't be locked on their own (#1560); the left rail's and tab strip's icons are larger, 20 pt (#553); pick select: Tab while the keyboard selection box shows (or the chord again) puts a pink outline on a layer and the keys walk the layer tree from it, as Accessibility at Figma says (#1836); scrubbing a field faster or slower by the pointer's height, with a notice of the speed, as the help center's Scrub fields says (#1837); component rows in the Layers panel at AA contrast in the theme's component tint, with the rows inside a selected component in a tone of its row (#1903); Cmd/Ctrl-click on a padding field sets all four sides with the value typed, a documented auto layout shortcut; a fill per region of a vector: with regions selected in edit mode, the Fill section and the fill commands edit those regions' own fills, as Edit vector layers says (#1875); the Fill section of a text whose characters were coloured differently while editing shows mixed content, characters that all share fills the layer doesn't have show those, and a layer-level fill edit reaches every character (#1856); a number field scrubs when dragged with Alt held, as the help center's scrub section says, not only by its label; reuse visible layer selection roots (M8); ; with a shape or frame tool chosen and nothing selected, the arrows show a placement crosshair in the middle of the view and move it, and Enter places there, as Accessibility at Figma says (#1839); text direction per paragraph: Text ▸ Text direction forces a paragraph left to right or right to left, as Add right-to-left text says (#1830), with `text.direction`, `node.set textDirection`, the Type settings control once a right-to-left script is in the text, inspect, the CSS `direction` and the `.fig` lines' `sourceDirectionality`; the boolean operation menu in the Design panel leads each entry with an original icon drawn in code, a filled preview of the result (#2003); a press on the open gradient's handles or stops on the canvas keeps the colour picker open through the drag, as its own control (#1852); a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as Shift+F10 does; the eyedropper with Cmd/Ctrl+Shift makes a colour style or variable of what Line truncated
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-10 · **Change:** minor (Shift while rotating lands on absolute multiples of 15°, measured in Figma; copy, cut and paste in vector edit mode act on the selected points and segments (#1875); M8, #2146: K focuses the Scale tool's factor field with its text selected, so K, 2, Enter scales the selection by two about the panel's origin (FigCraft's starts at the top left; Figma's grid starts at the centre, left for a follow-up because the origin also sets where a handle drag pivots, which is not measured) in one undo step, after which the tool returns to Move with the selection kept; Escape in the field closes it with the tool back on Move and nothing changed (measured in Figma's web app, 2026-11-09; `pressing_k_focuses_the_scale_field_with_its_text_selected`, `k_two_enter_scales_the_selection_by_two`, `escape_in_the_scale_field_closes_it_and_changes_nothing`); the main menu and its submenus stay inside the window, moving up to fit and scrolling when taller (#2217); locked layers ignore the arrow keys and a locked parent's children can't be locked on their own (#1560); the left rail's and tab strip's icons are larger, 20 pt (#553); pick select: Tab while the keyboard selection box shows (or the chord again) puts a pink outline on a layer and the keys walk the layer tree from it, as Accessibility at Figma says (#1836); scrubbing a field faster or slower by the pointer's height, with a notice of the speed, as the help center's Scrub fields says (#1837); component rows in the Layers panel at AA contrast in the theme's component tint, with the rows inside a selected component in a tone of its row (#1903); Cmd/Ctrl-click on a padding field sets all four sides with the value typed, a documented auto layout shortcut; a fill per region of a vector: with regions selected in edit mode, the Fill section and the fill commands edit those regions' own fills, as Edit vector layers says (#1875); the Fill section of a text whose characters were coloured differently while editing shows mixed content, characters that all share fills the layer doesn't have show those, and a layer-level fill edit reaches every character (#1856); a number field scrubs when dragged with Alt held, as the help center's scrub section says, not only by its label; reuse visible layer selection roots (M8); ; with a shape or frame tool chosen and nothing selected, the arrows show a placement crosshair in the middle of the view and move it, and Enter places there, as Accessibility at Figma says (#1839); text direction per paragraph: Text ▸ Text direction forces a paragraph left to right or right to left, as Add right-to-left text says (#1830), with `text.direction`, `node.set textDirection`, the Type settings control once a right-to-left script is in the text, inspect, the CSS `direction` and the `.fig` lines' `sourceDirectionality`; the boolean operation menu in the Design panel leads each entry with an original icon drawn in code, a filled preview of the result (#2003); a press on the open gradient's handles or stops on the canvas keeps the colour picker open through the drag, as its own control (#1852); a click with the Bend tool on a sharp point curves it, its handles along the line between its neighbours, as Edit vector layers says (#1875); wrap style: Auto, Balance and Pretty on a text layer decide where its lines break, as Explore text properties says (#1827), with the Type settings control, `text.wrapStyle`, `node.set wrapStyle`, inspect and the CSS `text-wrap`; Backspace or Delete at the start of a list item keeps the item's indentation level, as the lists article says; max lines on auto-width text keep it auto width, hugging that many lines, as the text properties article says; superscript and subscript are synthesised where the font has no glyphs for them, from the standard glyphs shrunk and shifted by the font's OS/2 metrics, and a run mixing available and unavailable glyphs is synthesised whole, as Explore text properties says (#1828); Alt+Enter while editing text opens the link at the caret, as the accessibility page documents; Minimize, by its shortcut or the button by the file name, collapses the navigation bar and both sidebars as the help center says, with the right sidebar back while something is selected (#1835); the interface size keys of the help center's accessibility page: Cmd/Ctrl+Shift+Alt with =, - and 0 step the interface through the Preferences sizes and back to the system's size; Cmd/Ctrl+Alt+arrows rotate the selection a degree at a time, 15 with Shift, as the help center's accessibility page says; they resized before; the Layers panel answers Ctrl+1 as well as Alt+1 on Windows and Linux, the two keys the help center gives it; the colour picker's Image tab shows a placeholder and Upload from computer, an asset preview, and a file dropped on it replaces the image, keeping the fill mode, crop and position (#1682); the keyboard's Menu key opens the context menu, as ShiLine truncated
 
 Fine canvas control is what Figma users feel first: handles, snapping, nudging, modifier keys,
 drag behaviour, numeric precision. This checklist covers the tools, gestures and panels. Status:
@@ -93,7 +93,7 @@ interaction feel not yet compared.
 | Rectangle, ellipse (arc handles and Design panel arc fields), polygon, star, line, arrow; Shift/Alt | done | Alt draws lines from the centre too (`shapes_behaviour_tests`) |
 | Corner radius handles (inside each corner of a rectangle or frame, a polygon's or star's top point; Alt: one corner), star ratio handle; Count and Ratio fields | done | handles hide under 48 px on screen; no count handle on the canvas (the Count field instead); corner smoothing rounds rectangles and frames only |
 | Pen: vector networks, branch, close, bend; pencil | done | pen pressure on Windows and from browser styluses only; outside edit mode the Pen closes on its first point, connects to its other points and continues a selected open path from an end point (`vector_multi_behaviour_tests`); Escape ends the path and keeps its layer in edit mode with the pen, so the next path joins the same vector and another Escape leaves edit mode (#760, `pen_end_tests`); Enter or a double-click ends the path (at the double-click's point, added once) and edits the vector with the Move tool, a double-click with the idle pen edits the layer under it, and in edit mode the pen's Enter or double-click takes the Move tool (#1430, `pen_vector_edit_tests`); switching from Design to Prototype or Inspect ends the path and returns to Move (#308) |
-| Vector edit mode: bend, paint bucket, lasso, cut, eraser, transform box, point snapping, mirroring | done | a double-click a few pixels off a thin stroke enters edit mode (#646); entering edit mode and picking a region keep the canvas still (#322); a point dropped on another point merges with it, and dropping one end of an open path on the other closes it (a 2-point line's end just moves, #401); Flatten keeps open paths open (#377); paint bucket drags across areas; cut drags divide a shape into layers; delete and heal follows the curve; rounded points are drawn; Shift-click deselects a point at a corner of the box (`vector_behaviour_tests`); several vectors edited at once, Shift-click handles to drag them together, a cap and join per point, rounded points beside curves (`vector_multi_behaviour_tests`); filled regions with the Move tool: the area under the pointer is hatched ("/" lines in the selection colour, clipped by the area's own fill rule, holes left out, gone 3.5 px from a point or 2 px from a segment at any zoom), the line spacing follows octave folding (fitted to measurements at several zoom levels: 8 px at every power-of-two zoom, growing with the zoom and stepping back at √2 · 2ⁿ) and stays fixed to the shape when panning; a click selects the area and its points (moved with it but drawn unselected), Shift adds or removes an area, a press on a selected area drags the whole selection, no hover hatch during drags, a click on an empty spot (a hole) clears it and stays in edit mode; `vector.edit.select {regions}` (`regions_tests`, `vector_regions_tests`); a Bend click on a sharp point between two segments curves it (handles along the line between its neighbours, a third of the way to each, `ops::auto_smooth`), on a curved one sharpens it, a drag sets the handles by hand (#1875); with regions selected, the Fill section (its rows and the colour picker) and `fill.set`, `fill.add`, `fill.remove`, `fill.move` and `fill.paste` edit those regions' own fills, the layer's untouched, or the regions named by `regions: [index, ...]`; Copy fill takes the region's paint, the colour picker and its canvas gradient and crop handles edit it (an image from Upload from computer included; a file dropped on the picker goes to the canvas instead), what belongs to the layer (its fill style, a variable bound to its fill, the image crop button) stays off a region's rows, and `fill.pattern` sets the layer's fill (#1875). Not yet: areas of other layers edited at once |
+| Vector edit mode: bend, paint bucket, lasso, cut, eraser, transform box, point snapping, mirroring | done | a double-click a few pixels off a thin stroke enters edit mode (#646); entering edit mode and picking a region keep the canvas still (#322); a point dropped on another point merges with it, and dropping one end of an open path on the other closes it (a 2-point line's end just moves, #401); Flatten keeps open paths open (#377); paint bucket drags across areas; cut drags divide a shape into layers; delete and heal follows the curve; rounded points are drawn; Shift-click deselects a point at a corner of the box (`vector_behaviour_tests`); several vectors edited at once, Shift-click handles to drag them together, a cap and join per point, rounded points beside curves (`vector_multi_behaviour_tests`); filled regions with the Move tool: the area under the pointer is hatched ("/" lines in the selection colour, clipped by the area's own fill rule, holes left out, gone 3.5 px from a point or 2 px from a segment at any zoom), the line spacing follows octave folding (fitted to measurements at several zoom levels: 8 px at every power-of-two zoom, growing with the zoom and stepping back at √2 · 2ⁿ) and stays fixed to the shape when panning; a click selects the area and its points (moved with it but drawn unselected), Shift adds or removes an area, a press on a selected area drags the whole selection, no hover hatch during drags, a click on an empty spot (a hole) clears it and stays in edit mode; `vector.edit.select {regions}` (`regions_tests`, `vector_regions_tests`); a Bend click on a sharp point between two segments curves it (handles along the line between its neighbours, a third of the way to each, `ops::auto_smooth`), on a curved one sharpens it, a drag sets the handles by hand (#1875); with regions selected, the Fill section (its rows and the colour picker) and `fill.set`, `fill.add`, `fill.remove`, `fill.move` and `fill.paste` edit those regions' own fills, the layer's untouched, or the regions named by `regions: [index, ...]`; Copy fill takes the region's paint, the colour picker and its canvas gradient and crop handles edit it (an image from Upload from computer included; a file dropped on the picker goes to the canvas instead), what belongs to the layer (its fill style, a variable bound to its fill, the image crop button) stays off a region's rows, and `fill.pattern` sets the layer's fill (#1875); Copy and Cut with points or segments selected take just those (a lone point: the segments touching it) as a vector with the layer's look, at their own place, so a paste outside edit mode is a new layer in place; Cut removes them as Delete does, the path splitting in the same layer with edit mode staying on; Paste while editing adds the clipboard's segments, or a copied shape's or boolean's outline, to the edited network in place with the new points selected, skipping layers with no outline (text, frames, groups; named in `skipped`) and refusing when none has one, as measured in Figma (`vector_clipboard_tests`, #1875). Not yet: areas of other layers edited at once |
 | Shape builder (Shift+M) on fills, strokes and open paths; variable width (Shift+W), one side with Alt | done | |
 | Boolean groups: clicked where the result is, double-click or Cmd/Ctrl-click into operands, live results while dragging or editing points, per-operand operations | done | a group past the path operations' caps (250 000 segments, 2 million possible crossings, 4 million segments swept over a fold) draws without its result, with a warning, and Flatten refuses it (#1104); the Design panel's Boolean groups menu leads Union, Subtract, Intersect and Exclude with their own icons, two offset squares with the result filled at reduced alpha (#2003) |
 | Text: point, auto height, fixed; caret, words, lines, IME | done | Backspace or Delete at the start of a list item takes its marker and keeps its level, the paragraph starting where the item's text did ("delete the counter, but keep the same level of indentation", Create bulleted and numbered lists; `text_tail_tests::list_keys_at_list_items`, text crate `behaviour_tests`); max lines on auto-width text keep it auto width, hugging up to that many lines and growing with its longest line ("Text resizing is set to auto height or auto width", Explore text properties; `text_behaviour_tests::max_lines_on_auto_width_text_keeps_auto_width_and_hugs_that_many_lines`); Alt+Enter while editing opens the link at the caret, web and mail links only (`text.openLink`; "press ⌥Option Return/Alt Enter to activate a focused link", Accessibility at Figma; `text_link_tests`); the font picker previews a family on the canvas while hovered (no undo step; Escape restores, #653) and Up/Down step through it (#352); a selection highlight after a line break starts at that line's start and an empty last line shows its mark (#665); carets step over whole emoji and accented letters; colour emoji draw from their colour tables (#300); IME composition replayed in tests as macOS sends it, not yet checked on a Mac (#747); CJK words by script run (no dictionary); vertical trim in Type settings; no spell check |
@@ -189,6 +189,7 @@ in the table. `crates/ui-egui/src/shortcut_keys_tests.rs` drives the keys a look
 | Date | Change | Summary |
 |---|---|---|
 | 2026-11-07 | patch | Transform: Shift while rotating lands on absolute multiples of 15°, measured in Figma (a layer at 7° or -4.27° Shift-rotated by its corner ends at 15°); FigCraft rounded the turn since the drag began, so 7° landed on 7 + k*15. The gesture keeps the selection's shared rotation and rounds base + turn; a selection with different rotations keeps rounding the turn. Test: `shift_rotating_lands_on_multiples_of_15_not_steps_from_the_start` |
+| 2026-11-08 | minor | Vector edit mode, #1875, measured in Figma (web, real keys): Copy with segments selected takes only those (with just a point selected, the segments touching it) and a paste outside edit mode is a new vector layer in place; Cut removes them, the path splitting into subpaths in the same layer with edit mode staying on, and a paste outside gives a new layer with the cut segments; Paste while editing a vector adds the clipboard's segments, or a copied layer's outline, to the same network in place, selecting the pasted points, with no new layer and the bounds growing. FigCraft copied the whole layer, Cut left nothing to paste and Paste did nothing. `edit.copy`, `edit.cut` and `edit.paste` act so with no `ids`/`parent` given (Ctrl+X is the real Cut again; Shift+Delete still heals); the copy carries the layer's look (fills, strokes, effects, opacity, blend; the width profile only when every segment is copied); layers with no outline are skipped. Tests: `vector_clipboard_tests` |
 | 2026-11-08 | patch | Selection: Escape with layers selected clears the selection instead of stepping out to the parent first. Measured in the Figma web app with a rectangle in a group in a frame, selected from the canvas, from the Layers panel and after Tab: one Escape selects nothing. Editing, gestures and the pen still end first |
 | 2026-11-10 | patch | M5, #1560: locked layers follow Figma's rules (Lock and unlock layers; measured in Figma's web app): a locked layer selected in the Layers panel ignores the arrow keys and the nudge commands while its properties still edit, and a child of a locked layer keeps its padlock inert (the Layers panel padlock, Lock/Unlock and `object.toggleLock` without a value no longer lock the child on its own) |
 | 2026-11-10 | patch | #2217: the main menu's submenus (Object, say) ran past the window's bottom, behind the taskbar, with the lowest commands out of reach, because submenus were not constrained to the window (to keep them beside their row). Every menu panel now scrolls when taller than the window less 8 pt margins, and a submenu is held within the window's height (moved up, never above the top) while keeping its place beside its row, so menu-aim is unchanged. Tests: `menu_overflow_tests.rs`. Numbers unchanged. |