Merge main into #2149

contributors/people.toml

@@ -115,3 +115,6 @@ display_name = "Hamza0101"
 
 [people.ashokram-si]
 real_name = "Ashok Ram"
+
+[people.GiovanniBot]
+sync_github_name = true

crates/collab-net/src/client_cap_tests.rs

@@ -4,7 +4,7 @@
 
 use std::sync::{Arc, Mutex};
 
-use figcraft_collab::message::{Peer, Presence, ServerMsg};
+use figcraft_collab::message::{Access, CatchUp, Peer, Presence, Processed, ServerMsg};
 use figcraft_engine::live::{Event, MAX_PEERS};
 
 use crate::guest::GuestConfig;
@@ -59,3 +59,39 @@ fn joins_past_the_cap_are_left_out_until_someone_leaves() {
     send(joined(over));
     assert!(matches!(inbox.drain().as_slice(), [Event::PeerLeft(7), Event::PeerJoined(p)] if p.client_id == over));
 }
+
+#[test]
+fn a_hosts_long_names_and_colours_are_cut_where_they_are_kept() {
+    let inbox = inbox();
+    let cfg = GuestConfig::new(Invite::new("127.0.0.1:47900", "0123456789abcdef", "AbCdEfGhIjKlMnOpQrStUv"), "Ada".into());
+    let resume = Mutex::new(None);
+    let mut seen = Seen::default();
+    let long = "x".repeat(100_000);
+    take(ServerMsg::PeerJoined(Peer { client_id: 1, name: long.clone(), color: long }), &cfg, &inbox, &mut seen, &resume, &|| {});
+    match inbox.drain().as_slice() {
+        [Event::PeerJoined(p)] => assert_eq!((p.name.as_str(), p.color.as_str()), ("x".repeat(256).as_str(), "x".repeat(32).as_str())),
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn the_welcome_handed_to_the_sync_client_carries_the_bounded_roster() {
+    let inbox = inbox();
+    let cfg = GuestConfig::new(Invite::new("127.0.0.1:47900", "0123456789abcdef", "AbCdEfGhIjKlMnOpQrStUv"), "Ada".into());
+    let resume = Mutex::new(None);
+    let long = "y".repeat(100_000);
+    let welcome = ServerMsg::Welcome {
+        session: 1,
+        client_id: 9,
+        seq: 0,
+        catch_up: CatchUp::Snapshot(Vec::new()),
+        processed: Processed::default(),
+        peers: vec![Peer { client_id: 1, name: long.clone(), color: long }],
+        access: Access::default(),
+        secret: 0,
+    };
+    take(welcome, &cfg, &inbox, &mut Seen::default(), &resume, &|| {});
+    let events = inbox.drain();
+    let Some(Event::Sync(ServerMsg::Welcome { peers, .. })) = events.iter().find(|e| matches!(e, Event::Sync(_))) else { panic!("{events:?}") };
+    assert_eq!(peers.first().map(|p| (p.name.chars().count(), p.color.chars().count())), Some((256, 32)));
+}

crates/collab-net/src/join.rs

@@ -226,6 +226,19 @@ pub(crate) struct Seen {
     peers: Vec<Peer>,
 }
 
+/// `p` with its name and colour cut to what the UI shows: the host is untrusted, and the roster is
+/// copied whenever someone's identity is updated.
+fn bounded(mut p: Peer) -> Peer {
+    p.name = p.name.chars().take(MAX_PEER_NAME).collect();
+    p.color = p.color.chars().take(MAX_COLOR).collect();
+    p
+}
+
+/// The most characters of a colour (`#rrggbb` and a few spellings more) kept for someone.
+const MAX_COLOR: usize = 32;
+/// The most characters of a name kept for someone.
+const MAX_PEER_NAME: usize = 256;
+
 /// What taking in one message from the host means for the connection.
 pub(crate) enum Taken {
     Continue,
@@ -251,7 +264,7 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 *r = Some(Resume { session, client_id, seq, secret });
             }
             // The sync client opens the document (and fills in its name and pages).
-            let peers: Vec<Peer> = peers.iter().take(MAX_PEERS).cloned().collect();
+            let peers: Vec<Peer> = peers.iter().take(MAX_PEERS).cloned().map(bounded).collect();
             let inv = &cfg.invite;
             let info = SessionInfo {
                 role: Role::Guest,
@@ -268,20 +281,24 @@ pub(crate) fn take(mut m: ServerMsg, cfg: &GuestConfig, inbox: &Inbox, seen: &mu
                 view: None,
             };
             seen.peers = peers.clone();
+            // The sync client keeps the roster of the welcome it is handed: the bounded one.
+            if let ServerMsg::Welcome { peers: sent, .. } = &mut m {
+                sent.clone_from(&peers);
+            }
             seen.info = Some(info.clone());
             welcomed();
             inbox.push(Event::Welcome { info, peers });
             inbox.push(Event::Sync(m));
             return Taken::Welcomed;
         }
-        ServerMsg::PeerJoined(p) => match seen.info.as_mut() {
+        ServerMsg::PeerJoined(p) => match (seen.info.as_mut(), bounded(p)) {
             // The host tells you how you are shown.
-            Some(info) if p.client_id == info.me => {
+            (Some(info), p) if p.client_id == info.me => {
                 info.name = p.name;
                 info.color = p.color;
                 inbox.push(Event::Welcome { info: info.clone(), peers: seen.peers.clone() });
             }
-            _ => {
+            (_, p) => {
                 match seen.peers.iter().position(|q| q.client_id == p.client_id) {
                     Some(i) => {
                         seen.peers.remove(i);

crates/doc/src/board.rs

@@ -37,8 +37,8 @@ impl FileKind {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "camelCase")]
 pub enum BoardItem {
-    /// A sticky note: a frame whose first text layer is the note (its size shrinks as the note
-    /// grows) and, below it, who wrote it.
+    /// A sticky note: a frame whose first text layer is the note (its size stays fixed, the note
+    /// grows taller) and, below it, who wrote it.
     Sticky {
         #[serde(default, skip_serializing_if = "String::is_empty")]
         author: String,

crates/doc/src/text.rs

@@ -886,6 +886,25 @@ impl TextData {
             }
             pl.indent = pl.indent.min(MAX_LIST_INDENT);
         }
+        self.fold_paragraph_lists();
+    }
+
+    /// Give paragraphs `a..=b` (by index) no start number of their own, as an item made by Enter
+    /// has none. Touches nothing else: a plain paragraph keeps its level, a bullet its settings.
+    /// One pass over the range, and nothing at all when no paragraph carries a start.
+    pub fn clear_list_starts(&mut self, a: usize, b: usize) {
+        if self.paragraphs.iter().all(|p| p.start_offset == 0) {
+            return;
+        }
+        self.fill_paragraphs();
+        for pl in self.paragraphs.get_mut(a..=b).unwrap_or(&mut []) {
+            pl.start_offset = 0;
+        }
+        self.fold_paragraph_lists();
+    }
+
+    /// One style for all paragraphs with no nesting or start folds back into `list`.
+    fn fold_paragraph_lists(&mut self) {
         if let Some(first) = self.paragraphs.first().copied()
             && first == (ParaList { list: first.list, ..ParaList::default() })
             && self.paragraphs.iter().all(|p| *p == first)
@@ -1104,6 +1123,25 @@ mod case_tests {
         t.set_para_lists(0, 0, |p| p.list = P);
         assert_eq!(t.para_list(0), ParaList::default());
     }
+
+    #[test]
+    fn clear_list_starts_touches_only_starts() {
+        use ListStyle::{None as P, Numbered as N};
+        let mut t = TextData { characters: "a\nb\nc".into(), ..Default::default() };
+        t.paragraphs = vec![
+            ParaList { list: N, start_offset: 4, ..ParaList::default() },
+            ParaList { list: P, indent: 1, ..ParaList::default() },
+            ParaList { list: N, indent: 2, start_offset: 7, ..ParaList::default() },
+        ];
+        t.clear_list_starts(1, 2);
+        assert_eq!(t.para_list(0).start_offset, 4, "outside the range");
+        assert_eq!(t.para_list(1), ParaList { list: P, indent: 1, ..ParaList::default() }, "a plain paragraph keeps its level");
+        assert_eq!(t.para_list(2), ParaList { list: N, indent: 2, start_offset: 0, ..ParaList::default() });
+        // Out of range and no-start cases leave it alone.
+        t.clear_list_starts(5, 9);
+        t.clear_list_starts(0, 0);
+        assert_eq!(t.para_list(0).start_offset, 0);
+    }
 }
 
 #[cfg(test)]

crates/engine/src/assets/components.rs

@@ -60,7 +60,7 @@ pub use patch::sync_after_edit;
 pub(crate) use patch::{FULL_REBUILD, PATCHED};
 #[cfg(test)]
 use rebase::RebaseSources;
-pub use rebase::rebase_instance;
+pub use rebase::{MainPaths, rebase_instance, rebase_instance_with};
 pub use sync::keep_text_overrides;
 pub use variants::{default_variant, exposed_copies, find_variant, mirror_issues, variant_conflicts, variant_name, variant_options, variant_props};
 

crates/engine/src/assets/components/rebase.rs

@@ -165,10 +165,28 @@ impl<'a> RebaseSources<'a> {
 /// values (after detaching an outer instance, restoring a main, or copying a nested instance out):
 /// the look is kept exactly. Values a component property sets aren't overrides.
 pub fn rebase_instance(doc: &mut Document, inst: NodeId) {
+    rebase_instance_with(doc, inst, &mut MainPaths::new());
+}
+
+/// The layers of mains by path, kept across several [`rebase_instance_with`] calls. Rebasing only
+/// writes instances' `source` and `overrides`, never a main's layers or names, so a main's paths
+/// stay right for as long as the caller changes nothing else.
+pub type MainPaths = BTreeMap<NodeId, std::rc::Rc<BTreeMap<String, NodeId>>>;
+
+/// [`rebase_instance`], taking each main's path map from `mains` (and adding it there).
+pub fn rebase_instance_with(doc: &mut Document, inst: NodeId, mains: &mut MainPaths) {
     let Some(NodeKind::Instance { component, .. }) = doc.node(inst).map(|n| n.kind.clone()) else { return };
     let mine = path_map(doc, inst, true);
-    let theirs: BTreeMap<String, NodeId> =
-        if doc.contains(component) { path_map(doc, component, false).into_iter().map(|(k, v)| (v, k)).collect() } else { BTreeMap::new() };
+    let theirs = mains
+        .entry(component)
+        .or_insert_with(|| {
+            std::rc::Rc::new(if doc.contains(component) {
+                path_map(doc, component, false).into_iter().map(|(k, v)| (v, k)).collect()
+            } else {
+                BTreeMap::new()
+            })
+        })
+        .clone();
     let value_groups = |a: &Node, b: &Node| -> Vec<String> {
         diff_groups(a, b).into_iter().filter(|g| !matches!(*g, "size" | "position")).map(str::to_string).collect()
     };

crates/engine/src/assets/components/sync.rs

@@ -34,7 +34,7 @@ pub(super) fn sync_instance_depth(doc: &mut Document, inst: NodeId, depth: usize
         let nid = doc.alloc_id();
         map.insert(s, nid);
     }
-    let Copies { nodes: new_nodes, nested, mut remeasure } = copy_layers(doc, inst, &src, &map, &old, &edited, eff_props);
+    let Copies { nodes: new_nodes, nested, mut remeasure } = copy_layers(doc, inst, component, &src, &map, &old, &edited, eff_props);
     for n in new_nodes {
         let (id, parent) = (n.id, n.parent);
         if insert_linked(doc, n).is_err()
@@ -132,6 +132,7 @@ struct Copies {
 fn copy_layers(
     doc: &Document,
     inst: NodeId,
+    component: NodeId,
     src: &[NodeId],
     map: &BTreeMap<NodeId, NodeId>,
     old: &BTreeMap<NodeId, std::sync::Arc<Node>>,
@@ -139,7 +140,7 @@ fn copy_layers(
     props: BTreeMap<String, Value>,
 ) -> Copies {
     let mut enclosing: BTreeMap<NodeId, Vec<NodeId>> = BTreeMap::from([(inst, vec![inst])]);
-    let mut inst_props: BTreeMap<NodeId, BTreeMap<String, Value>> = BTreeMap::from([(inst, props)]);
+    let mut inst_props: BTreeMap<NodeId, (NodeId, BTreeMap<String, Value>)> = BTreeMap::from([(inst, (component, props))]);
     let mut out = Copies { nodes: Vec::new(), nested: Vec::new(), remeasure: Vec::new() };
     for s in src {
         let Some(orig) = doc.node(*s) else { continue };
@@ -164,12 +165,12 @@ fn copy_layers(
             // No longer a slot in the main: it mirrors the main again.
             n.overrides.remove(SLOT);
         }
-        // Component properties: the main layer's bindings use this instance's values; layers of
-        // nested instances use the nested instance's values (one level per source hop).
+        // Bindings use the enclosing instance of their defining component, even when slot
+        // content has fewer source hops than enclosing instances.
         let enc = enclosing.get(&parent).cloned().unwrap_or_default();
         apply_enclosing_props(doc, &mut n, orig, &enc, &inst_props);
         if let NodeKind::Instance { component: c, props } = &n.kind {
-            inst_props.insert(nid, props.clone());
+            inst_props.insert(nid, (*c, props.clone()));
             let mut e = enc;
             e.push(nid);
             enclosing.insert(nid, e);
@@ -253,14 +254,28 @@ fn rebuild_nested(doc: &mut Document, nested: Vec<NodeId>, old: &BTreeMap<NodeId
     }
 }
 
-fn apply_enclosing_props(doc: &Document, n: &mut Node, orig: &Node, enc: &[NodeId], inst_props: &BTreeMap<NodeId, BTreeMap<String, Value>>) {
+/// Apply bindings from their defining components, preserving explicit overrides and letting
+/// nearer source layers take precedence. Slot content need not have one source hop per instance.
+fn apply_enclosing_props(
+    doc: &Document,
+    n: &mut Node,
+    orig: &Node,
+    enc: &[NodeId],
+    inst_props: &BTreeMap<NodeId, (NodeId, BTreeMap<String, Value>)>,
+) {
     let mut chain: Vec<&Node> = vec![orig];
     while chain.len() < enc.len() {
         let Some(next) = chain.last().and_then(|c| c.source).and_then(|x| doc.node(x)) else { break };
         chain.push(next);
     }
     for (j, level) in chain.iter().enumerate().rev() {
-        let Some(props) = enc.get(j).and_then(|e| inst_props.get(e)) else { continue };
+        if level.prop_refs.is_empty() {
+            continue;
+        }
+        let Some(owner) = owning_component(doc, level.id) else { continue };
+        // Instance-owned slot content skips a source hop through the slot's component. Match
+        // the binding's defining component, not the position in the enclosing instance chain.
+        let Some((_, props)) = enc.iter().rev().filter_map(|e| inst_props.get(e)).find(|(component, _)| *component == owner) else { continue };
         for (field, prop) in &level.prop_refs {
             let g = field_group(field);
             if n.overrides.contains(g) || (j > 0 && orig.overrides.contains(g)) {

crates/engine/src/automation/file_access.rs

@@ -12,6 +12,11 @@
 //! existing folder is resolved and the rest must be plain names. The comparison is by whole
 //! components (`/work2` is not inside `/work`), and the I/O uses the resolved path, so what was
 //! checked is what is opened.
+//!
+//! On Windows, resolving a path opens it, and opening a path on another computer contacts that
+//! computer and may send it the signed-in user's credentials. So on Windows, before anything is
+//! resolved, a path on another computer whose share no root is on, a device path, or one reached
+//! through a link that leads to them is refused by how it is spelled (#1094).
 #![allow(clippy::disallowed_methods)]
 
 use std::cell::RefCell;
@@ -19,6 +24,8 @@ use std::ffi::{OsStr, OsString};
 use std::path::{Component, Path, PathBuf};
 use std::sync::Arc;
 
+use craft_docpath::Refused;
+
 use crate::{EngineError, Result};
 
 /// What a command does with a file.
@@ -58,6 +65,19 @@ impl Roots {
             Access::Read => ([self.read.as_slice(), self.write.as_slice()].concat(), "read"),
             Access::Write => (self.write.clone(), "written"),
         };
+        if cfg!(windows) {
+            match refused_unresolved(path, &roots) {
+                Some(Unresolved::Spelled(Refused::Network)) => {
+                    return Err(format!(
+                        "automation path rejected: {asked} is on another computer, and no folder that may be {what} is on its share"
+                    ));
+                }
+                Some(Unresolved::Spelled(_)) => return Err(format!("automation path rejected: {asked} names a device, not a file")),
+                // Where a link leads is only told by the usual message: it would say what is there.
+                Some(Unresolved::Linked) => return Err(outside(asked, &roots, what)),
+                None => {}
+            }
+        }
         match resolve(path) {
             Ok(resolved) if roots.iter().any(|r| resolved.starts_with(r)) => return Ok(resolved),
             Ok(_) => {}
@@ -65,11 +85,7 @@ impl Roots {
             Err(why) if inside_as_far_as_it_exists(path, &roots) => return Err(format!("automation path rejected: {asked}: {why}")),
             Err(_) => {}
         }
-        if roots.is_empty() {
-            return Err(format!("automation path rejected: no folder may be {what} (no root for it was given): {asked}"));
-        }
-        let shown: Vec<String> = roots.iter().map(|r| shown(r)).collect();
-        Err(format!("automation path rejected: {asked} is outside the folders that may be {what}: {}", shown.join(", ")))
+        Err(outside(asked, &roots, what))
     }
 
     /// The folders as JSON, resolved: `{read: [every folder that may be read], write: [the write roots]}`.
@@ -79,23 +95,165 @@ impl Roots {
     }
 }
 
+/// Why `asked` is refused: it is outside every one of `roots`, the folders that may be `what`
+/// ("read" or "written"). The message lists those folders, or says that no folder may be `what`
+/// when `roots` is empty.
+fn outside(asked: std::path::Display<'_>, roots: &[PathBuf], what: &str) -> String {
+    if roots.is_empty() {
+        return format!("automation path rejected: no folder may be {what} (no root for it was given): {asked}");
+    }
+    let shown: Vec<String> = roots.iter().map(|r| shown(r)).collect();
+    format!("automation path rejected: {asked} is outside the folders that may be {what}: {}", shown.join(", "))
+}
+
+/// Why a path is refused before it is resolved (#1094).
+#[derive(Debug, PartialEq, Eq)]
+enum Unresolved {
+    /// Its spelling leads to another computer ([`Refused::Network`]) or a device ([`Refused::Device`]).
+    Spelled(Refused),
+    /// A link on the way leads there, or the way there can't be looked at: a link or folder on it
+    /// can't be read, it has more than [`MAX_LINKS`] links, or the path can't be made absolute.
+    Linked,
+}
+
+/// How many links are followed on the way to a path before it is given up on, as on Linux.
+const MAX_LINKS: u8 = 40;
+
+/// Why `path` is refused before anything on the way to it is opened, if it is: resolving it would
+/// open a path on another computer, which on Windows contacts that computer and may send it the
+/// signed-in user's credentials, or open a device (#1094). That is the case when the path as
+/// given or made absolute is refused by its spelling ([`refused_spelling`]), or when a link on
+/// the way, or on the way on from where one leads, leads to such a path ([`link_refused`]). A path
+/// on the share of one of `roots` goes on to the usual check. A path that can't be made absolute
+/// is refused as well, rather than left to what comes next.
+fn refused_unresolved(path: &Path, roots: &[PathBuf]) -> Option<Unresolved> {
+    // Made absolute without looking at the disk (on Windows `GetFullPathNameW`, which also turns a
+    // bare device name such as `NUL` into `\\.\NUL`, as opening it would). Like opening, it takes
+    // `..` by name, so `link\..\x` is `x` and never goes through the link.
+    let Ok(abs) = std::path::absolute(path) else { return Some(Unresolved::Linked) };
+    if let Some(why) = [path, abs.as_path()].into_iter().find_map(|p| refused_spelling(&p.to_string_lossy(), roots)) {
+        return Some(Unresolved::Spelled(why));
+    }
+    link_refused(&abs, roots, MAX_LINKS, &on_disk).then_some(Unresolved::Linked)
+}
+
+/// What is at a path, looked at without following a link there.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Entry {
+    /// Nothing ([`nothing_there`]): resolving the path meets the same there and goes no further.
+    Missing,
+    /// Something that can't be looked at (no permission, for one). It may be a link that resolving
+    /// the path would still follow, so the path is refused.
+    Unreadable,
+    /// A file or a folder.
+    Plain,
+    /// A link, with where it leads (`None` when that can't be read).
+    Link(Option<PathBuf>),
+}
+
+/// What is at `p` on disk (see [`Entry`]), looked at with [`std::fs::symlink_metadata`], which
+/// doesn't follow a link there; a link's target is read with [`std::fs::read_link`].
+fn on_disk(p: &Path) -> Entry {
+    match std::fs::symlink_metadata(p) {
+        Ok(m) if m.is_symlink() => Entry::Link(std::fs::read_link(p).ok()),
+        Ok(_) => Entry::Plain,
+        Err(e) if nothing_there(&e) => Entry::Missing,
+        Err(_) => Entry::Unreadable,
+    }
+}
+
+/// Whether looking at a path failed with `e` because nothing is there: no such name, a file where
+/// a folder was expected, or a name no file can have. Any other failure says nothing about what is
+/// there.
+fn nothing_there(e: &std::io::Error) -> bool {
+    use std::io::ErrorKind::{InvalidFilename, NotADirectory, NotFound};
+    matches!(e.kind(), NotFound | NotADirectory | InvalidFilename)
+}
+
+/// Why path `p` is refused by its spelling alone, if it is (see [`craft_docpath::resolve`], which
+/// reads both `/` and `\` as separators and compares names ignoring case):
+/// - on another computer (`\\server\share`, `//server/share`, `\\?\UNC\…`, `\\.\UNC\…`, or a
+///   server without a share) and on no root's share;
+/// - a device path (`\\.\pipe\…`, `\\?\GLOBALROOT\…`, `\\.\C:\…`), other than a local volume's
+///   `\\?\Volume{…}\` or `\\.\Volume{…}\`, which a folder can be mounted as;
+/// - or with a device name (`CON`, `NUL`, `COM1.png`, `lpt1 `…) as any of its names: each folder on
+///   the way is opened in turn while the path is resolved, and the device behind a name such as
+///   `LPT1` can be a printer on another computer.
+fn refused_spelling(p: &str, roots: &[PathBuf]) -> Option<Refused> {
+    match craft_docpath::resolve(p, None) {
+        // With a root passed as the document path (what a link would be relative to), a path on
+        // that root's share is allowed.
+        Err(Refused::Network) if !roots.iter().any(|r| craft_docpath::resolve(p, Some(r)) != Err(Refused::Network)) => {
+            return Some(Refused::Network);
+        }
+        Err(Refused::Device) if !is_volume(p) => return Some(Refused::Device),
+        _ => {}
+    }
+    // `craft_docpath` stops at the first name it refuses, which may not be the device's.
+    p.split(['\\', '/']).any(device_name).then_some(Refused::Device)
+}
+
+/// Whether `p` is in a local volume by its `\\?\Volume{…}` (or `\\.\Volume{…}`) name.
+fn is_volume(p: &str) -> bool {
+    let mut names = p.split(['\\', '/']);
+    let (Some(""), Some(""), Some("?" | "."), Some(volume)) = (names.next(), names.next(), names.next(), names.next()) else {
+        return false;
+    };
+    volume.get(..7).is_some_and(|v| v.eq_ignore_ascii_case("Volume{")) && volume.ends_with('}')
+}
+
+/// Whether a link on the way to `abs` (an absolute path) leads to a path [`refused_spelling`]
+/// refuses, following at most `links` links: one that leads to another, or on through further
+/// links, is followed too, as resolving the path would. A link that can't be read, a name on the
+/// way that can't be looked at ([`Entry::Unreadable`]), or more links than that, are refused as
+/// well. Each name on the way is looked at with `look` ([`on_disk`]), which doesn't follow a
+/// link: where a link leads is looked at only once its spelling is known not to be refused.
+fn link_refused(abs: &Path, roots: &[PathBuf], links: u8, look: &dyn Fn(&Path) -> Entry) -> bool {
+    let mut at = PathBuf::new();
+    let mut rest = abs.components();
+    while let Some(c) = rest.next() {
+        at.push(c);
+        if !matches!(c, Component::Normal(_)) {
+            continue;
+        }
+        let target = match look(&at) {
+            Entry::Plain => continue,
+            // Nothing is below what isn't there, so no link either.
+            Entry::Missing => return false,
+            Entry::Unreadable => return true,
+            Entry::Link(target) => target,
+        };
+        let (Some(links), Some(target)) = (links.checked_sub(1), target) else { return true };
+        // A relative target is relative to the link's folder; an absolute one replaces it.
+        let next = lexical(&at.parent().unwrap_or(&at).join(target).join(rest.as_path()));
+        return refused_spelling(&next.to_string_lossy(), roots).is_some() || link_refused(&next, roots, links, look);
+    }
+    false
+}
+
+/// `p` with its `.` and `..` taken by name, as Windows takes them.
+fn lexical(p: &Path) -> PathBuf {
+    let mut out = PathBuf::new();
+    for c in p.components() {
+        match c {
+            Component::ParentDir => {
+                out.pop();
+            }
+            Component::CurDir => {}
+            c => out.push(c),
+        }
+    }
+    out
+}
+
 /// Whether `path` lies in one of `roots` once made absolute with its `.` and `..` taken by name and
 /// its longest leading part that exists resolved, so links on the way are followed as the roots'
 /// were (`/tmp/work/x` is inside root `/private/tmp/work`, a link out of a root leads out of it).
 fn inside_as_far_as_it_exists(path: &Path, roots: &[PathBuf]) -> bool {
     let Ok(abs) = std::path::absolute(path) else { return false };
-    let mut lexical = PathBuf::new();
-    for c in abs.components() {
-        match c {
-            Component::ParentDir => {
-                lexical.pop();
-            }
-            Component::CurDir => {}
-            c => lexical.push(c),
-        }
-    }
+    let folded = lexical(&abs);
     let mut rest: Vec<&OsStr> = Vec::new();
-    let mut at = lexical.as_path();
+    let mut at = folded.as_path();
     let resolved = loop {
         if let Ok(mut base) = std::fs::canonicalize(at) {
             base.extend(rest.iter().rev());
@@ -169,18 +327,24 @@ fn resolve(path: &Path) -> std::result::Result<PathBuf, String> {
 fn plain_name(name: &OsStr) -> std::result::Result<(), String> {
     if cfg!(windows) {
         let n = name.to_string_lossy();
-        let stem = n.split('.').next().unwrap_or_default().trim_end().to_ascii_uppercase();
-        let device = matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$")
-            || ((stem.starts_with("COM") || stem.starts_with("LPT"))
-                && stem.chars().count() == 4
-                && stem.chars().last().is_some_and(|c| c.is_ascii_digit() || matches!(c, '¹' | '²' | '³')));
-        if device || n.contains(':') {
+        if device_name(&n) || n.contains(':') {
             return Err(format!("`{n}` is a device or stream name, not a file"));
         }
     }
     Ok(())
 }
 
+/// Whether Windows opens a device for file or folder name `n`: `CON`, `PRN`, `AUX`, `NUL`,
+/// `CONIN$`, `CONOUT$`, `COM1`…`COM9` and `LPT1`…`LPT9` (also with `¹`, `²` or `³`), in any case,
+/// and with anything after a dot or a colon or trailing spaces (`nul.txt`, `COM1 .png`, `con:x`).
+fn device_name(n: &str) -> bool {
+    let stem = n.split(['.', ':']).next().unwrap_or_default().trim_end().to_ascii_uppercase();
+    matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CONIN$" | "CONOUT$")
+        || ((stem.starts_with("COM") || stem.starts_with("LPT"))
+            && stem.chars().count() == 4
+            && stem.chars().last().is_some_and(|c| c.is_ascii_digit() || matches!(c, '¹' | '²' | '³')))
+}
+
 thread_local! {
     static ROOTS: RefCell<Option<Arc<Roots>>> = const { RefCell::new(None) };
 }

crates/engine/src/automation/file_access/tests.rs

@@ -191,6 +191,283 @@ fn windows_case_devices_and_streams() {
     assert!(!e.contains(r"\\?\"), "{e}");
 }
 
+/// How each spelling of a path on another computer or of a device is told apart from a local path
+/// (#1094), on every system: only Windows checks them, but they are spelled the same everywhere.
+#[test]
+fn spellings_of_other_computers_and_devices_are_refused() {
+    use super::refused_spelling;
+    use craft_docpath::Refused::{Device, Network};
+    let local = [PathBuf::from(r"C:\work")];
+    // On `\\192.0.2.1\share`.
+    let on_the_share = [
+        r"\\192.0.2.1\share\x.png",
+        "//192.0.2.1/share/x.png",
+        r"\/192.0.2.1/share\x.png",
+        r"\\?\UNC\192.0.2.1\share\x.png",
+        r"\\?\unc\192.0.2.1\share\x.png",
+        "//?/UNC/192.0.2.1/share/x.png",
+        r"\\.\UNC\192.0.2.1\share\x.png",
+    ];
+    let elsewhere = [
+        // A server without a share is contacted too.
+        r"\\192.0.2.1",
+        r"\\192.0.2.1\",
+        r"\\SERVER.\share \x.png",
+    ];
+    let network = [&on_the_share[..], &elsewhere[..]].concat();
+    let device = [
+        r"\\.\pipe\figcraft",
+        r"\\?\GLOBALROOT\Device\Mup\192.0.2.1\share\x.png",
+        r"\\.\C:\work\x.png",
+        r"\\.\COM1",
+        r"\??\UNC\192.0.2.1\share\x.png",
+        // A device name anywhere: each folder on the way is opened as the path is resolved.
+        r"C:\work\COM1",
+        r"C:\work\nul.txt",
+        r"C:\work\Com1 .png",
+        r"C:\work\lpt1.\x.png",
+        r"C:\work\LPT³\x.png",
+        r"C:\work\conout$",
+        r"C:\work\aux:stream",
+        // After a name `craft_docpath` refuses for another reason.
+        r"C:\work\a:b\prn.png",
+    ];
+    let fine = [
+        r"C:\work\x.png",
+        r"\\?\C:\work\x.png",
+        r"C:\work\console.png",
+        r"C:\work\com10.png",
+        r"C:\work\lpt.png",
+        r"C:\work\nul-ish.txt",
+        r"\\?\Volume{0b3b1c63-0000-0000-0000-100000000000}\x.png",
+        r"\\.\Volume{0b3b1c63-0000-0000-0000-100000000000}\x.png",
+        "/home/u/work/x.png",
+        "x.png",
+        r"..\x.png",
+    ];
+    for (paths, want) in [(&network[..], Some(Network)), (&device[..], Some(Device)), (&fine[..], None)] {
+        for p in paths {
+            assert_eq!(refused_spelling(p, &[]), want, "{p}");
+            assert_eq!(refused_spelling(p, &local), want, "{p} with a local root");
+        }
+    }
+    // A root on a share lets the paths on that share through, in any case and spelling, and only them:
+    // every spelling above of a path on `\\192.0.2.1\share`, but not the server without a share
+    // or another server.
+    for root in [r"\\?\UNC\192.0.2.1\share", r"\\192.0.2.1\share\work"] {
+        let on_share = [PathBuf::from(root)];
+        for p in on_the_share {
+            assert_eq!(refused_spelling(p, &on_share), None, "{p} with root {root}");
+        }
+        for p in elsewhere {
+            assert_eq!(refused_spelling(p, &on_share), Some(Network), "{p} with root {root}");
+        }
+    }
+    let shared = [PathBuf::from(r"\\?\UNC\Server\Share\work")];
+    for p in [r"\\server\SHARE\work\x.png", r"\\?\UNC\SERVER\share\elsewhere\x.png", "//Server/Share/work/x.png"] {
+        assert_eq!(refused_spelling(p, &shared), None, "{p}");
+    }
+    for p in [r"\\server\other\x.png", r"\\other\share\x.png", r"\\server", r"\\server.\share\x.png"] {
+        assert_eq!(refused_spelling(p, &shared), Some(Network), "{p}");
+    }
+    assert_eq!(refused_spelling(r"\\server\share\work\COM1", &shared), Some(Device));
+}
+
+/// The links on the way to a path are followed by their spelling before anything they lead to is
+/// opened (#1094). The links are made up here, so this runs where tests may not make links.
+#[test]
+fn links_on_the_way_are_followed_by_their_spelling_first() {
+    use super::{Entry, MAX_LINKS, link_refused};
+    use std::cell::RefCell;
+    use std::collections::HashMap;
+    let base = std::env::temp_dir().join("figcraft-links");
+    let at = |rel: &str| base.join(rel);
+    let mut links: HashMap<PathBuf, Option<PathBuf>> = HashMap::from([
+        // Relative to the link's folder, to a device name.
+        (at("root/dev"), Some(PathBuf::from("../outside/nul"))),
+        // To another link.
+        (at("root/hop"), Some(at("root/dev"))),
+        // Within the root.
+        (at("root/alias"), Some(PathBuf::from("sub"))),
+        (at("root/loop"), Some(at("root/loop"))),
+        (at("root/unreadable"), None),
+        // Below a name that isn't there: never looked at.
+        (at("missing/dev"), Some(PathBuf::from("nul"))),
+    ]);
+    if cfg!(windows) {
+        links.insert(at("root/remote"), Some(PathBuf::from(r"\\192.0.2.1\share")));
+        links.insert(at("root/far"), Some(at("root/remote/work")));
+    }
+    // Chains of `n` links, `root/<n>-1` to `root/<n>-2` and so on, the last one to `root/sub`.
+    for n in [MAX_LINKS - 1, MAX_LINKS, MAX_LINKS + 1] {
+        for i in 1..=n {
+            let next = if i == n { at("root/sub") } else { at(&format!("root/{n}-{}", i + 1)) };
+            links.insert(at(&format!("root/{n}-{i}")), Some(next));
+        }
+    }
+    let plain = [at("root"), at("root/sub"), at("outside")];
+    // What can't be looked at (no permission, say) may be a link, so it isn't taken for nothing.
+    let unreadable = at("root/locked");
+    let looked = RefCell::new(Vec::new());
+    let look = |p: &Path| {
+        looked.borrow_mut().push(p.to_path_buf());
+        match links.get(p) {
+            Some(target) => Entry::Link(target.clone()),
+            None if base.starts_with(p) || plain.iter().any(|q| q == p) => Entry::Plain,
+            None if p == unreadable => Entry::Unreadable,
+            None => Entry::Missing,
+        }
+    };
+    let refused = |rel: &str, roots: &[PathBuf]| link_refused(&at(rel), roots, MAX_LINKS, &look);
+    for rel in ["root/dev/x.png", "root/hop/x.png", "root/loop/x.png", "root/unreadable/x.png", "root/locked/x.png", "root/locked"] {
+        assert!(refused(rel, &[]), "{rel}");
+    }
+    for rel in ["root/alias/x.png", "root/sub/x.png", "root/x.png", "missing/dev/x.png"] {
+        assert!(!refused(rel, &[]), "{rel}");
+    }
+    // As many links as are followed lead on; one more is refused.
+    assert!(!refused(&format!("root/{}-1/x.png", MAX_LINKS - 1), &[]));
+    assert!(!refused(&format!("root/{MAX_LINKS}-1/x.png"), &[]));
+    assert!(refused(&format!("root/{}-1/x.png", MAX_LINKS + 1), &[]));
+    // A refused target isn't looked at, nor is anything below what isn't there.
+    let looked = looked.take();
+    assert!(!looked.contains(&at("outside/nul")) && !looked.contains(&at("missing/dev")), "{looked:?}");
+    if cfg!(windows) {
+        for rel in ["root/remote/x.png", "root/far/x.png"] {
+            assert!(refused(rel, &[]), "{rel}");
+            // Unless a root is on that share.
+            assert!(!refused(rel, &[PathBuf::from(r"\\?\UNC\192.0.2.1\share")]), "{rel}");
+        }
+    }
+}
+
+/// A path that can't be looked at is refused rather than taken for one with nothing there (#1094):
+/// only a failure that says nothing is there lets the walk stop, and a path that can't even be
+/// made absolute isn't left to the checks after it.
+#[test]
+fn what_cannot_be_looked_at_is_refused() {
+    use super::{Unresolved, nothing_there, refused_unresolved};
+    use std::io::{Error, ErrorKind};
+    for kind in [ErrorKind::NotFound, ErrorKind::NotADirectory, ErrorKind::InvalidFilename] {
+        assert!(nothing_there(&Error::from(kind)), "{kind:?}");
+    }
+    for kind in [ErrorKind::PermissionDenied, ErrorKind::ResourceBusy, ErrorKind::Interrupted, ErrorKind::Other] {
+        assert!(!nothing_there(&Error::from(kind)), "{kind:?}");
+    }
+    assert_eq!(refused_unresolved(Path::new(""), &[]), Some(Unresolved::Linked));
+}
+
+/// On Windows a path is classified as Windows opens it (#1094): with `..` taken by name before
+/// anything is opened (so a link followed by `..` is never gone through), and with names that
+/// aren't Unicode (a lone surrogate) still read for the parts that are spelled in ASCII.
+#[cfg(windows)]
+#[test]
+fn paths_are_classified_as_windows_opens_them() {
+    use super::{Unresolved, refused_unresolved};
+    use craft_docpath::Refused::{Device, Network};
+    use std::ffi::OsString;
+    use std::os::windows::ffi::OsStringExt;
+    assert_eq!(std::path::absolute(r"C:\work\remote\..\x.png").unwrap(), PathBuf::from(r"C:\work\x.png"));
+    // `before`, a lone surrogate, then `after`.
+    let odd = |before: &str, after: &str| {
+        let wide: Vec<u16> = before.encode_utf16().chain([0xD800]).chain(after.encode_utf16()).collect();
+        PathBuf::from(OsString::from_wide(&wide))
+    };
+    assert_eq!(refused_unresolved(&odd(r"\\192.0.2.1\share\", ".png"), &[]), Some(Unresolved::Spelled(Network)));
+    assert_eq!(refused_unresolved(&odd(r"C:\figcraft-no-such-folder\", r"\nul"), &[]), Some(Unresolved::Spelled(Device)));
+    assert_eq!(refused_unresolved(&odd(r"C:\figcraft-no-such-folder\", ".png"), &[]), None);
+    // A NUL can't be passed to Windows at all, so the path can't be made absolute.
+    assert_eq!(refused_unresolved(Path::new("C:\\work\\a\0b.png"), &[]), Some(Unresolved::Linked));
+}
+
+/// `..` after a link is taken by name, by the check and by Windows when it opens the path, so
+/// `root\j\..\in.txt` is `root\in.txt` and the link `j` is never gone through (#1094). Shown with
+/// a junction, a link any account can make: `j` leads out of the root to `outside`, and beside
+/// `outside` is another `in.txt`, which is what `..` would reach through the link.
+#[cfg(windows)]
+#[test]
+fn a_parent_after_a_link_is_taken_by_name() {
+    use super::{Entry, on_disk};
+    let f = Fixture::new("parent");
+    let r = f.rw();
+    std::fs::write(f.0.join("in.txt"), b"beside").unwrap();
+    let made = std::process::Command::new("cmd").args(["/C", "mklink", "/J"]).arg(f.0.join(r"root\j")).arg(f.0.join("outside")).output();
+    assert!(made.is_ok_and(|o| o.status.success()), "a junction can be made");
+    // The junction is a link to the check, and what is through it is outside.
+    assert!(matches!(on_disk(&f.0.join(r"root\j")), Entry::Link(Some(_))));
+    assert!(r.check(Path::new(&f.p(r"root\j\secret.txt")), Access::Read).is_err());
+    let through = f.p(r"root\j\..\in.txt");
+    assert_eq!(r.check(Path::new(&through), Access::Read), r.check(Path::new(&f.p(r"root\in.txt")), Access::Read));
+    assert!(r.check(Path::new(&through), Access::Read).is_ok());
+    assert_eq!(std::fs::read(&through).unwrap(), b"in", "Windows opens the file in the root");
+}
+
+/// A path on another computer and a device path are refused before anything is opened: resolving
+/// them made Windows contact the server, which may send it the signed-in user's credentials
+/// (#1094). Each is refused with a message that only the check before resolving gives: had the
+/// path been resolved, 192.0.2.1 (an address for documentation, where nothing answers) would have
+/// been contacted and the message would be the one for a path that can't be resolved.
+#[cfg(windows)]
+#[test]
+fn other_computers_and_devices_are_refused_before_anything_is_opened() {
+    let f = Fixture::new("network");
+    let r = f.rw();
+    let read_only = Roots::new(&[f.p("root")], &[]).unwrap();
+    let refused = |roots: &Roots, p: &str, access: Access| roots.check(Path::new(p), access).expect_err(p);
+    for p in
+        [r"\\192.0.2.1\share\x.png", "//192.0.2.1/share/x.png", r"\\?\UNC\192.0.2.1\share\x.png", r"\\.\UNC\192.0.2.1\share\x.png", r"\\192.0.2.1"]
+    {
+        for access in [Access::Read, Access::Write] {
+            let e = refused(&r, p, access);
+            assert!(e.contains("is on another computer, and no folder that may be"), "{p}: {e}");
+        }
+        let e = refused(&read_only, p, Access::Write);
+        assert!(e.ends_with("is on another computer, and no folder that may be written is on its share"), "{p}: {e}");
+    }
+    for p in [r"\\.\pipe\figcraft-roots", r"\\?\GLOBALROOT\Device\Mup\192.0.2.1\share\x.png", &f.p(r"root\COM1\x.png"), "nul"] {
+        for access in [Access::Read, Access::Write] {
+            let e = refused(&r, p, access);
+            assert!(e.ends_with("names a device, not a file"), "{p}: {e}");
+        }
+    }
+    // Local paths, in either spelling, are checked as before.
+    let inside = std::fs::canonicalize(f.p("root")).unwrap().join("in.txt");
+    assert!(r.check(&inside, Access::Read).is_ok());
+    assert!(r.check(Path::new(&f.p(r"root\in.txt")), Access::Read).is_ok());
+}
+
+/// A link in a root to another computer is refused before it is followed (#1094), also through
+/// another link, and with the message any path outside gets: it doesn't tell where the link
+/// leads. Had the link been followed, the message would be the one for a path that can't be
+/// resolved. This needs real links, which Windows lets only some accounts make: elsewhere it
+/// says so and checks nothing (`links_on_the_way_are_followed_by_their_spelling_first` covers the
+/// same walk with made-up links on every system).
+#[cfg(windows)]
+#[test]
+fn links_to_other_computers_are_refused_before_they_are_followed() {
+    let f = Fixture::new("network-links");
+    let r = f.rw();
+    if !symlink_dir(Path::new(r"\\192.0.2.1\share"), &f.0.join("root/remote")) || !symlink_dir(&f.0.join("root/remote/work"), &f.0.join("root/hop")) {
+        eprintln!("skipped: this system doesn't let tests make symbolic links");
+        return;
+    }
+    // Relative to the link's folder.
+    assert!(symlink_dir(Path::new(r"..\remote"), &f.0.join("root/sub/up")));
+    assert!(symlink_file(Path::new(r"\\.\pipe\figcraft-roots"), &f.0.join("root/pipe")));
+    let standard = |p: &str| format!("automation path rejected: {p} is outside the folders that may be");
+    for p in [f.p("root/remote/x.png"), f.p("root/hop/x.png"), f.p("root/sub/up/x.png"), f.p("root/pipe")] {
+        for access in [Access::Read, Access::Write] {
+            let e = r.check(Path::new(&p), access).expect_err(&p);
+            assert!(e.starts_with(&standard(&p)), "{p}: {e}");
+        }
+    }
+    // `..` after the link is taken by name, so the link isn't gone through.
+    assert!(r.check(Path::new(&f.p(r"root\remote\..\in.txt")), Access::Read).is_ok());
+    // A link to a folder in the root still leads there.
+    assert!(symlink_dir(&f.0.join("root/sub"), &f.0.join("root/alias")));
+    assert!(r.check(Path::new(&f.p("root/alias/x.png")), Access::Write).is_ok());
+}
+
 #[test]
 fn a_scope_confines_the_thread_and_ends_with_it() {
     let f = Fixture::new("scope");

crates/engine/src/board_tests.rs

@@ -7,7 +7,7 @@ use figcraft_doc::{
 use figcraft_geom::Point;
 use serde_json::{Value, json};
 
-use crate::board::{route, sticky_font_size};
+use crate::board::{STICKY_TEXT_SIZE, route};
 use crate::collab_live_tests::Room;
 use crate::tools::{PointerEvent, PointerKind, ToolId};
 use crate::{EngineError, Session};
@@ -77,7 +77,7 @@ fn board_commands_refuse_on_design_files_and_prototyping_refuses_on_boards() {
 }
 
 #[test]
-fn a_sticky_is_a_square_frame_whose_note_shrinks_as_it_grows() {
+fn a_sticky_is_a_square_frame_whose_note_grows_taller_as_it_fills() {
     let mut s = board();
     s.prefs.user_name = "Ada".into();
     let r = s.execute("board.sticky", &json!({"x": 10, "y": 20, "text": "Hi", "color": "blue"})).unwrap();
@@ -88,19 +88,75 @@ fn a_sticky_is_a_square_frame_whose_note_shrinks_as_it_grows() {
     assert_eq!(n.fills[0].solid_color(), board_color("blue"));
     assert!(n.layout.is_some() && !n.effects.is_empty());
     assert_eq!(n.children.len(), 2, "the note and its author");
-    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 24.0);
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 18.0);
     // A click on the note picks the sticky whole.
     let doc = s.doc().unwrap();
     assert_eq!(figcraft_doc::geometry::select_target(doc, note, &[], false), st);
-    // A long note takes a smaller size; a very long one grows the sticky past its square.
+    // A long note keeps the size; a very long one grows the sticky past its square.
     let long = "word ".repeat(120);
     s.execute("node.set", &json!({"id": note, "props": {"characters": long}})).unwrap();
-    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, sticky_font_size(&long));
-    assert!(sticky_font_size(&long) < 16.0);
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, STICKY_TEXT_SIZE);
     assert!(node(&s, st).width == 200.0 && node(&s, st).height >= 200.0);
-    // Undo puts the short note and its size back.
+    // Undo puts the short note back.
     s.execute("edit.undo", &json!({})).unwrap();
-    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 24.0);
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 18.0);
+}
+
+#[test]
+fn a_new_sticky_starts_at_18() {
+    let mut s = board();
+    for (cmd, p) in [("board.sticky", json!({"x": 0, "y": 0, "text": "Hi"})), ("board.sticky", json!({"x": 300, "y": 0}))] {
+        let note = id(&s.execute(cmd, &p).unwrap(), "text");
+        assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 18.0);
+    }
+    let next = id(&s.execute("board.nextSticky", &json!({})).unwrap(), "text");
+    assert_eq!(node(&s, next).kind.text().unwrap().style.font_size, 18.0);
+    assert_eq!(STICKY_TEXT_SIZE, 18.0);
+}
+
+#[test]
+fn a_sticky_keeps_its_text_size_as_text_is_added() {
+    // The note's growth needs text measured: without craft-fonts that is with a system font,
+    // scanned here rather than by whichever test happens to run first (#333).
+    figcraft_text::scan_system_fonts();
+    let mut s = board();
+    let r = s.execute("board.sticky", &json!({"x": 0, "y": 0, "text": "one"})).unwrap();
+    let (st, note) = (id(&r, "id"), id(&r, "text"));
+    let (height, text_height) = (node(&s, st).height, node(&s, note).height);
+    // Typing in the note: each step is a real edit that runs the normalize pass.
+    crate::board::edit_text(&mut s, st).unwrap();
+    for _ in 0..9 {
+        crate::textedit::key(&mut s, "Enter", false, false, false).unwrap();
+        crate::textedit::insert(&mut s, "another line").unwrap();
+    }
+    let ten = node(&s, note).kind.text().unwrap().clone();
+    assert_eq!(ten.characters.matches('\n').count(), 9, "ten lines");
+    assert_eq!(ten.style.font_size, 18.0);
+    assert!(node(&s, note).height > text_height, "ten lines make the text taller");
+    assert!(node(&s, st).height > height, "and the note");
+    assert_eq!(node(&s, st).child_layout.sizing_v, figcraft_doc::Sizing::Hug, "the note hugs its text");
+    let (w, h10) = (node(&s, st).width, node(&s, st).height);
+    crate::textedit::insert(&mut s, &"a long paragraph ".repeat(15)).unwrap();
+    crate::textedit::end(&mut s).unwrap();
+    let t = node(&s, note).kind.text().unwrap().clone();
+    assert!(t.characters.chars().count() >= 250);
+    assert_eq!(t.style.font_size, 18.0);
+    assert!(t.runs.iter().all(|r| r.style.font_size == 18.0));
+    assert_eq!(node(&s, st).width, w, "the note keeps its width");
+    assert!(node(&s, st).height > h10, "and grows taller");
+}
+
+#[test]
+fn a_sticky_saved_with_another_text_size_keeps_it() {
+    let mut s = board();
+    let r = s.execute("board.sticky", &json!({"x": 0, "y": 0, "text": "old"})).unwrap();
+    let (st, note) = (id(&r, "id"), id(&r, "text"));
+    s.execute("node.set", &json!({"id": note, "props": {"fontSize": 11}})).unwrap();
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 11.0);
+    s.execute("node.set", &json!({"id": note, "props": {"characters": "old and now much longer than it was"}})).unwrap();
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 11.0, "an edit");
+    s.execute("node.set", &json!({"id": st, "props": {"x": 40}})).unwrap();
+    assert_eq!(node(&s, note).kind.text().unwrap().style.font_size, 11.0, "a move");
 }
 
 #[test]

crates/engine/src/boards/board.rs

@@ -69,8 +69,8 @@ pub(crate) use edit::{copied_items, copy_map, rejoin};
 use edit::{label_cmd, set_color, set_style};
 pub(crate) use items::add_text;
 pub use items::{CONNECTED_GAP, connected_place};
+pub use items::{STICKY_TEXT_SIZE, edit_text, owner_of_text, text_of};
 use items::{add_connected, ink_cmd, next_sticky, shape_cmd, stamp_cmd, sticky_cmd};
-pub use items::{edit_text, owner_of_text, sticky_font_size, text_of};
 pub(crate) use mindmap::settle_mind_maps;
 pub(crate) use reshape::path_handle_at;
 pub use reshape::selected_connector_handles;

crates/engine/src/boards/board/derived.rs

@@ -1,7 +1,6 @@
 use figcraft_doc::RouteEnd;
 
-use super::edit::set_font_size;
-use super::items::{owner_of_text, shape_padding, sticky_font_size, text_of};
+use super::items::shape_padding;
 use super::{
     Affine, BTreeSet, BezPath, BoardItem, Connector, Document, End, NodeId, NodeKind, PathEl, Point, Rect, Routing, Shape, VectorNetwork, is_board,
 };
@@ -9,26 +8,14 @@ use super::{
 // ---------------------------------------------------------------------------------------------
 // Derived data (the normalize pass).
 
-/// Before text is measured: a sticky's note takes the size its length calls for, and a resized
-/// shape keeps its text inside its outline.
+/// Before text is measured: a resized shape keeps its text inside its outline. A sticky's text
+/// keeps whatever size it has (FigJam's size is the note's own setting).
 pub(crate) fn settle_text(doc: &mut Document, before: &Document, touched: &BTreeSet<NodeId>) {
     if !is_board(doc) {
         return;
     }
     for &id in touched {
         let Some(n) = doc.node(id) else { continue };
-        if let Some(owner) =
-            owner_of_text(doc, id).or(Some(id)).filter(|o| doc.node(*o).is_some_and(|k| matches!(k.board, Some(BoardItem::Sticky { .. }))))
-            && let Some(t) = text_of(doc, owner)
-            && let Some(NodeKind::Text(td)) = doc.node(t).map(|k| &k.kind)
-        {
-            let size = sticky_font_size(&td.characters);
-            let off = td.style.font_size != size || td.runs.iter().any(|r| r.style.font_size != size);
-            if off && let Some(NodeKind::Text(td)) = doc.node_mut(t).map(|k| &mut k.kind) {
-                set_font_size(td, size);
-            }
-            continue;
-        }
         if let Some(BoardItem::Shape { shape }) = n.board
             && before.node(id).is_none_or(|b| (b.width, b.height) != (n.width, n.height))
         {

crates/engine/src/boards/board/items.rs

@@ -57,18 +57,9 @@ pub(crate) fn add_text(doc: &mut Document, parent: NodeId, text: &str, size: f64
     Ok(id)
 }
 
-/// The text size a sticky's note gets: smaller the more it holds (by characters and lines, so
-/// every copy of the file picks the same size whatever fonts it has).
-pub fn sticky_font_size(text: &str) -> f64 {
-    let weight = text.chars().count() + 24 * text.matches('\n').count();
-    match weight {
-        0..=24 => 24.0,
-        25..=64 => 20.0,
-        65..=140 => 16.0,
-        141..=280 => 13.0,
-        _ => 11.0,
-    }
-}
+/// The text size of a new sticky's note, FigJam's "Small" default (measured in the web app,
+/// 2026-11-09): it never changes as the note fills, the note grows taller instead.
+pub const STICKY_TEXT_SIZE: f64 = 18.0;
 
 /// A sticky note's layers: the frame, the note and (when known) its author.
 fn make_sticky(doc: &mut Document, parent: NodeId, at: (f64, f64), text: &str, color: Color, author: &str) -> Result<(NodeId, NodeId)> {
@@ -89,7 +80,7 @@ fn make_sticky(doc: &mut Document, parent: NodeId, at: (f64, f64), text: &str, c
         n.board = Some(BoardItem::Sticky { author: author.to_string() });
     })?;
     let inner = STICKY - 2.0 * STICKY_PAD;
-    let note = add_text(doc, id, text, sticky_font_size(text), INK, TextAlignH::Left, inner)?;
+    let note = add_text(doc, id, text, STICKY_TEXT_SIZE, INK, TextAlignH::Left, inner)?;
     if !author.is_empty() {
         let a = add_text(doc, id, author, 10.0, AUTHOR_INK, TextAlignH::Left, inner)?;
         if let Some(n) = doc.node_mut(a) {

crates/engine/src/brush_tests.rs

@@ -8,6 +8,7 @@ use crate::params::id_of;
 use crate::tools::{PointerEvent, PointerKind, pressure_profile};
 use figcraft_doc::{NodeId, NodeKind};
 use figcraft_geom::Point;
+use figcraft_geom::kurbo::PathEl;
 
 fn id(v: Value) -> NodeId {
     id_of(&v["id"]).unwrap()
@@ -149,3 +150,68 @@ fn the_pencil_draws_white_on_a_dark_background() {
         assert_eq!(stroke(&mut s, 0.0, 600.0).0, want, "on {bg}");
     }
 }
+
+/// A Pencil stroke stays where it was drawn: the fitted curve shot far off the stroke, a spike
+/// (#1741, its second point), where the stroke went out and back to the very point it left and
+/// where samples ran on nearly straight. Pointer pixels become fractional page points, so going
+/// back to a pixel lands on exactly the same point. Both sample runs are ones kurbo's fit took
+/// hundreds of units off.
+///
+/// Each stroke is drawn in a fresh session, with the Pencil and with the Marker and Highlighter
+/// of a board, whose ink comes from the same fit. Every point along the stroke drawn must lie
+/// within 1.5 (twice the fit's accuracy) of the polyline through the samples.
+#[test]
+fn the_pencil_keeps_its_stroke_where_it_was_drawn() {
+    let (p, q) = ((86.043_565_719_086_97, -173.744_402_349_100_94), (87.851_850_739_335_35, -179.202_846_445_954_52));
+    let back = [(80.0, -160.0), p, q, p, (95.0, -185.0)];
+    let straight = [
+        (204.0, -198.0),
+        (209.598_690_794_015_5, -204.909_328_119_739_88),
+        (211.277_914_263_870_97, -207.190_974_020_753_4),
+        (214.246_506_828_720_84, -211.228_827_590_623_24),
+        (218.0, -214.0),
+    ];
+    for tool in ["pencil", "marker", "highlighter"] {
+        for (what, samples) in [("out and back", &back[..]), ("nearly straight", &straight[..])] {
+            let what = format!("{tool}, {what}");
+            let mut s = if tool == "pencil" { Session::new() } else { crate::board_tests::board() };
+            s.execute("tool.set", &json!({"tool": tool})).unwrap();
+            let before: Vec<NodeId> = s.doc().unwrap().nodes().map(|n| n.id).collect();
+            let (first, last) = (samples[0], samples[samples.len() - 1]);
+            s.pointer(&PointerEvent::at(PointerKind::Down, first.0, first.1, 1.0)).unwrap();
+            for (x, y) in &samples[1..] {
+                s.pointer(&PointerEvent::at(PointerKind::Move, *x, *y, 1.0)).unwrap();
+            }
+            s.pointer(&PointerEvent::at(PointerKind::Up, last.0, last.1, 1.0)).unwrap();
+            // The layer the stroke made, and only it.
+            let doc = s.doc().unwrap();
+            let made: Vec<&figcraft_doc::Node> =
+                doc.nodes().filter(|n| !before.contains(&n.id) && matches!(n.kind, NodeKind::Vector { .. })).collect();
+            let [n] = made[..] else { panic!("{what}: {} vectors made", made.len()) };
+            let NodeKind::Vector { network } = &n.kind else { panic!("{what}: not a vector") };
+            let drawn = doc.world_transform(n.id) * network.stroke_path();
+            let polyline = figcraft_geom::BezPath::from_vec(
+                samples
+                    .iter()
+                    .enumerate()
+                    .map(|(k, (x, y))| if k == 0 { PathEl::MoveTo(Point::new(*x, *y)) } else { PathEl::LineTo(Point::new(*x, *y)) })
+                    .collect(),
+            );
+            let d = crate::vector_behaviour_tests::strays(&drawn, &polyline);
+            assert!(d <= 1.5, "{what}: the stroke strays {d} from the samples: {}", drawn.to_svg());
+            let samples_box = figcraft_geom::points_bounds(samples.iter().map(|(x, y)| Point::new(*x, *y))).unwrap();
+            let node_box = doc.world_bounds(n.id).unwrap();
+            if tool == "pencil" {
+                assert!(samples_box.inflate(1.5, 1.5).contains_rect(node_box), "{what}: the layer {node_box:?}, the samples {samples_box:?}");
+            }
+            // The turn is a point of the stroke, where it was drawn.
+            if samples == back {
+                let xf = doc.world_transform(n.id);
+                assert!(
+                    network.vertices.iter().any(|v| (xf * Point::new(v.x, v.y) - Point::new(q.0, q.1)).hypot() < 1e-6),
+                    "{what}: no point at the turn"
+                );
+            }
+        }
+    }
+}

crates/engine/src/canvas/textedit.rs

@@ -284,32 +284,57 @@ fn insert_model(s: &mut Session, text: &str, ime_commit: bool) -> Result<ImeInse
     let text = normalized;
     edit(s, |t, te| {
         let (a, b) = range(te);
-        // "- ", "* ", "1. " or "1) " typed at the start of a plain paragraph starts a list (the
-        // creation characters of Create bulleted and numbered lists).
+        // "- ", "* ", "<number>. " or "1) " typed at the start of a plain paragraph starts a list
+        // (the creation characters of Create bulleted and numbered lists). As measured in Figma
+        // (2026-11-11), a typed "5. " starts the numbered list at 5 (there is no start-number
+        // field). "0. " and a bracket after a number other than 1 are not measured: plain text.
         if text == " " && a == b && t.para_list(t.para_of(a)).list == ListStyle::None {
             let chars: Vec<char> = t.characters.chars().collect();
             let start = line_start(&chars, a);
             let typed: String = chars.get(start..a).unwrap_or(&[]).iter().collect();
+            let mut first = 1_u32;
             let list = match typed.as_str() {
                 "-" | "*" => ListStyle::Bulleted,
-                "1." | "1)" => ListStyle::Numbered,
-                _ => ListStyle::None,
+                "1)" => ListStyle::Numbered,
+                _ => match typed.strip_suffix('.').filter(|d| !d.is_empty() && d.bytes().all(|b| b.is_ascii_digit())) {
+                    Some(d) => match d.parse::<u32>() {
+                        Ok(n) if (1..=MAX_TYPED_LIST_START).contains(&n) => {
+                            first = n;
+                            ListStyle::Numbered
+                        }
+                        _ => ListStyle::None,
+                    },
+                    None => ListStyle::None,
+                },
             };
             if list != ListStyle::None {
                 t.replace_range(start, a, "");
-                t.set_para_lists(start, start, |pl| pl.list = list);
+                t.set_para_lists(start, start, |pl| {
+                    pl.list = list;
+                    pl.start_offset = first - 1;
+                });
                 (te.caret, te.anchor) = (start, start);
                 outcome = ImeInsertion::Transformed;
                 return;
             }
         }
         t.replace_range(a, b, &text);
+        // As measured in Figma (2026-11-11): an item made by Enter has no start of its own, so
+        // unlisting the item before it makes it restart at 1 rather than at the copied start.
+        // Every paragraph after the first that the insertion made loses the start it was copied.
+        if text.contains('\n') {
+            let end = a + text.chars().count();
+            t.clear_list_starts(t.para_of(a) + 1, t.para_of(end));
+        }
         te.caret = a + text.chars().count();
         te.anchor = te.caret;
     })?;
     Ok(outcome)
 }
 
+/// The largest number a typed `N. ` can start a numbered list at.
+const MAX_TYPED_LIST_START: u32 = 9999;
+
 /// What a list key does to the selected items.
 #[derive(Clone, Copy, PartialEq, Eq)]
 enum ListMove {

crates/engine/src/canvas/tools/pen.rs

@@ -313,7 +313,8 @@ impl Session {
         if points.len() < 2 {
             return Ok(());
         }
-        // Smooth: fit a curve through the samples.
+        // Smooth: fit a curve through the samples, kept from shooting past them where the stroke
+        // turns back or runs nearly straight (#1741).
         let mut poly = figcraft_geom::BezPath::new();
         for (k, p) in points.iter().enumerate() {
             if k == 0 {
@@ -322,7 +323,7 @@ impl Session {
                 poly.line_to(*p);
             }
         }
-        let fitted = figcraft_geom::kurbo::simplify::simplify_bezpath(poly.iter(), 0.75, &Default::default());
+        let fitted = figcraft_geom::simplify_path(&poly, 0.75);
         let d = fitted.to_svg();
         if matches!(self.tool.tool, ToolId::Marker | ToolId::Highlighter) {
             return self.ink_finish(&d);

crates/engine/src/canvas/vectoredit.rs

@@ -638,7 +638,7 @@ fn index(cmd: &str, p: &Value, key: &str) -> Result<usize> {
 }
 
 /// Delete the points and segments of `parts` (`heal` keeps paths through deleted points closed).
-fn delete_selection(s: &mut Session, parts: Vec<EditPart>, heal: bool) -> Result<()> {
+pub(crate) fn delete_selection(s: &mut Session, parts: Vec<EditPart>, heal: bool) -> Result<()> {
     let doc = s.doc_mut()?;
     for EditPart { id, vertices: verts, segments: segs } in parts {
         edit(doc, id, |net| {

crates/engine/src/cmd/component.rs

@@ -24,8 +24,8 @@ use instance::{detach, make_slot, push_changes, remove_slot, reset_instance, res
 pub(crate) use instance::{swap_at, swap_instance};
 use props::{add_prop, bind_prop, delete_prop, edit_prop, set_props};
 pub(crate) use props::{apply_prop_bindings, check_prop_binding, describe_props};
-use variants::{add_variant, combine};
-pub use variants::{can_add_variant, can_combine_variants};
+use variants::{add_variant, combine, create_set};
+pub use variants::{can_add_variant, can_combine_variants, can_create_set};
 
 /// `component.hideWhenPublishing`: the leading `.` of the names of this file's components and
 /// sets (those `ids` are or are in), put on or taken off.
@@ -72,6 +72,13 @@ pub fn specs() -> Vec<CommandSpec> {
             s.set_selection(out.iter().filter_map(id_of).collect());
             Ok(json!({"ids": out}))
         }),
+        spec!(
+            "component.createSet",
+            "Create component set",
+            "{ids? (layers, not components, sets or instances)}  (each becomes a component, wrapped in place in a component set: variants \"Property 1=<name>\" left to right, 20 px around)",
+            true,
+            create_set
+        ),
         spec!(
             "component.combineVariants",
             "Combine as variants",

crates/engine/src/cmd/component/variants.rs

@@ -1,6 +1,6 @@
 use super::{
-    BTreeMap, BTreeSet, Document, EngineError, Node, NodeId, NodeKind, Result, Session, Value, bad, inside_instance, json, owning_instance,
-    req_targets, roots, set_name_from, string, targets, variant_name, variant_options, variant_props, variant_set, z_sorted,
+    BTreeMap, BTreeSet, Document, EngineError, Node, NodeId, NodeKind, Result, Session, Value, bad, create, id_of, inside_instance, json,
+    owning_instance, req_targets, roots, set_name_from, string, targets, variant_name, variant_options, variant_props, variant_set, z_sorted,
 };
 
 /// Wrap components in a new component set (named after the first) placed around them.
@@ -94,6 +94,75 @@ pub(super) fn combine(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"id": set}))
 }
 
+/// Why `ids` (distinct) can't each become a component of a new set (`component.createSet`), or
+/// `None` when they can: layers inside an instance, library copies, instances, components and
+/// component sets, and a layer inside another one of `ids`.
+fn create_set_refusal(doc: &Document, ids: &[NodeId]) -> Option<&'static str> {
+    if ids.iter().any(|i| inside_instance(doc, *i)) {
+        Some("layers inside an instance can't become components")
+    } else if ids.iter().any(|i| doc.is_remote(*i)) {
+        Some(crate::library::READ_ONLY)
+    } else if ids.iter().any(|i| {
+        doc.node(*i).is_some_and(|n| matches!(n.kind, NodeKind::Instance { .. } | NodeKind::Component { .. } | NodeKind::ComponentSet { .. }))
+    }) {
+        Some("select layers that aren't components, component sets or instances")
+    } else if roots(doc, ids).len() != ids.len() {
+        Some("a layer can't be in a set with one inside it")
+    } else {
+        None
+    }
+}
+
+/// Whether "Create component set" is on offer for `ids`: at least one layer that
+/// [`create_set_refusal`] lets through.
+pub fn can_create_set(doc: &Document, ids: &[NodeId]) -> bool {
+    let distinct: Vec<NodeId> = ids.iter().copied().collect::<BTreeSet<_>>().into_iter().collect();
+    !distinct.is_empty() && distinct.iter().all(|i| doc.contains(*i)) && create_set_refusal(doc, &distinct).is_none()
+}
+
+/// `component.createSet`: each target becomes a component (as `component.createMultiple` makes
+/// them) and all are wrapped in place in a component set, 20 px around, named as Figma names them:
+/// variants "Property 1=<layer name>" in left-to-right order (a name holding `=` is kept); layers
+/// that all share a name give a set of that name with "Property 1=Default" variants; otherwise the
+/// set is "Component N".
+pub(super) fn create_set(s: &mut Session, p: &Value) -> Result<Value> {
+    let cmd = "component.createSet";
+    let mut seen = BTreeSet::new();
+    let ids: Vec<NodeId> = req_targets(cmd, s, p)?.into_iter().filter(|i| seen.insert(*i)).collect();
+    let doc = s.doc()?;
+    if let Some(why) = create_set_refusal(doc, &ids) {
+        return Err(EngineError::Disabled(cmd.into(), why.into()));
+    }
+    let mut made = Vec::new();
+    for i in roots(doc, &ids) {
+        let r = create(s, &json!({"ids": [i]}))?;
+        made.push(id_of(&r["id"]).ok_or_else(|| bad(cmd, "component creation failed"))?);
+    }
+    let doc = s.doc_mut()?;
+    // Left to right by world x, ties by y: the variants' order, and the values' order.
+    let mut by_x: Vec<(NodeId, f64, f64)> = made.iter().map(|i| doc.world_bounds(*i).map_or((*i, 0.0, 0.0), |b| (*i, b.x0, b.y0))).collect();
+    by_x.sort_by(|a, b| a.1.total_cmp(&b.1).then(a.2.total_cmp(&b.2)));
+    let names: Vec<String> = by_x.iter().map(|(i, ..)| doc.node(*i).map(|n| n.name.clone()).unwrap_or_default()).collect();
+    let same = names.windows(2).all(|w| w.first() == w.get(1)) && names.first().is_some_and(|n| !n.is_empty() && !n.contains('='));
+    let set_name = match names.first() {
+        Some(n) if same => n.clone(),
+        _ => doc.next_name("Component"),
+    };
+    for ((i, ..), name) in by_x.iter().zip(&names) {
+        let node = doc.get_mut(*i)?;
+        if same {
+            node.name = "Property 1=Default".into();
+        } else if !name.contains('=') {
+            node.name = format!("Property 1={name}");
+        }
+    }
+    let ordered = z_sorted(doc, &made);
+    let set = wrap_in_set(cmd, doc, &ordered)?;
+    doc.get_mut(set)?.name = set_name;
+    s.set_selection(vec![set]);
+    Ok(json!({"id": set}))
+}
+
 /// Grow a component set so it wraps its variants with 20 px of padding (right and bottom).
 pub(super) fn fit_set(doc: &mut Document, set: NodeId) {
     let Some(kids) = doc.node(set).map(|n| n.children.clone()) else { return };

crates/engine/src/cmd/edit.rs

@@ -17,6 +17,10 @@ mod clipboard;
 mod props;
 pub(crate) use props::{edit_region_fills, fill_regions};
 mod select;
+mod vector_clipboard;
+pub use vector_clipboard::clipboard_svg;
+#[cfg(test)]
+mod vector_clipboard_tests;
 
 pub(crate) use clipboard::apply_copied_props;
 pub use clipboard::{CLIP_CLOSE, CLIP_OPEN, copy_to_clipboard, design_clipboard_buffer, paste_into};
@@ -117,12 +121,24 @@ pub fn specs() -> Vec<CommandSpec> {
             true,
             duplicate
         ),
-        spec!("edit.copy", "Copy", "{ids?}", false, copy),
-        spec!("edit.cut", "Cut", "{ids?}", true, cut),
+        spec!(
+            "edit.copy",
+            "Copy",
+            "{ids?}  in vector edit mode with points or segments selected (and no ids): just those, the segments touching a selected point, as a temporary vector on the clipboard (one per edited layer) with the edited layer's look, kept at its place on the page; points that touch no segment have nothing to copy, so Copy with only those is refused (Disabled). Returns {copied, segments}",
+            false,
+            copy
+        ),
+        spec!(
+            "edit.cut",
+            "Cut",
+            "{ids?}  in vector edit mode with points or segments selected (and no ids): copies them as Copy does, then removes them as Delete does; the path splits in the same layer and edit mode stays on. Returns {cut (layers), segments}. With only lone points (nothing to copy) it is refused (Disabled) and changes nothing, as Copy is; Delete removes lone points",
+            true,
+            cut
+        ),
         spec!(
             "edit.paste",
             "Paste",
-            "{parent?, x?, y? (page coordinates of the pasted top-left)}  a copied main component pastes as an instance of it within its file (cut ones, and pastes into other files, keep the component)",
+            "{parent?, x?, y? (page coordinates of the pasted top-left; give both or neither, one alone is refused)}  in vector edit mode (and no parent): the copied vectors' segments and the outlines of shapes, booleans and lines join the edited vector's network (at x/y when given, else in place), their points selected, as one undo step; layers with no outline (text, images, instances, frames, groups) are skipped and named in `skipped` (present only when some were), and when none has an outline the paste is refused (Disabled), as it is past 500,000 segments in one vector. Returns {ids: [] (always empty: no layer is created), edited (the vector's id), vertices (points added), skipped?}, unlike a paste outside edit mode, which returns the new layers' `ids`; a copied main component pastes as an instance of it within its file (cut ones, and pastes into other files, keep the component)",
             true,
             paste
         ),

crates/engine/src/cmd/edit/clipboard.rs

@@ -1,6 +1,6 @@
 use super::{
-    Affine, BTreeMap, BTreeSet, Document, EngineError, ImageData, Node, NodeId, NodeKind, Result, Session, Value, bad, delete, id, json, num, ok,
-    req_targets, roots, string, targets, z_sorted,
+    Affine, BTreeMap, BTreeSet, Document, EngineError, ImageData, Node, NodeId, NodeKind, Result, Session, Value, bad, delete, get, id, json, num,
+    ok, req_targets, roots, string, targets, vector_clipboard, z_sorted,
 };
 
 /// The copied form of the selection.
@@ -12,6 +12,18 @@ pub fn copy_to_clipboard(s: &mut Session, cmd: &str, ids: &[NodeId]) -> Result<(
         return Err(EngineError::Disabled(cmd.into(), "pages can't be copied; use page.duplicate".into()));
     }
     let (nodes, images, bounds) = copied(&ds.doc, &layers);
+    store_clipboard(s, cmd, nodes, images, bounds)
+}
+
+/// Make `nodes` (the copied layers, each root's transform in page space) the clipboard's layers.
+pub(super) fn store_clipboard(
+    s: &mut Session,
+    cmd: &str,
+    nodes: Vec<(NodeId, Vec<Node>)>,
+    images: BTreeMap<String, ImageData>,
+    bounds: Option<figcraft_geom::Rect>,
+) -> Result<()> {
+    let ds = s.ds()?;
     let (source, source_path, uid) = (ds.doc.clone(), ds.path.clone(), ds.uid);
     s.clipboard.source = Some(source);
     s.clipboard.source_path = source_path;
@@ -43,21 +55,26 @@ fn copied(doc: &Document, ids: &[NodeId]) -> Copied {
         if let Some(r) = sub.first_mut() {
             r.transform = world;
         }
-        for n in &sub {
-            for p in n.fills.iter().chain(n.strokes.iter()) {
-                if let figcraft_color::PaintKind::Image(img) = &p.kind
-                    && let Some(d) = doc.images.get(&img.image)
-                {
-                    images.insert(img.image.clone(), d.clone());
-                }
-            }
-        }
+        collect_images(doc, &sub, &mut images);
         nodes.push((*i, sub));
     }
     let bounds = doc.bounds_of(&ids);
     (nodes, images, bounds)
 }
 
+/// The images the paints of `nodes` use, taken from `doc` into `images`.
+pub(super) fn collect_images(doc: &Document, nodes: &[Node], images: &mut BTreeMap<String, ImageData>) {
+    for n in nodes {
+        for p in n.fills.iter().chain(n.strokes.iter()) {
+            if let figcraft_color::PaintKind::Image(img) = &p.kind
+                && let Some(d) = doc.images.get(&img.image)
+            {
+                images.insert(img.image.clone(), d.clone());
+            }
+        }
+    }
+}
+
 /// The markers around the copied layers in the clipboard's HTML, spelt as that format spells them.
 pub const CLIP_OPEN: &str = "(figma)";
 
@@ -167,13 +184,34 @@ fn layers_missing_images(doc: &figcraft_doc::Document, ids: &[NodeId]) -> Vec<St
     names
 }
 
+/// Whether the command names its layers (`ids` / `id`): it then acts on them even in vector edit mode.
+fn names_layers(p: &Value) -> bool {
+    get(p, "ids").is_some() || get(p, "id").is_some()
+}
+
 pub(super) fn copy(s: &mut Session, p: &Value) -> Result<Value> {
+    // In vector edit mode with points or segments selected, Copy takes just those (#1875).
+    if !names_layers(p)
+        && let Some(sel) = vector_clipboard::edit_selection(s)
+        && sel.any
+    {
+        // Only lone points selected: nothing to copy, and not the whole layer either.
+        return vector_clipboard::copy_selection(s, "edit.copy", sel);
+    }
     let ids = req_targets("edit.copy", s, p)?;
     copy_to_clipboard(s, "edit.copy", &ids)?;
     Ok(json!({"copied": s.clipboard.nodes.len()}))
 }
 
 pub(super) fn cut(s: &mut Session, p: &Value) -> Result<Value> {
+    // In vector edit mode with points or segments selected, Cut takes just those and stays in edit mode (#1875).
+    if !names_layers(p)
+        && let Some(sel) = vector_clipboard::edit_selection(s)
+        && sel.any
+    {
+        // Lone points with nothing to copy: `cut_selection` refuses, as Copy does.
+        return vector_clipboard::cut_selection(s, sel);
+    }
     let ids = req_targets("edit.cut", s, p)?;
     copy_to_clipboard(s, "edit.cut", &ids)?;
     let doc = s.doc()?;
@@ -238,6 +276,10 @@ pub fn paste_into(s: &mut Session, parent: NodeId, at: Option<(f64, f64)>) -> Re
 }
 
 pub(super) fn paste(s: &mut Session, p: &Value) -> Result<Value> {
+    // While editing a vector, the copied layers join its network (#1875); `parent` asks for layers.
+    if id(p, "parent").is_none() && s.ds()?.vector_edit.is_some() {
+        return vector_clipboard::paste_into_vector(s, p);
+    }
     let page = s.page()?;
     // Figma pastes into the selected frame (if one is selected), at the same position when it fits,
     // else in the frame's centre; otherwise in place on the page (or the viewport centre).

crates/engine/src/cmd/edit/vector_clipboard.rs

@@ -0,0 +1,303 @@
+//! Copy, cut and paste in vector edit mode (#1875).
+//!
+//! With points or segments selected, Copy and Cut take just those: a temporary vector holding the
+//! selected segments (and the segments touching a selected point) goes on the ordinary layer
+//! clipboard, kept at its place on the page, so a paste outside edit mode is a plain layer paste
+//! in place. Cut then removes the selection the way Delete does and stays in edit mode. Paste
+//! while editing adds the clipboard's layers to the edited vector's network, in place: a vector
+//! with its segments, a shape or boolean with its outline.
+
+use crate::bad;
+use figcraft_doc::{NodeKind, Region, VectorNetwork};
+
+use super::clipboard::{collect_images, store_clipboard};
+use super::{Affine, BTreeMap, BTreeSet, Document, EngineError, Node, NodeId, Result, Session, Value, json, num};
+use crate::canvas::vectoredit::{self, EditPart};
+
+/// The most segments a vector network takes through a paste.
+const MAX_SEGMENTS: usize = 500_000;
+
+/// What the edited layers have selected.
+pub(super) struct EditSelection {
+    /// Whether any edited layer has a point or a segment selected.
+    pub any: bool,
+    /// Each edited layer with something to copy, and the sub-network that is.
+    pub parts: Vec<(NodeId, VectorNetwork)>,
+    /// What Cut removes, per edited layer: the same points and segments the copy was built from.
+    pub delete: Vec<EditPart>,
+}
+
+/// The selection of the vector being edited (and the other layers edited with it), or `None` when
+/// not in vector edit mode.
+pub(super) fn edit_selection(s: &Session) -> Option<EditSelection> {
+    let ds = s.ds().ok()?;
+    let ve = ds.vector_edit.as_ref()?;
+    let mut sel = EditSelection { any: false, parts: Vec::new(), delete: Vec::new() };
+    for part in ve.parts() {
+        if part.vertices.is_empty() && part.segments.is_empty() {
+            continue;
+        }
+        sel.any = true;
+        let Some(net) = vectoredit::network(&ds.doc, part.id) else { continue };
+        let active = part.id == ve.id;
+        // Points selected only through a selected region don't pull in the segments touching
+        // them: the region's own segments are the selection.
+        let vertices: Vec<usize> = part.vertices.iter().copied().filter(|v| !active || !ve.region_vertices.contains(v)).collect();
+        let mut segments = part.segments.clone();
+        if active {
+            segments.extend(ve.regions.iter().filter_map(|r| net.regions.get(*r)).flat_map(|r| r.loops.iter().flatten().copied()));
+        }
+        sel.delete.push(EditPart { id: part.id, vertices: vertices.clone(), segments: segments.clone() });
+        if let Some(sub) = sub_network(net, &vertices, &segments) {
+            sel.parts.push((part.id, sub));
+        }
+    }
+    Some(sel)
+}
+
+/// The part of `net` that is the segments `segments` and those touching a point of `vertices`,
+/// with the points they join; `None` when there are none (a lone point with no segment draws
+/// nothing). The regions whose every segment is kept stay regions.
+fn sub_network(net: &VectorNetwork, vertices: &[usize], segments: &[usize]) -> Option<VectorNetwork> {
+    let picked: BTreeSet<usize> = vertices.iter().copied().collect();
+    let mut keep: BTreeSet<usize> = segments.iter().copied().filter(|i| *i < net.segments.len()).collect();
+    for (i, sg) in net.segments.iter().enumerate() {
+        if picked.contains(&sg.a) || picked.contains(&sg.b) {
+            keep.insert(i);
+        }
+    }
+    let used: BTreeSet<usize> = keep.iter().filter_map(|i| net.segments.get(*i)).flat_map(|sg| [sg.a, sg.b]).collect();
+    let vmap: BTreeMap<usize, usize> = used.iter().enumerate().map(|(new, old)| (*old, new)).collect();
+    let smap: BTreeMap<usize, usize> = keep.iter().enumerate().map(|(new, old)| (*old, new)).collect();
+    let mut out = VectorNetwork {
+        vertices: used.iter().filter_map(|v| net.vertices.get(*v).cloned()).collect(),
+        segments: keep
+            .iter()
+            .filter_map(|i| net.segments.get(*i))
+            .filter_map(|sg| {
+                let mut sg = *sg;
+                sg.a = *vmap.get(&sg.a)?;
+                sg.b = *vmap.get(&sg.b)?;
+                Some(sg)
+            })
+            .collect(),
+        regions: Vec::new(),
+    };
+    if out.segments.is_empty() || out.segments.len() != keep.len() || out.vertices.len() != used.len() {
+        return None;
+    }
+    for r in &net.regions {
+        let loops: Option<Vec<Vec<usize>>> = r.loops.iter().map(|l| l.iter().map(|i| smap.get(i).copied()).collect::<Option<Vec<usize>>>()).collect();
+        if let Some(loops) = loops.filter(|l| !l.is_empty()) {
+            out.regions.push(Region { loops, ..r.clone() });
+        }
+    }
+    Some(out)
+}
+
+/// The clipboard's layer for edited vector `id` holding `sub`: it keeps the layer's look (fills,
+/// strokes, effects, opacity, blend) and its place on the page. A variable width profile runs
+/// along the whole path, so it stays only when every segment is copied.
+fn clip_node(doc: &Document, id: NodeId, mut sub: VectorNetwork) -> Option<Node> {
+    let mut n = doc.node(id)?.clone();
+    let whole = vectoredit::network(doc, id).is_some_and(|all| all.segments.len() == sub.segments.len());
+    let b = sub.bounds().filter(|b| b.x0.is_finite() && b.y0.is_finite() && b.width().is_finite() && b.height().is_finite())?;
+    sub.translate(-b.x0, -b.y0);
+    n.transform = doc.world_transform(id) * Affine::translate((b.x0, b.y0));
+    n.width = b.width();
+    n.height = b.height();
+    n.kind = NodeKind::Vector { network: sub };
+    n.parent = None;
+    n.children.clear();
+    n.name = "Vector".into();
+    if !whole {
+        n.stroke.width_profile = None;
+    }
+    Some(n)
+}
+
+/// Put the selection's sub-networks on the layer clipboard. Returns how many segments went.
+fn copy_parts(s: &mut Session, cmd: &str, sel: &EditSelection) -> Result<usize> {
+    let doc = s.doc()?;
+    let mut nodes = Vec::new();
+    let mut images = BTreeMap::new();
+    let mut bounds: Option<figcraft_geom::Rect> = None;
+    let mut segments = 0;
+    for (id, sub) in &sel.parts {
+        segments += sub.segments.len();
+        let Some(n) = clip_node(doc, *id, sub.clone()) else { continue };
+        let r = figcraft_geom::transform_rect_bbox(n.transform, n.local_rect());
+        bounds = Some(bounds.map_or(r, |b| b.union(r)));
+        collect_images(doc, std::slice::from_ref(&n), &mut images);
+        nodes.push((*id, vec![n]));
+    }
+    if nodes.is_empty() {
+        return Err(EngineError::Disabled(cmd.into(), "the selection has nothing to copy".into()));
+    }
+    store_clipboard(s, cmd, nodes, images, bounds)?;
+    Ok(segments)
+}
+
+/// Copy the selected segments (see [`edit_selection`]).
+pub(super) fn copy_selection(s: &mut Session, cmd: &str, sel: EditSelection) -> Result<Value> {
+    let segments = copy_parts(s, cmd, &sel)?;
+    Ok(json!({"copied": s.clipboard.nodes.len(), "segments": segments}))
+}
+
+/// Cut: copy the selected segments, then remove the selection as Delete does (the path splits in
+/// the same layer and edit mode stays on). Cut is Copy plus Delete, so it is refused exactly where
+/// Copy is: a selection with nothing to copy (only lone points that touch no segment) is
+/// `Disabled` and changes nothing, clipboard included. Delete removes such points.
+pub(super) fn cut_selection(s: &mut Session, sel: EditSelection) -> Result<Value> {
+    if sel.parts.is_empty() {
+        return Err(EngineError::Disabled("edit.cut".into(), "the selection has nothing to copy (Delete removes lone points)".into()));
+    }
+    let cut = sel.parts.len();
+    let segments = copy_parts(s, "edit.cut", &sel)?;
+    vectoredit::delete_selection(s, sel.delete, false)?;
+    Ok(json!({"cut": cut, "segments": segments}))
+}
+
+/// The SVG of the layers a partial vector-edit copy or cut put on the clipboard, for the system
+/// clipboard: they are temporary layers that live only in the clipboard, so they are placed in a
+/// scratch document to export. `None` when the clipboard holds none or the export fails.
+pub fn clipboard_svg(s: &Session) -> Option<String> {
+    let mut scratch = Document::new("Clipboard");
+    let page = scratch.current_page?;
+    for (k, v) in &s.clipboard.images {
+        scratch.images.insert(k.clone(), v.clone());
+    }
+    let mut ids = Vec::new();
+    for (root, nodes) in &s.clipboard.nodes {
+        let map: BTreeMap<NodeId, NodeId> = nodes.iter().map(|n| (n.id, scratch.alloc_id())).collect();
+        ids.push(scratch.paste_nodes(nodes, &map, *root, page, None).ok()?);
+    }
+    let bytes = crate::cmd::file::export_bytes(&scratch, &ids, figcraft_doc::ExportFormat::Svg, 1.0).ok()?;
+    String::from_utf8(bytes).ok()
+}
+
+/// The network of the outline of copied layer `n` in its own coordinates: a vector's segments, a
+/// shape's or boolean's outline. `None` for the layers with no outline to add (text, images,
+/// frames, groups, instances, …). `doc` is the file the layer was copied from.
+fn outline_network(doc: &Document, n: &Node) -> Option<VectorNetwork> {
+    let net = match &n.kind {
+        NodeKind::Vector { network } => network.clone(),
+        k if k.is_shape() || matches!(k, NodeKind::BooleanOp { .. }) => {
+            let (path, rule) = figcraft_render::node_outline(doc, n)?;
+            let mut net = VectorNetwork::from_path(&path);
+            if matches!(n.kind, NodeKind::Line) {
+                net.regions.clear();
+            }
+            if rule == figcraft_render::FillRule::EvenOdd {
+                for r in &mut net.regions {
+                    r.winding = figcraft_doc::WindingRule::EvenOdd;
+                }
+            }
+            net
+        }
+        _ => return None,
+    };
+    (!net.segments.is_empty()).then_some(net)
+}
+
+/// `net` moved by `m` (points, handles, the regions' paint frames and the points' radii).
+fn placed(mut net: VectorNetwork, m: Affine) -> Option<VectorNetwork> {
+    let c = m.as_coeffs();
+    if !c.iter().all(|x| x.is_finite()) {
+        return None;
+    }
+    let linear = Affine::new([c[0], c[1], c[2], c[3], 0.0, 0.0]);
+    let scale = m.determinant().abs().sqrt();
+    for v in &mut net.vertices {
+        let p = m * v.point();
+        (v.x, v.y) = (p.x, p.y);
+        v.radius *= scale;
+    }
+    for sg in &mut net.segments {
+        let (ta, tb) = (linear * figcraft_geom::Point::new(sg.ta.0, sg.ta.1), linear * figcraft_geom::Point::new(sg.tb.0, sg.tb.1));
+        sg.ta = (ta.x, ta.y);
+        sg.tb = (tb.x, tb.y);
+    }
+    for r in &mut net.regions {
+        if let Some(frame) = r.paint_space.as_mut() {
+            frame.transform = m * frame.transform;
+        }
+    }
+    let finite = net.vertices.iter().all(|v| v.x.is_finite() && v.y.is_finite())
+        && net.segments.iter().all(|sg| [sg.ta.0, sg.ta.1, sg.tb.0, sg.tb.1].iter().all(|x| x.is_finite()));
+    finite.then_some(net)
+}
+
+/// Paste while editing a vector: the clipboard's layers join its network in place (with `x`, `y`:
+/// the copied top-left moved there), their points selected. Layers with no outline are skipped
+/// (named in `skipped`); when none has one, nothing is pasted.
+pub(super) fn paste_into_vector(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "edit.paste";
+    if s.clipboard.nodes.is_empty() {
+        return Err(EngineError::Disabled(CMD.into(), "the clipboard is empty".into()));
+    }
+    let target = vectoredit::editing(s)?.id;
+    let shift = match (num(p, "x"), num(p, "y"), s.clipboard.bounds) {
+        (Some(x), Some(y), Some(b)) => Affine::translate((x - b.x0, y - b.y0)),
+        (None, None, _) | (Some(_), Some(_), None) => Affine::IDENTITY,
+        _ => return Err(bad(CMD, "give both x and y, or neither")),
+    };
+    let live = s.doc()?;
+    // Borrow the clipboard (it holds the source document and the images) to build the pieces.
+    let clip = &s.clipboard;
+    let source: &Document = clip.source.as_deref().unwrap_or(live);
+    let to_local = live.world_transform(target).inverse() * shift;
+    let mut pieces = Vec::new();
+    let mut skipped: Vec<String> = Vec::new();
+    for (_, nodes) in &clip.nodes {
+        let Some(root) = nodes.first() else { continue };
+        match outline_network(source, root).and_then(|net| placed(net, to_local * root.transform)) {
+            Some(net) => pieces.push(net),
+            None => skipped.push(root.name.clone()),
+        }
+    }
+    if pieces.is_empty() {
+        return Err(EngineError::Disabled(
+            CMD.into(),
+            "none of the copied layers has an outline to add to the vector (text, frames and groups have none)".into(),
+        ));
+    }
+    let have = vectoredit::network(live, target).map_or(0, |n| n.segments.len());
+    if have.saturating_add(pieces.iter().map(|n| n.segments.len()).sum::<usize>()) > MAX_SEGMENTS {
+        return Err(EngineError::Disabled(CMD.into(), format!("a vector takes at most {MAX_SEGMENTS} segments")));
+    }
+    let mut pasted: Vec<usize> = Vec::new();
+    vectoredit::edit(s.doc_mut()?, target, |net| {
+        for piece in pieces {
+            let (vo, so) = (net.vertices.len(), net.segments.len());
+            pasted.extend(vo..vo + piece.vertices.len());
+            net.vertices.extend(piece.vertices);
+            net.segments.extend(piece.segments.into_iter().map(|mut sg| {
+                sg.a += vo;
+                sg.b += vo;
+                sg
+            }));
+            net.regions.extend(piece.regions.into_iter().map(|mut r| {
+                for i in r.loops.iter_mut().flatten() {
+                    *i += so;
+                }
+                r
+            }));
+        }
+    })?;
+    let selected = pasted.clone();
+    vectoredit::set_state(s, |ve| {
+        ve.clear_selection();
+        ve.clear_regions();
+        ve.vertices = selected;
+        ve.anchor = None;
+        ve.pen_out = None;
+        ve.width_point = None;
+    })?;
+    // `ids` stays empty: no layer is created, the pasted outlines joined layer `edited`.
+    let mut out = json!({"ids": [], "edited": target, "vertices": pasted.len()});
+    if !skipped.is_empty() {
+        out["skipped"] = json!(skipped);
+    }
+    Ok(out)
+}

crates/engine/src/cmd/edit/vector_clipboard_tests.rs

@@ -0,0 +1,442 @@
+//! Copy, cut and paste in vector edit mode (#1875), measured in Figma: Copy takes the selected
+//! segments (a lone point: the segments touching it) and a paste outside is a new vector in place;
+//! Cut removes them, splitting the path in the same layer; Paste while editing adds the clipboard's
+//! segments or a copied layer's outline to the vector's network in place, selected.
+
+use serde_json::{Value, json};
+
+use crate::{EngineError, Session, params};
+use figcraft_doc::{NodeId, NodeKind, VectorNetwork};
+
+fn ex(s: &mut Session, c: &str, p: Value) -> Value {
+    s.execute(c, &p).unwrap_or_else(|e| panic!("{c}: {e}"))
+}
+
+fn id_of(v: &Value) -> NodeId {
+    params::id_of(&v["id"]).unwrap()
+}
+
+/// Open path A-B-C-D (three segments) with a look of its own, in edit mode.
+fn path(s: &mut Session) -> NodeId {
+    let r = ex(s, "vector.create", json!({"points": [[100, 100], [200, 150], [300, 100], [400, 200]], "closed": false}));
+    let id = id_of(&r);
+    ex(s, "node.set", json!({"id": id, "props": {"strokeWeight": 7, "opacity": 0.5}}));
+    ex(s, "vector.edit.begin", json!({"id": id}));
+    id
+}
+
+fn net(s: &Session, id: NodeId) -> VectorNetwork {
+    crate::vectoredit::network(s.doc().unwrap(), id).unwrap().clone()
+}
+
+fn layers(s: &Session) -> Vec<NodeId> {
+    s.doc().unwrap().node(s.page().unwrap()).unwrap().children.clone()
+}
+
+/// The network's points on the page, rounded, in vertex order.
+fn page_points(s: &Session, id: NodeId) -> Vec<(i64, i64)> {
+    let w = s.doc().unwrap().world_transform(id);
+    net(s, id).vertices.iter().map(|v| w * v.point()).map(|p| (p.x.round() as i64, p.y.round() as i64)).collect()
+}
+
+/// The number of separate paths a network is made of.
+fn subpaths(n: &VectorNetwork) -> usize {
+    let mut group: Vec<usize> = (0..n.vertices.len()).collect();
+    fn root(g: &[usize], mut i: usize) -> usize {
+        while g[i] != i {
+            i = g[i];
+        }
+        i
+    }
+    for sg in &n.segments {
+        let (a, b) = (root(&group, sg.a), root(&group, sg.b));
+        group[a] = b;
+    }
+    (0..n.vertices.len()).filter(|i| root(&group, *i) == *i && n.segments.iter().any(|sg| root(&group, sg.a) == *i)).count()
+}
+
+fn select(s: &mut Session, vertices: &[usize], segments: &[usize]) {
+    ex(s, "vector.edit.select", json!({"vertices": vertices, "segments": segments}));
+}
+
+fn leave(s: &mut Session) {
+    ex(s, "vector.edit.end", json!({}));
+    assert!(s.ds().unwrap().vector_edit.is_none());
+}
+
+fn world_rect(s: &Session, id: NodeId) -> (f64, f64, f64, f64) {
+    let b = s.doc().unwrap().world_bounds(id).unwrap();
+    (b.x0, b.y0, b.width(), b.height())
+}
+
+#[test]
+fn a_copied_segment_pastes_outside_as_a_new_vector_in_place() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    let r = ex(&mut s, "edit.copy", json!({}));
+    assert_eq!(r["segments"], 1);
+    assert_eq!(net(&s, id).segments.len(), 3, "Copy changes nothing");
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let all = layers(&s);
+    assert_eq!(all.len(), 2);
+    let new = all[1];
+    let n = net(&s, new);
+    assert_eq!((n.vertices.len(), n.segments.len()), (2, 1));
+    assert_eq!(page_points(&s, new), vec![(200, 150), (300, 100)], "at the segment's own page position");
+    assert_eq!(world_rect(&s, new), (200.0, 100.0, 100.0, 50.0));
+    // The layer's look comes along (the width profile aside).
+    let node = s.doc().unwrap().node(new).unwrap();
+    assert_eq!((node.stroke.weight, node.opacity), (7.0, 0.5));
+    assert_eq!(s.selection(), vec![new]);
+}
+
+#[test]
+fn a_copied_point_takes_the_segments_touching_it() {
+    let mut s = Session::new();
+    path(&mut s);
+    select(&mut s, &[1], &[]);
+    ex(&mut s, "edit.copy", json!({}));
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    let n = net(&s, new);
+    assert_eq!((n.vertices.len(), n.segments.len()), (3, 2), "A-B and B-C");
+    assert_eq!(page_points(&s, new), vec![(100, 100), (200, 150), (300, 100)]);
+}
+
+#[test]
+fn nothing_selected_still_copies_the_whole_layer() {
+    let mut s = Session::new();
+    path(&mut s);
+    ex(&mut s, "edit.copy", json!({}));
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    assert_eq!(net(&s, new).segments.len(), 3);
+}
+
+#[test]
+fn cut_removes_the_segment_in_the_same_layer_and_stays_in_edit_mode() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.cut", json!({}));
+    assert_eq!(layers(&s), vec![id], "no new layer");
+    let n = net(&s, id);
+    assert_eq!(n.segments.len(), 2);
+    assert_eq!(subpaths(&n), 2, "the path split in two");
+    let ve = s.ds().unwrap().vector_edit.clone().expect("edit mode stays on");
+    assert!(ve.segments.is_empty() && ve.vertices.is_empty());
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let all = layers(&s);
+    assert_eq!(all.len(), 2);
+    let new = all[1];
+    assert_eq!(net(&s, new).segments.len(), 1);
+    assert_eq!(page_points(&s, new), vec![(200, 150), (300, 100)]);
+}
+
+#[test]
+fn cut_is_one_undo_step() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.cut", json!({}));
+    assert_eq!(net(&s, id).segments.len(), 2);
+    s.undo().unwrap();
+    assert_eq!(net(&s, id).segments.len(), 3);
+    assert_eq!(page_points(&s, id), vec![(100, 100), (200, 150), (300, 100), (400, 200)]);
+}
+
+#[test]
+fn a_cut_point_takes_its_segments_with_it() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[1], &[]);
+    ex(&mut s, "edit.cut", json!({}));
+    assert_eq!(net(&s, id).segments.len(), 1, "only C-D is left");
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    assert_eq!(net(&s, new).segments.len(), 2, "A-B and B-C");
+}
+
+#[test]
+fn pasting_segments_while_editing_adds_them_to_the_same_network_in_place() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    let r = ex(&mut s, "edit.paste", json!({}));
+    assert_eq!(r["vertices"], 2);
+    assert_eq!(layers(&s), vec![id], "no new layer");
+    let n = net(&s, id);
+    assert_eq!((n.vertices.len(), n.segments.len()), (6, 4));
+    assert_eq!(page_points(&s, id)[4..], [(200, 150), (300, 100)], "on top of the original");
+    let ve = s.ds().unwrap().vector_edit.clone().unwrap();
+    assert_eq!(ve.vertices, vec![4, 5], "the pasted points are selected");
+    assert!(ve.segments.is_empty());
+    // One undo reverts it.
+    s.undo().unwrap();
+    assert_eq!(net(&s, id).segments.len(), 3);
+    assert_eq!(net(&s, id).vertices.len(), 4);
+}
+
+#[test]
+fn pasting_at_a_point_moves_the_copied_top_left_there() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    ex(&mut s, "edit.paste", json!({"x": 0, "y": 0}));
+    assert_eq!(page_points(&s, id)[4..], [(0, 50), (100, 0)]);
+}
+
+#[test]
+fn pasting_a_rectangle_while_editing_adds_its_outline_in_the_vectors_coordinates() {
+    let mut s = Session::new();
+    let rect = id_of(&ex(&mut s, "shape.rectangle", json!({"x": 500, "y": 300, "width": 60, "height": 40})));
+    ex(&mut s, "select.set", json!({"ids": [rect]}));
+    ex(&mut s, "edit.copy", json!({}));
+    let id = path(&mut s);
+    let before = world_rect(&s, id);
+    ex(&mut s, "edit.paste", json!({}));
+    assert_eq!(layers(&s), vec![rect, id], "no new layer");
+    let n = net(&s, id);
+    assert_eq!((n.vertices.len(), n.segments.len()), (8, 7), "four corners, four sides, joined to the path");
+    let mut corners: Vec<(i64, i64)> = page_points(&s, id)[4..].to_vec();
+    corners.sort_unstable();
+    assert_eq!(corners, vec![(500, 300), (500, 340), (560, 300), (560, 340)]);
+    let ve = s.ds().unwrap().vector_edit.clone().unwrap();
+    assert_eq!(ve.vertices, vec![4, 5, 6, 7]);
+    let after = world_rect(&s, id);
+    assert!(after.2 > before.2 && after.3 > before.3, "the vector's bounds grow: {before:?} to {after:?}");
+    assert_eq!((after.0, after.1), (before.0, before.1));
+    assert_eq!(after.0 + after.2, 560.0);
+    s.undo().unwrap();
+    assert_eq!(net(&s, id).vertices.len(), 4);
+    assert_eq!(world_rect(&s, id), before);
+}
+
+#[test]
+fn a_rotated_vector_takes_pasted_points_in_its_own_coordinates() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    ex(&mut s, "node.set", json!({"id": id, "props": {"rotation": 90}}));
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    let before = page_points(&s, id);
+    assert_ne!(before[0], (100, 100), "the vector is rotated");
+    ex(&mut s, "edit.paste", json!({}));
+    let after = page_points(&s, id);
+    assert_eq!(after[4..], before[1..3]);
+}
+
+#[test]
+fn layers_with_no_outline_are_skipped_and_named() {
+    let mut s = Session::new();
+    let rect = id_of(&ex(&mut s, "shape.rectangle", json!({"x": 500, "y": 300, "width": 60, "height": 40})));
+    let text = id_of(&ex(&mut s, "text.create", json!({"text": "hello", "x": 500, "y": 400})));
+    let name = s.doc().unwrap().node(text).unwrap().name.clone();
+    // Only text: nothing to add, and nothing changes.
+    ex(&mut s, "select.set", json!({"ids": [text]}));
+    ex(&mut s, "edit.copy", json!({}));
+    let id = path(&mut s);
+    let err = s.execute("edit.paste", &json!({})).unwrap_err();
+    assert!(matches!(err, EngineError::Disabled(..)), "{err}");
+    assert_eq!(net(&s, id).vertices.len(), 4);
+    // The rectangle joins, the text is named as skipped.
+    leave(&mut s);
+    ex(&mut s, "edit.copy", json!({"ids": [rect, text]}));
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    let r = ex(&mut s, "edit.paste", json!({}));
+    assert_eq!(r["skipped"], json!([name]));
+    assert_eq!(net(&s, id).vertices.len(), 8);
+}
+
+#[test]
+fn a_parent_still_pastes_layers_while_editing() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[1]);
+    ex(&mut s, "edit.copy", json!({}));
+    let page = s.page().unwrap();
+    ex(&mut s, "edit.paste", json!({"parent": page}));
+    assert_eq!(layers(&s).len(), 2);
+    assert_eq!(net(&s, id).segments.len(), 3);
+}
+
+#[test]
+fn an_empty_clipboard_refuses_to_paste_while_editing() {
+    let mut s = Session::new();
+    path(&mut s);
+    assert!(matches!(s.execute("edit.paste", &json!({})), Err(EngineError::Disabled(..))));
+}
+
+#[test]
+fn a_selected_face_copies_its_own_outline_with_the_fill() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "shape.rectangle", json!({"x": 100, "y": 100, "width": 80, "height": 60}));
+    let id = id_of(&r);
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    select(&mut s, &[], &[0, 1, 2, 3]);
+    ex(&mut s, "edit.copy", json!({}));
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    let n = net(&s, new);
+    assert_eq!((n.segments.len(), n.regions.len()), (4, 1), "the closed shape stays filled");
+    assert!(matches!(s.doc().unwrap().node(new).unwrap().kind, NodeKind::Vector { .. }));
+}
+
+/// Everything junk must not change when a command is refused: the vector, the layers, the edit
+/// selection and what the clipboard holds.
+fn state(s: &Session, id: NodeId) -> String {
+    let ve = s.ds().unwrap().vector_edit.clone();
+    let clip: Vec<String> = s.clipboard.nodes.iter().flat_map(|(_, n)| n).map(|n| format!("{:?}", n.kind)).collect();
+    format!("{:?}|{:?}|{:?}|{:?}|{}", net(s, id), layers(s), ve.map(|v| (v.vertices, v.segments)), clip, s.clipboard.layers_generation)
+}
+
+fn finite(n: &VectorNetwork) -> bool {
+    n.vertices.iter().all(|v| v.x.is_finite() && v.y.is_finite())
+        && n.segments.iter().all(|sg| [sg.ta.0, sg.ta.1, sg.tb.0, sg.tb.1].iter().all(|x| x.is_finite()))
+}
+
+#[test]
+fn copy_cut_and_paste_survive_junk_in_vector_edit_mode() {
+    let junk = [
+        json!({}),
+        json!(null),
+        json!([1, 2]),
+        json!({"ids": ["x", -1, 99999]}),
+        json!({"id": "nope", "x": "NaN", "y": 1e308}),
+        json!({"parent": "nope", "x": -1e308, "y": "x"}),
+        json!({"x": 1e308, "y": 1e308}),
+        json!({"x": 1e308}),
+    ];
+    for cmd in ["edit.copy", "edit.cut", "edit.paste", "edit.pasteOver", "edit.pasteReplace"] {
+        for j in &junk {
+            // Both a selection with a text layer next to it, and after a copy from the selection.
+            for copied in [false, true] {
+                let mut s = Session::new();
+                let id = path(&mut s);
+                if copied {
+                    select(&mut s, &[2], &[]);
+                    let _ = s.execute("edit.copy", &json!({}));
+                } else {
+                    select(&mut s, &[1], &[0]);
+                    ex(&mut s, "text.create", json!({"text": "t"}));
+                    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+                    select(&mut s, &[1], &[0]);
+                }
+                let before = state(&s, id);
+                match s.execute(cmd, j) {
+                    Err(EngineError::Internal { cmd, msg }) => panic!("{cmd} panicked on {j}: {msg}"),
+                    Err(_) => {
+                        if cmd != "edit.pasteOver" && cmd != "edit.pasteReplace" {
+                            assert_eq!(state(&s, id), before, "{cmd} {j} was refused but changed something");
+                        }
+                    }
+                    // Accepted: whatever it made has finite coordinates.
+                    Ok(_) => {
+                        if let Some(n) = crate::vectoredit::network(s.doc().unwrap(), id) {
+                            assert!(finite(n), "{cmd} {j} left non-finite coordinates");
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn a_huge_paste_position_is_refused_or_stays_finite() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[0]);
+    ex(&mut s, "edit.copy", json!({}));
+    let before = state(&s, id);
+    match s.execute("edit.paste", &json!({"x": 1e308, "y": 1e308})) {
+        Err(e) => {
+            assert!(!matches!(e, EngineError::Internal { .. }), "{e}");
+            assert_eq!(state(&s, id), before, "a refused paste changed something");
+        }
+        // It is accepted here: 1e308 plus a few hundred is still finite, so the points are too.
+        Ok(_) => assert!(finite(&net(&s, id)), "the points are finite"),
+    }
+}
+
+#[test]
+fn cut_with_only_lone_points_is_refused_like_copy_and_changes_nothing() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    // A point no segment touches.
+    crate::vectoredit::edit(s.doc_mut().unwrap(), id, |n| n.vertices.push(figcraft_doc::Vertex::new(50.0, 50.0))).unwrap();
+    // Something on the clipboard first, then only the lone point selected.
+    select(&mut s, &[0], &[]);
+    ex(&mut s, "edit.copy", json!({}));
+    select(&mut s, &[4], &[]);
+    let before = state(&s, id);
+    for cmd in ["edit.copy", "edit.cut"] {
+        let err = s.execute(cmd, &json!({})).expect_err(cmd);
+        assert!(matches!(err, EngineError::Disabled(..)), "{cmd}: {err}");
+        assert_eq!(state(&s, id), before, "{cmd} changed something");
+    }
+    // Delete is the way to remove it.
+    ex(&mut s, "vector.edit.delete", json!({}));
+    assert_eq!(net(&s, id).vertices.len(), 4);
+}
+
+#[test]
+fn only_one_of_x_and_y_is_refused_and_pastes_nothing() {
+    let mut s = Session::new();
+    let id = path(&mut s);
+    select(&mut s, &[], &[0]);
+    ex(&mut s, "edit.copy", json!({}));
+    let before = state(&s, id);
+    for p in [json!({"x": 10}), json!({"y": 10})] {
+        let err = s.execute("edit.paste", &p).expect_err("one coordinate");
+        assert!(err.to_string().contains("give both x and y, or neither"), "{err}");
+        assert_eq!(state(&s, id), before);
+    }
+    ex(&mut s, "edit.paste", json!({"x": 10, "y": 10}));
+}
+
+#[test]
+fn a_partial_copy_has_an_svg_for_the_system_clipboard() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "shape.rectangle", json!({"x": 100, "y": 100, "width": 80, "height": 60}));
+    assert!(crate::cmd::edit::clipboard_svg(&s).is_none(), "nothing copied yet");
+    ex(&mut s, "vector.edit.begin", json!({"id": id_of(&r)}));
+    select(&mut s, &[], &[0, 1, 2, 3]);
+    ex(&mut s, "edit.copy", json!({}));
+    let svg = crate::cmd::edit::clipboard_svg(&s).expect("svg");
+    assert!(svg.contains("<svg") && svg.contains("<path"), "{svg}");
+}
+
+#[test]
+fn cutting_a_selected_region_deletes_exactly_the_segments_it_copies_and_keeps_a_tail() {
+    let mut s = Session::new();
+    let r = ex(&mut s, "vector.create", json!({"points": [[100, 100], [200, 100], [150, 200]], "closed": true}));
+    let id = id_of(&r);
+    // A tail: one open segment from the first corner to a new point.
+    crate::vectoredit::edit(s.doc_mut().unwrap(), id, |n| {
+        n.vertices.push(figcraft_doc::Vertex::new(20.0, 20.0));
+        let tail = n.vertices.len() - 1;
+        crate::vectoredit::ops::connect(n, 0, tail, (0.0, 0.0), (0.0, 0.0));
+    })
+    .unwrap();
+    assert_eq!((net(&s, id).segments.len(), net(&s, id).regions.len()), (4, 1));
+    ex(&mut s, "vector.edit.begin", json!({"id": id}));
+    ex(&mut s, "vector.edit.select", json!({"regions": [0]}));
+    ex(&mut s, "edit.cut", json!({}));
+    let n = net(&s, id);
+    assert_eq!(n.segments.len(), 1, "only the tail is left");
+    assert!(n.regions.is_empty());
+    leave(&mut s);
+    ex(&mut s, "edit.paste", json!({}));
+    let new = *layers(&s).last().unwrap();
+    assert_eq!(net(&s, new).segments.len(), 3, "the copy holds the region's three segments, not the tail");
+}

crates/engine/src/cmd/file/export.rs

@@ -1,7 +1,7 @@
 use super::load::{ext, write};
 use super::save::thumbnail;
 use super::*;
-use crate::params::f64_of;
+use crate::params::{f64_of, req_targets};
 
 /// Encode `ids` (or the page) in `format` at `scale`.
 pub fn export_bytes(doc: &Document, ids: &[NodeId], format: ExportFormat, scale: f64) -> Result<Vec<u8>> {
@@ -86,7 +86,7 @@ pub(super) fn export(s: &mut Session, p: &Value) -> Result<Value> {
         _ => {}
     }
     let doc = s.doc()?;
-    let mut ids = targets(s, p);
+    let mut ids = export_targets(cmd, s, p)?;
     if ids.is_empty() {
         ids = doc.get(s.page()?)?.children.clone();
     }
@@ -325,11 +325,22 @@ pub fn exportable_layers(doc: &Document, page: NodeId) -> Vec<NodeId> {
     doc.subtree(page).into_iter().skip(1).filter(|i| doc.node(*i).is_some_and(|n| !n.exports.is_empty())).collect()
 }
 
+/// Named layers (`ids` / `id`), checked like other commands; empty when none are named, so the
+/// caller can fall back to its default instead of silently dropping a bad id.
+fn export_targets(cmd: &str, s: &Session, p: &Value) -> Result<Vec<NodeId>> {
+    let named = match get(p, "ids") {
+        Some(Value::Array(a)) if !a.is_empty() => true,
+        Some(Value::Array(_) | Value::Null) | None => get(p, "id").is_some_and(|v| !v.is_null()),
+        Some(_) => true,
+    };
+    if named { req_targets(cmd, s, p) } else { Ok(targets(s, p)) }
+}
+
 pub(super) fn export_layers(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "file.exportLayers";
     let doc = s.doc()?;
     let assets = boolean(p, "assets").unwrap_or(false);
-    let mut ids = targets(s, p);
+    let mut ids = export_targets(cmd, s, p)?;
     if ids.is_empty() {
         ids = if assets { vec![s.page()?] } else { exportable_layers(doc, s.page()?) };
     }

crates/engine/src/cmd/file/load.rs

@@ -399,11 +399,19 @@ pub(crate) fn load_fig(bytes: &[u8], name: &str) -> Option<Result<figcraft_forma
     }))
 }
 
+/// The most layers all of a Penpot file's raw SVG placeholders may expand to together.
+const MAX_PENPOT_SVG_LAYERS: usize = 100_000;
+
 /// Turn Penpot raw SVG placeholders into editable FigCraft SVG content, using the
 /// normal SVG importer. The parser (figcraft-format) only stores bounded XML so it
 /// does not need to depend on the SVG crate; the engine does this second pass.
 /// Any failure leaves the original placeholder and XML data intact for later use.
 fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
+    expand_penpot_raw_svgs_within(doc, notes, MAX_PENPOT_SVG_LAYERS);
+}
+
+/// [`expand_penpot_raw_svgs`] with at most `room` layers made in all.
+fn expand_penpot_raw_svgs_within(doc: &mut Document, notes: &mut Vec<String>, mut room: usize) {
     let layers = doc
         .nodes()
         .filter_map(|node| {
@@ -413,12 +421,24 @@ fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
         })
         .collect::<Vec<_>>();
     let mut ok_count = 0usize;
+    // The SVG importer caps its own layers per file; `room` is the cap over all of a file's placeholders.
     for (id, name, width, height, xml, empty) in layers {
+        if room == 0 {
+            if let Some(n) = doc.node_mut(id) {
+                n.plugin_data.insert("penpot.svgRawStatus".into(), "not-expanded".into());
+            }
+            if notes.len() < 100 {
+                notes.push(format!("Penpot SVG '{name}': not converted, the file's SVG layers are over the limit; the original markup is preserved"));
+            }
+            continue;
+        }
         if !empty {
             notes.push(format!("Penpot SVG '{name}': has separate child layers; the original tree was preserved to prevent duplicate rendering"));
             continue;
         }
-        match figcraft_svg::import_svg_with_notes(doc, xml.as_bytes(), id, 0.0, 0.0, &name) {
+        let before = doc.node_count();
+        let imported = figcraft_svg::import_svg_with_notes(doc, xml.as_bytes(), id, 0.0, 0.0, &name);
+        match imported {
             Ok(imported) => {
                 // An SVG can be syntactically valid yet contain no supported drawable
                 // elements. Do not claim success or leave an empty extra frame.
@@ -432,6 +452,21 @@ fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
                     }
                     continue;
                 }
+                // Charged once the empty ones are gone; one that doesn't fit is taken out again.
+                let added = doc.node_count().saturating_sub(before);
+                if added > room {
+                    let _ = doc.remove(imported.frame);
+                    if let Some(n) = doc.node_mut(id) {
+                        n.plugin_data.insert("penpot.svgRawStatus".into(), "not-expanded".into());
+                    }
+                    if notes.len() < 100 {
+                        notes.push(format!(
+                            "Penpot SVG '{name}': not converted, the file's SVG layers are over the limit; the original markup is preserved"
+                        ));
+                    }
+                    continue;
+                }
+                room -= added;
                 let size = doc.node(imported.frame).map(|n| (n.width, n.height));
                 if let Some((svg_w, svg_h)) = size
                     && svg_w.is_finite()
@@ -470,6 +505,28 @@ fn expand_penpot_raw_svgs(doc: &mut Document, notes: &mut Vec<String>) {
     }
 }
 
+/// Whether some of the first `len` characters are in none of `runs`. Where runs start and stop
+/// covering is summed once, so runs overlapping any number of times cost no more than their count.
+fn has_uncovered(len: usize, runs: &[figcraft_doc::StyleRun]) -> bool {
+    let mut change = vec![0i64; len + 1];
+    for run in runs {
+        let (start, end) = (run.start.min(len), run.end.min(len));
+        if start < end {
+            if let Some(c) = change.get_mut(start) {
+                *c += 1;
+            }
+            if let Some(c) = change.get_mut(end) {
+                *c -= 1;
+            }
+        }
+    }
+    let mut open = 0i64;
+    change.iter().take(len).any(|c| {
+        open += c;
+        open <= 0
+    })
+}
+
 /// Non-destructive font diagnostic for the action palette, CLI and control API.
 /// Includes styled runs, not just the default typeface of each text layer.
 pub(super) fn font_report(doc: &Document) -> Value {
@@ -485,21 +542,15 @@ fn font_report_with_families(doc: &Document, installed: &[String]) -> Value {
         if text.characters.is_empty() {
             continue;
         }
-        let mut covered = vec![false; text.characters.chars().count().min(100_000)];
+        let len = text.characters.chars().count().min(100_000);
         let mut used = BTreeSet::new();
         for run in &text.runs {
-            let start = run.start.min(covered.len());
-            let end = run.end.min(covered.len());
-            if start < end {
-                if !run.style.font_family.trim().is_empty() {
-                    used.insert(run.style.font_family.clone());
-                }
-                for entry in covered.iter_mut().take(end).skip(start) {
-                    *entry = true;
-                }
+            if run.start.min(len) < run.end.min(len) && !run.style.font_family.trim().is_empty() {
+                used.insert(run.style.font_family.clone());
             }
         }
-        if covered.iter().any(|entry| !entry) {
+        let uncovered = has_uncovered(len, &text.runs);
+        if uncovered {
             used.insert(text.style.font_family.clone());
         }
         for family in used {
@@ -599,19 +650,14 @@ fn missing_penpot_font_warnings(doc: &Document, families: &[String]) -> Vec<Stri
         if text_len == 0 {
             continue;
         }
-        let mut covered = vec![false; text_len.min(100_000)];
+        let len = text_len.min(100_000);
         let mut used = BTreeSet::new();
         for run in &text.runs {
-            let start = run.start.min(covered.len());
-            let end = run.end.min(covered.len());
-            if start < end {
+            if run.start.min(len) < run.end.min(len) {
                 used.insert(run.style.font_family.clone());
-                for flag in covered.iter_mut().take(end).skip(start) {
-                    *flag = true;
-                }
             }
         }
-        if covered.iter().any(|present| !present) {
+        if has_uncovered(len, &text.runs) {
             used.insert(text.style.font_family.clone());
         }
         for family in used {
@@ -652,8 +698,10 @@ fn link_instances(doc: &mut Document) {
     let mut insts: Vec<(usize, NodeId)> =
         doc.nodes().filter(|n| matches!(n.kind, NodeKind::Instance { .. })).map(|n| (doc.ancestors(n.id).len(), n.id)).collect();
     insts.sort_by_key(|a| std::cmp::Reverse(a.0));
+    // Rebasing leaves the mains alone, so each main's layer paths are worked out once.
+    let mut mains = crate::components::MainPaths::new();
     for (_, i) in insts {
-        crate::components::rebase_instance(doc, i);
+        crate::components::rebase_instance_with(doc, i, &mut mains);
     }
 }
 
@@ -790,6 +838,47 @@ mod penpot_svg_v10_tests {
     use super::*;
     use figcraft_doc::TextData;
 
+    #[test]
+    fn placeholders_share_one_layer_allowance() {
+        let mut doc = Document::new("Two SVGs");
+        let page = doc.first_page().unwrap();
+        let svg = r#"<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><rect width="5" height="5" fill="red"/><rect x="5" width="5" height="5" fill="blue"/></svg>"#;
+        let ids: Vec<NodeId> = (0..2)
+            .map(|i| {
+                let id = doc.create(page, NodeKind::Frame, &format!("S{i}"), 0.0, 0.0, 10.0, 10.0).unwrap();
+                let layer = doc.node_mut(id).unwrap();
+                layer.plugin_data.insert("penpot.svgRawXml".into(), svg.into());
+                layer.plugin_data.insert("penpot.svgRawStatus".into(), "pending".into());
+                id
+            })
+            .collect();
+        let mut warnings = Vec::new();
+        let nodes = doc.node_count();
+        expand_penpot_raw_svgs_within(&mut doc, &mut warnings, 4);
+        assert!(doc.node_count() - nodes <= 4, "never more layers than the allowance");
+        let status = |i: usize| doc.node(ids[i]).unwrap().plugin_data.get("penpot.svgRawStatus").cloned();
+        assert_eq!(status(0).as_deref(), Some("expanded"), "the first uses the allowance");
+        assert_eq!(status(1).as_deref(), Some("not-expanded"));
+        assert!(doc.node(ids[1]).unwrap().children.is_empty());
+        assert!(warnings.iter().any(|w| w.contains("over the limit")), "{warnings:?}");
+    }
+
+    #[test]
+    fn many_overlapping_style_runs_are_summed_once() {
+        use figcraft_doc::StyleRun;
+        let mut doc = Document::new("Runs");
+        let page = doc.first_page().unwrap();
+        let mut t = TextData::new("x".repeat(100_000));
+        t.style.font_family = "Unused Base".into();
+        let mut run = t.style.clone();
+        run.font_family = "Run Font".into();
+        t.runs = (0..50_000).map(|_| StyleRun { start: 0, end: 100_000, style: run.clone() }).collect();
+        doc.create(page, NodeKind::Text(t), "Long", 0.0, 0.0, 100.0, 30.0).unwrap();
+        let report = font_report_with_families(&doc, &[]);
+        assert_eq!(report["fonts"].as_array().map(Vec::len), Some(1), "{report}");
+        assert_eq!(report["fonts"][0]["family"], "Run Font");
+    }
+
     #[test]
     fn expands_inline_svg_into_editable_shapes_without_discarding_source() {
         let mut doc = Document::new("SVG fixture");

crates/engine/src/cmd/image.rs

@@ -5,7 +5,7 @@ use figcraft_doc::{Document, ImagePreset, Node};
 use serde_json::{Value, json};
 
 use super::{CommandSpec, ok};
-use crate::params::{f64_of, get, num, req_index, req_string, req_targets, string, targets};
+use crate::params::{f64_of, get, req_index, req_string, req_targets, string, targets};
 use crate::{EngineError, Result, Session, bad, spec};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -236,7 +236,10 @@ fn save_preset(s: &mut Session, p: &Value) -> Result<Value> {
         Some(v) => with_values(cmd, ImageFilters::NONE, v)?,
         None => {
             let stroke = strokes(cmd, p)?;
-            let index = num(p, "index").filter(|k| k.is_finite() && *k >= 0.0).map(|k| k as usize);
+            let index = match get(p, "index") {
+                None | Some(Value::Null) => None,
+                Some(_) => Some(req_index(cmd, p, "index")?),
+            };
             let doc = s.doc()?;
             targets(s, p)
                 .iter()

crates/engine/src/cmd/structure.rs

@@ -799,7 +799,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
                     WindingRule::NonZero
                 };
                 let path = drawn.fill_path();
-                let path = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                let path = figcraft_geom::simplify_path(&path, tol);
                 let (path, output_winding) = match figcraft_pathops::simplify_with_rule(&path, winding == WindingRule::EvenOdd) {
                     Ok(path) => (path, WindingRule::EvenOdd),
                     Err(_) => (path, winding),
@@ -809,7 +809,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
             } else {
                 for (index, region) in source.regions.iter().enumerate() {
                     let Some(path) = drawn.region_path(index) else { continue };
-                    let path = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                    let path = figcraft_geom::simplify_path(&path, tol);
                     let path = figcraft_pathops::simplify_with_rule(&path, region.winding == WindingRule::EvenOdd).unwrap_or(path);
                     append_region_path(&mut net, &path, region, region.winding);
                 }
@@ -826,7 +826,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
                 open.regions.clear();
                 if !open.segments.is_empty() {
                     let path = open.stroke_path();
-                    let simplified = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                    let simplified = figcraft_geom::simplify_path(&path, tol);
                     let mut loose = VectorNetwork::from_path(&simplified);
                     loose.regions.clear();
                     append_network(&mut net, loose);
@@ -834,7 +834,7 @@ fn simplify(s: &mut Session, p: &Value) -> Result<Value> {
             }
             if source.regions.is_empty() {
                 let path = source.stroke_path();
-                let simplified = figcraft_geom::kurbo::simplify::simplify_bezpath(path.iter(), tol, &Default::default());
+                let simplified = figcraft_geom::simplify_path(&path, tol);
                 net = VectorNetwork::from_path(&simplified);
                 net.regions.clear();
             }

crates/engine/src/components_behaviour_tests.rs

@@ -7,6 +7,7 @@
 use serde_json::{Value, json};
 
 use crate::Session;
+use crate::automation::params::id_of;
 use crate::components::tests::{chars, copy_of, ex, fill, healthy, idv, kids, node};
 use figcraft_doc::*;
 
@@ -1000,3 +1001,245 @@ fn deleting_a_layer_inside_an_instance_hides_it_instead() {
     s.execute("edit.delete", &json!({"ids": [k.inst]})).unwrap();
     assert!(s.doc().unwrap().node(k.inst).is_none());
 }
+
+/// Create multiple components (#2088): each selected layer becomes its own component in place,
+/// keeping its name and position; all stay selected and one undo reverts them all.
+#[test]
+fn create_multiple_components_keeps_names_and_places_and_is_one_undo_step() {
+    let mut s = Session::new();
+    let mut frames = Vec::new();
+    for (i, name) in ["Card", "Badge", "Tile"].into_iter().enumerate() {
+        let x = 150.0 * i as f64;
+        let v = s.execute("frame.create", &json!({"x": x, "y": 20, "width": 100, "height": 60})).unwrap();
+        let f = id_of(&v["id"]).unwrap();
+        s.execute("object.rename", &json!({"ids": [f], "name": name})).unwrap();
+        frames.push(f);
+    }
+    let before = undo_len(&s);
+    let out = s.execute("component.createMultiple", &json!({"ids": frames})).unwrap();
+    assert_eq!(undo_len(&s), before + 1, "one undo step");
+    let made: Vec<NodeId> = out["ids"].as_array().unwrap().iter().filter_map(id_of).collect();
+    assert_eq!(made.len(), 3);
+    assert_eq!(s.selection(), made, "all of them stay selected");
+    let doc = s.doc().unwrap();
+    for (i, (c, name)) in made.iter().zip(["Card", "Badge", "Tile"]).enumerate() {
+        let n = doc.node(*c).unwrap();
+        assert!(matches!(n.kind, NodeKind::Component { .. }), "{name} is a component");
+        assert_eq!(n.name, name);
+        let b = doc.world_bounds(*c).unwrap();
+        assert_eq!((b.x0, b.y0), (150.0 * i as f64, 20.0), "{name} stays in place");
+    }
+    s.undo().unwrap();
+    let doc = s.doc().unwrap();
+    assert!(frames.iter().all(|f| matches!(doc.node(*f).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo restores the frames");
+}
+
+/// Frames named `names` at x = 150 * i (mirrored when `reverse`), y 20, 100 x 60.
+fn named_frames(s: &mut Session, names: &[&str], reverse: bool) -> Vec<NodeId> {
+    let n = names.len();
+    names
+        .iter()
+        .enumerate()
+        .map(|(i, name)| {
+            let x = 150.0 * if reverse { n - 1 - i } else { i } as f64;
+            let v = s.execute("frame.create", &json!({"x": x, "y": 20, "width": 100, "height": 60})).unwrap();
+            let f = id_of(&v["id"]).unwrap();
+            s.execute("object.rename", &json!({"ids": [f], "name": name})).unwrap();
+            f
+        })
+        .collect()
+}
+
+/// The set's name and its children's names in layer order.
+fn set_names(s: &Session, set: NodeId) -> (String, Vec<String>) {
+    let doc = s.doc().unwrap();
+    let n = doc.node(set).unwrap();
+    (n.name.clone(), n.children.iter().map(|c| doc.node(*c).unwrap().name.clone()).collect())
+}
+
+/// The set's variant names ordered by world x.
+fn names_by_x(s: &Session, set: NodeId) -> Vec<String> {
+    let doc = s.doc().unwrap();
+    let mut v: Vec<(f64, String)> =
+        doc.node(set).unwrap().children.iter().map(|c| (doc.world_bounds(*c).unwrap().x0, doc.node(*c).unwrap().name.clone())).collect();
+    v.sort_by(|a, b| a.0.total_cmp(&b.0));
+    v.into_iter().map(|(_, n)| n).collect()
+}
+
+/// Create component set (#2088, measured in Figma): variants "Property 1=<name>" in left-to-right
+/// order, the set "Component 1", wrapped in place 20 px around, selected, one undo step.
+#[test]
+fn create_set_names_variants_by_layer_name_and_wraps_in_place() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Primary", "Secondary", "Ghost"], false);
+    let before = undo_len(&s);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    assert_eq!(undo_len(&s), before + 1, "one undo step");
+    let set = id_of(&out["id"]).unwrap();
+    assert_eq!(s.selection(), vec![set], "the set is selected");
+    assert_eq!(set_names(&s, set).0, "Component 1");
+    assert_eq!(names_by_x(&s, set), ["Property 1=Primary", "Property 1=Secondary", "Property 1=Ghost"]);
+    let doc = s.doc().unwrap();
+    for (i, c) in doc.node(set).unwrap().children.iter().enumerate() {
+        assert!(matches!(doc.node(*c).unwrap().kind, NodeKind::Component { .. }));
+        let b = doc.world_bounds(*c).unwrap();
+        assert_eq!((b.x0, b.y0), (150.0 * i as f64, 20.0), "frames stay put");
+    }
+    let sb = doc.world_bounds(set).unwrap();
+    assert_eq!((sb.x0, sb.y0, sb.x1, sb.y1), (-20.0, 0.0, 420.0, 100.0), "20 px on every side");
+    s.undo().unwrap();
+    let doc = s.doc().unwrap();
+    assert!(doc.node(set).is_none());
+    assert!(frames.iter().all(|f| matches!(doc.node(*f).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo restores the frames");
+}
+
+#[test]
+fn create_set_orders_left_to_right_whatever_the_selection_order() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B", "C"], true);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    let set = id_of(&out["id"]).unwrap();
+    assert_eq!(names_by_x(&s, set), ["Property 1=C", "Property 1=B", "Property 1=A"]);
+    let (_, kids) = set_names(&s, set);
+    assert_eq!(kids.len(), 3);
+}
+
+#[test]
+fn create_set_keeps_names_already_in_prop_value_form() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Size=Small", "Size=Large", "Size=Medium"], false);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    let set = id_of(&out["id"]).unwrap();
+    assert_eq!(set_names(&s, set).0, "Component 1");
+    assert_eq!(names_by_x(&s, set), ["Size=Small", "Size=Large", "Size=Medium"]);
+}
+
+#[test]
+fn create_set_with_one_shared_name_names_the_set_and_makes_default_variants() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Card", "Card", "Card"], false);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    let set = id_of(&out["id"]).unwrap();
+    let (name, kids) = set_names(&s, set);
+    assert_eq!(name, "Card");
+    assert_eq!(kids, ["Property 1=Default", "Property 1=Default", "Property 1=Default"]);
+}
+
+#[test]
+fn create_set_refuses_instances_and_leaves_the_document_alone() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B"], false);
+    let c = s.execute("component.create", &json!({"ids": [frames[0]]})).unwrap();
+    let comp = id_of(&c["id"]).unwrap();
+    let inst = s.execute("instance.create", &json!({"component": comp})).unwrap();
+    let inst = id_of(&inst["id"]).unwrap();
+    let before = undo_len(&s);
+    let e = s.execute("component.createSet", &json!({"ids": [inst, frames[1]]})).unwrap_err();
+    assert!(matches!(e, crate::EngineError::Disabled(..)), "{e:?}");
+    assert_eq!(undo_len(&s), before);
+    assert!(matches!(s.doc().unwrap().node(frames[1]).unwrap().kind, NodeKind::Frame));
+}
+
+#[test]
+fn create_set_refuses_a_target_inside_another_target_and_leaves_the_document_alone() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Outer", "Inner"], false);
+    s.execute("node.reparent", &json!({"ids": [frames[1]], "parent": frames[0]})).unwrap();
+    let before = undo_len(&s);
+    let e = s.execute("component.createSet", &json!({"ids": [frames[0], frames[1]]})).unwrap_err();
+    assert!(matches!(e, crate::EngineError::Disabled(..)), "{e:?}");
+    assert_eq!(undo_len(&s), before);
+    let doc = s.doc().unwrap();
+    assert!(matches!(doc.node(frames[0]).unwrap().kind, NodeKind::Frame));
+    assert!(matches!(doc.node(frames[1]).unwrap().kind, NodeKind::Frame));
+}
+
+/// Every node's id, parent, name and kind, to compare a document before and after a refused command.
+fn snapshot(s: &Session) -> Vec<String> {
+    s.doc().unwrap().nodes().map(|n| format!("{:?}|{:?}|{}|{:?}", n.id, n.parent, n.name, n.kind)).collect()
+}
+
+/// A refused `component.createSet`: `Disabled`, no undo step, the document and the selection as they were.
+fn assert_create_set_refused(s: &mut Session, ids: &[NodeId]) {
+    let (before, undo, selection) = (snapshot(s), undo_len(s), s.selection());
+    let e = s.execute("component.createSet", &json!({"ids": ids})).unwrap_err();
+    assert!(matches!(e, crate::EngineError::Disabled(..)), "{e:?}");
+    assert_eq!(undo_len(s), undo, "no undo step");
+    assert_eq!(snapshot(s), before, "the document is unchanged");
+    assert_eq!(s.selection(), selection, "the selection is unchanged");
+}
+
+/// Nothing to wrap is refused before anything is created.
+#[test]
+fn create_set_refuses_no_layers_and_leaves_the_document_alone() {
+    let mut s = Session::new();
+    named_frames(&mut s, &["A"], false);
+    s.execute("select.set", &json!({"ids": []})).unwrap();
+    assert_create_set_refused(&mut s, &[]);
+}
+
+/// One layer is allowed: a set of one variant, as many layers would make.
+#[test]
+fn create_set_with_one_layer_makes_a_one_variant_set() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["Solo"], false);
+    let before = undo_len(&s);
+    let out = s.execute("component.createSet", &json!({"ids": frames})).unwrap();
+    assert_eq!(undo_len(&s), before + 1, "one undo step");
+    let set = id_of(&out["id"]).unwrap();
+    let doc = s.doc().unwrap();
+    assert_eq!(doc.node(set).unwrap().children.len(), 1);
+    assert_eq!(names_by_x(&s, set), ["Property 1=Default"], "a lone layer shares its name with itself");
+    assert!(matches!(doc.node(doc.node(set).unwrap().children[0]).unwrap().kind, NodeKind::Component { .. }));
+    s.undo().unwrap();
+    assert!(matches!(s.doc().unwrap().node(frames[0]).unwrap().kind, NodeKind::Frame));
+}
+
+/// Each refusal branch of `create_set`, with `can_create_set` agreeing with it.
+#[test]
+fn create_set_refuses_every_ineligible_selection_and_leaves_the_document_alone() {
+    use crate::cmd::component::can_create_set;
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B", "C"], false);
+    let comp = id_of(&s.execute("component.create", &json!({"ids": [frames[0]]})).unwrap()["id"]).unwrap();
+    let inst = id_of(&s.execute("instance.create", &json!({"component": comp})).unwrap()["id"]).unwrap();
+    let set_frames = named_frames(&mut s, &["V1", "V2"], false);
+    let set = id_of(&s.execute("component.createSet", &json!({"ids": set_frames})).unwrap()["id"]).unwrap();
+    // A layer inside the instance (its copy of the card's content).
+    let in_inst = s.doc().unwrap().node(inst).unwrap().children.first().copied();
+    // A library copy.
+    let remote = {
+        let doc = s.doc_mut().unwrap();
+        let store = doc.ensure_library_store();
+        let remote = doc.alloc_id();
+        doc.insert(Node::new(remote, NodeKind::Frame, "Remote", 10.0, 10.0), store, None).unwrap();
+        remote
+    };
+    let ok = frames[1];
+    assert!(can_create_set(s.doc().unwrap(), &[ok, frames[2]]));
+    assert!(!can_create_set(s.doc().unwrap(), &[]));
+    let mut cases = vec![("instance", inst), ("library copy", remote), ("component", comp), ("component set", set)];
+    if let Some(i) = in_inst {
+        cases.push(("inside an instance", i));
+    }
+    for (what, bad) in cases {
+        assert!(!can_create_set(s.doc().unwrap(), &[ok, bad]), "{what}: not offered");
+        assert_create_set_refused(&mut s, &[ok, bad]);
+        assert_create_set_refused(&mut s, &[bad]);
+    }
+}
+
+/// A command that fails leaves no trace: the checks before the creation loop catch every
+/// refusal the loop's own commands could hit, and `Session::execute` restores the document, the
+/// selection and the undo stack on any error, so no half-made components can survive.
+#[test]
+fn a_failing_create_set_leaves_no_components_behind() {
+    let mut s = Session::new();
+    let frames = named_frames(&mut s, &["A", "B"], false);
+    let (before, undo, selection) = (snapshot(&s), undo_len(&s), s.selection());
+    let e = s.execute("component.createSet", &json!({"ids": [frames[0], NodeId(u64::MAX)]}));
+    assert!(e.is_err());
+    assert_eq!(undo_len(&s), undo);
+    assert_eq!(snapshot(&s), before);
+    assert_eq!(s.selection(), selection);
+}

crates/engine/src/design_paste_tests.rs

@@ -106,3 +106,67 @@ fn other_content_is_refused_without_changes() {
     assert_eq!(s.doc().unwrap().nodes().count(), before);
     assert!(s.clipboard.nodes.is_empty());
 }
+
+// The next three pin the paste-placement rules measured in Figma's web app on 2026-11-08 (a
+// synthetic file): in place when the original is in view, at the view's centre when it is off
+// screen, and in a selected frame's centre when the frame is elsewhere. The fourth pins
+// FigCraft's own branch for a selected frame that contains the original (in place inside it),
+// which was not measured.
+
+fn copied_rect(s: &mut Session) -> NodeId {
+    let r = id(&s.execute("shape.rectangle", &json!({"x": 100, "y": 100, "width": 50, "height": 50})).unwrap());
+    s.execute("edit.copy", &json!({"ids": [r]})).unwrap();
+    r
+}
+
+fn pasted(s: &mut Session) -> NodeId {
+    let r = s.execute("edit.paste", &json!({})).unwrap();
+    params::id_of(&r["ids"][0]).unwrap()
+}
+
+#[test]
+fn paste_with_the_original_in_view_lands_in_place_above_it() {
+    let mut s = Session::new();
+    let page = s.page().unwrap();
+    let r = copied_rect(&mut s);
+    s.execute("view.set", &json!({"zoom": 1, "cx": 125, "cy": 125})).unwrap();
+    let c = pasted(&mut s);
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.x0, b.y0), (100.0, 100.0));
+    assert_eq!(s.selection(), [c]);
+    assert_eq!(s.doc().unwrap().node(page).unwrap().children, [r, c]);
+}
+
+#[test]
+fn paste_with_the_original_off_screen_lands_at_the_view_centre() {
+    let mut s = Session::new();
+    copied_rect(&mut s);
+    s.execute("view.set", &json!({"zoom": 1, "cx": 5000, "cy": 3000})).unwrap();
+    let c = pasted(&mut s);
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.center().x, b.center().y), (5000.0, 3000.0));
+}
+
+#[test]
+fn paste_into_a_selected_far_frame_lands_at_its_centre() {
+    let mut s = Session::new();
+    copied_rect(&mut s);
+    let f = id(&s.execute("frame.create", &json!({"x": 2000, "y": 1000, "width": 300, "height": 300})).unwrap());
+    s.execute("select.set", &json!({"ids": [f]})).unwrap();
+    let c = pasted(&mut s);
+    assert_eq!(s.doc().unwrap().node(c).unwrap().parent, Some(f));
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.center().x, b.center().y), (2150.0, 1150.0));
+}
+
+#[test]
+fn paste_into_a_selected_frame_holding_the_original_keeps_its_place() {
+    let mut s = Session::new();
+    copied_rect(&mut s);
+    let f = id(&s.execute("frame.create", &json!({"x": 0, "y": 0, "width": 500, "height": 500})).unwrap());
+    s.execute("select.set", &json!({"ids": [f]})).unwrap();
+    let c = pasted(&mut s);
+    assert_eq!(s.doc().unwrap().node(c).unwrap().parent, Some(f));
+    let b = s.doc().unwrap().world_bounds(c).unwrap();
+    assert_eq!((b.x0, b.y0), (100.0, 100.0));
+}

crates/engine/src/export_behaviour_tests.rs

@@ -384,3 +384,17 @@ fn copy_as_png_svg_and_code() {
     let css = crate::codegen::code_for(doc, a, crate::codegen::CodeLang::Css);
     assert!(css.contains("background: #FF0000;"), "Copy as CSS is the layer's CSS from Inspect");
 }
+
+#[test]
+fn export_rejects_an_invalid_layer_id_instead_of_exporting_the_page() {
+    let mut s = Session::new();
+    let r = rect(&mut s, 0.0, 0.0, 10.0, 10.0, "#ff0000", None);
+    ex(&mut s, "export.add", json!({"ids": [r]}));
+    for cmd in ["file.export", "file.exportLayers"] {
+        for p in [json!({"ids": ["abc"], "format": "svg"}), json!({"id": "abc", "format": "svg"}), json!({"ids": [], "id": "abc", "format": "svg"})] {
+            let res = s.execute(cmd, &p);
+            assert!(res.is_err(), "{cmd} {p} exported for an invalid id: {res:?}");
+        }
+    }
+    assert!(s.execute("file.export", &json!({"format": "svg"})).is_ok());
+}

crates/engine/src/extensions/widgets.rs

@@ -41,6 +41,8 @@ const FIELD: &str = "figcraft.widget.field";
 const HOVER: &str = "figcraft.widget.hover";
 /// Images in a widget are at most this many pixels on a side.
 const MAX_IMAGE_SIDE: u32 = 4096;
+/// All images of one widget together are at most this many pixels once decoded (four of the largest).
+const MAX_IMAGES_PIXELS: u64 = 4 * 4096 * 4096;
 
 /// Whether `n` is a widget's own layer.
 pub fn is_widget(n: &Node) -> bool {
@@ -259,8 +261,9 @@ fn build(s: &mut Session, plugin: &str, w: NodeId, r: &WidgetRender) -> Result<(
         _ => n.plugin_data.remove(MENU),
     };
     set_hover(n, r.root.hover.as_ref());
+    let mut pixels = 0;
     for c in &r.root.children {
-        add(doc, w, c, cmd)?;
+        add(doc, w, c, cmd, &mut pixels)?;
     }
     // An SVG brings as many layers as it describes.
     if doc.subtree(w).len() > MAX_NODES {
@@ -271,7 +274,7 @@ fn build(s: &mut Session, plugin: &str, w: NodeId, r: &WidgetRender) -> Result<(
 }
 
 /// Add layer `d` (and what it holds) inside `parent`, locked.
-fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str) -> Result<()> {
+fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str, pixels: &mut u64) -> Result<()> {
     let (kind, name) = match d.kind {
         WidgetKind::Frame => (NodeKind::Frame, "Frame"),
         WidgetKind::Text => (NodeKind::Text(TextData { characters: d.text.clone(), ..TextData::default() }), "Text"),
@@ -292,6 +295,16 @@ fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str) -> Result<
         if bytes.len() > MAX_IMAGE_BYTES {
             return Err(bad(cmd, format!("an image is larger than {} KB", MAX_IMAGE_BYTES / 1024)));
         }
+        // From the header, before anything is decoded: a small file can hold billions of pixels.
+        if let Some((w, h)) = figcraft_render::images::dimensions(&bytes) {
+            if w > MAX_IMAGE_SIDE || h > MAX_IMAGE_SIDE {
+                return Err(bad(cmd, format!("an image is larger than {MAX_IMAGE_SIDE} pixels on a side")));
+            }
+            *pixels += u64::from(w) * u64::from(h);
+            if *pixels > MAX_IMAGES_PIXELS {
+                return Err(bad(cmd, format!("the images are larger than {MAX_IMAGES_PIXELS} pixels together")));
+            }
+        }
         let (hash, iw, ih) = crate::cmd::create::add_readable_image(doc, bytes).map_err(|e| bad(cmd, e))?;
         if iw > MAX_IMAGE_SIDE || ih > MAX_IMAGE_SIDE {
             return Err(bad(cmd, format!("an image is larger than {MAX_IMAGE_SIDE} pixels on a side")));
@@ -302,7 +315,7 @@ fn add(doc: &mut Document, parent: NodeId, d: &WidgetNode, cmd: &str) -> Result<
     }
     doc.insert(n, parent, None)?;
     crate::cmd::props::apply(cmd, doc, id, &props(d, false))?;
-    d.children.iter().try_for_each(|c| add(doc, id, c, cmd))
+    d.children.iter().try_for_each(|c| add(doc, id, c, cmd, pixels))
 }
 
 /// Add SVG layer `d` inside `parent`: a frame of the picture's own size holding its layers, locked
@@ -604,3 +617,32 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!("widget.list", "List widgets", "{} → {widgets: [{id, plugin, name, page, state, targets, fields, menu}]}", false, list),
     ]
 }
+
+#[cfg(test)]
+mod pixel_budget_tests {
+    use super::*;
+    use base64::Engine as _;
+
+    /// A `side` x `side` blank PNG (a few KB however many pixels).
+    fn png(side: u32) -> String {
+        let pix = figcraft_render::Pixmap::new(side, side).unwrap();
+        base64::engine::general_purpose::STANDARD.encode(figcraft_render::encode_png(&pix).unwrap())
+    }
+
+    #[test]
+    fn images_of_a_widget_share_a_decoded_pixel_budget() {
+        let mut doc = Document::new("t");
+        let page = doc.first_page().unwrap();
+        let data = png(4096);
+        let image = |i: usize| serde_json::from_value::<WidgetNode>(json!({"type": "image", "name": format!("I{i}"), "data": data})).unwrap();
+        let mut pixels = 0;
+        for i in 0..4 {
+            add(&mut doc, page, &image(i), "widget.insert", &mut pixels).unwrap();
+        }
+        let err = add(&mut doc, page, &image(4), "widget.insert", &mut pixels).unwrap_err().to_string();
+        assert!(err.contains("together"), "{err}");
+        // A header past the side limit is refused before it is decoded.
+        let wide = serde_json::from_value::<WidgetNode>(json!({"type": "image", "data": png(4097)})).unwrap();
+        assert!(add(&mut doc, page, &wide, "widget.insert", &mut 0).unwrap_err().to_string().contains("pixels on a side"));
+    }
+}

crates/engine/src/paint_tests.rs

@@ -135,6 +135,16 @@ fn image_adjust_refuses_what_it_cannot_do() {
     assert_eq!(s.execute("image.adjust", &json!({"ids": [plain, r], "index": 1, "preset": "vivid"})).unwrap()["changed"], 1);
 }
 
+#[test]
+fn save_preset_rejects_bad_index() {
+    let mut s = Session::new();
+    let r = image_rect(&mut s);
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": 0})).is_err());
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": -1})).is_err(), "negative index accepted");
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": 1.5})).is_err(), "fractional index accepted");
+    assert!(s.execute("image.savePreset", &json!({"ids": [r], "name": "B", "index": 1})).is_ok());
+}
+
 #[test]
 fn saved_image_presets() {
     let mut s = Session::new();

crates/engine/src/slot_tests.rs

@@ -376,6 +376,265 @@ fn slots_of_nested_instances_fill_from_the_outer_main_and_its_instances() {
     assert_eq!(fill(&s, *kids(&s, nslot).first().unwrap()), "CCCCCC", "content no longer follows the Card main");
 }
 
+/// Wrap a component instance in another main, keeping the nested instance addressable.
+fn slot_text_wrapper(s: &mut Session, component: NodeId, name: &str) -> (NodeId, NodeId) {
+    let frame = idv(&ex(s, "frame.create", json!({"width": 300, "height": 200, "name": name})));
+    let nested = idv(&ex(s, "instance.create", json!({"component": component, "parent": frame})));
+    (idv(&ex(s, "component.create", json!({"ids": [frame]}))), nested)
+}
+
+/// Content.Label binds Text; Composition holds Base, whose Body uses default or own Content.
+/// Returns (Content main, Label, Base main, Composition main, nested Content instance).
+fn slot_text_composition(s: &mut Session, own: bool) -> (NodeId, NodeId, NodeId, NodeId, NodeId) {
+    let frame = idv(&ex(s, "frame.create", json!({"width": 100, "height": 40, "name": "Content"})));
+    let label = idv(&ex(s, "text.create", json!({"text": "Default", "parent": frame, "props": {"name": "Label"}})));
+    let content = idv(&ex(s, "component.create", json!({"ids": [frame]})));
+    ex(s, "component.addProperty", json!({"id": content, "name": "Text", "type": "text", "default": "Default", "layer": label}));
+    let frame = idv(&ex(s, "frame.create", json!({"width": 200, "height": 100, "name": "Base"})));
+    let body = idv(&ex(s, "frame.create", json!({"width": 180, "height": 80, "name": "Body", "parent": frame})));
+    let default = (!own).then(|| idv(&ex(s, "instance.create", json!({"component": content, "parent": body}))));
+    let base = idv(&ex(s, "component.create", json!({"ids": [frame]})));
+    ex(s, "component.makeSlot", json!({"id": body}));
+    let (composition, nested_base) = slot_text_wrapper(s, base, "Composition");
+    let nested_content = if let Some(default) = default {
+        copy_of(s, nested_base, default)
+    } else {
+        idv(&ex(s, "instance.slotInsert", json!({"id": nested_base, "slot": "Body", "component": content})))
+    };
+    (content, label, base, composition, nested_content)
+}
+
+fn assert_slot_text(s: &mut Session, instance: NodeId, expected: &str) {
+    let children = kids(s, instance);
+    assert_eq!(children.len(), 1, "Content {instance} must have exactly one Label");
+    let label = children[0];
+    assert_eq!(node(s, label).name, "Label");
+    let characters = node(s, label).kind.text().expect("Content's only child must be text").characters.clone();
+    let html = ex(s, "inspect.code", json!({"id": instance, "language": "html"}))["code"].as_str().unwrap().to_string();
+    assert_eq!(characters, expected, "slot Label characters; HTML: {html}");
+    assert_eq!(html.matches("<p ").count(), 1, "slot Label HTML must contain exactly one paragraph: {html}");
+    assert_eq!(html.matches("</p>").count(), 1, "slot Label HTML must contain exactly one paragraph: {html}");
+    assert!(html.contains(&format!(">{expected}</p>")), "slot Label HTML: {html}");
+}
+
+fn assert_local_slot_text(s: &mut Session, instance: NodeId, expected: &str) {
+    assert!(
+        matches!(&node(s, instance).kind, NodeKind::Instance { props, .. } if props.get("Text") == Some(&json!(expected))),
+        "instance {instance} must store its own Text value {expected:?}: {:?}",
+        node(s, instance).kind
+    );
+    let properties = props_of(s, instance);
+    let text = properties.iter().find(|p| p["name"] == "Text").unwrap_or_else(|| panic!("instance {instance} has no Text property: {properties:?}"));
+    assert_eq!(text["value"], expected, "instance {instance} Text property");
+}
+
+/// Exercise the same ownership contract for default slot content and content supplied by the
+/// Composition main; separate tests identify which route regresses.
+fn check_slot_text_properties_stay_local(own: bool) {
+    let mut s = Session::new();
+    let (content, label, _base, composition, main_content) = slot_text_composition(&mut s, own);
+    let a = idv(&ex(&mut s, "instance.create", json!({"component": composition, "x": 400})));
+    let b = idv(&ex(&mut s, "instance.create", json!({"component": composition, "x": 800})));
+    let ac = copy_of(&s, a, main_content);
+    let bc = copy_of(&s, b, main_content);
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Text": "Custom"}}));
+    assert_local_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_local_slot_text(&mut s, bc, "Default");
+    assert_slot_text(&mut s, bc, "Default");
+    assert_local_slot_text(&mut s, main_content, "Default");
+    assert_slot_text(&mut s, main_content, "Default");
+    assert_eq!(node(&s, label).kind.text().unwrap().characters, "Default");
+    // Main property edits propagate without replacing another instance's local value.
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Text": "Main value"}}));
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, bc, "Main value");
+    assert_slot_text(&mut s, main_content, "Main value");
+    ex(&mut s, "component.editProperty", json!({"id": content, "name": "Text", "default": "New default"}));
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, bc, "Main value");
+    assert_local_slot_text(&mut s, main_content, "Main value");
+    assert_slot_text(&mut s, main_content, "Main value");
+    healthy(&s);
+}
+
+#[test]
+fn slot_text_properties_stay_local_in_default_content() {
+    check_slot_text_properties_stay_local(false);
+}
+
+#[test]
+fn slot_text_properties_stay_local_in_own_content() {
+    check_slot_text_properties_stay_local(true);
+}
+
+#[test]
+fn slot_text_properties_do_not_read_an_unbound_base_property() {
+    let mut s = Session::new();
+    let (_content, _label, base, composition, main_content) = slot_text_composition(&mut s, true);
+    ex(&mut s, "component.addProperty", json!({"id": base, "name": "Text", "type": "text", "default": "Wrong owner"}));
+    let i = idv(&ex(&mut s, "instance.create", json!({"component": composition, "x": 400})));
+    let nested_base = kids(&s, i)[0];
+    assert_local_slot_text(&mut s, nested_base, "Wrong owner");
+    let nested = copy_of(&s, i, main_content);
+    assert_local_slot_text(&mut s, nested, "Default");
+    assert_slot_text(&mut s, nested, "Default");
+    ex(&mut s, "instance.setProperties", json!({"ids": [nested], "properties": {"Text": "Custom"}}));
+    assert_local_slot_text(&mut s, nested, "Custom");
+    assert_slot_text(&mut s, nested, "Custom");
+    assert_local_slot_text(&mut s, nested_base, "Wrong owner");
+    assert_slot_text(&mut s, main_content, "Default");
+    healthy(&s);
+}
+
+#[test]
+fn slot_text_properties_survive_inherited_own_content_and_persistence() {
+    let mut s = Session::new();
+    let (_content, _label, _base, composition, main_content) = slot_text_composition(&mut s, true);
+    let (outer, inherited) = slot_text_wrapper(&mut s, composition, "Outer composition");
+    let inherited_content = copy_of(&s, inherited, main_content);
+    let a = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 400})));
+    let b = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 800})));
+    let ac = copy_of(&s, a, inherited_content);
+    let bc = copy_of(&s, b, inherited_content);
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Text": "Custom"}}));
+    assert_local_slot_text(&mut s, ac, "Custom");
+    assert_local_slot_text(&mut s, bc, "Default");
+    assert_local_slot_text(&mut s, inherited_content, "Default");
+    assert_local_slot_text(&mut s, main_content, "Default");
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    let (back, _) = figcraft_format::load_bytes(&bytes).unwrap();
+    let mut s = Session::with_document(back);
+    assert_local_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, ac, "Custom");
+    assert_slot_text(&mut s, bc, "Default");
+    assert_slot_text(&mut s, inherited_content, "Default");
+    assert_slot_text(&mut s, main_content, "Default");
+    // Explicit characters override the bound property, even after a main update.
+    let alabel = kids(&s, ac)[0];
+    ex(&mut s, "text.set", json!({"id": alabel, "characters": "Explicit"}));
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Text": "Later"}}));
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Text": "Main value"}}));
+    assert_local_slot_text(&mut s, ac, "Later");
+    assert_slot_text(&mut s, ac, "Explicit");
+    assert_slot_text(&mut s, bc, "Main value");
+    ex(&mut s, "component.resetOverride", json!({"id": alabel, "group": "characters"}));
+    assert_slot_text(&mut s, ac, "Later");
+    s.undo().unwrap();
+    assert_slot_text(&mut s, ac, "Explicit");
+    healthy(&s);
+}
+
+/// Check both the stored property and the Label it drives, not just one representation.
+fn assert_slot_visibility(s: &mut Session, instance: NodeId, expected: bool) {
+    assert!(
+        matches!(&node(s, instance).kind, NodeKind::Instance { props, .. } if props.get("Visible") == Some(&json!(expected))),
+        "instance {instance} must store Visible={expected}: {:?}",
+        node(s, instance).kind
+    );
+    let properties = props_of(s, instance);
+    let visible =
+        properties.iter().find(|p| p["name"] == "Visible").unwrap_or_else(|| panic!("instance {instance} has no Visible property: {properties:?}"));
+    assert_eq!(visible["value"], expected, "instance {instance} Visible property");
+    let children = kids(s, instance);
+    assert_eq!(children.len(), 1, "Content {instance} must have exactly one Label");
+    assert_eq!(node(s, children[0]).name, "Label");
+    assert_eq!(node(s, children[0]).visible, expected, "instance {instance} Label visibility");
+}
+
+#[test]
+fn slot_boolean_properties_stay_local_in_inherited_own_content() {
+    let mut s = Session::new();
+    let (content, label, base, composition, main_content) = slot_text_composition(&mut s, true);
+    ex(&mut s, "component.addProperty", json!({"id": content, "name": "Visible", "type": "boolean", "default": true, "layer": label}));
+    ex(&mut s, "component.addProperty", json!({"id": base, "name": "Visible", "type": "boolean", "default": false}));
+    let (outer, inherited) = slot_text_wrapper(&mut s, composition, "Outer composition");
+    let inherited_base = kids(&s, inherited)[0];
+    let inherited_content = copy_of(&s, inherited, main_content);
+    let a = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 400})));
+    let b = idv(&ex(&mut s, "instance.create", json!({"component": outer, "x": 800})));
+    let ac = copy_of(&s, a, inherited_content);
+    let bc = copy_of(&s, b, inherited_content);
+    let abase = copy_of(&s, a, inherited_base);
+    assert!(matches!(&node(&s, abase).kind, NodeKind::Instance { props, .. } if props.get("Visible") == Some(&json!(false))));
+    assert_slot_visibility(&mut s, ac, true);
+    assert_slot_visibility(&mut s, bc, true);
+    ex(&mut s, "instance.setProperties", json!({"ids": [ac], "properties": {"Visible": false}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, inherited_content, true);
+    assert_slot_visibility(&mut s, main_content, true);
+    // A main update must not replace either instance's local value with the Base's homonym.
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Visible": false}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, false);
+    ex(&mut s, "instance.setProperties", json!({"ids": [bc], "properties": {"Visible": true}}));
+    ex(&mut s, "node.set", json!({"id": content, "props": {"fill": "#abcdef"}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, main_content, false);
+    healthy(&s);
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    let (back, _) = figcraft_format::load_bytes(&bytes).unwrap();
+    let mut s = Session::with_document(back);
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, inherited_content, false);
+    assert_slot_visibility(&mut s, main_content, false);
+    ex(&mut s, "instance.setProperties", json!({"ids": [main_content], "properties": {"Visible": true}}));
+    assert_slot_visibility(&mut s, ac, false);
+    assert_slot_visibility(&mut s, bc, true);
+    assert_slot_visibility(&mut s, main_content, true);
+    healthy(&s);
+}
+
+#[test]
+fn same_component_in_own_slot_keeps_independent_text_properties() {
+    let mut s = Session::new();
+    let frame = idv(&ex(&mut s, "frame.create", json!({"width": 200, "height": 100, "name": "Card"})));
+    let label = idv(&ex(&mut s, "text.create", json!({"text": "Default", "parent": frame, "props": {"name": "Label"}})));
+    let body = idv(&ex(&mut s, "frame.create", json!({"width": 180, "height": 60, "y": 40, "name": "Body", "parent": frame})));
+    let card = idv(&ex(&mut s, "component.create", json!({"ids": [frame]})));
+    ex(&mut s, "component.addProperty", json!({"id": card, "name": "Text", "type": "text", "default": "Default", "layer": label}));
+    ex(&mut s, "component.makeSlot", json!({"id": body}));
+    // Only page instance content holds another Card: the main never contains itself.
+    let outer = idv(&ex(&mut s, "instance.create", json!({"component": card, "x": 400})));
+    let inner = idv(&ex(&mut s, "instance.slotInsert", json!({"id": outer, "slot": "Body", "component": card})));
+    let check = |s: &mut Session, outer_text: &str, inner_text: &str| {
+        assert_local_slot_text(s, outer, outer_text);
+        assert_local_slot_text(s, inner, inner_text);
+        assert_eq!(node(s, copy_of(s, outer, label)).kind.text().unwrap().characters, outer_text);
+        assert_eq!(node(s, copy_of(s, inner, label)).kind.text().unwrap().characters, inner_text);
+        let outer_body = copy_of(s, outer, body);
+        assert!(slot_edited(s.doc().unwrap(), outer_body));
+        assert_eq!(kids(s, outer_body), vec![inner]);
+        assert!(kids(s, copy_of(s, inner, body)).is_empty());
+        assert!(kids(s, body).is_empty(), "the main's slot must remain empty");
+        healthy(s);
+    };
+    ex(&mut s, "instance.setProperties", json!({"ids": [outer], "properties": {"Text": "Outer"}}));
+    check(&mut s, "Outer", "Default");
+    ex(&mut s, "instance.setProperties", json!({"ids": [inner], "properties": {"Text": "Inner"}}));
+    check(&mut s, "Outer", "Inner");
+    ex(&mut s, "text.set", json!({"id": label, "characters": "New default"}));
+    ex(&mut s, "node.set", json!({"id": card, "props": {"fill": "#abcdef"}}));
+    check(&mut s, "Outer", "Inner");
+    assert_eq!(fill(&s, outer), "ABCDEF");
+    assert_eq!(fill(&s, inner), "ABCDEF");
+    ex(&mut s, "instance.setProperties", json!({"ids": [outer], "properties": {"Text": "Outer updated"}}));
+    check(&mut s, "Outer updated", "Inner");
+    ex(&mut s, "instance.setProperties", json!({"ids": [inner], "properties": {"Text": "Inner updated"}}));
+    check(&mut s, "Outer updated", "Inner updated");
+    let bytes = figcraft_format::save_bytes(s.doc().unwrap(), None).unwrap();
+    let (back, _) = figcraft_format::load_bytes(&bytes).unwrap();
+    let mut s = Session::with_document(back);
+    check(&mut s, "Outer updated", "Inner updated");
+    ex(&mut s, "node.set", json!({"id": card, "props": {"fill": "#123456"}}));
+    check(&mut s, "Outer updated", "Inner updated");
+    assert_eq!(fill(&s, outer), "123456");
+    assert_eq!(fill(&s, inner), "123456");
+}
+
 /// Random slot edits, main edits and resets keep every instance mirroring its main.
 #[test]
 fn random_slot_edits_keep_instances_consistent() {

crates/engine/src/text_tail_tests.rs

@@ -84,7 +84,11 @@ fn typed_list_starts() {
         ("- ", "", B, "hyphen and space: bullets"),
         ("* ", "", B, "asterisk and space: bullets"),
         ("1. ", "", N, "one, full stop, space: numbers"),
-        ("2. ", "2. ", P, "silent: only 1. starts a numbered list"),
+        ("2. ", "", N, "as measured in Figma: a typed number starts the list there"),
+        ("0. ", "0. ", P, "zero is not measured: text"),
+        ("12a. ", "12a. ", P, "digits only: text"),
+        ("1) ", "", N, "one and a closing bracket: numbers"),
+        ("2) ", "2) ", P, "silent: only 1) starts with a bracket"),
         ("a- ", "a- ", P, "not at the paragraph's start: text"),
         ("-x ", "-x ", P, "the space must follow the marker"),
     ];
@@ -108,6 +112,76 @@ fn typed_list_starts() {
     assert_eq!((data(&s, t).characters.as_str(), lists(&s, t)), ("Intro\n- ", vec![(P, 0), (B, 0)]), "an item's own text stays text");
 }
 
+#[test]
+fn typed_number_starts_the_list_there() {
+    // As measured in Figma (2026-11-11): typing "5. x", Enter, "y" reads 5. then 6.; the start
+    // is the typed number less one, and the next item goes on counting from it.
+    let mut s = Session::new();
+    let t = text(&mut s, "x");
+    s.execute("node.set", &json!({"id": t, "props": {"characters": ""}})).unwrap();
+    begin(&mut s, t, Some(0), false).unwrap();
+    for c in "5. x".chars() {
+        insert(&mut s, &c.to_string()).unwrap();
+    }
+    assert_eq!(data(&s, t).para_list(0).start_offset, 4, "5 starts at offset 4");
+    key(&mut s, "Enter", false, false, false).unwrap();
+    insert(&mut s, "y").unwrap();
+    crate::textedit::end(&mut s).unwrap();
+    let d = data(&s, t);
+    assert_eq!(d.characters, "x\ny");
+    assert_eq!(lists(&s, t), [(N, 0), (N, 0)]);
+    // An item made by Enter has no start of its own and goes on counting: 5. then 6.
+    assert_eq!((d.para_list(0).start_offset, d.para_list(1).start_offset), (4, 0), "the new item has no start");
+    s.undo().unwrap();
+    assert_eq!(data(&s, t).characters, "", "one undo step for the session");
+    assert_eq!(data(&s, t).para_list(0).start_offset, 0);
+}
+
+/// Type `first` ("5. a" style), then Enter, "b", Enter, "c", leaving the caret in "c".
+fn three_typed_items(s: &mut Session, first: &str) -> NodeId {
+    let t = text(s, "x");
+    s.execute("node.set", &json!({"id": t, "props": {"characters": ""}})).unwrap();
+    begin(s, t, Some(0), false).unwrap();
+    for c in first.chars() {
+        insert(s, &c.to_string()).unwrap();
+    }
+    for step in ["Enter", "b", "Enter", "c"] {
+        if step == "Enter" {
+            key(s, step, false, false, false).unwrap();
+        } else {
+            insert(s, step).unwrap();
+        }
+    }
+    t
+}
+
+#[test]
+fn a_list_split_by_unlisting_a_middle_item_restarts_at_one() {
+    // As measured in Figma (2026-11-11): typed "5. a", Enter, "b", Enter, "c" reads 5. 6. 7.;
+    // Backspace at the start of "b" takes its marker and "c" then reads 1., for "1. " too.
+    // `list_markers` counts on after a numbered item and restarts a numbered item that follows a
+    // plain paragraph at its own start, so the starts and the neighbours give the markers.
+    for (first, start) in [("5. a", 4), ("1. a", 0)] {
+        let mut s = Session::new();
+        let t = three_typed_items(&mut s, first);
+        assert_eq!(
+            data(&s, t).characters,
+            "a
+b
+c"
+        );
+        // The guard: unsplit, "b" and "c" go on counting (5. 6. 7.).
+        let d = data(&s, t);
+        assert_eq!(lists(&s, t), [(N, 0); 3], "{first}: no split");
+        assert_eq!((d.para_list(0).start_offset, d.para_list(1).start_offset, d.para_list(2).start_offset), (start, 0, 0), "{first}");
+        set_caret(&mut s, 2, false).unwrap();
+        key(&mut s, "Backspace", false, false, false).unwrap();
+        let d = data(&s, t);
+        assert_eq!(lists(&s, t), [(N, 0), (P, 0), (N, 0)], "{first}: split");
+        assert_eq!(d.para_list(2).start_offset, 0, "{first}: c restarts at 1 (the item made by Enter has no start)");
+    }
+}
+
 #[test]
 fn list_keys_at_list_items() {
     // (chars, lists before, caret, key, shift, chars after, lists after, derivation)
@@ -372,3 +446,39 @@ fn typing_a_creation_character_and_a_space_starts_a_list() {
     }
     assert_eq!((data(&s, t).characters.as_str(), lists(&s, t)), ("2) ", vec![(P, 0)]));
 }
+
+#[test]
+fn splitting_a_plain_paragraph_that_kept_its_level_keeps_the_level() {
+    // Backspace at a nested item's start unlists it but keeps indent 1; Enter inside it then
+    // splits it, and neither half loses the level (the start reset changes only starts).
+    let mut s = Session::new();
+    let t = text(&mut s, "ab\ncd");
+    let ps = vec![ParaList { list: N, start_offset: 4, ..ParaList::default() }, ParaList { list: N, indent: 1, ..ParaList::default() }];
+    if let figcraft_doc::NodeKind::Text(td) = &mut s.doc_mut().unwrap().get_mut(t).unwrap().kind {
+        td.paragraphs = ps;
+    }
+    begin(&mut s, t, Some(3), false).unwrap();
+    key(&mut s, "Backspace", false, false, false).unwrap();
+    assert_eq!(lists(&s, t), [(N, 0), (P, 1)], "unlisted, level kept");
+    set_caret(&mut s, 4, false).unwrap();
+    key(&mut s, "Enter", false, false, false).unwrap();
+    assert_eq!(data(&s, t).characters, "ab\nc\nd");
+    assert_eq!(lists(&s, t), [(N, 0), (P, 1), (P, 1)], "both halves keep indent 1");
+}
+
+#[test]
+fn a_many_line_paste_clears_every_created_start() {
+    let mut s = Session::new();
+    let t = text(&mut s, "x");
+    s.execute("node.set", &json!({"id": t, "props": {"characters": ""}})).unwrap();
+    begin(&mut s, t, Some(0), false).unwrap();
+    for c in "5. x".chars() {
+        insert(&mut s, &c.to_string()).unwrap();
+    }
+    let lines: Vec<String> = (0..2001).map(|i| format!("l{i}")).collect();
+    insert(&mut s, &lines.join("\n")).unwrap();
+    let d = data(&s, t);
+    assert_eq!(d.paragraph_count(), 2001);
+    assert_eq!(d.para_list(0).start_offset, 4, "the first item keeps its start");
+    assert!((1..d.paragraph_count()).all(|p| d.para_list(p).start_offset == 0 && d.para_list(p).list == N));
+}

crates/engine/src/vector_behaviour_tests.rs

@@ -326,6 +326,58 @@ fn ex_to_vector(doc: &mut figcraft_doc::Document, id: NodeId) {
     doc.get_mut(id).unwrap().kind = NodeKind::Vector { network };
 }
 
+/// How far `path` strays from `from`: the largest distance from a point sampled along `path` to
+/// the nearest segment of `from`.
+pub(crate) fn strays(path: &BezPath, from: &BezPath) -> f64 {
+    use figcraft_geom::kurbo::ParamCurveNearest;
+    let segs: Vec<_> = from.segments().collect();
+    path.segments()
+        .flat_map(|seg| (0..=32).map(move |i| seg.eval(f64::from(i) / 32.0)))
+        .map(|p| segs.iter().map(|s| s.nearest(p, 1e-6).distance_sq).fold(f64::INFINITY, f64::min).sqrt())
+        .fold(0.0, f64::max)
+}
+
+/// Simplify path keeps nearly collinear points, and a stroke that goes out and back, near where
+/// they were: kurbo's fit, which Simplify path and the Pencil share, ran a handle hundreds of units
+/// on along the line (#1741). That holds for each way the command simplifies a layer: an open
+/// stroke, a filled shape, a region with its own fill, and a stroke beside a filled shape.
+#[test]
+fn simplify_keeps_nearly_collinear_points_near_them() {
+    // The points exactly as sampled.
+    let straight = "M209.5986907940155 -204.90932811973988 L211.27791426387097 -207.1909740207534 L214.24650682872084 -211.22882759062324";
+    let back =
+        "M80 -160 L86.04356571908697 -173.74440234910094 L87.85185073933535 -179.20284644595452 L86.04356571908697 -173.74440234910094 L95 -185";
+    let shape = format!("{straight} L260 -150 Z");
+    let cases = [
+        ("an open stroke", straight.to_string(), false),
+        ("a filled shape", shape.clone(), false),
+        ("a region with its own fill", shape.clone(), true),
+        ("a stroke beside a filled shape", format!("{shape} {back}"), false),
+    ];
+    for (what, d, own_fill) in cases {
+        let mut s = Session::new();
+        let id = id_of(&ex(&mut s, "vector.create", json!({"path": "M0 0 L10 10"}))["id"]).unwrap();
+        // At the page origin, as given (`vector.create` would move the points).
+        let mut network = VectorNetwork::from_path(&BezPath::from_svg(&d).unwrap());
+        if own_fill {
+            network.regions[0].fills = Some(vec![figcraft_color::Paint::solid(figcraft_color::Color::from_hex("#FF0000").unwrap())]);
+        }
+        {
+            let n = s.doc_mut().unwrap().get_mut(id).unwrap();
+            n.transform = figcraft_geom::Affine::IDENTITY;
+            n.kind = NodeKind::Vector { network };
+        }
+        let before = net(&s, id);
+        ex(&mut s, "vector.simplify", json!({"ids": [id], "tolerance": 0.75}));
+        let after = s.doc().unwrap().world_transform(id) * net(&s, id).stroke_path();
+        let gone = strays(&after, &before.stroke_path());
+        assert!(gone <= 1.5, "{what}: strays {gone}: {}", after.to_svg());
+        let (b0, b1) = (before.stroke_path().bounding_box(), after.bounding_box());
+        assert!(b0.inflate(1.5, 1.5).contains_rect(b1), "{what}: {b1:?} past {b0:?}: {}", after.to_svg());
+        assert_eq!(net(&s, id).regions.len(), before.regions.len(), "{what}: the fill is kept");
+    }
+}
+
 fn ex(s: &mut Session, cmd: &str, p: Value) -> Value {
     s.execute(cmd, &p).unwrap_or_else(|e| panic!("{cmd}: {e}"))
 }

crates/format/src/fig/export/shape.rs

@@ -207,7 +207,9 @@ impl<'d> Exporter<'d> {
                 .enumerate()
                 .map(|(i, v)| {
                     let mut st: Fields = Vec::new();
-                    if v.radius > 0.0 {
+                    // A point without a radius of its own is drawn with the layer's, so a sharp
+                    // point on a rounded layer says so.
+                    if v.radius > 0.0 || n.corners.radii[0] > 0.0 {
                         st.push(("cornerRadius", fl(v.radius)));
                     }
                     if let Some(m) = v.mirror {

crates/format/src/fig/export_tests.rs

@@ -955,6 +955,25 @@ fn closed_vector_geometry_is_written_with_its_corner_smoothing() {
     assert_eq!(radii, vec![20.0, 0.0, 10.0, 0.0], "each point keeps its own radius");
 }
 
+#[test]
+fn sharp_points_on_a_rounded_vector_stay_sharp() {
+    // A point without a radius takes the layer's when read, so a sharp point on a vector with a
+    // layer radius is written with its own zero.
+    let mut doc = Document::new("sharp point");
+    let page = doc.first_page().unwrap();
+    let mut network = VectorNetwork::from_points(&[(0.0, 0.0), (100.0, 0.0), (100.0, 100.0), (0.0, 100.0)].map(|(x, y)| Point::new(x, y)), true);
+    for (v, r) in network.vertices.iter_mut().zip([8.0, 0.0, 8.0, 0.0]) {
+        v.radius = r;
+    }
+    let id = doc.create(page, NodeKind::Vector { network }, "V", 0.0, 0.0, 100.0, 100.0).unwrap();
+    doc.node_mut(id).unwrap().corners.radii = [8.0; 4];
+    let (back, _) = round_trip(&doc, "sharp point");
+    let v = back.nodes().find(|n| matches!(n.kind, NodeKind::Vector { .. })).unwrap();
+    let NodeKind::Vector { network } = &v.kind else { panic!("vector") };
+    let radii: Vec<f64> = network.vertices.iter().map(|x| x.radius).collect();
+    assert_eq!(radii, vec![8.0, 0.0, 8.0, 0.0]);
+}
+
 #[test]
 fn the_written_schema_parses_and_round_trips() {
     let schema = Schema::parse(export::SCHEMA).unwrap();

crates/format/src/fig/map.rs

@@ -356,8 +356,9 @@ struct Mapper<'a> {
     /// holding it) name it by `vectorNetworkRef`. Kept out of the JSON, where a large file's
     /// networks took gigabytes.
     networks: Vec<Option<VectorNetwork>>,
-    /// Index in `networks` by its blob, position scale, style table and point-radius scale.
-    network_ids: HashMap<(usize, u64, u64, usize, u64), usize>,
+    /// Index in `networks` by its blob, position scale, style table, point-radius scale and the
+    /// layer's corner radius (which points without one of their own take).
+    network_ids: HashMap<(usize, u64, u64, usize, u64, u64), usize>,
     /// Region paint elements (paints and gradient stops) read so far: one budget for the whole
     /// file, since layers with region paints don't share their network.
     region_paint_elements: usize,

crates/format/src/fig/map/layer.rs

@@ -668,6 +668,8 @@ impl<'a> Mapper<'a> {
             size.zip(norm).filter(|(s, n)| s.is_finite() && *n > 1e-9).map_or(1.0, |(s, n)| s / n)
         };
         let (sx, sy) = (scale("x"), scale("y"));
+        // A point whose style doesn't set a radius takes the layer's, as the editor draws it.
+        let layer_radius = v.len("cornerRadius");
         let vertices: Vec<Value> = net
             .vertices
             .iter()
@@ -676,7 +678,7 @@ impl<'a> Mapper<'a> {
                 let st = style(p.style);
                 // Point radii are lengths in this row's space, unlike the normalized positions.
                 // An override/derived row already carries the instance's scale.
-                if let Some(r) = st.and_then(|s| num(s, "cornerRadius")).and_then(|r| scaled(r, radius_scale)).filter(|r| *r > 0.0) {
+                if let Some(r) = st.and_then(|s| num(s, "cornerRadius")).and_then(|r| scaled(r, radius_scale)).or(layer_radius).filter(|r| *r > 0.0) {
                     out["radius"] = json!(r);
                 }
                 match st.and_then(|s| s.get("handleMirroring")).and_then(Kv::str) {
@@ -793,7 +795,8 @@ impl<'a> Mapper<'a> {
             return true;
         }
         // A resized instance and a K-scaled one can have the same box but different radii.
-        let key = (blob_id, sx.to_bits(), sy.to_bits(), std::ptr::from_ref(vd) as usize, radius_scale.to_bits());
+        let key =
+            (blob_id, sx.to_bits(), sy.to_bits(), std::ptr::from_ref(vd) as usize, radius_scale.to_bits(), layer_radius.unwrap_or(0.0).to_bits());
         let id = match self.network_ids.get(&key) {
             Some(id) => *id,
             None => {

crates/format/src/fig/tail_tests.rs

@@ -521,6 +521,96 @@ fn network_of<'d>(doc: &'d figcraft_doc::Document, name: &str) -> &'d figcraft_d
     }
 }
 
+#[test]
+fn vector_points_without_a_radius_of_their_own_take_the_layers() {
+    // A vector rounded from the layer's corner radius: the editor rounds every point whose
+    // style doesn't set a radius (no style, or one without `cornerRadius`) with the layer's,
+    // while a point's own radius, zero included, wins.
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let wave = nodes.iter_mut().find(|node| node.get("name").and_then(Kv::str) == Some("Wave")).unwrap();
+    let Kv::Object(fields) = wave else { panic!() };
+    fields.push(("cornerRadius", f(6.0)));
+    let vector_data = field_mut(wave, "vectorData").unwrap();
+    let Kv::Array(styles) = field_mut(vector_data, "styleOverrideTable").unwrap() else { panic!() };
+    let Kv::Object(sharp) = styles.get_mut(2).unwrap() else { panic!() };
+    sharp.push(("cornerRadius", f(0.0)));
+    let (doc, _) = import(&canvas(&schema(), &message), "Rounded").unwrap();
+    let radii: Vec<f64> = network_of(&doc, "Wave").vertices.iter().map(|v| v.radius).collect();
+    assert_eq!(radii, [6.0, 4.0, 6.0, 0.0], "no style, own radius, style without one, own zero");
+    // Without a layer radius, the points without one of their own stay sharp.
+    let (doc, _) = import(&tail_canvas(), "Tail").unwrap();
+    let radii: Vec<f64> = network_of(&doc, "Wave").vertices.iter().map(|v| v.radius).collect();
+    assert_eq!(radii, [0.0, 4.0, 0.0, 0.0]);
+}
+
+#[test]
+fn an_instance_that_rounds_a_vector_keeps_its_own_points() {
+    // An instance's copy shares its main's vector data; overriding the layer's radius must not
+    // reuse the main's network, nor hand the instance's to the main.
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let wave = nodes.iter_mut().find(|node| node.get("name").and_then(Kv::str) == Some("Wave")).unwrap();
+    *field_mut(wave, "parentIndex").unwrap() = o(vec![("guid", g(50)), ("position", s("!"))]);
+    *field_mut(wave, "transform").unwrap() = at(0.0, 0.0);
+    let rounded = o(vec![("guidPath", o(vec![("guids", arr(vec![g(30)]))])), ("cornerRadius", f(6.0))]);
+    nodes.push(node(50, Some((1, "~")), "SYMBOL", "Mark", vec![("size", xy(200.0, 100.0)), ("transform", at(700.0, 0.0))]));
+    nodes.push(node(
+        51,
+        Some((1, "~!")),
+        "INSTANCE",
+        "Rounded mark",
+        vec![
+            ("size", xy(200.0, 100.0)),
+            ("transform", at(700.0, 400.0)),
+            ("symbolData", o(vec![("symbolID", g(50)), ("symbolOverrides", arr(vec![rounded]))])),
+        ],
+    ));
+    let (doc, _) = import(&canvas(&schema(), &message), "Instance").unwrap();
+    let radii_under = |parent: &str| -> Vec<f64> {
+        let p = named(&doc, parent);
+        let wave = p.children.iter().map(|c| doc.node(*c).unwrap()).find(|n| n.name == "Wave").unwrap();
+        let NodeKind::Vector { network } = &wave.kind else { panic!() };
+        network.vertices.iter().map(|v| v.radius).collect()
+    };
+    assert_eq!(radii_under("Mark"), [0.0, 4.0, 0.0, 0.0]);
+    assert_eq!(radii_under("Rounded mark"), [6.0, 4.0, 6.0, 6.0]);
+}
+
+#[test]
+fn a_scaled_instance_scales_its_vectors_point_radii() {
+    // Point radii are lengths: an instance scaled with the Scale tool draws its main's, from a
+    // point's own style or from the layer, times the factor (#2091).
+    let mut message = tail_message();
+    let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() };
+    let wave = nodes.iter_mut().find(|node| node.get("name").and_then(Kv::str) == Some("Wave")).unwrap();
+    *field_mut(wave, "parentIndex").unwrap() = o(vec![("guid", g(50)), ("position", s("!"))]);
+    *field_mut(wave, "transform").unwrap() = at(0.0, 0.0);
+    let Kv::Object(fields) = wave else { panic!() };
+    fields.push(("cornerRadius", f(3.0)));
+    nodes.push(node(50, Some((1, "~")), "SYMBOL", "Mark", vec![("size", xy(200.0, 100.0)), ("transform", at(700.0, 0.0))]));
+    nodes.push(node(
+        51,
+        Some((1, "~!")),
+        "INSTANCE",
+        "Big mark",
+        vec![
+            ("size", xy(400.0, 200.0)),
+            ("transform", at(700.0, 400.0)),
+            ("symbolData", o(vec![("symbolID", g(50)), ("uniformScaleFactor", f(2.0))])),
+        ],
+    ));
+    let (doc, _) = import(&canvas(&schema(), &message), "Scaled").unwrap();
+    let radii_under = |parent: &str| -> Vec<f64> {
+        let p = named(&doc, parent);
+        let wave = p.children.iter().map(|c| doc.node(*c).unwrap()).find(|n| n.name == "Wave").unwrap();
+        let NodeKind::Vector { network } = &wave.kind else { panic!() };
+        network.vertices.iter().map(|v| v.radius).collect()
+    };
+    assert_eq!(radii_under("Mark"), [3.0, 4.0, 3.0, 3.0]);
+    assert_eq!(radii_under("Big mark"), [6.0, 8.0, 6.0, 6.0]);
+}
+
 #[test]
 fn vectors_import_as_editable_networks() {
     let (doc, warnings) = import(&tail_canvas(), "Tail").unwrap();

crates/geom/src/lib.rs

@@ -12,7 +12,9 @@ use kurbo::ParamCurve;
 use std::f64::consts::{FRAC_PI_2, PI, TAU};
 
 pub mod measure;
+mod simplify;
 mod transform;
+pub use simplify::simplify_path;
 pub use transform::*;
 
 /// Corner radii in clockwise order from the top-left: `[tl, tr, br, bl]`.

crates/geom/src/simplify.rs

@@ -0,0 +1,140 @@
+//! Path simplification that keeps to its input where kurbo's fit would shoot past it.
+
+use kurbo::{BezPath, ParamCurve, ParamCurveNearest, PathEl, PathSeg, Point, Vec2};
+
+/// How far, as a multiple of the accuracy asked for, a fitted run may stray from the run it
+/// replaces before the run is kept as it was. kurbo's own fits stay within about the accuracy; its
+/// failures stray by tens to hundreds of units, so twice the accuracy tells them apart without
+/// undoing fits that are merely a little over.
+const STRAY: f64 = 2.0;
+
+/// `path` simplified to within `accuracy` by kurbo's [`simplify_bezpath`], kept from straying
+/// far from `path` where kurbo's fit does.
+///
+/// Two inputs made kurbo's fit shoot far past the path it simplified (#1741, a Pencil stroke with
+/// a spike off it), and both are common in pointer samples:
+/// - A join where the path turns straight back (samples going down and back up the same line):
+///   kurbo keeps two segments in one smooth fit when their tangents are parallel whichever way
+///   they point (`|cross| <= |dot| * angle_thresh`), so it fits a smooth curve through the cusp.
+///   The path is cut where it turns back by more than a right angle, each run between the cuts is
+///   simplified on its own, and the runs are joined again, so the turn stays a sharp corner. Any
+///   other join that isn't straight within kurbo's threshold is a corner to kurbo already, so the
+///   cut changes nothing there.
+/// - A run of nearly collinear segments: kurbo measures its error across the path, not along it, so
+///   a fitted cubic whose handle runs hundreds of units on along the line passes its check. Each
+///   fitted run is measured against the run it replaces, and one that strays more than
+///   twice `accuracy` from it is kept as it was instead.
+///
+/// Subpaths and closes are kept, and a closing segment stays implicit, as kurbo leaves it.
+///
+/// [`simplify_bezpath`]: kurbo::simplify::simplify_bezpath
+pub fn simplify_path(path: &BezPath, accuracy: f64) -> BezPath {
+    let mut out = BezPath::new();
+    let mut run = BezPath::new();
+    // Where the current subpath started, where the pen is, and the last segment's end tangent.
+    let mut start = Point::ZERO;
+    let mut at = Point::ZERO;
+    let mut last_tan: Option<Vec2> = None;
+    // Whether the next run that draws anything has to start the subpath with its move.
+    let mut fresh = true;
+    for el in path.elements() {
+        let seg = match *el {
+            PathEl::MoveTo(p) => {
+                flush(&mut out, &mut run, accuracy, &mut fresh);
+                (start, at, last_tan, fresh) = (p, p, None, true);
+                run.move_to(p);
+                continue;
+            }
+            PathEl::ClosePath => {
+                flush(&mut out, &mut run, accuracy, &mut fresh);
+                if !fresh {
+                    out.close_path();
+                }
+                // A segment after a close starts a new subpath at the closed one's start.
+                (at, last_tan, fresh) = (start, None, true);
+                run.move_to(start);
+                continue;
+            }
+            PathEl::LineTo(p) => PathSeg::Line(kurbo::Line::new(at, p)),
+            PathEl::QuadTo(p1, p2) => PathSeg::Quad(kurbo::QuadBez::new(at, p1, p2)),
+            PathEl::CurveTo(p1, p2, p3) => PathSeg::Cubic(kurbo::CubicBez::new(at, p1, p2, p3)),
+        };
+        if run.elements().is_empty() {
+            run.move_to(at);
+        }
+        let Some((t0, t1)) = tangents(seg) else { continue };
+        if last_tan.is_some_and(|last| last.dot(t0) < 0.0) {
+            flush(&mut out, &mut run, accuracy, &mut fresh);
+            run.move_to(at);
+        }
+        run.push(*el);
+        at = seg.end();
+        last_tan = Some(t1);
+    }
+    flush(&mut out, &mut run, accuracy, &mut fresh);
+    out
+}
+
+/// Simplify `run` (one move and the segments after it) with kurbo and append it to `out`; the
+/// run's move is kept only when it starts a subpath (`fresh`), else the run carries on from the
+/// last point drawn. `run` is left empty.
+fn flush(out: &mut BezPath, run: &mut BezPath, accuracy: f64, fresh: &mut bool) {
+    if run.elements().len() > 1 {
+        let fitted = kurbo::simplify::simplify_bezpath(run.iter(), accuracy, &Default::default());
+        let fitted = if keeps_to(&fitted, run, STRAY * accuracy) { fitted } else { std::mem::take(run) };
+        for el in fitted.elements() {
+            match el {
+                PathEl::MoveTo(_) if !*fresh => {}
+                _ => {
+                    out.push(*el);
+                    *fresh = false;
+                }
+            }
+        }
+    }
+    *run = BezPath::new();
+}
+
+/// Whether every point of `fitted` lies within `tol` of `source`: one subpath each, from the same
+/// start to the same end, `fitted` being kurbo's simplification of `source`.
+///
+/// kurbo ends each fitted segment on the source, so the two are walked together: for each fitted
+/// segment, the source segments from where it starts to the first one its end lies on are the only
+/// ones its sample points are measured against. The work is linear in the two lengths. A fitted end
+/// found on no source segment counts as straying.
+fn keeps_to(fitted: &BezPath, source: &BezPath, tol: f64) -> bool {
+    /// Parts each fitted segment is cut into: the points between them are the ones measured.
+    const SAMPLES: u32 = 16;
+    let src: Vec<PathSeg> = source.segments().collect();
+    // kurbo puts each end on the source by evaluating it: off by rounding at most.
+    let on2 = (tol * 1e-3).powi(2);
+    let (tol2, mut cur) = (tol * tol, 0);
+    for seg in fitted.segments() {
+        let Some(last) = (cur..src.len()).find(|&i| src.get(i).is_some_and(|s| s.nearest(seg.end(), 1e-9).distance_sq <= on2)) else {
+            return false;
+        };
+        let near = src.get(cur..=last).unwrap_or_default();
+        for i in 1..SAMPLES {
+            let p = seg.eval(f64::from(i) / f64::from(SAMPLES));
+            if !near.iter().any(|s| s.nearest(p, 1e-6).distance_sq <= tol2) {
+                return false;
+            }
+        }
+        cur = last;
+    }
+    true
+}
+
+/// The directions `seg` leaves its start and reaches its end, skipping control points that sit on
+/// an end; `None` for a segment of no length, which kurbo skips too.
+fn tangents(seg: PathSeg) -> Option<(Vec2, Vec2)> {
+    let pts: Vec<Point> = match seg {
+        PathSeg::Line(l) => vec![l.p0, l.p1],
+        PathSeg::Quad(q) => vec![q.p0, q.p1, q.p2],
+        PathSeg::Cubic(c) => vec![c.p0, c.p1, c.p2, c.p3],
+    };
+    let (first, last) = (*pts.first()?, *pts.last()?);
+    let t0 = pts.iter().map(|p| *p - first).find(|d| d.hypot2() > 0.0)?;
+    let t1 = pts.iter().rev().map(|p| last - *p).find(|d| d.hypot2() > 0.0)?;
+    Some((t0, t1))
+}

crates/geom/src/tests.rs

@@ -366,3 +366,277 @@ fn svg_path_refuses_numbers_past_the_limit_before_parsing() {
     assert!(number_past("M0 0L-2.5.5 1e-3-4e3z", 1e3));
     assert!(number_past("M.5.5e10", 1e3));
 }
+
+/// A path through `pts` with straight lines (pencil samples).
+fn polyline(pts: &[(f64, f64)]) -> BezPath {
+    let mut p = BezPath::new();
+    for (k, (x, y)) in pts.iter().enumerate() {
+        if k == 0 { p.move_to((*x, *y)) } else { p.line_to((*x, *y)) }
+    }
+    p
+}
+
+/// How far `out` strays from `input`: the largest distance from a point sampled along `out` to the
+/// nearest segment of `input` (closing segments included).
+fn deviation(out: &BezPath, input: &BezPath) -> f64 {
+    use kurbo::{ParamCurve, ParamCurveNearest};
+    let segs: Vec<kurbo::PathSeg> = input.segments().collect();
+    out.segments()
+        .flat_map(|seg| (0..=32).map(move |i| seg.eval(f64::from(i) / 32.0)))
+        .map(|p| segs.iter().map(|s| s.nearest(p, 1e-6).distance_sq).fold(f64::INFINITY, f64::min).sqrt())
+        .fold(0.0, f64::max)
+}
+
+/// Pencil strokes kurbo's fit shot far past keep to their samples (#1741): a stroke that goes out
+/// and back to the very point it left, nearly collinear samples, and strokes that turn back along
+/// their own line. The first two are from fuzzing pencil-like strokes, where kurbo's curve went
+/// about 390 and 160 units off; at whole-pixel coordinates the same shapes happened to fit well.
+#[test]
+fn simplifying_keeps_to_strokes_kurbo_shot_past() {
+    let cases: [(&str, &[(f64, f64)]); 5] = [
+        (
+            "out and back to the same point",
+            &[
+                (86.043_565_719_086_97, -173.744_402_349_100_94),
+                (87.851_850_739_335_35, -179.202_846_445_954_52),
+                (86.043_565_719_086_97, -173.744_402_349_100_94),
+            ],
+        ),
+        (
+            "nearly collinear",
+            &[
+                (209.598_690_794_015_5, -204.909_328_119_739_88),
+                (211.277_914_263_870_97, -207.190_974_020_753_4),
+                (214.246_506_828_720_84, -211.228_827_590_623_24),
+            ],
+        ),
+        (
+            "a dip straight down and back up",
+            &[(0.0, 0.0), (10.0, 0.0), (20.0, 2.0), (30.0, 6.0), (30.0, 12.0), (30.0, 6.0), (40.0, 2.0), (50.0, 0.0)],
+        ),
+        ("a slip back at the end", &[(0.0, 0.0), (10.0, 3.0), (20.0, 8.0), (30.0, 15.0), (30.0, 25.0), (30.0, 22.0)]),
+        (
+            "a near reversal in a curve",
+            &[(0.0, 0.0), (8.0, 2.0), (16.0, 6.0), (24.0, 12.0), (32.0, 20.0), (24.0, 12.000_01), (16.0, 6.0), (8.0, 2.0)],
+        ),
+    ];
+    for (what, pts) in cases {
+        keeps_to_one_stroke(what, &polyline(pts));
+    }
+}
+
+/// Accuracies the simplification is checked at: fine, the Pencil's, and coarse.
+const ACCURACIES: [f64; 3] = [0.1, 0.75, 8.0];
+
+/// Check that `input` (one open subpath), simplified at each of [`ACCURACIES`], strays no more
+/// than twice the accuracy from it and leaves no part of it further off than that, stays in its
+/// box grown by as much, and is still one subpath from its start to its end.
+fn keeps_to_one_stroke(what: &str, input: &BezPath) {
+    for accuracy in ACCURACIES {
+        let out = simplify_path(input, accuracy);
+        let (svg, limit) = (out.to_svg(), 2.0 * accuracy);
+        let d = deviation(&out, input);
+        assert!(d <= limit, "{what} at {accuracy}: strays {d} from the input: {svg}");
+        let left = deviation(input, &out);
+        assert!(left <= limit, "{what} at {accuracy}: leaves the input {left} off: {svg}");
+        let (inb, outb) = (input.bounding_box(), out.bounding_box());
+        assert!(inb.inflate(limit, limit).contains_rect(outb), "{what} at {accuracy}: {outb:?} past {inb:?}");
+        let moves = out.elements().iter().filter(|e| matches!(e, kurbo::PathEl::MoveTo(_))).count();
+        assert_eq!(moves, 1, "{what} at {accuracy}: {svg}");
+        // From its start to its end: kurbo evaluates a fitted end on the input, so it is off by
+        // rounding at most.
+        let ends = |p: &BezPath| p.segments().next().map(|s| s.start()).zip(p.segments().last().map(|s| s.end()));
+        let ((start, end), (start_in, end_in)) = (ends(&out).unwrap(), ends(input).unwrap());
+        assert!((start - start_in).hypot() < 1e-9 && (end - end_in).hypot() < 1e-9, "{what} at {accuracy}: {svg}");
+    }
+}
+
+/// Strokes made of curves keep to them as polylines do (#1741): a quadratic or a cubic that goes
+/// out and comes straight back, one whose control points sit on its ends (so its direction is
+/// read from the control point after them), and nearly collinear curves.
+#[test]
+fn simplifying_keeps_to_curves_that_turn_back_or_run_straight() {
+    let (p, q, r) = (
+        (209.598_690_794_015_5, -204.909_328_119_739_88),
+        (211.277_914_263_870_97, -207.190_974_020_753_4),
+        (214.246_506_828_720_84, -211.228_827_590_623_24),
+    );
+    // The nearly collinear samples, each line as a cubic with its handles a third of the way along.
+    let third = |a: (f64, f64), b: (f64, f64), t: f64| (a.0 + (b.0 - a.0) * t, a.1 + (b.1 - a.1) * t);
+    let mut straight_cubics = BezPath::new();
+    straight_cubics.move_to(p);
+    for (a, b) in [(p, q), (q, r)] {
+        straight_cubics.curve_to(third(a, b, 1.0 / 3.0), third(a, b, 2.0 / 3.0), b);
+    }
+    let mut straight_quads = BezPath::new();
+    straight_quads.move_to(p);
+    straight_quads.quad_to(third(p, q, 0.5), q);
+    straight_quads.quad_to(third(q, r, 0.5), r);
+    let cases = [
+        ("a quadratic out and back", BezPath::from_svg("M0 0 Q15 10 30 0 Q15 10 0 0 Q-15 10 -30 0").unwrap()),
+        ("a cubic out and back", BezPath::from_svg("M0 0 C10 8 20 8 30 0 C20 8 10 8 0 0 C-10 8 -20 8 -30 0").unwrap()),
+        ("handles on the ends", BezPath::from_svg("M0 0 C0 0 30 4 30 4 C30 4 0 0 0 0 L-30 -4").unwrap()),
+        ("a cubic dip down and back up", BezPath::from_svg("M0 0 L10 0 C15 0 20 5 20 12 C20 5 25 0 30 0 L40 0").unwrap()),
+        ("nearly collinear cubics", straight_cubics),
+        ("nearly collinear quadratics", straight_quads),
+    ];
+    for (what, input) in cases {
+        keeps_to_one_stroke(what, &input);
+    }
+}
+
+/// `sides` simplified by kurbo one at a time and joined into one subpath.
+fn fitted_apart(sides: &[&BezPath], accuracy: f64) -> BezPath {
+    let mut out = BezPath::new();
+    for side in sides {
+        let fit = kurbo::simplify::simplify_bezpath(side.iter(), accuracy, &Default::default());
+        let skip = usize::from(!out.elements().is_empty());
+        out.extend(fit.elements().iter().copied().skip(skip));
+    }
+    out
+}
+
+/// `curve` cut into `n` cubics, drawn on from where `path` is: forwards, or back from its end.
+fn in_pieces(path: &mut BezPath, curve: kurbo::CubicBez, n: u32, back: bool) {
+    use kurbo::ParamCurve;
+    for i in 0..n {
+        let i = if back { n - 1 - i } else { i };
+        let c = curve.subsegment(f64::from(i) / f64::from(n)..f64::from(i + 1) / f64::from(n));
+        if back { path.curve_to(c.p2, c.p1, c.p0) } else { path.curve_to(c.p1, c.p2, c.p3) }
+    }
+}
+
+/// Where a path turns straight back it is cut, so the result is kurbo's fit of each side on its
+/// own, with a point of the path at the turn. Fitted as one, kurbo rounds the turn off: its curve
+/// passes the stray check, but falls short of the turn or takes more segments. A cubic whose
+/// control points sit on its ends turns back as a line does.
+#[test]
+fn simplifying_fits_each_side_of_a_turn_back_on_its_own() {
+    use kurbo::ParamCurve;
+    let svg = |d: &str| BezPath::from_svg(d).unwrap();
+    let s = kurbo::CubicBez::new((0.0, 0.0), (40.0, -60.0), (80.0, 60.0), (120.0, 0.0));
+    let (mut s_out, mut s_back) = (BezPath::new(), BezPath::new());
+    s_out.move_to(s.p0);
+    in_pieces(&mut s_out, s, 8, false);
+    s_back.move_to(s.p3);
+    in_pieces(&mut s_back, s, 8, true);
+    let cases = [
+        ("lines", svg("M0 0 L10 0 L20 0 L30 0"), svg("M30 0 L20 0 L10 0")),
+        ("handles on the ends", svg("M0 0 L10 0 L20 0 C20 0 30 0 30 0"), svg("M30 0 C30 0 20 0 20 0 L10 0")),
+        ("a curve in pieces", s_out, s_back),
+    ];
+    for (what, out_side, back_side) in cases {
+        let turn = out_side.segments().last().map(|seg| seg.end()).unwrap();
+        let mut input = out_side.clone();
+        input.extend(back_side.elements().iter().copied().skip(1));
+        for accuracy in ACCURACIES {
+            let ours = simplify_path(&input, accuracy);
+            let apart = fitted_apart(&[&out_side, &back_side], accuracy);
+            assert_eq!(ours.elements(), apart.elements(), "{what} at {accuracy}");
+            assert!(ours.segments().any(|seg| (seg.end() - turn).hypot() < 1e-9), "{what} at {accuracy}: {}", ours.to_svg());
+        }
+    }
+}
+
+/// Where a path never turns back and kurbo's fit holds, the result is kurbo's own, element for
+/// element: smooth runs, corners sharper than a right angle, closed subpaths and several subpaths.
+/// A fit counts as holding up to twice the accuracy asked for, whatever that is: the large wave's
+/// is further off at the coarse accuracy than the Pencil's limit of 1.5.
+#[test]
+fn simplifying_is_kurbos_where_its_fit_holds() {
+    let wave: Vec<(f64, f64)> = (0..=60).map(|i| (f64::from(i) * 4.0, (f64::from(i) / 6.0).sin() * 30.0)).collect();
+    let zigzag: Vec<(f64, f64)> = (0..=8).map(|i| (f64::from(i) * 10.0, if i % 2 == 0 { 0.0 } else { 40.0 })).collect();
+    let mut closed = polyline(&wave[..20]);
+    closed.close_path();
+    let mut several = polyline(&wave);
+    several.extend(polyline(&zigzag).elements().iter().map(|e| match *e {
+        kurbo::PathEl::MoveTo(p) => kurbo::PathEl::MoveTo(p + Vec2::new(0.0, 100.0)),
+        kurbo::PathEl::LineTo(p) => kurbo::PathEl::LineTo(p + Vec2::new(0.0, 100.0)),
+        e => e,
+    }));
+    let curves = BezPath::from_svg("M0 0 C10 -20 30 -20 40 0 C50 20 70 20 80 0 Q100 -30 120 0 L140 10 Z M200 0 L240 0").unwrap();
+    // A sine 300 high in 40 smooth cubics.
+    let sine = |x: f64| ((x / 120.0).sin() * 300.0, (x / 120.0).cos() * 2.5);
+    let mut large = BezPath::new();
+    large.move_to((0.0, 0.0));
+    for i in 0..40 {
+        let (x0, x1) = (f64::from(i) * 40.0, f64::from(i + 1) * 40.0);
+        let ((y0, d0), (y1, d1)) = (sine(x0), sine(x1));
+        large.curve_to((x0 + 40.0 / 3.0, y0 + d0 * 40.0 / 3.0), (x1 - 40.0 / 3.0, y1 - d1 * 40.0 / 3.0), (x1, y1));
+    }
+    let coarse = simplify_path(&large, 8.0);
+    assert!(coarse.elements().len() < 10 && (1.5..=8.0).contains(&deviation(&coarse, &large)), "{}", deviation(&coarse, &large));
+    for (what, input) in [
+        ("a wave", polyline(&wave)),
+        ("a zigzag", polyline(&zigzag)),
+        ("closed", closed),
+        ("two subpaths", several),
+        ("curves", curves),
+        ("a large wave", large),
+    ] {
+        for accuracy in ACCURACIES {
+            let ours = simplify_path(&input, accuracy);
+            let theirs = kurbo::simplify::simplify_bezpath(input.iter(), accuracy, &Default::default());
+            assert_eq!(ours.elements(), theirs.elements(), "{what} at {accuracy}");
+        }
+    }
+}
+
+/// A closed path with a reversal in it stays one closed subpath, and each subpath of several keeps
+/// its own start.
+#[test]
+fn simplifying_keeps_closes_and_subpaths_across_a_reversal() {
+    let mut input = polyline(&[(0.0, 0.0), (40.0, 0.0), (40.0, 30.0), (40.0, 20.0), (0.0, 30.0)]);
+    input.close_path();
+    input.extend(polyline(&[(100.0, 0.0), (100.0, 20.0), (100.0, 10.0)]).elements().iter().copied());
+    let out = simplify_path(&input, 0.75);
+    let els = out.elements();
+    let moves: Vec<Point> = els.iter().filter_map(|e| if let kurbo::PathEl::MoveTo(p) = e { Some(*p) } else { None }).collect();
+    assert_eq!(moves, [Point::new(0.0, 0.0), Point::new(100.0, 0.0)], "{}", out.to_svg());
+    assert_eq!(els.iter().filter(|e| matches!(e, kurbo::PathEl::ClosePath)).count(), 1, "{}", out.to_svg());
+    let close = els.iter().position(|e| matches!(e, kurbo::PathEl::ClosePath)).unwrap();
+    assert!(matches!(els[close + 1], kurbo::PathEl::MoveTo(_)), "the first subpath closes before the second starts");
+    assert!(deviation(&out, &input) <= 1.5, "{}", out.to_svg());
+    // Nothing to draw: nothing out, not a stray move or close.
+    let mut empty = BezPath::new();
+    empty.move_to((5.0, 5.0));
+    empty.line_to((5.0, 5.0));
+    empty.close_path();
+    assert!(simplify_path(&empty, 0.75).elements().is_empty());
+    for d in ["", "M5 5", "M5 5 M6 6", "M5 5 Z"] {
+        let input = if d.is_empty() { BezPath::new() } else { BezPath::from_svg(d).unwrap() };
+        assert!(simplify_path(&input, 0.75).elements().is_empty(), "{d:?}");
+    }
+}
+
+/// The subpaths simplified keep their starts: a move with nothing drawn from it between two
+/// subpaths leaves no trace, and a segment drawn on from a close starts a subpath where the closed
+/// one started, as it does in the path given.
+#[test]
+fn simplifying_keeps_where_each_subpath_starts() {
+    let starts =
+        |p: &BezPath| -> Vec<Point> { p.elements().iter().filter_map(|e| if let kurbo::PathEl::MoveTo(p) = e { Some(*p) } else { None }).collect() };
+    let between = BezPath::from_svg("M0 0 L10 0 L20 5 M50 50 M100 0 L110 0 L120 5").unwrap();
+    let out = simplify_path(&between, 0.75);
+    assert_eq!(starts(&out), [Point::new(0.0, 0.0), Point::new(100.0, 0.0)], "{}", out.to_svg());
+    assert!(deviation(&out, &between) <= 1.5, "{}", out.to_svg());
+    // After the close, the pen is back at (0, 0): the next segments start there, also across a
+    // reversal.
+    use kurbo::PathEl::{ClosePath, LineTo, MoveTo};
+    let on = BezPath::from_vec(vec![
+        MoveTo(Point::new(0.0, 0.0)),
+        LineTo(Point::new(10.0, 0.0)),
+        LineTo(Point::new(10.0, 10.0)),
+        ClosePath,
+        LineTo(Point::new(20.0, 20.0)),
+        LineTo(Point::new(30.0, 20.0)),
+        LineTo(Point::new(20.0, 20.0)),
+    ]);
+    let out = simplify_path(&on, 0.75);
+    let els = out.elements();
+    let close = els.iter().position(|e| matches!(e, kurbo::PathEl::ClosePath)).unwrap();
+    assert_eq!(els.get(close + 1), Some(&kurbo::PathEl::MoveTo(Point::new(0.0, 0.0))), "{}", out.to_svg());
+    assert_eq!(starts(&out), [Point::new(0.0, 0.0), Point::new(0.0, 0.0)], "{}", out.to_svg());
+    assert_eq!(out.segments().last().map(|s| kurbo::ParamCurve::end(&s)), Some(Point::new(20.0, 20.0)));
+    assert!(deviation(&out, &on) <= 1.5, "{}", out.to_svg());
+}

crates/layout/src/depth_tests.rs

@@ -93,3 +93,15 @@ fn deeply_nested_fill_frames_lay_out_without_running_out_of_stack() {
         assert_eq!(width(&d, chain[DEEP - 1]), 10.0, "past the nesting the layout follows, layers stay");
     });
 }
+
+#[test]
+fn snap_lines_are_bounded_across_a_frames_grids() {
+    use figcraft_doc::{Document, GridKind, LayoutGrid, NodeKind};
+    let mut d = Document::new("t");
+    let p = d.first_page().unwrap();
+    let f = d.create(p, NodeKind::Frame, "F", 0.0, 0.0, 4000.0, 4000.0).unwrap();
+    d.get_mut(f).unwrap().grids = vec![LayoutGrid { kind: GridKind::Grid, size: 1.0, visible: true, ..LayoutGrid::default() }; 1000];
+    let (xs, ys) = crate::grid_snap_lines(&d, f);
+    assert!(xs.len() + ys.len() <= 200_000, "{}", xs.len() + ys.len());
+    assert!(xs.len() > 4000 && ys.len() > 4000, "the first grids still give their lines");
+}

crates/layout/src/lib.rs

@@ -1159,6 +1159,9 @@ pub fn grid_snap_lines(doc: &Document, frame: NodeId) -> (Vec<f64>, Vec<f64>) {
     grid_snap_lines_in(doc, frame, doc.world_transform(frame))
 }
 
+/// The most snap coordinates a frame's grids give together (a few dozen grids' worth of lines).
+const MAX_SNAP_LINES: usize = 200_000;
+
 /// [`grid_snap_lines`] mapped from the frame's coordinates by `xf` (the frame's world transform
 /// for page lines).
 pub fn grid_snap_lines_in(doc: &Document, frame: NodeId, xf: Affine) -> (Vec<f64>, Vec<f64>) {
@@ -1166,7 +1169,13 @@ pub fn grid_snap_lines_in(doc: &Document, frame: NodeId, xf: Affine) -> (Vec<f64
     let mut xs = Vec::new();
     let mut ys = Vec::new();
     for g in f.grids.iter().filter(|g| g.visible) {
-        for r in grid_lines(g, f.width, f.height) {
+        // A frame-wide budget: each grid adds up to ~17,000 lines, and a file can hold any number of grids;
+        // a grid that would pass it is left out whole.
+        let lines = grid_lines(g, f.width, f.height);
+        if xs.len() + ys.len() + 2 * lines.len() > MAX_SNAP_LINES {
+            break;
+        }
+        for r in lines {
             let a = xf * Point::new(r.x0, r.y0);
             let b = xf * Point::new(r.x1, r.y1);
             match g.kind {

crates/svg/src/import.rs

@@ -704,13 +704,36 @@ fn simple_hash(b: &[u8]) -> String {
 /// Deepest element nesting the parser is given: deeper documents would exhaust the stack.
 const MAX_NESTING: usize = 512;
 
+/// The most attributes one element may have. The XML parser checks each attribute against the
+/// earlier ones, so a huge count is quadratic work; real elements have a few dozen at most.
+const MAX_ATTRIBUTES: usize = 4096;
+
 /// How deep elements nest in `data`: a scan of its tags (comments, CDATA, declarations and quoted
 /// attribute values skipped) that stops once past `limit`.
 pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
+    scan(data, limit).0
+}
+
+/// The most the parser's duplicate-attribute checks may cost over a whole document, as the sum of
+/// each element's attribute count squared (a real file with 100,000 elements of 20 attributes is
+/// 40 million).
+const MAX_ATTRIBUTE_WORK: usize = 1 << 28;
+
+/// Whether an element of `data` has more than [`MAX_ATTRIBUTES`] attributes, or all of them cost
+/// more than [`MAX_ATTRIBUTE_WORK`] (counted as quoted values, before the parser sees them; the
+/// declarations of a DTD count as one element, as entities can hold elements).
+pub(crate) fn too_wide(data: &[u8]) -> bool {
+    let (_, widest, work) = scan(data, usize::MAX);
+    widest > MAX_ATTRIBUTES || work > MAX_ATTRIBUTE_WORK
+}
+
+/// [`nesting`], the most attribute values on one element and the attribute work (see
+/// [`MAX_ATTRIBUTE_WORK`]); stops once any is past its limit.
+fn scan(data: &[u8], limit: usize) -> (usize, usize, usize) {
     let find = |from: usize, pat: &[u8]| -> usize {
         data.get(from..).and_then(|r| r.windows(pat.len()).position(|w| w == pat)).map_or(data.len(), |p| from + p + pat.len())
     };
-    let (mut depth, mut max, mut i) = (0usize, 0usize, 0usize);
+    let (mut depth, mut max, mut i, mut widest, mut work) = (0usize, 0usize, 0usize, 0usize, 0usize);
     while let Some(off) = data.get(i..).and_then(|r| r.iter().position(|b| *b == b'<')) {
         i += off;
         let rest = data.get(i..).unwrap_or(&[]);
@@ -718,6 +741,19 @@ pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
             i = find(i + 4, b"-->");
         } else if rest.starts_with(b"<![CDATA[") {
             i = find(i + 9, b"]]>");
+        } else if rest.starts_with(b"<!DOCTYPE") {
+            // To the `]>` closing its subset (the first `>` when it has none).
+            let end = match (rest.iter().position(|b| *b == b'['), rest.iter().position(|b| *b == b'>')) {
+                (Some(o), Some(g)) if o < g => find(i, b"]>"),
+                _ => find(i, b">"),
+            };
+            let quotes = data.get(i..end).unwrap_or(&[]).iter().filter(|b| matches!(**b, b'"' | b'\'')).count();
+            widest = widest.max(quotes / 2);
+            work = work.saturating_add((quotes / 2).saturating_mul(quotes / 2));
+            if widest > MAX_ATTRIBUTES || work > MAX_ATTRIBUTE_WORK {
+                return (max, widest, work);
+            }
+            i = end;
         } else if rest.starts_with(b"<?") || rest.starts_with(b"<!") {
             i = find(i + 2, b">");
         } else if rest.starts_with(b"</") {
@@ -725,12 +761,15 @@ pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
             i = find(i + 2, b">");
         } else {
             // A start tag: to its `>` outside quotes; `/>` closes it.
-            let (mut quote, mut j, mut closed) = (None, i + 1, false);
+            let (mut quote, mut j, mut closed, mut attrs) = (None, i + 1, false, 0usize);
             while let Some(&c) = data.get(j) {
                 match quote {
                     Some(q) if c == q => quote = None,
                     Some(_) => {}
-                    None if c == b'"' || c == b'\'' => quote = Some(c),
+                    None if c == b'"' || c == b'\'' => {
+                        quote = Some(c);
+                        attrs += 1;
+                    }
                     None if c == b'>' => {
                         closed = data.get(j.wrapping_sub(1)) == Some(&b'/');
                         break;
@@ -739,17 +778,22 @@ pub(crate) fn nesting(data: &[u8], limit: usize) -> usize {
                 }
                 j += 1;
             }
+            widest = widest.max(attrs);
+            work = work.saturating_add(attrs * attrs);
+            if widest > MAX_ATTRIBUTES || work > MAX_ATTRIBUTE_WORK {
+                return (max, widest, work);
+            }
             if !closed {
                 depth += 1;
                 max = max.max(depth);
                 if max > limit {
-                    return max;
+                    return (max, widest, work);
                 }
             }
             i = j + 1;
         }
     }
-    max
+    (max, widest, work)
 }
 
 /// Whether `data` nests elements more than [`MAX_NESTING`] deep: the byte scan first, then the
@@ -883,6 +927,9 @@ fn import_within(
 ) -> Result<Imported, ImportError> {
     // SVGZ is unpacked here, within a budget, so every check below sees the real document.
     let data = budget::document(data, &limits).map_err(ImportError)?;
+    if too_wide(&data) {
+        return Err(ImportError(format!("an element has more than {MAX_ATTRIBUTES} attributes")));
+    }
     if too_deep(&data) {
         return Err(ImportError(format!("elements nested more than {MAX_NESTING} deep")));
     }

crates/svg/src/import/budget.rs

@@ -87,7 +87,7 @@ fn embedded(used: &Used, limits: &Limits, data: &[u8], opts: &Options) -> Option
         }
     };
     used.bytes.fetch_add(plain.len(), Ordering::Relaxed);
-    if super::too_deep(&plain) {
+    if super::too_wide(&plain) || super::too_deep(&plain) {
         return None;
     }
     used.depth.fetch_add(1, Ordering::Relaxed);

crates/svg/src/import/hostile_tests.rs

@@ -181,3 +181,27 @@ fn entity_expansion_cannot_bypass_the_nesting_limit() {
     let err = import_svg(&mut d, data.as_bytes(), p, 0.0, 0.0, "x").err().map(|e| e.to_string()).unwrap_or_default();
     assert!(err.contains("nested more than 512 deep"), "{err:?}");
 }
+
+#[test]
+fn an_element_with_thousands_of_attributes_is_refused_before_parsing() {
+    use super::too_wide;
+    let many = |n: usize| (0..n).map(|i| format!(" a{i}=\"1\"")).collect::<String>();
+    assert!(!too_wide(format!("<svg{}/>", many(4096)).as_bytes()));
+    assert!(too_wide(format!("<svg><g{}/></svg>", many(4097)).as_bytes()));
+    assert!(!too_wide(format!("<svg>{}</svg>", "<g a='1' b='2'/>".repeat(10_000)).as_bytes()), "per element, not per file");
+    let mut d = Document::new("t");
+    let p = d.first_page().unwrap();
+    assert!(import_svg(&mut d, &svg(&format!("<g{}/>", many(100_000))), p, 0.0, 0.0, "x").is_err());
+}
+
+#[test]
+fn attribute_work_is_bounded_over_the_whole_document_and_its_dtd() {
+    use super::too_wide;
+    let many = |n: usize| (0..n).map(|i| format!(" a{i}=\"1\"")).collect::<String>();
+    let tag = format!("<g{}/>", many(4000));
+    assert!(!too_wide(format!("<svg>{}</svg>", tag.repeat(10)).as_bytes()));
+    assert!(too_wide(format!("<svg>{}</svg>", tag.repeat(40)).as_bytes()), "each element is within the limit, all together are not");
+    let dtd = format!("<!DOCTYPE svg [<!ENTITY e '<g{}/>'>]><svg>&e;</svg>", many(5000));
+    assert!(too_wide(dtd.as_bytes()), "entities can hold elements");
+    assert!(!too_wide(b"<?xml version='1.0'?><!DOCTYPE svg [<!ENTITY ns 'http://www.w3.org/2000/svg'>]><svg/>"));
+}

crates/svg/src/import/text.rs

@@ -195,7 +195,7 @@ pub(crate) fn text(cx: &mut Ctx, t: &usvg::Text, parent: NodeId, base: Affine, d
         let x = chunk.x().map_or(pen_x, f64::from) + d(t.dx());
         let y = chunk.y().map_or(pen_y, f64::from) + d(t.dy());
         char_at += count;
-        let ci = |b: usize| text.get(..b).map_or(count, |p| p.chars().count());
+        let ci = char_index(text, chunk.spans().iter().flat_map(|sp| [sp.start(), sp.end()]));
         let spans: Vec<_> = chunk.spans().iter().map(|sp| (ci(sp.start()), ci(sp.end()), sp, span_style(sp, s, fonts))).collect();
         if spans.is_empty() {
             continue;
@@ -229,6 +229,32 @@ pub(crate) fn text(cx: &mut Ctx, t: &usvg::Text, parent: NodeId, base: Affine, d
     }
 }
 
+/// The characters of `text` before each of the byte `offsets` (all of them for an offset that is
+/// past the end or inside a character): one pass over the text, whatever the number of spans.
+fn char_index(text: &str, offsets: impl IntoIterator<Item = usize>) -> impl Fn(usize) -> usize {
+    let mut want: Vec<usize> = offsets.into_iter().collect();
+    want.sort_unstable();
+    want.dedup();
+    let mut found: Vec<(usize, usize)> = Vec::with_capacity(want.len());
+    let mut wanted = want.into_iter().peekable();
+    let mut count = 0;
+    for (i, _) in text.char_indices() {
+        while let Some(&o) = wanted.peek() {
+            match o.cmp(&i) {
+                std::cmp::Ordering::Equal => found.push((o, count)),
+                std::cmp::Ordering::Greater => break,
+                std::cmp::Ordering::Less => {}
+            }
+            wanted.next();
+        }
+        count += 1;
+    }
+    if wanted.any(|o| o == text.len()) {
+        found.push((text.len(), count));
+    }
+    move |b| found.binary_search_by_key(&b, |f| f.0).ok().and_then(|k| found.get(k)).map_or(count, |f| f.1)
+}
+
 /// The text of `lines` (one per line, stacked at their pitch; `s`: their scale): characters, the
 /// first span's style and a run per span, fills still to come.
 fn text_data(lines: &[Line], s: f64) -> TextData {
@@ -262,8 +288,7 @@ fn on_path(cx: &mut Ctx, t: &usvg::Text, world: Affine, parent: NodeId) -> bool
     let Some(len) = figcraft_geom::measure::polylines(&path).and_then(|l| l.first().map(|l| l.length())).filter(|l| *l > 1e-9) else { return false };
     let fonts = cx.fonts.get_or_insert_with(Fonts::load);
     let text = chunk.text();
-    let count = text.chars().count();
-    let ci = |b: usize| text.get(..b).map_or(count, |p| p.chars().count());
+    let ci = char_index(text, chunk.spans().iter().flat_map(|sp| [sp.start(), sp.end()]));
     let spans: Vec<_> = chunk.spans().iter().map(|sp| (ci(sp.start()), ci(sp.end()), sp, span_style(sp, 1.0, fonts))).collect();
     let line = Line { x: 0.0, y: 0.0, anchor: chunk.anchor(), text: text.to_string(), spans };
     let mut td = text_data(std::slice::from_ref(&line), 1.0);

crates/svg/src/import/text_tests.rs

@@ -30,3 +30,11 @@ fn css_system_font_names_keep_their_name_where_the_system_font_is() {
     assert_eq!(family(&named(&["-apple-system", "BlinkMacSystemFont", "system-ui", "sans-serif"]), &elsewhere), "Inter");
     assert_eq!(family(&named(&["-apple-system"]), &elsewhere), "-apple-system", "nothing installed: the first name it gives");
 }
+
+#[test]
+fn char_index_counts_the_characters_before_a_byte_offset() {
+    let t = "aé😀b";
+    let ci = super::char_index(t, [0, 1, 3, 7, 8, 2, 4, 99]);
+    assert_eq!([ci(0), ci(1), ci(3), ci(7), ci(8)], [0, 1, 2, 3, 4]);
+    assert_eq!([ci(2), ci(4), ci(99)], [4, 4, 4], "inside a character or past the end: all of them");
+}

crates/text/src/fontdb.rs

@@ -92,6 +92,10 @@ pub struct Face {
     pub italic: bool,
     pub bytes: FontBytes,
     pub index: u32,
+    /// 0 for a built-in or installed face; else the order it was loaded in with `text.loadFont`
+    /// ([`FontDb::add_loaded`]). A loaded face wins over any other of its family and style, the
+    /// latest load over earlier ones (#2092).
+    pub loaded: u32,
     pub upem: f64,
     /// Ascent and descent in font units, both positive.
     pub ascent: f64,
@@ -207,6 +211,7 @@ impl Face {
             family,
             style,
             index,
+            loaded: 0,
             upem,
             ascent,
             descent,
@@ -620,6 +625,8 @@ pub struct FontDb {
     loaded_files: std::collections::BTreeSet<(std::path::PathBuf, u32)>,
     /// Font files added as bytes (hash and length → families), so loading one again adds nothing.
     loaded_bytes: std::collections::HashMap<(u64, usize), Vec<String>>,
+    /// Loads so far ([`Face::loaded`]).
+    load_seq: u32,
     system_scanned: bool,
     /// Browser fonts text asked for and not yet taken by the browser layer.
     wanted: Vec<usize>,
@@ -716,8 +723,20 @@ impl FontDb {
         face
     }
 
+    /// [`add`](Self::add) a face loaded explicitly (`text.loadFont`): it wins over the other faces
+    /// of its family and style, and over those loaded before it.
+    pub fn add_loaded(&mut self, mut face: Face) -> Arc<Face> {
+        self.load_seq += 1;
+        face.loaded = self.load_seq;
+        self.add(face)
+    }
+
     /// Add font file bytes (all faces of a collection). Returns the faces added.
     pub fn add_bytes(&mut self, bytes: Vec<u8>) -> Vec<Arc<Face>> {
+        self.add_bytes_with(bytes, false)
+    }
+
+    fn add_bytes_with(&mut self, bytes: Vec<u8>, loaded: bool) -> Vec<Arc<Face>> {
         let shared = Arc::new(bytes);
         let count = match FileRef::new(shared.as_slice()) {
             // A collection's header may name any number of faces, each a few bytes pointing at
@@ -727,7 +746,10 @@ impl FontDb {
             Ok(FileRef::Font(_)) => 1,
             Err(_) => 0,
         };
-        (0..count).filter_map(|i| Face::from_bytes(FontBytes::Shared(shared.clone()), i, None, None)).map(|f| self.add(f)).collect()
+        (0..count)
+            .filter_map(|i| Face::from_bytes(FontBytes::Shared(shared.clone()), i, None, None))
+            .map(|f| if loaded { self.add_loaded(f) } else { self.add(f) })
+            .collect()
     }
 
     /// The family and style of the face whose PostScript name is `ps` (ignoring case), loaded or
@@ -1035,7 +1057,9 @@ impl FontDb {
     /// The loaded face of `family` nearest `style`.
     fn best(&self, family: &str, style: &str) -> Option<Arc<Face>> {
         let (_, idx) = self.families.get(&self.key(family))?;
-        let faces: Vec<&Arc<Face>> = idx.iter().filter_map(|i| self.faces.get(*i)).collect();
+        let mut faces: Vec<&Arc<Face>> = idx.iter().filter_map(|i| self.faces.get(*i)).collect();
+        // A loaded font comes first (the latest load first): of faces as near, the first wins.
+        faces.sort_by_key(|f| std::cmp::Reverse(f.loaded));
         let want = norm_style(style);
         if let Some(f) = faces.iter().find(|f| norm_style(&f.style) == want).or_else(|| faces.iter().find(|f| has_style(f, style))) {
             return Some((*f).clone());
@@ -1595,7 +1619,7 @@ pub fn load_font_bytes(bytes: Vec<u8>) -> Vec<String> {
     if let Some(families) = db.loaded_bytes.get(&key) {
         return families.clone();
     }
-    let faces = db.add_bytes(bytes);
+    let faces = db.add_bytes_with(bytes, true);
     let mut families: Vec<String> = faces.iter().map(|f| f.family.clone()).collect();
     families.dedup();
     if !families.is_empty() {

crates/text/src/fontdb_tests.rs

@@ -382,6 +382,45 @@ fn font_bytes_load_into_the_db() {
     }
 }
 
+/// #2092: a font loaded with `text.loadFont` wins over the built-in and installed faces of its family
+/// and style, the latest load over earlier ones; other styles resolve as before.
+#[test]
+fn a_loaded_face_wins_over_the_built_in_one_of_its_family_and_style() {
+    // Any embedded or installed font stands in for the faces (none without craft-fonts on CI).
+    let stand_in = CRAFT_FONTS.first().map(|f| f.bytes.to_vec()).or_else(|| {
+        let mut installed = BTreeMap::new();
+        for dir in system_font_dirs() {
+            scan_dir(&dir, 0, &mut installed);
+        }
+        installed.values().flat_map(|(_, v)| v).find_map(|p| std::fs::read(&p.path).ok())
+    });
+    let Some(bytes) = stand_in.map(Arc::new) else {
+        eprintln!("skipping: no font to stand in");
+        return;
+    };
+    let face = |style: &str, name: &str| {
+        let mut f = Face::from_bytes(FontBytes::Shared(bytes.clone()), 0, Some("Brand Sans"), Some(style)).unwrap();
+        f.instances.clear();
+        f.postscript = Some(name.into());
+        f
+    };
+    let name = |db: &FontDb, style: &str| db.best("Brand Sans", style).and_then(|f| f.postscript.clone());
+    let mut db = FontDb::default();
+    db.add(face("Regular", "Built-in-Regular"));
+    db.add(face("Bold", "Built-in-Bold"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Built-in-Regular"));
+    db.add_loaded(face("Regular", "Loaded-Regular"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Loaded-Regular"));
+    // Bold wasn't loaded: the built-in one stays. Nor does the loaded Regular stand in for it.
+    assert_eq!(name(&db, "Bold").as_deref(), Some("Built-in-Bold"));
+    // The latest load wins.
+    db.add_loaded(face("Regular", "Loaded-Regular-2"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Loaded-Regular-2"));
+    // A face added after a load, not loaded, doesn't displace it.
+    db.add(face("Regular", "Installed-Regular"));
+    assert_eq!(name(&db, "Regular").as_deref(), Some("Loaded-Regular-2"));
+}
+
 /// Apple's system font answers to the names designs and CSS use for it (SF Pro, SF UI Text,
 /// system-ui, …), unless a font of that name is installed.
 #[test]

crates/text/src/tail_tests.rs

@@ -93,8 +93,16 @@ fn list_numbering_by_level() {
             vec!["\u{2022}", "\u{2022}", "\u{2022}", "\u{2022}"],
             "bullets keep the same styling at all levels of indentation",
         ),
-        (vec![pl(N, 0), pl(N, 0), pl(P, 0), pl(N, 0)], vec!["1.", "2.", "", "1."], "silent: a plain paragraph ends a list, the next starts at 1"),
-        (vec![pl(N, 0), pl(B, 0), pl(N, 0)], vec!["1.", "\u{2022}", "1."], "silent: the other kind of list at the same level starts the count again"),
+        (
+            vec![pl(N, 0), pl(N, 0), pl(P, 0), pl(N, 0)],
+            vec!["1.", "2.", "", "1."],
+            "as measured in Figma (2026-11-11): a plain paragraph ends a list, the next starts at 1",
+        ),
+        (
+            vec![pl(N, 0), pl(B, 0), pl(N, 0)],
+            vec!["1.", "\u{2022}", "1."],
+            "as measured in Figma (2026-11-11): a bullet item between numbered ones starts the count again",
+        ),
         (vec![pl(N, 0), pl(N, 1), pl(N, 0), pl(N, 1)], vec!["1.", "a.", "2.", "a."], "a shallower item starts the deeper count again"),
         (vec![pl(N, 2), pl(N, 2), pl(N, 2), pl(N, 2)], vec!["i.", "ii.", "iii.", "iv."], "roman numerals at the third level"),
     ];

crates/ui-egui/locales/ar.toml

@@ -2009,6 +2009,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "جمع كتنويعات"
 "component.create" = "إنشاء مكوّن"
 "component.createMultiple" = "إنشاء مكونات متعددة"
+"component.createSet" = "إنشاء مجموعة مكونات"
 "component.deleteProperty" = "حذف خاصية المكوّن"
 "component.detach" = "فصل النسخة المثيلة"
 "component.editProperty" = "تحرير خاصية المكوّن"

crates/ui-egui/locales/bs.toml

@@ -2038,6 +2038,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Kombinuj kao varijante"
 "component.create" = "Kreiraj komponentu"
 "component.createMultiple" = "Kreiraj više komponenti"
+"component.createSet" = "Kreiraj skup komponenti"
 "component.deleteProperty" = "Izbriši svojstvo komponente"
 "component.detach" = "Odvoji instancu"
 "component.editProperty" = "Uredi svojstvo komponente"

crates/ui-egui/locales/cs.toml

@@ -1913,6 +1913,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Sloučit jako varianty"
 "component.create" = "Vytvořit komponentu"
 "component.createMultiple" = "Vytvořit více komponent"
+"component.createSet" = "Vytvořit sadu komponent"
 "component.deleteProperty" = "Smazat vlastnost komponenty"
 "component.detach" = "Odpojit instanci"
 "component.editProperty" = "Upravit vlastnost komponenty"

crates/ui-egui/locales/de.toml

@@ -2079,6 +2079,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Als Varianten kombinieren"
 "component.create" = "Komponente erstellen"
 "component.createMultiple" = "Mehrere Komponenten erstellen"
+"component.createSet" = "Komponentensatz erstellen"
 "component.deleteProperty" = "Komponenteneigenschaft löschen"
 "component.detach" = "Instanz lösen"
 "component.editProperty" = "Komponenteneigenschaft bearbeiten"

crates/ui-egui/locales/es.toml

@@ -2002,6 +2002,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combinar como variantes"
 "component.create" = "Crear componente"
 "component.createMultiple" = "Crear varios componentes"
+"component.createSet" = "Crear conjunto de componentes"
 "component.deleteProperty" = "Eliminar propiedad de componente"
 "component.detach" = "Separar instancia"
 "component.editProperty" = "Editar propiedad de componente"

crates/ui-egui/locales/fi.toml

@@ -2086,6 +2086,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Yhdistä varianteiksi"
 "component.create" = "Luo komponentti"
 "component.createMultiple" = "Luo useita komponentteja"
+"component.createSet" = "Luo komponenttijoukko"
 "component.deleteProperty" = "Poista komponentin ominaisuus"
 "component.detach" = "Irrota ilmentymä"
 "component.editProperty" = "Muokkaa komponentin ominaisuutta"

crates/ui-egui/locales/fr.toml

@@ -1958,6 +1958,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combiner en variantes"
 "component.create" = "Créer un composant"
 "component.createMultiple" = "Créer plusieurs composants"
+"component.createSet" = "Créer un ensemble de composants"
 "component.deleteProperty" = "Supprimer la propriété de composant"
 "component.detach" = "Détacher l’instance"
 "component.editProperty" = "Modifier la propriété de composant"

crates/ui-egui/locales/id.toml

@@ -1917,6 +1917,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Gabungkan sebagai variant"
 "component.create" = "Buat component"
 "component.createMultiple" = "Buat beberapa component"
+"component.createSet" = "Buat set component"
 "component.deleteProperty" = "Hapus properti component"
 "component.detach" = "Lepaskan instance"
 "component.editProperty" = "Edit properti component"

crates/ui-egui/locales/it.toml

@@ -1861,6 +1861,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combina come varianti"
 "component.create" = "Crea componente"
 "component.createMultiple" = "Crea più componenti"
+"component.createSet" = "Crea set di componenti"
 "component.deleteProperty" = "Elimina proprietà del componente"
 "component.detach" = "Scollega istanza"
 "component.editProperty" = "Modifica proprietà del componente"

crates/ui-egui/locales/ja.toml

@@ -1938,6 +1938,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "バリアントとして結合"
 "component.create" = "コンポーネントを作成"
 "component.createMultiple" = "複数のコンポーネントを作成"
+"component.createSet" = "コンポーネントセットを作成"
 "component.deleteProperty" = "コンポーネントプロパティを削除"
 "component.detach" = "インスタンスを切り離す"
 "component.editProperty" = "コンポーネントプロパティを編集"

crates/ui-egui/locales/ka.toml

@@ -2013,6 +2013,7 @@ status = "draft — reviewed by a native speaker, awaiting a maintainer's approv
 "component.combineVariants" = "ვარიანტებად გაერთიანება"
 "component.create" = "კომპონენტის შექმნა"
 "component.createMultiple" = "რამდენიმე კომპონენტის შექმნა"
+"component.createSet" = "კომპონენტების ნაკრების შექმნა"
 "component.deleteProperty" = "კომპონენტის თვისების წაშლა"
 "component.detach" = "ინსტანსის გამოყოფა"
 "component.editProperty" = "კომპონენტის თვისების რედაქტირება"

crates/ui-egui/locales/ko.toml

@@ -1978,6 +1978,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "배리언트로 결합"
 "component.create" = "컴포넌트 만들기"
 "component.createMultiple" = "여러 컴포넌트 만들기"
+"component.createSet" = "컴포넌트 세트 만들기"
 "component.deleteProperty" = "컴포넌트 속성 삭제"
 "component.detach" = "인스턴스 분리"
 "component.editProperty" = "컴포넌트 속성 편집"

crates/ui-egui/locales/nl.toml

@@ -1956,6 +1956,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combineren als varianten"
 "component.create" = "Component maken"
 "component.createMultiple" = "Meerdere componenten maken"
+"component.createSet" = "Componentenset maken"
 "component.deleteProperty" = "Componenteigenschap verwijderen"
 "component.detach" = "Instance loskoppelen"
 "component.editProperty" = "Componenteigenschap bewerken"

crates/ui-egui/locales/pl.toml

@@ -1970,6 +1970,7 @@ name = "Polski"
 "component.combineVariants" = "Połącz jako warianty"
 "component.create" = "Utwórz komponent"
 "component.createMultiple" = "Utwórz wiele komponentów"
+"component.createSet" = "Utwórz zestaw komponentów"
 "component.deleteProperty" = "Usuń właściwość komponentu"
 "component.detach" = "Odłącz instancję"
 "component.editProperty" = "Edytuj właściwość komponentu"

crates/ui-egui/locales/pt-BR.toml

@@ -1975,6 +1975,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Combinar como variantes"
 "component.create" = "Criar componente"
 "component.createMultiple" = "Criar vários componentes"
+"component.createSet" = "Criar conjunto de componentes"
 "component.deleteProperty" = "Excluir propriedade de componente"
 "component.detach" = "Desvincular instância"
 "component.editProperty" = "Editar propriedade de componente"

crates/ui-egui/locales/ru.toml

@@ -1970,6 +1970,7 @@ name = "Русский"
 "component.combineVariants" = "Объединить в варианты"
 "component.create" = "Создать компонент"
 "component.createMultiple" = "Создать несколько компонентов"
+"component.createSet" = "Создать набор компонентов"
 "component.deleteProperty" = "Удалить свойство компонента"
 "component.detach" = "Отсоединить экземпляр"
 "component.editProperty" = "Изменить свойство компонента"

crates/ui-egui/locales/sv.toml

@@ -2077,6 +2077,7 @@ name = "Svenska"
 "component.combineVariants" = "Kombinera som varianter"
 "component.create" = "Skapa komponent"
 "component.createMultiple" = "Skapa flera komponenter"
+"component.createSet" = "Skapa komponentuppsättning"
 "component.deleteProperty" = "Radera komponentegenskap"
 "component.detach" = "Koppla bort instans"
 "component.editProperty" = "Redigera komponentegenskap"

crates/ui-egui/locales/th.toml

@@ -1934,6 +1934,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "รวมเป็นแวเรียนต์"
 "component.create" = "สร้างคอมโพเนนต์"
 "component.createMultiple" = "สร้างหลายคอมโพเนนต์"
+"component.createSet" = "สร้างชุดคอมโพเนนต์"
 "component.deleteProperty" = "ลบพร็อพเพอร์ตีของคอมโพเนนต์"
 "component.detach" = "ถอดอินสแตนซ์"
 "component.editProperty" = "แก้ไขพร็อพเพอร์ตีของคอมโพเนนต์"

crates/ui-egui/locales/tr.toml

@@ -1918,6 +1918,7 @@ name = "Türkçe"
 "component.combineVariants" = "Varyant olarak birleştir"
 "component.create" = "Bileşen oluştur"
 "component.createMultiple" = "Birden çok bileşen oluştur"
+"component.createSet" = "Bileşen kümesi oluştur"
 "component.deleteProperty" = "Bileşen özelliğini sil"
 "component.detach" = "Örneği ayır"
 "component.editProperty" = "Bileşen özelliğini düzenle"

crates/ui-egui/locales/vi.toml

@@ -1862,6 +1862,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "Kết hợp thành các biến thể"
 "component.create" = "Tạo thành phần"
 "component.createMultiple" = "Tạo nhiều thành phần"
+"component.createSet" = "Tạo bộ thành phần"
 "component.deleteProperty" = "Xóa thuộc tính thành phần"
 "component.detach" = "Tách bản thể"
 "component.editProperty" = "Chỉnh sửa thuộc tính thành phần"

crates/ui-egui/locales/zh-Hans.toml

@@ -1871,6 +1871,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "合并为变体"
 "component.create" = "创建组件"
 "component.createMultiple" = "创建多个组件"
+"component.createSet" = "创建组件集"
 "component.deleteProperty" = "删除组件属性"
 "component.detach" = "分离实例"
 "component.editProperty" = "编辑组件属性"

crates/ui-egui/locales/zh-Hant.toml

@@ -2089,6 +2089,7 @@ status = "draft — needs native review"
 "component.combineVariants" = "合併為變體"
 "component.create" = "建立元件"
 "component.createMultiple" = "建立多個元件"
+"component.createSet" = "建立元件集"
 "component.deleteProperty" = "刪除元件屬性"
 "component.detach" = "分離實例"
 "component.editProperty" = "編輯元件屬性"

crates/ui-egui/src/cjk.rs

@@ -131,6 +131,11 @@ fn shows(code: &str, web: bool) -> bool {
         // Arabic; keep the catalog out until an embedded Arabic fallback is supplied.
         return figcraft_text::face_with_char('ع', &["Noto Sans Arabic"]).is_some();
     }
+    if code.split('-').next() == Some("ta") {
+        // Desktop draws Tamil with a system face (#2018); the web has none until craft-fonts
+        // carries Noto Sans Tamil.
+        return figcraft_text::face_with_char('த', &["Noto Sans Tamil"]).is_some();
+    }
     let need = language(code);
     need == 0 || samples(need, 0, traditional(code)).iter().all(|(c, families)| figcraft_text::face_with_char(*c, families).is_some())
 }
@@ -228,6 +233,14 @@ mod tests {
         assert_eq!(shows("ar-SA", true), face);
     }
 
+    #[test]
+    fn the_web_offers_tamil_only_with_its_face() {
+        assert!(shows("ta", false), "desktop always lists Tamil");
+        let face = figcraft_text::face_with_char('த', &["Noto Sans Tamil"]).is_some();
+        assert_eq!(shows("ta", true), face);
+        assert_eq!(shows("ta-IN", true), face);
+    }
+
     /// The UI language's script leads the fallback order; the others follow.
     #[test]
     fn the_ui_language_script_comes_first() {

crates/ui-egui/src/create_multiple_menu_tests.rs

@@ -0,0 +1,165 @@
+//! With two or more layers selected the Design panel's component button opens a menu (Create
+//! component, Create multiple components, Create component set); one layer keeps the plain click (#2088): drawn headless.
+
+use egui::accesskit::Node;
+use egui::{Event, PointerButton, Pos2, Rect, pos2};
+use figcraft_doc::{NodeId, NodeKind};
+use figcraft_engine::Session;
+use serde_json::json;
+
+use crate::layers_drag_tests::Ui;
+
+const NAMES: [&str; 3] = ["Card", "Badge", "Tile"];
+
+fn id(v: serde_json::Value) -> NodeId {
+    serde_json::from_value(v["id"].clone()).unwrap()
+}
+
+/// Frames named `NAMES[..n]`, all selected, headless.
+fn frames(n: usize) -> (Ui, Vec<NodeId>) {
+    let mut s = Session::new();
+    let mut ids = Vec::new();
+    for (i, name) in NAMES.into_iter().take(n).enumerate() {
+        let f = id(s.execute("frame.create", &json!({"x": 150 * i, "y": 0, "width": 100, "height": 60})).unwrap());
+        s.execute("object.rename", &json!({"ids": [f], "name": name})).unwrap();
+        ids.push(f);
+    }
+    s.execute("select.set", &json!({"ids": ids})).unwrap();
+    let mut u = Ui::new(s);
+    u.frame(vec![]);
+    (u, ids)
+}
+
+fn nodes(u: &mut Ui) -> Vec<Node> {
+    u.ctx.enable_accesskit();
+    u.frame(vec![]);
+    u.frame_output(vec![]).platform_output.accesskit_update.expect("an AccessKit update").nodes.into_iter().map(|(_, n)| n).collect()
+}
+
+fn bounds(n: &Node) -> Rect {
+    let b = n.bounds().unwrap();
+    Rect::from_min_max(pos2(b.x0 as f32, b.y0 as f32), pos2(b.x1 as f32, b.y1 as f32))
+}
+
+fn click(u: &mut Ui, at: Pos2) {
+    for pressed in [true, false] {
+        u.frame(vec![
+            Event::PointerMoved(at),
+            Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Default::default() },
+        ]);
+    }
+}
+
+fn settle(u: &mut Ui) {
+    for _ in 0..10 {
+        u.frame(vec![]);
+    }
+}
+
+/// The header's component button (its tooltip may carry the shortcut).
+fn click_button(u: &mut Ui) {
+    let all = nodes(u);
+    let button = all.iter().find(|n| n.label().is_some_and(|l| l.starts_with("Create component"))).expect("the Design panel's component button");
+    click(u, bounds(button).center());
+    settle(u);
+}
+
+fn undo_len(u: &Ui) -> usize {
+    u.app.session.ds().unwrap().history.undo.len()
+}
+
+#[test]
+fn several_layers_open_a_menu_and_create_multiple_components_in_one_undo_step() {
+    let (mut u, ids) = frames(3);
+    let before = undo_len(&u);
+    click_button(&mut u);
+    assert_eq!(undo_len(&u), before, "opening the menu changes nothing");
+    let all = nodes(&mut u);
+    // The menu's rows share an x with Create multiple components: exactly these two, in this order.
+    let multiple = all.iter().find(|n| n.label() == Some("Create multiple components")).expect("the menu's second entry");
+    let mb = bounds(multiple);
+    let mut rows: Vec<(f32, String)> = all
+        .iter()
+        .filter(|n| n.label().is_some() && (bounds(n).min.x - mb.min.x).abs() < 1.0 && (bounds(n).min.y - mb.min.y).abs() < 90.0)
+        .map(|n| (bounds(n).min.y, n.label().unwrap_or("").to_owned()))
+        .collect();
+    rows.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let labels: Vec<&str> = rows.iter().map(|(_, l)| l.as_str()).collect();
+    assert_eq!(labels, ["Create component", "Create multiple components", "Create component set"], "the menu's entries");
+    click(&mut u, bounds(multiple).center());
+    settle(&mut u);
+    let sel = u.app.session.selection();
+    assert_eq!(sel.len(), 3);
+    let doc = u.app.session.doc().unwrap();
+    let names: Vec<&str> = sel.iter().map(|i| doc.node(*i).unwrap().name.as_str()).collect();
+    assert_eq!(names, NAMES);
+    assert!(sel.iter().all(|i| matches!(doc.node(*i).unwrap().kind, NodeKind::Component { .. })));
+    assert_eq!(undo_len(&u), before + 1);
+    u.app.session.undo().unwrap();
+    let doc = u.app.session.doc().unwrap();
+    assert!(ids.iter().all(|i| matches!(doc.node(*i).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo reverts all three");
+}
+
+#[test]
+fn one_layer_keeps_the_plain_button() {
+    let (mut u, ids) = frames(1);
+    click_button(&mut u);
+    let all = nodes(&mut u);
+    assert!(all.iter().all(|n| n.label() != Some("Create multiple components")), "no menu opens");
+    let sel = u.app.session.selection();
+    assert_eq!(sel.len(), 1);
+    let doc = u.app.session.doc().unwrap();
+    assert!(matches!(doc.node(sel[0]).unwrap().kind, NodeKind::Component { .. }));
+    assert_eq!(doc.node(sel[0]).unwrap().name, NAMES[0]);
+    let _ = ids;
+}
+
+#[test]
+fn the_third_entry_creates_one_component_set() {
+    let (mut u, ids) = frames(3);
+    let before = undo_len(&u);
+    click_button(&mut u);
+    let all = nodes(&mut u);
+    let entry = all.iter().find(|n| n.label() == Some("Create component set")).expect("the menu's third entry");
+    click(&mut u, bounds(entry).center());
+    settle(&mut u);
+    let sel = u.app.session.selection();
+    assert_eq!(sel.len(), 1, "the set is selected");
+    let doc = u.app.session.doc().unwrap();
+    let set = doc.node(sel[0]).unwrap();
+    assert!(matches!(set.kind, NodeKind::ComponentSet { .. }));
+    assert_eq!(set.children.len(), 3);
+    assert_eq!(undo_len(&u), before + 1);
+    u.app.session.undo().unwrap();
+    let doc = u.app.session.doc().unwrap();
+    assert!(ids.iter().all(|i| matches!(doc.node(*i).map(|n| &n.kind), Some(NodeKind::Frame))), "one undo reverts it all");
+}
+
+/// The component button's width in the Design panel: wider with a dropdown chevron beside the icon.
+fn button_width(u: &mut Ui) -> f32 {
+    let all = nodes(u);
+    let button = all.iter().find(|n| n.label().is_some_and(|l| l.starts_with("Create component"))).expect("the Design panel's component button");
+    bounds(button).width()
+}
+
+#[test]
+fn the_dropdown_chevron_is_there_only_for_several_layers() {
+    let (mut one, _) = frames(1);
+    let (mut two, _) = frames(2);
+    let (single, several) = (button_width(&mut one), button_width(&mut two));
+    assert_eq!(single, 24.0, "one layer: the plain icon button");
+    assert_eq!(several, 34.0, "several layers: room for the chevron");
+}
+
+#[test]
+fn create_component_set_is_offered_only_where_it_works() {
+    let (mut u, ids) = frames(3);
+    // Make the first a component: the set can't take it, so the entry is left out.
+    u.app.session.execute("component.create", &json!({"ids": [ids[0]]})).unwrap();
+    u.app.session.execute("select.set", &json!({"ids": ids})).unwrap();
+    u.frame(vec![]);
+    click_button(&mut u);
+    let all = nodes(&mut u);
+    assert!(all.iter().any(|n| n.label() == Some("Create multiple components")), "the menu is open");
+    assert!(all.iter().all(|n| n.label() != Some("Create component set")), "left out for a selection with a component");
+}

crates/ui-egui/src/lib.rs

@@ -88,6 +88,8 @@ mod context_menu_tests;
 #[cfg(test)]
 mod corner_individual_tests;
 #[cfg(test)]
+mod create_multiple_menu_tests;
+#[cfg(test)]
 mod crop_image_tests;
 #[cfg(test)]
 mod cursors_tests;

crates/ui-egui/src/menus.rs

@@ -197,13 +197,24 @@ pub fn invoke(app: &mut FigApp, id: &str) {
             let ids = app.session.selection();
             // For other apps: text layers' text, other layers as SVG; taken before a cut removes them.
             let doc = app.session.doc().ok();
-            let mirror = doc.and_then(|d| text_layers_text(d, &ids).or_else(|| figcraft_svg_export(d, &ids)));
-            app.run(id, json!({}));
+            // Points or segments selected in vector edit mode copy just those: the whole vector's
+            // SVG would misdescribe them.
+            let partial = app
+                .session
+                .ds()
+                .ok()
+                .and_then(|d| d.vector_edit.as_ref())
+                .is_some_and(|ve| ve.parts().iter().any(|p| !p.vertices.is_empty() || !p.segments.is_empty()));
+            let mirror = doc.filter(|_| !partial).and_then(|d| text_layers_text(d, &ids).or_else(|| figcraft_svg_export(d, &ids)));
+            let ran = app.run(id, json!({}));
+            // A partial copy put temporary layers on the engine clipboard; mirror their SVG.
+            let refused = partial && ran.is_none();
+            let mirror = if partial { ran.and_then(|_| figcraft_engine::cmd::edit::clipboard_svg(&app.session)) } else { mirror };
             // Mirror to the system clipboard (text or SVG, else a marker) and remember it, so a
             // later paste knows whether the clipboard still holds our layers. Control-channel
             // gestures keep the engine's copy but never replace the user's clipboard; `run` then
             // invalidates the old mirror because it no longer describes the engine clipboard.
-            if !app.control_synthetic {
+            if !app.control_synthetic && !refused {
                 let text = mirror.unwrap_or_else(|| format!("figcraft://clipboard/{}", ids.len()));
                 app.clipboard_set_text(&text);
                 app.ui.last_copy = Some(text);

crates/ui-egui/src/panels/right.rs

@@ -498,7 +498,10 @@ fn header(app: &mut FigApp, ui: &mut Ui, doc: &Document, sel: &[NodeId]) {
     // Layers in boolean groups, or one boolean group: the operation they use (checked in the menu).
     let current = figcraft_engine::booleans::shown_op(doc, sel);
     for (icon, label, cmd) in actions.into_iter().rev() {
-        let br = Rect::from_min_size(pos2(x - 24.0, r.center().y - 12.0), vec2(24.0, 24.0));
+        // With several layers the component button is a dropdown: a small chevron sits beside its icon.
+        let dropdown = cmd == "component.create" && sel.len() > 1;
+        let bw = if dropdown { 34.0 } else { 24.0 };
+        let br = Rect::from_min_size(pos2(x - bw, r.center().y - 12.0), vec2(bw, 24.0));
         let tip = if cmd == "bool.union" { label } else { crate::shortcuts::tip(label, cmd) };
         let bresp = ui.interact(br, ui.scope_id().with(("qa", cmd)), Sense::click()).tip(tip);
         if bresp.hovered() {
@@ -509,7 +512,11 @@ fn header(app: &mut FigApp, ui: &mut Ui, doc: &Document, sel: &[NodeId]) {
             ("bool.union", Some(op)) => crate::layers::op_icon(op),
             _ => icon,
         };
-        icons::paint(ui.painter(), br.shrink(5.0), icon, t.icon);
+        let icon_rect = Rect::from_min_size(br.min, vec2(24.0, 24.0)).shrink(5.0);
+        icons::paint(ui.painter(), icon_rect, icon, t.icon);
+        if dropdown {
+            icons::paint(ui.painter(), Rect::from_center_size(pos2(br.max.x - 6.0, br.center().y), vec2(8.0, 8.0)), Icon::Chevron, t.icon_secondary);
+        }
         if cmd == "bool.union" {
             menu_popup(&bresp).width(180.0).show(|ui| {
                 for (op, c) in [
@@ -534,10 +541,35 @@ fn header(app: &mut FigApp, ui: &mut Ui, doc: &Document, sel: &[NodeId]) {
                     ui.close();
                 }
             });
+        } else if cmd == "component.create" && sel.len() > 1 {
+            // Several layers: the button opens a menu, as Figma's does (#2088). One layer keeps the plain click.
+            let create = crate::i18n::command("component.create", "Create component");
+            let multiple = crate::i18n::command("component.createMultiple", "Create multiple components");
+            let set = crate::i18n::command("component.createSet", "Create component set");
+            // Like the layers menu, leave out what the selection can't use.
+            let can_set = figcraft_engine::cmd::component::can_create_set(doc, sel);
+            let mut entries = vec![("component.create", &create), ("component.createMultiple", &multiple)];
+            if can_set {
+                entries.push(("component.createSet", &set));
+            }
+            // Wide enough for the longest translated label (the rows grow with it, the menu never clips).
+            let widest = entries
+                .iter()
+                .map(|(_, l)| ui.painter().layout_no_wrap(l.to_string(), regular(11.5), Color32::PLACEHOLDER).size().x)
+                .fold(0.0f32, f32::max);
+            menu_popup(&bresp).width(menu::menu_row_width(widest, 0.0).ceil().max(160.0)).show(|ui| {
+                for (c, label) in &entries {
+                    let key = crate::shortcuts::shortcut(c).unwrap_or("");
+                    if menu_item(ui, label, key) {
+                        app.run(c, json!({}));
+                        ui.close();
+                    }
+                }
+            });
         } else if bresp.clicked() {
             app.run(cmd, json!({}));
         }
-        x -= 26.0;
+        x -= bw + 2.0;
     }
     crate::component_panel::instance_section(app, ui, doc, sel);
 }

crates/ui-egui/src/shortcuts.rs

@@ -178,7 +178,7 @@ pub(crate) fn handle_input(
                 let props = ctx.input(|i| i.modifiers.alt);
                 crate::menus::invoke(app, if props { "edit.copyProperties" } else { "edit.copy" });
             }
-            Event::Cut => cut(app),
+            Event::Cut => cut(app, ctx.input(|i| i.modifiers)),
             Event::Paste(text) if !paste.drop_text => crate::menus::paste(app, Some(text), None),
             Event::Key { key, physical_key, pressed: true, modifiers, repeat }
                 if key_event(app, *key, *physical_key, *modifiers, *repeat, now, ctx) =>
@@ -192,13 +192,18 @@ pub(crate) fn handle_input(
 
 /// Cut: usually the layers. Windows sends Shift+Delete (remove the points and heal the path)
 /// as a cut command and never as a key, so in vector edit mode the selection is points: they are
-/// removed, a heal joining the path through them.
-fn cut(app: &mut FigApp) {
+/// removed, a heal joining the path through them. Ctrl/Cmd+X is the real Cut: with points or
+/// segments selected the engine copies them and removes them, staying in edit mode (#1875).
+fn cut(app: &mut FigApp, modifiers: egui::Modifiers) {
     let Some(ve) = app.session.ds().ok().and_then(|d| d.vector_edit.clone()) else {
         crate::menus::invoke(app, "edit.cut");
         return;
     };
-    if ve.parts().iter().any(|p| !p.vertices.is_empty()) {
+    if modifiers.command {
+        if ve.parts().iter().any(|p| !p.vertices.is_empty() || !p.segments.is_empty()) {
+            crate::menus::invoke(app, "edit.cut");
+        }
+    } else if ve.parts().iter().any(|p| !p.vertices.is_empty()) {
         app.run("vector.deleteHeal", json!({}));
     } else if ve.parts().iter().any(|p| !p.segments.is_empty()) {
         app.run("vector.edit.delete", json!({}));

crates/ui-egui/src/vector_keys_tests.rs

@@ -49,6 +49,18 @@ fn a_cut_command_in_edit_mode_takes_the_selected_points_not_the_layer() {
     assert_eq!(net(&u, path).vertices.len(), 2, "it takes the selected point");
 }
 
+#[test]
+fn ctrl_x_on_selected_segments_puts_them_on_the_clipboard_and_keeps_the_layer() {
+    let mut u = Ui::new(Session::new());
+    let path = abc(&mut u);
+    u.app.session.execute("vector.edit.select", &json!({"segments": [0]})).unwrap();
+    u.frame_with(vec![Event::Cut], Modifiers::COMMAND);
+    assert!(u.app.session.doc().unwrap().node(path).is_some(), "Ctrl+X keeps the layer");
+    assert_eq!(net(&u, path).segments.len(), 1, "the segment is gone");
+    assert_eq!(u.app.session.clipboard.nodes.len(), 1, "and on the clipboard");
+    assert!(u.app.session.ds().unwrap().vector_edit.is_some(), "edit mode stays on");
+}
+
 #[test]
 fn a_cut_command_in_edit_mode_with_nothing_selected_keeps_the_layer() {
     let mut u = Ui::new(Session::new());

docs/boards-parity.md

@@ -1,6 +1,6 @@
 # Boards parity
 
-> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-10 · **Change:** minor (mind maps, first step: a first node with three children on curved branches, laid out again after every edit (`board.mindMap`, `board.mindMapAdd`, #2226); a `.jam` elbowed connector saved with its path keeps it on import instead of being routed again (#1910); a "+" handle dragged carries the preview: the next shape is made where it is let go, or a connector joins the object it is let go on (#1919); a connector attached to a side starts 4 pt outside the border, so its stroke never lies on the fill (#1916); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre)
+> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-10 · **Change:** minor (a sticky's text stays 18 and the note grows taller instead of the text shrinking, as measured in FigJam's web app (#2157); mind maps, first step: a first node with three children on curved branches, laid out again after every edit (`board.mindMap`, `board.mindMapAdd`, #2226); a `.jam` elbowed connector saved with its path keeps it on import instead of being routed again (#1910); a "+" handle dragged carries the preview: the next shape is made where it is let go, or a connector joins the object it is let go on (#1919); a connector attached to a side starts 4 pt outside the border, so its stroke never lies on the fill (#1916); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre)
 
 **Breadth ~47%, ready ~29% (estimated, erring low).** A board is a FigCraft file of its own kind
 (`file.newBoard`) with a dot grid on the page, sticky notes, shapes with text, connectors that
@@ -17,8 +17,8 @@ design product). The work item is gap 24 in [`gaps.md`](gaps.md).
 Board objects are ordinary layers with a small `board` field on the node (`figcraft_doc::BoardItem`),
 so rendering, hit testing, undo, saving, SVG/PNG/PDF export, copy and paste and live sessions work
 on them unchanged. The file kind (`Document.kind`) is saved in `.figcraft` and reaches people who
-join a live session in their snapshot. What follows from the metadata (a sticky's text size, a
-shape's text room, connector routes and their labels) is recomputed in the engine's normalize pass,
+join a live session in their snapshot. What follows from the metadata (a shape's text
+room, connector routes and their labels) is recomputed in the engine's normalize pass,
 deterministically from the document, so local edits, undo and edits from others in a live session
 all end with the same geometry.
 
@@ -30,7 +30,7 @@ all end with the same geometry.
 | Board toolbar at the bottom | done | Move/Hand, Marker/Highlighter/Eraser, Sticky (colour flyout), Shapes (flyout), Connector, Text, Section, Stamp (flyout), Comment, Actions, then the templates and the Design panel's buttons — on the same 32 pt grid as a design file's (no Resources button, as there) |
 | Design panel hidden by default; a contextual bar above the selection | done | colour, shape, text size (S/M/L/XL); for connectors straight/elbow/curved, the start and end points (none, round, square, line arrow, triangle arrow, reversed triangle, circle, diamond), solid or dashed, the weight, and any colour in the colour picker beside the board colours (#1596); each control says what it is on hover; the Design panel opens with its button or View ▸ Design panel |
 | Prototyping and Developer Mode refuse on boards | done | `proto.*`, `dev.*`, `view.prototype`, `view.devMode` say why |
-| Sticky notes | done | a square frame (200 wide, growing taller through auto layout), 8 soft colours, a soft shadow, the note's text size shrinking as it grows (24 → 11, by characters and lines), the author's name at the bottom; a click places one and starts typing; Enter or a double-click edits; Shift+Cmd/Ctrl+Enter adds the next one beside it |
+| Sticky notes | done | a square frame (200 wide, growing taller through auto layout), 8 soft colours, a soft shadow, the note's text 18 by default and fixed (FigJam's "Small"): the note grows taller as it fills and never shrinks its text, measured in FigJam's web app, 2026-11-09; stickies saved with another size keep it, and there is no size menu yet (#2157), the author's name at the bottom; a click places one and starts typing; Enter or a double-click edits; Shift+Cmd/Ctrl+Enter adds the next one beside it |
 | Sticky options: hide the author, change size presets, sticky stacks | partial | `board.sticky {author: false}`; no size presets or stacks |
 | Shapes with text | done | rectangle, rounded rectangle, ellipse, diamond, triangle, speech bubble, chevron; text centred and wrapping inside the outline; shape type and text size from the contextual bar |
 | Shape auto-fit to its text, more shapes (cylinder, cross, star…), shape libraries | missing | |
@@ -72,6 +72,7 @@ all end with the same geometry.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-09 | patch | M12, #2157: a sticky's text is 18 and stays 18 (measured in FigJam's web app: ten lines, then a long paragraph, never changed it; the note kept its width and grew taller). The normalize pass no longer resets a sticky's text to a size by its length (24 down to 11 before), so stickies in saved files keep their size. Size presets (Small to Huge) are still missing. Tests: `a_new_sticky_starts_at_18`, `a_sticky_keeps_its_text_size_as_text_is_added`, `a_sticky_saved_with_another_text_size_keeps_it` |
 | 2026-11-10 | minor | M12, #2226 (step 1 of 4): mind maps in the document and engine. A mind map node is a board object of its own (`BoardItem::MindNode`: text with no box) and a branch is a connector marked `branch`; the map's shape is read from its branches. `board.mindMap` places a first node with three children and `board.mindMapAdd` adds a child or a sibling, each one undo step. The normalize pass lays a touched map out again from its first node (`board::settle_mind_maps`, `figcraft_doc::mind_layout`): 88 between columns, 48 between siblings, each stack centred on its parent, numbers from a FigJam file saved and decoded. Tests: `board_mindmap_tests` in doc (five) and engine (eight). Numbers unchanged (no toolbar entry yet). |
 | 2026-11-03 | minor | M12, #1919: as the quick create help says ("Click to select and create the next shape in that direction, or drag the preview to any location on your board"; "A new shape is created with a connector and its text field active"), a "+" beside the selected sticky or shape can be dragged: the preview follows the pointer and, let go on empty board, the next one is made there, centred on the pointer, and joined by a connector leaving by the handle's side and arriving by the side facing it (`board.addConnected` gains `at: [x, y]`, a point of the page placed in the parent's coordinates); let go on another sticky or shape, inside a section or frame too (`board::sticky_or_shape_at`), a connector joins the two instead (`board.connector`), that object outlined while the pointer is over it; let go off the canvas or over the toolbar, nothing, and the bar above the selection stays away meanwhile, as for any drag. The click is as before. A shape picker on drop and choosing the connector type are not done (the help doesn't describe them). Tests: `board_connect_tests` (the drag ones), engine `board_connected_tests::the_next_one_goes_where_it_is_dropped`. Numbers unchanged. |
 | 2026-11-04 | minor | M12, #1916: a connector end attached to a side starts 4 pt outside the border (`board_route::END_GAP`), as FigJam's do (the issue's screenshots: the line starts a few pixels outside, with a round cap), so the stroke never lies on the fill; elbows leaving one side share their first run along its normal, curves leave tangent to it and straight ones fan out from the same point; the `.jam` importer's routes, re-attached ends, path handles and labels follow the route's points; an end placed by hand with Cmd/Ctrl held keeps its exact point. Tests: `board_route_tests` (three). Numbers unchanged. |

docs/components-parity.md

@@ -1,6 +1,6 @@
 # Components, variants, styles and variables parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (the Local variables window selects several variables (click, Shift+click for a range, Cmd/Ctrl+click to toggle, Escape to clear) and delete, move to a group and scope act on the selected local variables in one undo step (#2002); text styles carry paragraph spacing and indent, the list style and the OpenType features, as the Supported in text styles table of Create and apply text styles says (#1829); a layer's effect binding takes only a field its effect has; Go to main component on an instance of a library component opens the library file in a tab and selects the main there; glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-07 · **Change:** minor (with several layers selected the Design panel header's component button offers Create multiple components (#2088); the Local variables window selects several variables (click, Shift+click for a range, Cmd/Ctrl+click to toggle, Escape to clear) and delete, move to a group and scope act on the selected local variables in one undo step (#2002); text styles carry paragraph spacing and indent, the list style and the OpenType features, as the Supported in text styles table of Create and apply text styles says (#1829); a layer's effect binding takes only a field its effect has; Go to main component on an instance of a library component opens the library file in a tab and selects the main there; glass effects take variables; Delete on a layer inside an instance hides it as an override instead of being refused, as the help center says: "Figma will only toggle the layer's visibility instead of removing it"; library analytics list how many layers and files use each style and variable; SwiftUI and Compose code names a bound variable by its iOS or Android code syntax; library analytics count insertions and show insertions and detachments over the past 30 days, 90 days or year; a collection of this file can be extended (Extend collection on its row, `variable.extendCollection`), its extension following its edits at once, and extended collections extend again in the file; a typed or stored variable, collection or mode id names only the object with that id (#1613); colour variables can be calculated from other colours per mode — `{alpha}` replaces a colour's alpha, `{mix}` blends two — and follow them (#1280); stored variable and collection references keep their identity when another object is named like their id (follow-up to #1542); a component set's property rows fit the 240 px right panel: variant values wrap two to a line there and every + and − stays in view; opening a file contacts no team library server it names until you check it (#1097); an explicit variables file path (`variable.import`, the `variables` of `file.open` and `file.import`) is refused past 256 MiB or when it isn't a regular file, as the sibling `variables.json` already was (part of #1114); component properties keep the order they were made in when one is renamed, and Make slot asks for the slot's name first (#1536, #1537); components can't contain their own instances, directly or through others (#1084); the instance-swap menus have a search field (#1338); an instance-swap property's default menu scrolls (#1338); variables on a text style's fields from the style editor; instance-swap properties in the component playground; duplicating or Alt-dragging a main component makes an instance of it (#892); a bound colour variable's alpha applies once (#802); variables import reads `variables` outside `meta` and warns when it imports none (#790); variant properties reorder by drag; library files saved right after a read are read again; Hide when publishing note corrected; size and resizing overrides of layers inside instances (#731); variables export in the browser as a download; core editor leftovers: component playground, variables inside styles; layers and assets panels behaviour suite and fixes; extended collections tail; styles and variables behaviour suite and fixes; components behaviour suite and fixes; team libraries on the server, library usage and swapping a library; extended collections, variables import/export, gradient stops and variant properties bound to variables) · **Target:** Figma Design (desktop app 126.10.7)
 
 Design systems are why teams adopt Figma. **Components: breadth ~96%, ready ~72%. Styles and
 variables: breadth ~95%, ready ~76% (estimated).** QA'd with a synthetic design system of ~300
@@ -12,7 +12,7 @@ accounts).
 
 | Feature | Status | Notes |
 |---|---|---|
-| Create component, instances, detach, reset, go to main, restore main, push changes | done | push from a nested layer goes to the outer main |
+| Create component, instances, detach, reset, go to main, restore main, push changes | done | push from a nested layer goes to the outer main; with two or more layers selected the Design panel header's component button opens a menu with Create component, Create multiple components (each layer its own component in place, one undo step) and Create component set (each layer a component, wrapped in place in a set 20 px around: variants `Property 1=<layer name>` left to right, `prop=value` names kept, layers that all share a name give a set of that name with `Property 1=Default` variants; measured in Figma), one layer keeps the plain click (#2088) |
 | Per-layer overrides with reset; kept across main edits, nested swaps, copy/paste | done | main edits match a full rebuild exactly at 2,000 instances |
 | What an instance overrides: fills, strokes, effects, visibility, layer names, text content and every text property (resizing included), auto layout padding, gap and alignment, layout grids, export settings, prototype interactions, nested swaps and property values; the size and resizing (hug, fill, fixed, min and max) of layers inside it | done | each kept when the main changes that property, reset per group; opacity and corner radius too (documentation silent); size and resizing are kept through relayout, undo, save, `.fig` and REST import and detach, and stay with the instance on push |
 | What it doesn't: position, rotation, constraints and absolute or grid placement of layers inside it, its auto layout direction and other settings, its structure | done | refused with a message, the fields greyed out (Delete on a layer inside an instance hides it instead of removing it, as the help center says it does); the instance itself resizes and its layers follow the main's constraints |
@@ -79,6 +79,7 @@ updates with overrides kept: `library_tests.rs`, `components_scale_tests.rs`.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-07 | patch | M3, #2088: with two or more layers selected the Design panel header's component button opens a menu with Create component, Create multiple components and Create component set (`component.createSet`, naming measured in Figma), as Figma's does; one layer keeps the plain button. Tests: `create_multiple_menu_tests`, `components_behaviour_tests::create_multiple_components_keeps_names_and_places_and_is_one_undo_step`, `components_behaviour_tests::create_set_*`. Grade unchanged. |
 | 2026-11-05 | minor | M3, #2002: the Local variables window selects several variables, as the Layers panel selects layers. A click selects one row, Shift+click the range from the anchor through the rows shown, Cmd/Ctrl+click toggles a row, Escape or a click on the empty space below the rows clears; selected rows use the sidebar's selected-row colour. Right-clicking a row that is part of a selection of several offers Delete, Move to group and Scope (all supported properties, hidden from pickers, or only one scope) for the selected local variables, each sent as one `command.batch`, so one undo step; no engine command changed. Renaming and value edits stay single-row. Tests: `variables_select_tests` (headless UI). Grade unchanged |
 | 2026-11-02 | minor | M3, #1829: text styles carry paragraph spacing and indent, the list style and the OpenType features ("Supported in text styles": "Paragraph spacing and indentation", "Lists", "OpenType features", Create and apply text styles) beside the character properties: `style.create` takes them from the layer (or the selected paragraphs' list) or from a `value` (`paragraphSpacing`, `paragraphIndent`, `listStyle`, `features`), `style.apply` sets them (on a range, the list goes to the paragraphs touched; the rest is the layer's, as in Figma), `style.update` moves them on every linked layer, editing one on a styled text unlinks it as editing its font does, the style editor lists them, and a `.fig` file keeps them with the style (its sample layer). Grade unchanged. |
 | 2026-11-06 | patch | M3: a glass's light angle bound to a number past ±180 turns round to the same direction (270 is -90), as the angle drawn from it does, instead of stopping at 180. Tests: `effects_tests::a_bound_light_angle_turns_round_instead_of_stopping`. Grade unchanged. |

docs/file-format-parity.md

@@ -188,6 +188,7 @@ scales and empty-style clears; they have not been checked in other software.
 | | Figma | FigCraft |
 |---|---|---|
 | Local fonts | yes (font helper / desktop app) | yes (system scan) |
+| Conflicting fonts | an uploaded organization font comes first, then fonts installed on the device, then Figma's web fonts (help center, "Manage conflicting fonts") | a font loaded with `text.loadFont` wins over the built-in and installed faces of the same family and style, the latest load over earlier ones (#2092); installed versus built-in order is unchanged, and browser local fonts count as installed |
 | Bundled/shared fonts | Google Fonts in the cloud | optional `CRAFT_FONTS_DIR` build input (storytold/craft-fonts) |
 | Variable fonts | yes | yes (axes, named instances, per-range axis values) |
 | Missing-font replacement on open | yes | listed, not replaced: in the desktop app the Missing fonts window opens after a file that uses them opens and from Text ▸ Missing fonts (`text.missingFonts`; `figcraft-cli info` prints `missing font` lines), and their text draws in a fallback font. A family the font store has (Google Fonts, Noto) downloads from the window once the user allows downloading fonts (`font.download`, #754): pinned, checksum-verified files into the Craft apps' shared font folder, after which the text draws in it. A family is found however a file names it: by the legacy name of one of its weights ("Family Medium") or by the typographic name of a family installed one family per weight, and spelt with other case, spaces or hyphens (#1292). No substitute picker |
@@ -196,6 +197,7 @@ scales and empty-style clears; they have not been checked in other software.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-07 | patch | Fonts, #2092: a font loaded with `text.loadFont` is the counterpart of a font uploaded to the organization, which Figma's help center ("Manage conflicting fonts") ranks first, ahead of installed fonts and the web fonts. FigCraft chose the first face added for a family and style, so the built-in Inter 4.x kept Regular, SemiBold and Bold after Inter 3.19 was loaded and only Medium refitted. A loaded face now wins over the other faces of its family and style, the latest load over earlier ones; style matching and fallbacks are unchanged, and `refitted` lists the text whose size changes. Installed versus built-in order is not changed here. Test: `fontdb::tests::a_loaded_face_wins_over_the_built_in_one_of_its_family_and_style`. Numbers unchanged. |
 | 2026-11-08 | minor | M6, #2097 follow-up: per-point vector corner radii take the scale of the row supplying `vectorData`, including nested instance rows; override and derived rows are not scaled twice. Network caching distinguishes the instance scale even when resizing gives two vectors the same final box. Synthetic tests cover missing/unit factors, half/double scale, derived size alone, overridden and derived vector data, nested scale and equal-size cache separation. Layer-radius fallback remains the separate #2115 change. Numbers unchanged. |
 | 2026-11-08 | patch | #2097 / #2100: scaled-instance lengths reset to the unscaled main value survive export/import as explicit overrides. Dimensionless values and zero do not gain scale overrides. Exported factors stay within the importer's 0.001–1000 range; larger or smaller ratios use explicit values instead. Effect/grid payload rows above an inherited style link take precedence at their own scale, including nested instances and empty-list clears, without detaching styles. Synthetic regressions cover corners, dashes/shadows, layout/grids and bounds, typography and styled runs, linked text and nested styles. Numbers unchanged. |
 | 2026-11-07 | minor | `.fig` import, #2091 item 1: an instance scaled with the Scale tool stores `symbolData.uniformScaleFactor`, which the import never read, so the layers of a 128 px instance of a 256 px component came in at 256 px with the main's radii, strokes and spacing. The layers of an instance now take the main's lengths times the factor (composed through nested instances, so 0.5 inside 0.5 is 0.25 for the inner layers), the lengths the Scale tool scales: sizes and places, corner radii, stroke weights and dashes, effect radii, spreads and offsets, auto layout gaps and paddings, grid gaps, min and max sizes, layout grids, font sizes, pixel line heights and letter spacings, paragraph spacing and indent. A value an override or derived row gives is taken as written, already at the instance's scale; the instance's own size is the file's; a missing, non-finite, non-positive or out-of-range factor (outside 0.001 to 1000) changes nothing. Not scaled: vector outline paths (a network's points follow the layer's size), per-point corner radii, fixed grid tracks, image tile scales and glass effects. Tests: `fig::tests::a_scaled_instance_draws_its_layers_at_the_factor` and `fig::scale_factor_tests`. Numbers unchanged |

docs/translating.md

@@ -24,6 +24,8 @@ assistance and reviewed by a native speaker, and stays a draft until a maintaine
 Russian (`ru`, Русский) was reviewed and approved by VanTan; its catalog keeps Frame and
 Smart animate as familiar tool names and uses « » quotes. Turkish (`tr`) was machine-drafted and
 reviewed by a native speaker, and Swedish (`sv`) translates every UI string, command label and menu wording.
+Tamil (`ta`, தமிழ்) was machine-drafted and reviewed by a native speaker, and stays a draft until a
+maintainer changes its status.
 
 ## The catalogs
 
@@ -76,7 +78,11 @@ written in Latin script with ijekavian forms and Bosnian words (historija, hilja
 sedmica), uses bare imperatives for buttons and menu items (Sačuvaj, Izbriši) and the formal Vi for
 instructions (Odaberite, Kliknite), „ “ quotes, and consistent design terms (okvir, sloj,
 komponenta, instanca, varijanta, automatski raspored, ograničenja, ispuna, obrub, efekat, varijabla,
-stil, način for a variable mode, dodatak for a plugin).
+stil, način for a variable mode, dodatak for a plugin). Tamil uses modern written Tamil, bare
+imperatives for buttons and menu items (சேமி, நீக்கு), the polite -கவும் for instructions
+(தேர்ந்தெடுக்கவும்), Western digits, and design terms in Tamil script as Tamil designers say them
+(ஃப்ரேம், லேயர், காம்போனென்ட், இன்ஸ்டன்ஸ், ஆட்டோ லேஅவுட்) while everyday words are translated
+(கோப்பு, பக்கம், நிறம், ஏற்றுமதி). A case ending follows a placeholder after a space (`{name} கோப்பை`).
 
 CJK and Thai text need their own fonts, which egui and Inter lack: the desktop app adds an installed
 one when something on screen needs it, so layer and page names in those scripts show whatever the
@@ -117,6 +123,17 @@ that face out, so Arabic is not offered on the web yet. No font is added to
 this repository. The interface's panels are not mirrored; this catalog does not claim a complete
 right-to-left interface. Native review and representative in-app checks remain required.
 
+## Tamil draft
+
+`ta.toml` adds தமிழ் as a draft: 2,012 UI entries, 630 command labels and 31 menu wordings
+(2,673 entries, measured 2026-11-09), covering every English key. Drafted with AI assistance against a
+fixed style guide and glossary, then reviewed by a native speaker (#2159).
+
+The desktop UI draws Tamil in an installed face (Tamil Sangam MN, Nirmala UI or Noto Sans Tamil,
+#2018); no font is added to this repository. The web picker leaves Tamil out until craft-fonts has
+Noto Sans Tamil. Tamil runs longer than English: the left rail's Variables label and the frame type
+dropdown cut it off.
+
 ## Traditional Chinese (Taiwan) draft
 
 `zh-Hant.toml` adds 繁體中文（台灣） as a draft: 1,975 UI entries, 641 command labels and 31 menu