Merge remote-tracking branch 'origin/main' into jp/kinsoku-jis

# Conflicts: # ROADMAP.md # docs/target-app-parity.md
2026-10-29 12:56:47 -06:00 · 2026-10-24 04:11:13 +09:00
parent 42bdfcce34 d6e8a6e874
commit 04e60e23bc
75 changed files with 629 additions and 336 deletions
@@ -1,9 +1,7 @@
-# CI for pull requests and main: format, clippy, tests, dependency layering, asset attribution and
-# the wasm32 check (the same gates as `cargo xtask ci`). Linux only: macOS is built and tested only
-# by release.yml (the org's macOS runners are kept for releases; craftrules release/playbook.md),
-# and Windows/FreeBSD packaging have their own workflows.
 name: CI

+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
 on:
  push:
    branches: [main]
@@ -13,76 +11,21 @@ on:
 permissions:
  contents: read

-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-  RUST_BACKTRACE: 1
-  # Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
-  # debug info: faster codegen and links, and a smaller target dir.
-  CARGO_PROFILE_DEV_DEBUG: line-tables-only
-
-# A newer push to a PR branch cancels its older run. Runs on main are never cancelled, so every
-# main state that gets a run is checked to the end.
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 jobs:
-  test:
-    timeout-minutes: 35
-    name: test (ubuntu-latest)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Install Linux system dependencies (egui/winit/rfd)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
-            libgl1-mesa-dev libgtk-3-dev
-
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
-
-      # Only main saves caches; PRs restore main's, so PR caches don't evict main's.
-      - uses: Swatinem/rust-cache@v2
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-          cache-on-failure: true
-
-      - name: Format
-        run: cargo fmt --all -- --check
-
-      - name: Clippy
-        run: cargo clippy --workspace --all-targets --locked -- -D warnings
-
-      # Without craft-fonts (the optional CRAFT_FONTS_DIR input, which .cargo/config.toml points at
-      # a sibling checkout that CI doesn't have): everything must build and pass without it.
-      - name: Test
-        run: cargo test --workspace --locked
-
-      - name: Dependency layering
-        run: cargo run --locked -q -p xtask -- layers
-
-      - name: Asset attribution
-        run: cargo run --locked -q -p xtask -- assets
-
-  wasm:
-    timeout-minutes: 30
-    name: wasm32 check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: wasm32
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-          cache-on-failure: true
-      # The engine, the UI crate and apps/figcraft-web must keep compiling for the browser.
-      - name: Check wasm-safe crates
-        run: cargo run --locked -q -p xtask -- wasm
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # The craft-fonts commit release.yml builds with. Needs fonts/latin-manifest.txt (Inter):
+      # crates/text/build.rs fails a build that requires craft-fonts without it. Only craft-fonts'
+      # pr/latin-presentation-fonts has it; its main has Noto Sans Georgian but no Inter. Re-pin
+      # once one commit has both (storytold/craft-fonts#42).
+      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+      packages: >-
+        libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev
+        libgtk-3-dev
@@ -4,12 +4,10 @@
 # before it can fail a release. Nothing is uploaded and no secrets are used.
 name: FreeBSD

-# The VM build takes one to several hours, so it runs nightly on main rather than on every push
-# or dependency change: a drifted dependency still shows up within a day. PRs that change the
-# FreeBSD packaging itself still run it.
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
-  schedule:
-    - cron: "17 2 * * *"
  push:
    branches: [release]
  pull_request:
@@ -17,6 +15,8 @@ on:
      - .github/workflows/freebsd.yml
      - packaging/freebsd/**
      - packaging/env.sh
+  schedule:
+    - cron: "17 2 * * *"
  workflow_dispatch:

 concurrency:
@@ -0,0 +1,20 @@
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonarcloud-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sonarcloud:
+    # Tracked at @main so org-wide CI improvements propagate without PR churn.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    secrets: inherit
@@ -81,6 +81,7 @@ code.
  L6 depends on egui/eframe/rfd/winit. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
  `app.set_props(ids, props)`. Colours come from `theme::Tokens`.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).

 ### Quality gates (before every commit)
@@ -81,6 +81,7 @@ code.
  L6 depends on egui/eframe/rfd/winit. **The UI crate is swappable.**
 - **The UI is thin**: panels read engine state and act through `app.run(id, params)` /
  `app.set_props(ids, props)`. Colours come from `theme::Tokens`.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math); a crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).

 ### Quality gates (before every commit)
@@ -742,6 +742,15 @@ dependencies = [
 "rand_core 0.10.1",
 ]

+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -1456,7 +1465,7 @@ checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"

 [[package]]
 name = "figcraft"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "arboard",
 "craft-window",
@@ -1482,7 +1491,7 @@ dependencies = [

 [[package]]
 name = "figcraft-cli"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-doc",
 "figcraft-engine",
@@ -1496,9 +1505,10 @@ dependencies = [

 [[package]]
 name = "figcraft-collab"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "base64 0.22.1",
+ "chrono",
 "figcraft-color",
 "figcraft-doc",
 "figcraft-geom",
@@ -1511,7 +1521,7 @@ dependencies = [

 [[package]]
 name = "figcraft-collab-net"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "base64 0.22.1",
 "figcraft-collab",
@@ -1534,7 +1544,7 @@ dependencies = [

 [[package]]
 name = "figcraft-color"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "kurbo",
 "serde",
@@ -1543,7 +1553,7 @@ dependencies = [

 [[package]]
 name = "figcraft-doc"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-color",
 "figcraft-geom",
@@ -1555,7 +1565,7 @@ dependencies = [

 [[package]]
 name = "figcraft-engine"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "base64 0.22.1",
 "craft-docpath",
@@ -1583,7 +1593,7 @@ dependencies = [

 [[package]]
 name = "figcraft-format"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-doc",
 "figcraft-pathops",
@@ -1598,7 +1608,7 @@ dependencies = [

 [[package]]
 name = "figcraft-geom"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "kurbo",
 "serde",
@@ -1606,7 +1616,7 @@ dependencies = [

 [[package]]
 name = "figcraft-layout"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-doc",
 "figcraft-geom",
@@ -1614,7 +1624,7 @@ dependencies = [

 [[package]]
 name = "figcraft-mcp"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "base64 0.22.1",
 "figcraft-collab-net",
@@ -1630,7 +1640,7 @@ dependencies = [

 [[package]]
 name = "figcraft-pathops"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-doc",
 "figcraft-geom",
@@ -1639,7 +1649,7 @@ dependencies = [

 [[package]]
 name = "figcraft-pdf"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-color",
 "figcraft-doc",
@@ -1656,7 +1666,7 @@ dependencies = [

 [[package]]
 name = "figcraft-plugin"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-color",
 "serde",
@@ -1669,7 +1679,7 @@ dependencies = [

 [[package]]
 name = "figcraft-render"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "crc32fast",
 "figcraft-color",
@@ -1687,7 +1697,7 @@ dependencies = [

 [[package]]
 name = "figcraft-server"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "crc32fast",
 "ctrlc",
@@ -1711,7 +1721,7 @@ dependencies = [

 [[package]]
 name = "figcraft-svg"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "base64 0.22.1",
 "figcraft-color",
@@ -1727,7 +1737,7 @@ dependencies = [

 [[package]]
 name = "figcraft-text"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-doc",
 "figcraft-geom",
@@ -1741,9 +1751,10 @@ dependencies = [

 [[package]]
 name = "figcraft-ui-egui"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "base64 0.22.1",
+ "chrono",
 "egui",
 "egui_extras",
 "figcraft-color",
@@ -1766,7 +1777,7 @@ dependencies = [

 [[package]]
 name = "figcraft-web"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "eframe",
 "egui",
@@ -5871,7 +5882,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.8.0"
+version = "0.10.0"
 dependencies = [
 "figcraft-engine",
 "serde_json",
@@ -6,7 +6,7 @@ exclude = ["plugins"]
 # default-members = ["crates/*", "apps/figcraft", "apps/figcraft-cli", "xtask"]

 [workspace.package]
-version = "0.8.0"
+version = "0.10.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -45,6 +45,8 @@ serde = { version = "1", features = ["derive", "rc"] }
 serde_json = { version = "1", features = ["float_roundtrip"] }
 regex = "1.13"
 log = "0.4"
+# All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
+chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 proptest = "1"
 imbl = { version = "7", features = ["serde"] }
 postcard = { version = "1", default-features = false, features = ["alloc"] }
@@ -101,11 +103,15 @@ todo = "deny"
 unimplemented = "deny"
 unreachable = "deny"

-[profile.dev.package."*"]
-opt-level = 2
-
+# Workspace crates keep file:line in panic backtraces; dependencies carry no debug info. Both make
+# the test build faster and the target dir smaller.
 [profile.dev]
 opt-level = 1
+debug = "line-tables-only"
+
+[profile.dev.package."*"]
+opt-level = 2
+debug = false

 [profile.release]
 lto = "thin"
@@ -7,6 +7,10 @@
  </a>
 </p>

+<p align="center">
+  <img src="assets/app-icon/hicolor/256x256/apps/ai.storyteller.figcraft.png" width="128" height="128" alt="FigCraft icon: an engraved chameleon on a mint-green tile">
+</p>
+
 <h1 align="center">FigCraft</h1>

 <p align="center">
@@ -1,5 +1,4 @@
 //! The binary end to end.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use std::io::Write;
 use std::process::{Command, Stdio};
@@ -1,5 +1,4 @@
 //! Depth refusal through the actual CLI, including its exit status and destination writes.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use figcraft_doc::color::{Color, Paint};
 use figcraft_doc::{Document, NodeKind};
@@ -1,6 +1,5 @@
 //! Headless runs lay text out with the installed fonts, like the desktop app, unless
 //! `--no-system-fonts` or `FIGCRAFT_NO_SYSTEM_FONTS=1` opts out.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use std::process::Command;

@@ -0,0 +1,12 @@
+//! The crate's integration tests, built as one test binary.
+
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod cli;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod export_depth;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod fonts;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod pdf;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod pdf_print;
@@ -1,5 +1,4 @@
 //! `figcraft-cli export --format pdf` and `convert … .pdf` end to end.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use std::process::Command;

@@ -1,5 +1,4 @@
 //! `figcraft-cli export` with PDF print options: bleed, marks, CMYK; bad lengths are usage errors.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use std::process::Command;

@@ -261,7 +261,9 @@ fn fuzzed_frames_dont_hurt_the_server() {
                break;
            }
        }
-        let _ = ws.read();
+        // read() returns Result<Message>, not a lock guard; the fuzz loop ends here on purpose and
+        // the close frame from the server is not interesting.
+        let _ = ws.read(); // NOSONAR
    }
    // Still serving, the file intact.
    let mut b = join(&p.edit, "Bo");
@@ -2,7 +2,6 @@
 //! holds confirmed edits (#408): the log is replayed over the snapshot, which only the changes the
 //! snapshot lacks survive, and the damage is reported. A genuine leftover of a compaction cut short
 //! still restores silently.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use figcraft_collab::message::{Access, ClientMsg};
 use figcraft_collab::{Client, Outgoing, Replica, Server};
@@ -0,0 +1,5 @@
+//! The crate's integration tests, built as one test binary.
+
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod header_recovery;
+mod problem_retention;
@@ -141,7 +141,9 @@ fn old_server() -> (Endpoint, std::thread::JoinHandle<()>) {
    let t = std::thread::spawn(move || {
        for stream in listener.incoming().take(2).flatten() {
            let Ok(mut ws) = tungstenite::accept(stream) else { continue };
-            let _ = ws.read();
+            // read() returns Result<Message>, not a lock guard; this test server deliberately
+            // ignores whatever the client sent first.
+            let _ = ws.read(); // NOSONAR
            let refused = ServerMsg::Refused { reason: "that message couldn't be read".into() };
            let _ = ws.send(Message::Binary(Bytes::from(message::encode(&refused).unwrap())));
            let _ = ws.close(None);
@@ -13,6 +13,7 @@ figcraft-doc = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
+chrono = { workspace = true }
 imbl = { workspace = true }
 base64 = { workspace = true }
 postcard = { workspace = true }
@@ -696,22 +696,38 @@ pub enum ServerMsg {
    },
 }

+/// (days since 1970-01-01, seconds-of-day, nanos) → (proleptic Gregorian year, the same wall-clock
+/// instant moved into chrono's range by whole 400-year cycles). The calendar repeats every 400
+/// years (146_097 days), so month, day and time of day come from chrono and only the year is
+/// carried, which keeps the result exact for any `i64` day count. This is not hand-rolled calendar
+/// math: chrono still does the date, the cycle count just shifts the year.
+fn utc_parts(days: i64, sod: u32, nanos: u32) -> (i64, chrono::NaiveDateTime) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = chrono::NaiveTime::from_num_seconds_from_midnight_opt(sod.min(86_399), nanos.min(999_999_999));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
 /// `YYYY-MM-DD HH:MM UTC` for seconds since 1970 (how servers and apps show the times in these
-/// messages).
+/// messages). Years past chrono's own range (262143) keep converting: the instant is moved into
+/// range by whole 400-year cycles and the real year restored, so every `u64` reads as the date the
+/// old hand-rolled conversion produced (e.g. `u64::MAX` → `584554051223-11-09 07:00 UTC`).
 pub fn utc_date(secs: u64) -> String {
-    let days = i64::try_from(secs / 86_400).unwrap_or(0);
-    let (h, m) = ((secs % 86_400) / 3600, (secs % 3600) / 60);
-    // Days to a civil date (proleptic Gregorian).
-    let z = days + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let d = doy - (153 * mp + 2) / 5 + 1;
-    let mo = if mp < 10 { mp + 3 } else { mp - 9 };
-    let y = yoe + era * 400 + i64::from(mo <= 2);
-    format!("{y:04}-{mo:02}-{d:02} {h:02}:{m:02} UTC")
+    // The day count of any `u64` seconds fits in `i64` (`u64::MAX / 86_400` ≈ 2.1e14), and the
+    // seconds-of-day is < 86_400, so the conversion is always exact (no epoch fallback). Splitting
+    // with `u64` arithmetic (as the old code did) avoids the `i64` seconds overflow near `u64::MAX`.
+    let (days, sod) = (i64::try_from(secs / 86_400).unwrap_or(i64::MAX), (secs % 86_400) as u32);
+    let (y, t) = utc_parts(days, sod, 0);
+    // `{y:04}` rather than `%Y`, which writes a `+` before years past 9999 (the old code did not).
+    format!("{y:04}-{}", t.format("%m-%d %H:%M UTC"))
 }

 /// The binary form of `msg`: [`WIRE_VERSION`], then postcard.
@@ -752,3 +768,25 @@ pub fn decode_json<T: DeserializeOwned>(text: &str, max_bytes: usize) -> Result<
    }
    serde_json::from_str(text).map_err(|e| Error::Decode(e.to_string()))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `utc_date` keeps the exact `YYYY-MM-DD HH:MM UTC` output the hand-rolled civil-from-days
+    /// code produced (leap days and all).
+    #[test]
+    fn utc_date_formats_seconds_since_1970() {
+        assert_eq!(utc_date(0), "1970-01-01 00:00 UTC");
+        assert_eq!(utc_date(1_000_000), "1970-01-12 13:46 UTC");
+        assert_eq!(utc_date(951_782_400), "2000-02-29 00:00 UTC");
+        assert_eq!(utc_date(1_709_164_800), "2024-02-29 00:00 UTC");
+        assert_eq!(utc_date(1_791_208_980), "2026-10-05 14:03 UTC");
+        // A year past 9999 keeps the plain zero-padded year (no `+`), as the old `{y:04}` did.
+        assert_eq!(utc_date(253_402_300_800), "10000-01-01 00:00 UTC");
+        // Past chrono's own year range (262143) the instant is moved into range by whole 400-year
+        // cycles and the real year restored, so it keeps the old hand-rolled output instead of
+        // falling back to the epoch.
+        assert_eq!(utc_date(u64::MAX), "584554051223-11-09 07:00 UTC");
+    }
+}
@@ -177,20 +177,19 @@ fn vertical_trim_through_node_set() {

 #[test]
 fn paragraph_indent_only_moves_left_aligned_text() {
+    figcraft_text::scan_system_fonts();
    let mut s = Session::new();
    let t = text(&mut s, "Indented paragraph", json!({"fontSize": 20, "paragraphIndent": 30}));
    let first_x = |s: &Session| {
        let (l, _) = figcraft_text::layout_node(s.doc().unwrap().node(t).unwrap()).unwrap();
-        (l.glyphs.first().map_or(0.0, |g| g.x), l.width)
+        (l.glyphs.first().map(|g| g.x), l.width)
    };
-    let (x, w) = first_x(&s);
-    if w <= 0.0 {
-        return;
-    }
+    // Without any font there are no glyphs, but the indent alone still gives the box a width.
+    let (Some(x), w) = first_x(&s) else { return };
    assert!((x - 30.0).abs() < 1e-6, "left: indented");
    s.execute("node.set", &json!({"id": t, "props": {"textAlign": "center"}})).unwrap();
    let (x, w2) = first_x(&s);
-    assert!((w2 - (w - 30.0)).abs() < 1e-6 && x.abs() < 1e-6, "centered auto-width text: no indent, the box shrinks by it");
+    assert!((w2 - (w - 30.0)).abs() < 1e-6 && x.is_some_and(|x| x.abs() < 1e-6), "centered auto-width text: no indent, the box shrinks by it");
 }

 /// A new text made with the Text tool by a press at `from`, a drag to `to` and a release, holding
@@ -1,5 +1,3 @@
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
 use figcraft_engine::{
    Session,
    doc::NodeKind,
@@ -1,5 +1,4 @@
 //! Accepting a library update that changes only a paint style refreshes the layers linked to it.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::disallowed_methods)]

 use figcraft_doc::{NodeId, StyleKind};
 use figcraft_engine::Session;
@@ -1,5 +1,4 @@
 //! `text.listIndent` / `text.listOutdent` report `changed` only when the document changed.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use figcraft_engine::{
    Session,
@@ -0,0 +1,14 @@
+//! The crate's integration tests, built as one test binary.
+
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod empty_text_box_undo;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::disallowed_methods)]
+mod library_style_acceptance;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod list_indent_response;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod scope_reset;
+#[allow(clippy::unwrap_used)]
+mod selection_colors;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod shape_builder_response;
@@ -1,5 +1,3 @@
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-
 use figcraft_engine::Session;
 use serde_json::json;

@@ -1,5 +1,3 @@
-#![allow(clippy::unwrap_used)]
-
 use figcraft_color::Paint;
 use figcraft_doc::NodeId;
 use figcraft_engine::{
@@ -1,4 +1,3 @@
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 use figcraft_engine::Session;
 use serde_json::{Value, json};

@@ -0,0 +1,5 @@
+//! The crate's integration tests, built as one test binary.
+
+mod distributed_alignment;
+mod import_link_contract;
+mod range_hyperlink_round_trip;
@@ -1,8 +1,7 @@
 //! End-to-end agent tasks: an in-process MCP client completes realistic design tasks only through
 //! MCP tool calls, and checks every result through inspect_document / get_node like an agent would.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

-mod common;
+use crate::common;

 use common::{Client, approx, png_dims};
 use serde_json::{Value, json};
@@ -1,6 +1,5 @@
 //! The attached backend against a fake app: a loopback control server answering with a headless
 //! session, speaking the desktop app's JSON-lines protocol.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use std::io::{BufRead, BufReader, Write};
 use std::net::TcpListener;
@@ -1,6 +1,5 @@
 //! `--automation-read-root` / `--automation-write-root` over MCP (#715): a tool call reads only
 //! inside the read and write roots and writes only inside the write roots.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::disallowed_methods)]

 use std::path::PathBuf;

@@ -1,5 +1,4 @@
 //! An in-process MCP client: feeds JSON-RPC lines to `Server::handle_line`.
-#![allow(dead_code, clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use figcraft_mcp::Server;
 use serde_json::{Value, json};
@@ -1,7 +1,6 @@
 //! Hidden top-level layers in an export take no room in the image (issue #447).
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

-mod common;
+use crate::common;

 use common::{Client, png_dims};
 use serde_json::{Value, json};
@@ -1,5 +1,4 @@
 //! Fuzz-ish: no input line may crash the server or leave it unable to answer.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use figcraft_mcp::{Server, TOOL_NAMES};
 use proptest::prelude::*;
@@ -0,0 +1,18 @@
+//! The crate's integration tests, built as one test binary.
+
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod agent_tasks;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod attached;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::disallowed_methods)]
+mod automation_roots;
+#[allow(dead_code, clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod common;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod export_hidden_roots;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod garbage;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod protocol;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod screenshot_pixel_limit;
@@ -1,7 +1,6 @@
 //! JSON-RPC / MCP protocol behaviour.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

-mod common;
+use crate::common;

 use common::Client;
 use figcraft_mcp::{PROTOCOL_VERSION, Server, TOOL_NAMES};
@@ -1,6 +1,5 @@
 //! `screenshot` with `ids` must honour `maxSize` for the rendered paint area (shadows, overflow).
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-mod common;
+use crate::common;
 use common::{Client, png_dims};
 use serde_json::{Value, json};

@@ -22,6 +22,7 @@ egui = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+chrono = { workspace = true }
 base64 = { workspace = true }
 image = { workspace = true }
 egui_extras = { workspace = true }
@@ -10,6 +10,7 @@
 use std::collections::HashMap;
 use std::path::Path;

+use chrono::Datelike;
 use egui::{Align2, Color32, CornerRadius, Id, Key, Rect, Response, Sense, Stroke, StrokeKind, Ui, pos2, vec2};
 use figcraft_engine::Prefs;
 use figcraft_format::thumbnail::{FileKind, Preview};
@@ -200,18 +201,35 @@ const MONTHS: [&str; 12] = [
    tr_noop("Dec"),
 ];

-/// `secs` since 1970 as a date in UTC: "Mar 4, 2026".
+/// (days since 1970-01-01, seconds-of-day, nanos) → (proleptic Gregorian year, the same wall-clock
+/// instant moved into chrono's range by whole 400-year cycles). The calendar repeats every 400
+/// years (146_097 days), so month, day and time of day come from chrono and only the year is
+/// carried, which keeps the result exact for any `i64` day count. This is not hand-rolled calendar
+/// math: chrono still does the date, the cycle count just shifts the year.
+fn utc_parts(days: i64, sod: u32, nanos: u32) -> (i64, chrono::NaiveDateTime) {
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` (1970-01-01 is CE day 719_163) is always a valid CE day, and `sod` < 86_400.
+    let date = i32::try_from(rest + 719_163).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt);
+    let time = chrono::NaiveTime::from_num_seconds_from_midnight_opt(sod.min(86_399), nanos.min(999_999_999));
+    match (date, time) {
+        (Some(d), Some(t)) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.and_time(t))
+        }
+        _ => (1970, chrono::NaiveDateTime::default()), // unreachable
+    }
+}
+
+/// `secs` since 1970 as a date in UTC: "Mar 4, 2026". Years past chrono's own range (262143) keep
+/// converting: the instant is moved into range by whole 400-year cycles and the real year restored,
+/// so every `u64` reads as the date the old hand-rolled conversion produced.
 fn date(secs: u64) -> String {
-    // Days to a civil date (Howard Hinnant's days_from_civil, inverted).
-    let z = i64::try_from(secs / 86_400).unwrap_or(0) + 719_468;
-    let era = z.div_euclid(146_097);
-    let doe = z.rem_euclid(146_097);
-    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
-    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
-    let mp = (5 * doy + 2) / 153;
-    let day = doy - (153 * mp + 2) / 5 + 1;
-    let month = if mp < 10 { mp + 3 } else { mp - 9 };
-    let year = yoe + era * 400 + i64::from(month <= 2);
+    // The day count of any `u64` seconds fits in `i64` (`u64::MAX / 86_400` ≈ 2.1e14), so the
+    // conversion is always exact (no epoch fallback). Splitting with `u64` arithmetic (as the old
+    // code did) avoids the `i64` seconds overflow near `u64::MAX`.
+    let (days, sod) = (i64::try_from(secs / 86_400).unwrap_or(i64::MAX), (secs % 86_400) as u32);
+    let (year, dt) = utc_parts(days, sod, 0);
+    let (month, day) = (i64::from(dt.month()), i64::from(dt.day()));
    let name = usize::try_from(month - 1).ok().and_then(|m| MONTHS.get(m)).map_or("", |m| tr(m));
    trf("{month} {day}, {year}", &[("month", &name), ("day", &day), ("year", &year)])
 }
@@ -965,3 +983,24 @@ fn list(ui: &mut Ui, t: &Tokens, recents: &mut Recents, files: &[Shown], now: u6
    arrows(ui, recents, files, 0, 1);
    action
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `date` keeps the exact "Mon D, YYYY" (UTC) output the hand-rolled days-from-civil code
+    /// produced. With no catalog loaded the month and format strings pass through in English.
+    #[test]
+    fn date_formats_seconds_since_1970_in_utc() {
+        assert_eq!(date(0), "Jan 1, 1970");
+        assert_eq!(date(951_782_400), "Feb 29, 2000");
+        assert_eq!(date(1_709_164_800), "Feb 29, 2024");
+        assert_eq!(date(1_741_046_400), "Mar 4, 2025");
+        // A year past chrono's own `NaiveDate` range (262143): the instant is moved into range by
+        // whole 400-year cycles and the real year restored.
+        assert_eq!(date(253_402_300_800), "Jan 1, 10000");
+        // Past chrono's year range, `u64::MAX` keeps the old hand-rolled output instead of falling
+        // back to the epoch.
+        assert_eq!(date(u64::MAX), "Nov 9, 584554051223");
+    }
+}
@@ -1,6 +1,5 @@
 //! A canvas pan (middle button or Space + primary) ends when its button is released, even when the
 //! release happens over a panel: returning to the canvas with no button held must not move the view.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use egui::{Event, Key, PointerButton, Pos2, RawInput, Rect, vec2};
 use figcraft_engine::Session;
@@ -1,6 +1,5 @@
 //! File > Export frames to PDF: the menu asks where to save and writes the frames' PDF there,
 //! one visible top-level frame per page.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use std::path::PathBuf;

@@ -1,5 +1,3 @@
-#![allow(clippy::unwrap_used)]
-
 use egui::{Pos2, RawInput, Rect, Vec2, vec2};
 use figcraft_engine::Session;
 use figcraft_ui_egui::{FigApp, NoServices};
@@ -0,0 +1,11 @@
+//! The crate's integration tests, built as one test binary.
+
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod canvas_pan_release;
+mod comment_open_other_page;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod file_menu_pdf;
+#[allow(clippy::unwrap_used)]
+mod guide_label_narrow;
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod recent_file_names;
@@ -1,5 +1,4 @@
 //! Recent file rows keep their full accessible name.
-#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]

 use egui::{Context, Id, Pos2, RawInput, Rect, accesskit::Role, vec2};
 use figcraft_engine::Session;
@@ -1,6 +1,6 @@
 # File format parity

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732); SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (`.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732); SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source) · **Target:** Figma Design (desktop app 126.10.7)

 Every format Figma reads or writes, with FigCraft's support. Sources: `Info.plist` of
 `/Applications/Figma.app` (document types only; nothing inside the bundle's code was read), Figma's
@@ -20,7 +20,7 @@ and prototype interactions are still unchecked there.
 | `.fig` (Figma Design, `com.figma.document`, `application/x-figma`) | native (cloud; "Save local copy") | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP) | **experimental** ([below](#export-to-fig-experimental)) | `.fig` files open (best effort): the zip, its deflate/zstd chunks and the kiwi schema are decoded generically and mapped by field name onto the REST importer, so pages, the layer tree, geometry, paints (styles resolved), strokes, effects, text with styled runs, vectors as editable vector networks (points, curved segments, filled areas with their winding, per-point corner radius and handle mirroring, end caps; outlines when the network is missing or damaged), auto layout (grid included; a flow that records no primary-axis sizing hugs on that axis, an instance that records no auto layout has its main's), constraints, ellipse arcs, boolean operations, components, sets (with their descriptions), instances (expanded from their main with overrides, derived layout and property values; the size and resizing their layers override stay overrides), styles, variables with modes and bindings, prototyping (set-variable, set-variable-mode and conditional actions included) and image fills from the archive come across; sticky notes, shapes with text, connectors, tables, code blocks, slides and similar layers come in as the closest frames, text layers and vectors, with a warning; anything else is a warning. Since 2026-10-17 (community batches #727, #728): an instance's own identity and the cached library components a file carries, overrides applied by key and order, local text values and instance overrides over a shared text style, grid track sizes (fixed, content-sized, fill), slot content, labels of connectors saved with their drawn path (a static snapshot; the ends aren't live), skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, editable text on a path, image adjustments and images carried in the message. Budgets come from the file's own size (one value per compressed byte, 20M–128M, lower ceilings on 32-bit targets; the layer cap follows), so a 15.4 MB synthetic file with 300,000 layers opens whole; the file's bytes stay out of the command journal; an import report lists what was left out or changed once the file opens. Not read: elbowed or curved connectors without a saved path (drawn straight) and labels of connectors without a saved snapshot, table cells beyond their own layers, filled areas with their own fills, variables bound to fields the editor can't bind, video fills. Tested on fixtures generated in code (`crates/format/src/fig/tests.rs`, `tail_tests.rs` and the per-feature `*_tests.rs` beside them, fuzzed) and by reading back what the export writes; no real-world files yet | read tail 5–10, write: checks against real files 5–15 |
 | `.jam` (FigJam), `.deck` (Slides) | native to other Figma products | no | no | out of scope | — |
 | REST API file JSON (`GET /v1/files/:key`) + local variables JSON + `images/` folder | the API's output | **yes** (`file.open`, `file.import`, CLI) | no | pages, layer tree, geometry, paints, strokes, effects, text runs, vectors, auto layout (sizing modes left out read as hug, as documented; grid track sizes from `gridColumnsSizing` / `gridRowsSizing`: px, fr, auto, `minmax(0, 1fr)`, `repeat()`), constraints, grids, components, sets, instances with overrides (sizes and resizing included), component properties, slots (`SLOT` layers bound to their slot property; an instance's slot keeps its content as the instance's own unless its property value is the main's default content; slot limits and preferred components are warnings), styles, prototyping (incl. conditionals and variable modes), variables with modes, aliases, scopes and bindings, image adjustments (the same tint sign as `.fig`); the import report after opening; warnings for what's skipped (video triggers and actions, modifier keys). Unit tests in `crates/format/src/rest/*_tests.rs` | — |
-| `.figcraft` (ours: zip of `document.json` + images, versions inside) | — | yes | yes | streamed JSON, 50k layers save ~0.09 s / load ~0.16 s (`cargo xtask bench`); old files keep opening (`large_tests.rs`) | — |
+| `.figcraft` (ours: zip of `document.json` + images, versions inside) | — | yes | yes | streamed JSON, 50k layers save ~0.09 s / load ~0.16 s (`cargo xtask bench`); old files keep opening (`large_tests.rs`); saves write a unique staging file and rename it into place (#284); optional auto-save of files with a path (`pref.autoSave`, #305) | — |
 | Local library files | team libraries in the cloud | yes (enable a `.figcraft` as a library) | yes (publish) | per-asset versions, updates with overrides kept | see [collaboration-parity](collaboration-parity.md) |

 ## Import (place / paste / drop)
@@ -51,7 +51,7 @@ export limit, not a native document nesting limit.
 |---|---|---|---|---|
 | PNG | yes, scales/suffixes | yes | export settings per layer, presets (`2x`, `512w`, `512h`), preview, "Export N layers"; contents only (off: every layer showing in the area) and include bounding box (the layer's own box); slashes in layer names export into folders. The exported area is what the layer paints: shadows towards their offset, outside and centre strokes, unclipped children, a mask group's mask, nothing for hidden layers; slices export everything under them; sides round up to whole pixels | — |
 | JPG | yes | yes | white where transparent; fixed quality (90) | — |
-| SVG | yes (outline text option, ids) | yes | alpha/luminance masks kept; noise, texture, progressive and background blur, glass embedded as images; outline text (off: `<text>` with one `<tspan>` per line, one style per layer), unique id attributes from layer names, explicit depth-limit refusal, simplified strokes (stroke attributes for centred strokes and for inside and outside strokes on boxes and ellipses) | — |
+| SVG | yes (outline text option, ids) | yes | alpha/luminance masks kept; noise, texture, progressive and background blur, glass embedded as images; outline text (off: `<text>` with one `<tspan>` per line, one style per layer), unique id attributes from layer names, explicit depth-limit refusal, nested frames clipped by their parent's clip (#327), simplified strokes (stroke attributes for centred strokes and for inside and outside strokes on boxes and ellipses) | — |
 | PDF | yes | yes | one page per frame, real selectable text in subset fonts, links, vectors and gradients as vectors, effects as images; bleed, crop/bleed marks, page boxes, naive CMYK; checked by rendering the PDF back against PNG exports; explicit depth-limit refusal | CMYK output intent 2–4 |
 | WebP | — | yes (ours) | | — |
 | Copy as CSS / SVG / PNG / text / link | yes | yes | Copy as PNG: the whole selection at 2x | — |
@@ -165,6 +165,7 @@ each.

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-15 | minor | `.fig` import (#279, #281; #266, #267): resized instances lay out their layers by their constraints, and explicit variable modes whose collection is named by its asset key come across (before, they were dropped and bound layers resolved in the default mode); fixture-tested, real files still owed. `.figcraft`: atomic saves and exports through unique staging files (#284), optional auto-save (#305). SVG export keeps a nested frame's fill and stroke inside its parent's clip (#327). Numbers unchanged |
 | 2026-10-18 | minor | REST file JSON import keeps `SLOT` layers (#792): they were dropped with everything placed in them, which emptied every instance's slot. A slot in a main component becomes a slot frame bound to its `SLOT` property (the one it references, else the one named like it, else the only one left), and an instance's slot holds the instance's own content, kept across syncs, moves of the mains and saving, unless the instance's property value is the main's default content (without values, a slot that holds layers keeps them). Instances in slot content link to their own mains. Slot content limits, preferred-only and preferred components are warnings. Synthetic files only. Numbers unchanged |
 | 2026-10-17 | minor | REST file JSON import reads grid track sizes from the CSS track strings `gridColumnsSizing` / `gridRowsSizing` (fixed px, fill fr, hug `auto`, `minmax(0, 1fr)`, `repeat()`; other tracks stay equal) (#465). Numbers unchanged |
 | 2026-10-17 | minor | The community batches #727 and #728 in the `.fig` row: instance identity and cached library components, overrides by key, text style precedence, grid track sizes, slot content, labels of connectors saved with their path, skip ink, paragraph options, list start numbers, vertical trim, per-point stroke joins, text on a path, image adjustments (also REST), images in the message; budgets from the file's size; the journal keeps no file bytes; the import report. Not read cut to what's left. A `.fig` copy from Save as. Pasted content: layers copied from another design app, best effort (tested only with clipboard HTML made from our own export), and images under Wayland (not run there). All on synthetic files: summary and hours unchanged |
@@ -1,6 +1,6 @@
 # Where FigCraft falls short of Figma

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (the 2026-10-17 landings: `.fig` import fidelity, budgets for large files, the import report, a `.fig` copy from Save as and paste from another design app (gap 1); menus, the Actions palette, editor fixes, Selection colors and smart-selection spacing (gap 4); catalog counts re-measured (gap 5); bounded canvas pan overscan; reviewed Russian catalog and integer plurals; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; `.fig` import: editable vector networks, more layer kinds, variable prototype actions; `.fig` import, best effort: gap 1 down to its tail; Windows QA pass: everyday workflows on Windows 11, eight fixes incl. unsaved work kept after a crash or a forced quit; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings: gap 14 down to its tail) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (gap 5: reviewed Turkish, Czech and Indonesian drafts, the Japanese draft completed; reviewed Russian catalog and integer plurals; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; `.fig` import: editable vector networks, more layer kinds, variable prototype actions; `.fig` import, best effort: gap 1 down to its tail; Windows QA pass: everyday workflows on Windows 11, eight fixes incl. unsaved work kept after a crash or a forced quit; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings: gap 14 down to its tail; the 2026-10-17 landings: `.fig` import fidelity, budgets for large files, the import report, a `.fig` copy from Save as and paste from another design app (gap 1); menus, the Actions palette, editor fixes, Selection colors and smart-selection spacing (gap 4); catalog counts re-measured (gap 5); bounded canvas pan overscan; reviewed Russian catalog and integer plurals; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; `.fig` import: editable vector networks, more layer kinds, variable prototype actions; `.fig` import, best effort: gap 1 down to its tail; Windows QA pass: everyday workflows on Windows 11, eight fixes incl. unsaved work kept after a crash or a forced quit; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings: gap 14 down to its tail) · **Target:** Figma Design (desktop app 126.10.7)

 Every known shortfall against Figma, one entry each, ranked by how much it stops a Figma user from
 doing real work in FigCraft. Agents: pick work from the top unless the owner says otherwise. The
@@ -18,7 +18,7 @@ No alpha blockers: the alpha gate in [`roadmap.md`](roadmap.md#alpha-gate) passe
 | 2 | Multiplayer and sharing are a preview, without accounts (**beta blocker**) | Feature | 42–84 | [collaboration-parity](collaboration-parity.md) |
 | 3 | Nothing checked against real Figma files | Fidelity | 15–30 | [target-app-parity](target-app-parity.md) |
 | 4 | Interaction fidelity not compared tool by tool | UI/UX | 40–60 | [ui-parity](ui-parity.md) |
-| 5 | Localization: English, reviewed Russian, plus unreviewed Spanish (and Latin American Spanish), French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Indonesian and Czech drafts; Turkish and Swedish catalogs | Localization | 29–51 | [localization-parity](localization-parity.md) |
+| 5 | Localization: English, reviewed Russian and Turkish, plus unreviewed Spanish (and Latin American Spanish), French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Indonesian and Czech drafts; Turkish and Swedish catalogs | Localization | 29–51 | [localization-parity](localization-parity.md) |
 | 6 | Plugins: widgets take clicks only, a self-hosted directory but no public catalogue; Figma's plugins don't run | Ecosystem | 8–26 | [target-app-parity](target-app-parity.md) |
 | 7 | CPU canvas where Figma uses the GPU | Hardware/performance | 30–60 | [hardware-parity](hardware-parity.md) |
 | 8 | Platform QA: Linux and the browser left (Windows pass done 2026-10-11) | Stability/platforms | 10–20 | [hardware-parity](hardware-parity.md) |
@@ -178,7 +178,7 @@ No alpha blockers: the alpha gate in [`roadmap.md`](roadmap.md#alpha-gate) passe
 - **Impact:** Figma users notice the feel within minutes; it decides whether they stay.
 - **Estimate:** 40–60 h. Detail in [`ui-parity.md`](ui-parity.md).

-### 5. Localization: English, reviewed Russian, plus unreviewed drafts
+### 5. Localization: English, reviewed Russian and Turkish, plus unreviewed drafts
 - **Missing:** native reviews of the Spanish, French, German, Brazilian Portuguese, Japanese,
  Korean, Simplified Chinese, Indonesian and Czech drafts and the Latin American Spanish
  overlay, the strings added since each catalog was drafted (1–5% of each), Hindi, Arabic and
@@ -444,6 +444,7 @@ No alpha blockers: the alpha gate in [`roadmap.md`](roadmap.md#alpha-gate) passe

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-15 | minor | Gap 5: Turkish reviewed by a native speaker (#263), Czech (#469) and Indonesian (#477) drafts, the Japanese draft caught up (#288); Indonesian is no longer missing; counts re-measured (2,177 entries) and corrected: only Spanish is held to completeness, Russian included. Estimate unchanged at this rounding |
 | 2026-10-17 | minor | The 2026-10-17 landings. Gap 1: a new Landed entry (community batches #727 and #728, then #745: instance identity and cached library components, overrides by key, text style precedence, grid track sizes, slot content, labels of connectors saved with their path, skip ink, paragraph options, list start numbers, vertical trim, per-point stroke joins, text on a path, image adjustments, images in the message, instance layers' size and resizing overrides, Hug where nothing is recorded; budgets from the file's size; the import report; a `.fig` copy from Save as; paste from another design app), its Missing list cut to what is still left, and the wrong "whether other apps open its files is unknown" replaced by what was checked; all on synthetic files, so the beta blocker and hours stand. Gap 2: server limits, log recovery and web join links in the evidence. Gap 4: menus, the Actions palette and the editor fixes (#733, #735, #736, #729), then Selection colors and smart-selection spacing (#753) landed, none compared side by side. Gap 5: catalog counts re-measured (2,272 entries; drafts at 95–99%; Indonesian, Czech, Turkish and Swedish listed). Gap 8: the Linux and BSD clipboard changes and Wayland window controls, not run there by the maintainers. Ranking and hours unchanged |
 | 2026-10-15 | minor | Gap 7: bounded canvas overscan for smoother panning. Estimates and ranking unchanged. |
 | 2026-10-14 | minor | Russian catalog (M9), reviewed and approved by VanTan: all 2,165 current entries, Русский in Preferences and regional ru tags. Russian integer plurals use one/few/many; contributor display name VanTan added. Existing estimates unchanged. |
@@ -1,6 +1,6 @@
 # Hardware and platform parity

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (macOS: quitting ends the process once everything is kept, avoiding the Touch Bar teardown crash (#781); Linux and BSD clipboard: images under Wayland, reads time out; minimised windows under Wayland; window controls on Wayland without server decorations; canvas textures on device pixels; copy and paste in the browser; Windows QA pass; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; pen pressure for the Pencil and brushes on Windows and from browser styluses) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** minor (zoom previews; hidden windows answer control requests; macOS file opening, the Windows start-up message, Linux packaging; copy and paste in the browser; Windows QA pass; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; pen pressure for the Pencil and brushes on Windows and from browser styluses; macOS: quitting ends the process once everything is kept, avoiding the Touch Bar teardown crash (#781); Linux and BSD clipboard: images under Wayland, reads time out; minimised windows under Wayland; window controls on Wayland without server decorations; canvas textures on device pixels; copy and paste in the browser; Windows QA pass; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; pen pressure for the Pencil and brushes on Windows and from browser styluses) · **Target:** Figma Design (desktop app 126.10.7)

 How FigCraft uses hardware and which platforms it runs on, against Figma. Figma's desktop app is
 Electron with a GPU helper process; its canvas renders on the GPU (WebGL, with WebGPU rolling out
@@ -12,13 +12,13 @@ since 2025). FigCraft renders the canvas on the CPU and presents it through wgpu

 | Feature | Figma | FigCraft (macOS / Windows / Linux / web) | Hours |
 |---|---|---|---|
-| Canvas rendering | GPU | CPU (tiny-skia), banded across cores, retained (re-renders only what an edit or pan touches), levels of detail below 50% zoom; shown through wgpu (WebGPU or WebGL2 in the browser) | 30–60 for a GPU path |
+| Canvas rendering | GPU | CPU (tiny-skia), banded across cores, retained (re-renders only what an edit or pan touches), levels of detail below 50% zoom; when renders from scratch are slow, a new zoom shows the whole view coarsely first, then refines it (#312); shown through wgpu (WebGPU or WebGL2 in the browser) | 30–60 for a GPU path |
 | Effects (blurs, glass, noise) | GPU | CPU | in the above |
 | HiDPI / Retina | yes | yes (all); a canvas image rendered at the screen's density is placed on whole device pixels, so fractional pans, zooms and display scales don't blur it (#359; geometry tests, the snapping not judged by eye) | — |
 | Wide-gamut display (Display P3) | yes, on capable displays | colours stored and exported in P3; the screen shows sRGB: eframe/egui-wgpu 0.36 configure an 8-bit sRGB surface with no colour space option, although wgpu 30 can present Display P3 or extended sRGB on Metal, DX12, Vulkan and WebGPU (see gaps #18). The colour picker warns about colours outside sRGB and View ▸ Soft-proof sRGB stripes them on the canvas | 2–5 |
 | Trackpad pinch zoom and two-finger pan | yes | yes (egui zoom delta, smooth scroll) | — |
 | Pen tablet pressure (pencil, Figma Draw brushes) | yes (forum reports of regressions in 2025) | Windows pens (winit pointer input) and browser styluses that send touch events with a force (an Apple Pencil in Safari); the Pencil records it as the stroke's width profile. A mouse, macOS and Linux tablets and pens sending only pointer events in a browser report none: constant width | 1–3 |
-| Several windows / multi-monitor | yes (a window per file; presenter in its own window) | desktop: File ▸ New window, a tab's Open in new window or a tab dragged off the strip; each window has its own tabs, panels and canvas, draws only when it needs to and asks about unsaved changes when it closes. Only the main window has a screen-reader tree (eframe 0.36), so files stay tabs while a screen reader runs; positions aren't restored at the next start; the presenter stays inside its window; one window in the browser | 1–2 |
+| Several windows / multi-monitor | yes (a window per file; presenter in its own window) | desktop: File ▸ New window, a tab's Open in new window or a tab dragged off the strip; each window has its own tabs, panels and canvas, draws only when it needs to and asks about unsaved changes when it closes; a minimised or covered window still answers control and MCP requests, while screenshots and input fail at once until it is on screen (#313, #332, #720). Only the main window has a screen-reader tree (eframe 0.36), so files stay tabs while a screen reader runs; positions aren't restored at the next start; the presenter stays inside its window; one window in the browser | 1–2 |
 | Screen readers | partial | AccessKit tree on desktop (names, roles, states), never tested with a real screen reader; none in the browser | 4–8 + human QA |
 | Keyboard layouts (non-US) | yes | keymap uses logical keys; not checked on AZERTY/QWERTZ/JIS | 1–2 |

@@ -50,6 +50,7 @@ Nothing has been timed against Figma on the same document (needs `.fig` import).

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-15 | minor | Community fixes (#290, #306, #312, #313, #328, #332, #346, #474): coarse zoom previews when renders from scratch are slow; a minimised or covered window answers control and MCP requests (screenshots and input fail at once while it is hidden); `.figcraft` files open from Finder on macOS; a message box when the window can't open on Windows; on Linux the window id matches the desktop entry, the RPM requires glibc 2.35 and user fonts under `XDG_DATA_HOME` are found. Numbers unchanged |
 | 2026-10-18 | minor | macOS quit crash (#781): on Macs with a Touch Bar the app could crash as it quit (an exception in AppKit's Touch Bar support while the window's content view, which the accessibility adapter subclasses, was torn down). Quitting now keeps everything (preferences, this run's recovery copies, live sessions ended) and then ends the process before that teardown. Quit from the menu bar ends the app without the unsaved-changes question, so unsaved files' recovery copies now stay and reopen at the next start instead of being removed. Numbers unchanged |
 | 2026-10-17 | minor | Linux row: clipboard reads on Linux and the BSDs time out after 2 s on a helper thread, images copied in other apps paste under Wayland (arboard's data-control feature, #693), a minimised window can't be detected under Wayland, so frame-only control requests may still wait there (#720), and Wayland compositors without server-side decorations give the window Adwaita controls (#592, checked by its author on GNOME, not by the maintainers; KDE not run); compiled in CI, not run on a Linux desktop. HiDPI row: native-density canvas images placed on whole device pixels (#359, geometry tests; not judged by eye). Numbers unchanged |
 | 2026-10-14 | minor | Copy and paste in the browser: the web build never wrote to the system clipboard, so Cmd+V after Cmd+C pasted whatever text the clipboard held before (as a text layer) instead of the copied layers. Copies (layers, Copy as SVG/CSS/text/PNG, links) now go out through egui's output, which eframe writes during the copy event (`web_clipboard_tests`). Numbers unchanged. |
@@ -1,6 +1,6 @@
 # Localization parity

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (macOS finds its downloadable CJK system fonts (#406); string counts re-measured: 2,272 entries, the drafts at 95–99%; Swedish command labels and menu wordings; Russian, Swedish, Turkish, Czech and Indonesian listed; a duplicated paragraph removed; draft catalogs catch up: every draft translates every string again; Simplified Chinese draft catalog) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (Russian and Turkish catalogs reviewed by native speakers, Russian one/few/many plurals; Czech and Indonesian drafts; the Japanese draft completed; counts re-measured; Windows UI language from the first preferred language; draft catalogs catch up: every draft translates every string again; Simplified Chinese draft catalog; macOS finds its downloadable CJK system fonts (#406); string counts re-measured: 2,272 entries, the drafts at 95–99%; Swedish command labels and menu wordings; Russian, Swedish, Turkish, Czech and Indonesian listed; a duplicated paragraph removed; draft catalogs catch up: every draft translates every string again; Simplified Chinese draft catalog) · **Target:** Figma Design (desktop app 126.10.7)

 FigCraft's interface has a localization layer with an English catalog, a Russian catalog reviewed
 by a native speaker, and Spanish (with a Latin American overlay), French, German, Brazilian
@@ -37,7 +37,8 @@ supported by both apps (CJK, Arabic and Devanagari shaping, IME); Figma has no v
  only the first preferred language counts, since that list also holds the languages added for a
  keyboard; macOS AppleLanguages, `LANGUAGE` then the locale variables on Linux and BSD; a regional
  tag falls back to its language, pt-PT or pt to pt-BR, and es-419, es-MX, es-AR, es-CO and the
-  other Latin American and US Spanish tags to es-419; zh, zh-CN, zh-SG and zh-Hans read zh-Hans,
+  other Latin American and US Spanish tags to es-419; regional ru, tr, cs and id tags (ru-RU,
+  tr-TR, cs-CZ, id-ID) to their catalogs; zh, zh-CN, zh-SG and zh-Hans read zh-Hans,
  while Traditional Chinese (zh-Hant, zh-TW, zh-HK, zh-MO) has no catalog and reads English or the
  next OS language, never Simplified) or the browser's language on the web.
  `pref.language {language}` sets it from the CLI, MCP and the control channel.
@@ -63,7 +64,8 @@ supported by both apps (CJK, Arabic and Devanagari shaping, IME); Figma has no v
 - **Script support in the UI:** menus widen to their longest label; dropdowns, the two-column
  labels of the right panel and the home screen's cards keep a long translation on one line with an
  ellipsis and show it in full on hover (checked in German, the longest); no mirrored
-  (right-to-left) layout of panels. CJK translations are shorter than English; the same ellipsis
+  (right-to-left) layout of panels. Cyrillic, Turkish and Czech letters draw from the UI fonts
+  (no font added; Russian checked in screenshots). CJK translations are shorter than English; the same ellipsis
  and tooltip cover the few that don't fit (the sizing dropdowns).
 - **CJK UI fonts:** egui's fonts and Inter have no CJK glyphs. Once the UI language, the open
  file's names or comments, typed text or the language picker needs Japanese kana, Hangul or Han,
@@ -120,6 +122,7 @@ Hindi, Vietnamese and Arabic. Traditional Chinese is not planned (no catalog; it

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-15 | minor | Community catalogs (#257, #263, #469, #477, #288): Russian (`ru`, Русский, reviewed and approved by VanTan) and Turkish (`tr`, Türkçe, reviewed by a native speaker), Czech (`cs`, Čeština) and Indonesian (`id`, Bahasa Indonesia) drafts, and the Japanese draft caught up; Preferences ▸ Language lists them and System maps their regional tags. Catalogs may give few and many plural forms; Russian picks one, few or many by its integer rule (11–14 take many), the catalog supplying the text choosing the rule. Only Spanish is held to completeness. Counts re-measured: 1,587 UI keys (38 plural), 559 command labels and 31 menu wordings, 2,177 entries; Spanish 100%, Japanese 2,176, Czech and Indonesian 2,166, Russian and Turkish 2,165, the five older drafts 2,088–2,089 (95%). Localization 39% and 29–51 h unchanged at this rounding |
 | 2026-10-17 | minor | Chinese showed as boxes on macOS (#406): the font scan also walks the system's downloaded font assets (`/System/Library/AssetsV2` and the older `/System/Library/Assets`, only their `com_apple_MobileAsset_Font*` folders), where current versions keep PingFang SC, and Hiragino Sans GB and Heiti SC join the Chinese UI faces and the text fallbacks. Tested with a folder laid out the same way; not yet run on a Mac |
 | 2026-10-17 | minor | String counts re-measured from the catalogs: 1,680 UI keys, 561 command labels and 31 menu wordings (2,272 entries); Spanish complete, the other drafts at 95.3–99.2% (strings added since 2026-10-12 show English), es-419 101 entries. Indonesian has a draft (98.8%; it was listed as none); Russian (98.8%, reviewed), Swedish (99.6%, command labels and menu wordings from #599), Turkish (98.7%) and Czech (98.8%) listed with counts; the language picker's list updated; a paragraph repeated by a merge removed. Grade and hours unchanged (Indonesian's draft is offset by the drafts' new gaps) |
 | 2026-10-14 | minor | Windows UI language (#291): the interface language comes from Windows' first preferred language alone; that list is also the input-language list (a German keyboard on a Polish system adds Deutsch), and taking the first entry with a catalog turned the interface German there. A first preferred language without a catalog reads English; macOS AppleLanguages and gettext's `LANGUAGE` still take the first language with a catalog |
@@ -1675,7 +1675,7 @@ other key next to `$step` fails the whole batch, which is rolled back. Only an o
 value too) is read as a reference. A step that is itself a `command.batch` is passed on as written,
 so the references in its steps are to its own steps, not the outer batch's.

-The end-to-end tests in `crates/mcp/tests/agent_tasks.rs` are worked examples of realistic tasks
+The end-to-end tests in `crates/mcp/tests/it/agent_tasks.rs` are worked examples of realistic tasks
 (auto layout, a card built in one batch with step references, components and overrides, gradients
 and shadows, paint styles, Light/Dark variables, align/distribute/group, boolean subtract + flatten,
 export, undo/redo, drawing with tools).
@@ -1,6 +1,6 @@
 # FigCraft roadmap: milestones and what's next

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (community batch #753: Selection colors, smart-selection spacing, a Present tab; community fixes from #524 up (55 PRs: `.fig` import fidelity, paste from other apps, the Actions palette, editor fixes, server limits) and a boolean-op crash guard; community fixes from #478 up and a control-channel fix (#589); recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading, SVG import budgets, Leptos code, full screen, server snapshots, owner-only preferences, ruzstd 0.9.1, layer cycle repair, batch rollback, Direct3D 12 on Windows, plugin metering; vector edit mode regions: hover hatch, selection and drag; repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; `.fig` import, best effort; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~79%) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (community fixes in #507, #510, #529 and #530: auto-save, a text box by dragging, batch step references, removing someone from a live session, Russian and Turkish catalogs reviewed, Czech and Indonesian drafts, the Japanese draft completed, zoom previews, the web clipboard, Alt-drag snapping and Cmd+D repeat, recovery copies, crash and rollback fixes, colour emoji, `.fig` import fixes; earlier changes are in the revision history below) · **Target:** Figma Design (desktop app 126.10.7)

 Forward-looking plan. Where FigCraft stands today: [`ROADMAP.md`](../ROADMAP.md) and
 [`target-app-parity.md`](target-app-parity.md); the full ranked list: [`gaps.md`](gaps.md). Hours
@@ -16,8 +16,9 @@ are one Opus 5.5 agent; most milestones split across 4–6 agents on disjoint cr
 3. **Tool-by-tool interaction pass** against the running Figma ([`ui-parity.md`](ui-parity.md)):
   40–60 h, parallel by tool.
 4. **Languages** on the landed localization layer: native reviews of the es, fr, de, pt-BR, ja,
-   ko and zh-Hans drafts and the es-419 overlay (people), then the other key languages: 3–7 h per language
-   plus native review.
+   ko, zh-Hans, id and cs drafts and the es-419 overlay (people; Russian and Turkish are reviewed),
+   the entries added since each catalog was written, then the other key languages (Hindi,
+   Vietnamese, Arabic): 3–7 h per language plus native review.
 5. **Multiplayer M9**: accounts and teams on top of the live sessions and the standalone server (the WebSocket transport, hosting from the app, invite links that open the app, document sync, live cursors, selections, text carets, avatars and follow, per-user undo, reconnect with offline edits, collision-free ids for styles, variables, collections and comments, joining from the browser, and `figcraft-server` with persistence, publishing from the app and share links to edit or view landed), per [`collab-protocol.md`](collab-protocol.md) and [`server.md`](server.md): 45–90 h.

 ## Alpha gate
@@ -57,7 +58,7 @@ blockers.
 | M7 Release & fidelity (signed builds, look & feel, shortcuts) | builds done; fidelity pass started | tool-by-tool pass | 40–60 |
 | M8 Hardening & performance (bench, retained canvas, accessibility, idle) | ~60% | real-file corpus, platform QA, GPU canvas, screen readers | 60–110 |
 | M9 Real-time collaboration | core done (#103: ids, change sets, server ordering, convergence); live sessions (WebSocket transport with limits and reconnect, hosting from the app, invite links, document sync between apps, cursors, selections, avatars, follow, `collab.*` commands); per-user undo, rejection handling, offline queue and resuming after a reconnect; styles, variables, collections, modes and comments created in a session get ids from their creator's space; others' text carets and selections on the canvas; the browser client (joins desktop-hosted sessions); `figcraft://` links open the app and join (Windows registers per user; macOS and Linux packages declare the scheme); the standalone `figcraft-server` (persistence with compaction, restarts that lose nothing confirmed, publishing from the app, share links to edit or view, revocable); team libraries kept on the server and enabled by a share link, with usage counts, and swapping a library; `wss://` from the desktop app, server releases and a deployment guide | accounts, teams | 45–90 |
-| M10 Localization (new) | not started | layer + 11 languages | 60–100 |
+| M10 Localization | ~39%: the layer, English, Russian and Turkish reviewed by native speakers; Spanish (with a Latin American overlay), French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Indonesian and Czech drafts | native reviews, Hindi, Vietnamese, Arabic (with mirrored panels), engine messages and number formatting ([localization-parity](localization-parity.md)) | 29–51 |
 | M11 Plugins | runtime, API, menu, manager and SDK done (#101); plugin panels and settings (ABI v2); widgets (API 3), panels side by side, colour picker on plugin fields; a plugin directory on `figcraft-server` (publish, browse, install, update) | a public catalogue, publisher accounts and signatures, the directory in the browser, richer widget events; Figma plugin compatibility is an owner decision | 8–26 |
 | M12 AI features (new, owner decision) | not started | local models | 30–60 |

@@ -73,6 +74,55 @@ blockers.

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-15 | minor | Auto-save (#305, #296): Preferences ▸ Save files automatically (`pref.autoSave`, off by default; desktop only, the browser has no files to save to) saves each open file that has a path 3 s after its last change, so steady editing doesn't save every few seconds, and never during a gesture, a live text preview or while a version is shown. The file is encoded on a thread of its own and written as of that moment (edits made meanwhile stay unsaved); a failed save says why in a toast and is tried again a minute later, and version history checkpoints keep coming with it on. Numbers unchanged |
+| 2026-10-15 | minor | A text box by dragging (#363, #360): a drag with the Text tool makes a fixed-size text box the size of the drag (at least one line tall); a click, or a drag shorter than the drag threshold, still makes auto-width text. Numbers unchanged |
+| 2026-10-15 | minor | Batch step references (#400): inside `command.batch` (MCP `batch`), `{"$step": n}` anywhere in a step's params stands for the `id` step n returned (`{"$step": n, "field": …}` for another field; `$step` is a reserved key), so a frame with its children takes one batch and one undo step; a malformed reference fails the batch, which rolls back, and a nested batch keeps references to its own steps. Numbers unchanged |
+| 2026-10-15 | minor | Removing someone from a live session (#338): right-click a person's avatar ▸ Remove *name* from session, or `collab.removePerson {client}`, when you host the session or own the file on a server; the session ends for them (they keep their copy), the code or link they hold no longer gets them back in while it runs, and everyone else stays. Numbers unchanged |
+| 2026-10-15 | minor | Pages list (#272, #258): a long pages list scrolls in its own area, so the layers below stay in view; page and layer drops count only inside the list's visible rows. Numbers unchanged |
+| 2026-10-15 | minor | Variables export in the browser (#368): Export… ▸ Variables JSON / CSS custom properties did nothing in the web build and now arrives as a download; importing there still needs a file picker. Numbers unchanged |
+| 2026-10-15 | minor | Font picker keys (#352, #345): Up and Down step through the font families from the current one, keeping the highlight in view and previewing it on the canvas; Enter applies it, Escape leaves the text as it was. Numbers unchanged |
+| 2026-10-15 | minor | Leaving Design ends the pen path (#308, #307): switching to Prototype or Inspect while the Pen draws ends the path and goes back to Move (pressing Design again keeps drawing), and a click on the toolbar no longer reaches the canvas under it. Numbers unchanged |
+| 2026-10-15 | minor | Vector edit mode keeps the canvas still (#322): the edit mode hints in the Design panel wrap, so entering edit mode and picking a region no longer shift the canvas by about 25 points in the middle of the click (which dragged the region picked). Numbers unchanged |
+| 2026-10-15 | minor | Drop shadows under a background blur (#317, #255): a layer with both casts its shadows from what it paints (a translucent fill casts a lighter shadow than an opaque one) and reads the backdrop only after drawing them, so a shadow shown behind transparent areas is seen through the blur. Numbers unchanged |
+| 2026-10-15 | minor | When the window can't open (#306, #261): Windows release builds have no console, so a graphics failure at start quit without a word; the error is now logged and shown in a message box in the interface language, with what to try (unset `WGPU_BACKEND`, update the driver, OpenGL) and where to report it, skipped with `--control`. Numbers unchanged |
+| 2026-10-15 | minor | Crashes on Windows (#271, #314, #337; #224 and two more): a text field focused before it was drawn aborted the screen-reader layer; double-clicking a page, creating a variable collection and renaming a style folder no longer close the app. Numbers unchanged |
+| 2026-10-15 | minor | Deeply nested layers (#330, #210): one depth guard (256) on the three recursive layout paths, so a deep file can't run the layout out of stack. Numbers unchanged |
+| 2026-10-15 | minor | Image memory budgets (#326; #203, #189): decoded images and a file's images have budgets; the decode cache evicts its least recently used entries. Numbers unchanged |
+| 2026-10-15 | minor | macOS file dialogs (#253, #250) no longer re-enter the event loop; a dialog's result goes to the file and window it was opened for, and dialogs are parented to the main window. Numbers unchanged |
+| 2026-10-15 | minor | Recovery copies (#297, #303, #331, #336; #202, #185, #187): a copy counts only after its write succeeds and a failed one is retried; saves and closes wait for the write in flight; copies keep version history and branches; a recovered copy stays until this run has its own. Numbers unchanged |
+| 2026-10-15 | minor | Text edits (#280, #278) no longer roll back earlier changes; a drag released off the canvas ends at the pointer's last canvas position. Numbers unchanged |
+| 2026-10-15 | minor | Rollback (#282, #301; #196): a failed command rolls back during a drag or other gesture too; a failed batch keeps the redo steps. Numbers unchanged |
+| 2026-10-15 | minor | Atomic save and export (#284): staging files are uniquely named and created exclusively, so a file or link already at the old fixed staging name is never written through, and two writers of one file no longer share one. Numbers unchanged |
+| 2026-10-15 | minor | Alt-drag copies (#283) snap to their original, and Duplicate (Cmd+D) then repeats the last copy's offset. Numbers unchanged |
+| 2026-10-15 | minor | The pen (#277) shows its Bezier handles while a point is dragged out. Numbers unchanged |
+| 2026-10-15 | minor | Corner handles (#293, #292): a press on a corner handle resizes instead of picking the corner-radius handle. Numbers unchanged |
+| 2026-10-15 | minor | New text (#372, #362) takes a readable colour from the frame it is drawn in, not only the page (text drawn in a white frame on a dark page was white). Numbers unchanged |
+| 2026-10-15 | minor | Outline stroke (#386) works on every selected layer. Numbers unchanged |
+| 2026-10-15 | minor | Send to back (#444) counts per parent when the selection spans frames. Numbers unchanged |
+| 2026-10-15 | minor | Align buttons (#276) are off when the selection has nothing to align to. Numbers unchanged |
+| 2026-10-15 | minor | Gradient type icons (#275) show their gradient. Numbers unchanged |
+| 2026-10-15 | minor | Corner resize cursors (#388) stay diagonal at any proportions; the text selection highlight (#390) stays inside the box on the last line. Numbers unchanged |
+| 2026-10-15 | minor | New pages (#311, #295) take the current page's background; the theme still decides a new file's page. Numbers unchanged |
+| 2026-10-15 | minor | A slice's export preview (#265) shows the content under it. Numbers unchanged |
+| 2026-10-15 | minor | SVG export (#327, #325) keeps a nested frame's fill and stroke inside its parent's clip. Numbers unchanged |
+| 2026-10-15 | minor | Home screen (#318, #324): recent files notice files deleted while it is open; a long path no longer draws over the file name. Numbers unchanged |
+| 2026-10-15 | minor | System theme on first run (#262): the first frame follows the system theme, and going back to System from a manual theme works. Numbers unchanged |
+| 2026-10-15 | minor | Web clipboard (#375): copy and paste in the browser go through the system clipboard, so a paste after a copy brings the copied layers instead of whatever text the clipboard held. Numbers unchanged |
+| 2026-10-15 | minor | Zoom previews (#312): when renders from scratch are slow, a new zoom first shows the whole view coarsely instead of the page colour, then the refined image; images of another file or page never show. Numbers unchanged |
+| 2026-10-15 | minor | Hidden windows (#313, #332; #269): a minimised or covered window answers control and MCP requests (commands, inspection, `ui.render`) at once, each window on its own; screenshots and input still wait for it to be on screen. Numbers unchanged |
+| 2026-10-15 | minor | Server (#340, #302): a compaction cut short closes the file instead of confirming lost edits (#183); each team library version is kept in its own file (#206). Numbers unchanged |
+| 2026-10-15 | minor | Counters (#343, #344, #353; #309): collab sequence numbers, layer name counters and opacity digits can't overflow. Numbers unchanged |
+| 2026-10-15 | minor | Commands refuse bad indexes and ids (#475, #384, #310): `page.select` and `doc.switch`, `effect.set` and `export.update` / `export.remove`, `page.move` with a non-page id. Numbers unchanged |
+| 2026-10-15 | minor | Find and replace (#358, #361) changes every occurrence, case-insensitively, also when the replacement contains the search text. Numbers unchanged |
+| 2026-10-15 | minor | The gradient shorthand (#254, #252) is read by the engine, so the CLI, control channel and MCP share it. Numbers unchanged |
+| 2026-10-15 | minor | .fig import (#279, #281): resized instances lay out their layers by their constraints (#266); explicit variable modes whose collection is named by its asset key, as library collections are, come across (#267). Numbers unchanged |
+| 2026-10-15 | minor | Colour emoji (#300, #268) draw from their own colour tables (sbix and CBDT/EBDT bitmap strikes, COLR v0 layers), a colour face tried first; COLR v1 still draws outlines. Numbers unchanged |
+| 2026-10-15 | minor | macOS (#290, #289): `.figcraft` files open from Finder, Open With and the Dock. Numbers unchanged |
+| 2026-10-15 | minor | Windows (#294, #291): the first preferred language alone picks the UI language. Numbers unchanged |
+| 2026-10-15 | minor | Unix font discovery (#474) follows `XDG_DATA_HOME`. Numbers unchanged |
+| 2026-10-15 | minor | Linux packaging (#346, #328): the window id matches the desktop entry (FreeBSD keeps its class); the RPM requires glibc 2.35. Numbers unchanged |
+| 2026-10-15 | minor | Tests (#472, #471, #339): the rename shortcut test, the hanging punctuation test and the font-scanning tests no longer depend on the platform, font or test order. Numbers unchanged |
+| 2026-10-15 | minor | Languages (#257, #263, #469, #477, #288): Russian (with one/few/many plural forms) and Turkish catalogs, reviewed by native speakers; Czech and Indonesian drafts; the Japanese draft completed. 2,177 entries now (1,587 UI strings, 559 command labels, 31 menu wordings); strings added since a catalog was written read English there. Localization 39% and 29–51 h unchanged at this rounding (Indonesian is now a draft, while the five older drafts lack 88 newer entries) |
 | 2026-10-17 | minor | Community batch #753 (10 PRs): Selection colors for mixed selections (#403); smart-selection spacing fields and canvas handles (#402); a Present tab with device and scale controls (#537); adding auto layout to an empty frame keeps its size (#369); `node.set` applies auto layout keys to frames only and warns about font styles a family lacks (#603); canvas images on whole device pixels (#359); Adwaita window controls on Wayland without server decorations (#592, not run on GNOME or KDE by the maintainers); the keyboard shortcuts panel closes on the home screen (#548); macOS paste modifiers in tests (#750); credits column tests (#347). Numbers unchanged. |
 | 2026-10-17 | minor | Community fixes from #524 up (batches #727, #728, #733, #735, #736 and #729; 55 PRs) and a crash guard. `.fig` import: explicit instance identity, overrides by key, text style precedence, grid track sizes, slot content, connector labels, skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, text on a path, image adjustments and embedded images; large files open within budgets from the file's own size; an import report after opening; imported bytes stay out of the command journal. Files and paste: save a copy as `.fig`; Cmd/Ctrl+V pastes images copied in other apps and layers copied from another design app (`edit.pasteDesignLayers`); paste over and paste properties; clipboard reads on Linux and the BSDs time out after 2 s. Editor: live font preview on hover; Shift+I and Resources open Assets; Shift-drag moves the selection; thin strokes take a nearby double-click; dropped points merge; Flatten keeps open paths; the Actions palette gets tabs, ranked search, a keyboard highlight and recents; the colour picker opens on a new fill or stroke; text strokes follow their alignment; selection highlights after line breaks; a draggable pages/layers divider; variant properties reorder by drag; submenus keep their hover with a safe triangle; menu actions that need a value ask for it; File ▸ Rename edits the name in place. Engine: bad paint indexes, non-finite geometry and pages in copy/cut are refused; a param naming a layer says so when it isn't one; a CLI script is one undo step and resolves `$step`. Server and collaboration: message limits follow `max_file_mb` (client capped at 1 GiB); a damaged generation field no longer drops flushed edits; the web build joins a session from a `#join=` link. Also Swedish command labels, Nix CI through the shared workflow, paint bounds once per render, and a guard that turns a panic inside the boolean-op library into bad input (the stroke draws unclipped). Numbers unchanged. |
 | 2026-10-16 | minor | Community fixes from #478 up (batches #591, #598, #602; 69 PRs) and a control-channel fix: a line that isn't JSON now ends a `--control` connection, so a web page can't drive the app through a browser request (#589). Highlights: page copies keep navigation, flows, prototype settings and guides; Find and Replace keeps line endings and case-insensitive matches; text hyperlinks survive import and export; recent colours record only what was picked; MCP screenshots respect `maxSize`; Swedish catalog (UI strings), Czech plurals; bounded canvas overscan while panning; Korean fallback at the run's weight; many vector-edit, guide, page and .fig round-trip fixes. Numbers unchanged |
@@ -1,6 +1,6 @@
 # FigCraft parity with Figma

-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; previous: minor, rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719); reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7) · **Target:** Figma Design (desktop app 126.10.7, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (CJK line breaking: JIS X 4051's line-start and line-end sets completed with the halfwidth small kana, the halfwidth and spacing (semi-)voiced sound marks, iteration marks 〱–〵 and the halfwidth parentheses; previous: minor, Turkish reviewed, Czech and Indonesian drafts, the Japanese draft completed; rows for the community batches: Selection colors, smart-selection spacing and a Present tab (#753), `.fig` import fidelity, paste from another design app, a `.fig` copy from Save as; control requests while the window is minimised (#720); catalog counts re-measured; automation roots (#715); number variables in the text content picker (#629); frames and sections convert into each other (#719); reviewed Russian catalog and integer plurals; vector edit mode regions: hover hatch, selection and drag; plugin log byte/count limits (#191); core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; starter templates, a Templates tab and Getting started tips on the home screen: essentials ~57% → ~59%; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages, numbers unchanged but menu breadth 211/211; text box sizes measured against documents re-saved by other software: whole-pixel line heights, advances on a 1024-per-em grid, letter spacing between glyphs only, numbers unchanged; .fig export checked by opening written files in other software, numbers unchanged; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%; last major: full re-measure against Figma desktop 126.10.7) · **Target:** Figma Design (desktop app 126.10.7, macOS)

 The authoritative assessment of how close FigCraft is to Figma Design. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) is the ranked work list; the measured menu checklist is
@@ -639,6 +639,7 @@ Carried over from the ROADMAP's "Shipped so far" (2026-10-10). The test count th

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-15 | minor | Localization (#263, #469, #477, #288): Turkish reviewed by a native speaker, Czech and Indonesian drafts, the Japanese draft caught up; coverage re-measured (2,177 entries; the five older drafts at 95%). Localization 39% and 29–51 h unchanged at this rounding (see [localization-parity](localization-parity.md)) |
 | 2026-10-20 | minor | Layer data reads back (#879): `node.get` (the command, the control method and MCP `get_node`) and `document.inspect` report a layer's or page's `pluginData` as `{key: value}` when it has any, so a tool that keeps state in a file with `node.set {props: {pluginData}}` can read it on its next run (`plugin_data_tests`). Numbers unchanged |
 | 2026-10-17 | minor | Menu breadth re-run with `cargo xtask parity`: 212 / 212 (100%; the catalog gained View ▸ Full screen with #227 on 2026-10-14), 561 commands. Rows for the 2026-10-17 landings: import/export (area 14) and the file formats dimension name the `.fig` import's new fidelity (instance identity, overrides by key, text style precedence, grid tracks, slots, connector labels, per-point joins, text on a path, image adjustments, list start numbers, vertical trim), budgets from the file's size, the import report, a `.fig` copy from Save as and paste from another design app; the localization evidence takes the re-measured catalog counts (2,272 entries, drafts at 95–99%, Indonesian and Czech drafts, Swedish and Turkish catalogs); the Automation line adds control requests answered while the window is minimised (#720); batch #753's Selection colors, smart-selection spacing, Present tab and auto layout on empty frames are in ui-parity, prototyping-parity and auto-layout-parity. Numbers unchanged: every `.fig` and paste change is checked on synthetic files or clipboard HTML made from our own export, and real files are what gap 1's blocker and the file-exchange discounts wait for; the UI changes (menus, the Actions palette, editor fixes) are not compared side by side, so UI/UX stays at 58%; the localization grade and hours stay (Indonesian's draft is offset by the drafts' new gaps) |
 | 2026-10-17 | minor | Automation roots (M8, #715, #481): `figcraft-cli mcp --automation-read-root DIR --automation-write-root DIR` (each repeatable, existing folders) and the desktop app with the same flags confine every file a command reads to the read and write roots and every file it writes to the write roots; paths are resolved (links followed, `..`, Windows `\\?\` and UNC paths, case) and compared by whole folder names, anything else is an ordinary error. The engine reaches the file system through one module (enforced by `crates/engine/clippy.toml`), and a sweep runs every command with paths outside the roots. `--attach` refuses the flags (the app confines itself); `ui.screenshot` and `ui.render` return PNG data without a `path`, so the attached MCP server writes no temporary files. Numbers unchanged. |
@@ -6,7 +6,7 @@ cd "$(dirname "${BASH_SOURCE[0]}")/.."
 bash packaging/server/install-test.sh
 if grep -rniE 'photoshop|psd|photocraft|vectorcraft|illustrator|adobe|figma' packaging/ .github/ \
    --exclude=packaging-lint.yml --exclude=check-app-specific.sh; then
-  echo "::error::package metadata mentions another product (see above)"
+  echo "::error::package metadata mentions another product (see above)" >&2
  exit 1
 fi

@@ -24,10 +24,11 @@ workspace_version() {
    /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
    in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
  ' "$ROOT/Cargo.toml"
+  return $?
 }

 VERSION="${FIGCRAFT_VERSION:-$(workspace_version)}"
-if [ -z "$VERSION" ]; then
+if [[ -z "$VERSION" ]]; then
  echo "error: could not read [workspace.package] version from $ROOT/Cargo.toml" >&2
  exit 1
 fi
@@ -37,7 +38,7 @@ DIST="${DIST:-$ROOT/dist/release}"
 mkdir -p "$DIST"
 export DIST

-if [ -z "${FIGCRAFT_BUILD_SHA:-}" ]; then
+if [[ -z "${FIGCRAFT_BUILD_SHA:-}" ]]; then
  FIGCRAFT_BUILD_SHA="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
 fi
 export FIGCRAFT_BUILD_SHA
@@ -47,7 +48,7 @@ export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 # The headless CLI ships next to the app once apps/figcraft-cli exists.
 BINS=(figcraft)
 HAS_CLI=0
-if [ -f "$ROOT/apps/figcraft-cli/Cargo.toml" ]; then
+if [[ -f "$ROOT/apps/figcraft-cli/Cargo.toml" ]]; then
  BINS+=(figcraft-cli)
  HAS_CLI=1
 fi
@@ -58,7 +59,8 @@ unset _bin
 # The binary used for a `--version` smoke test: the CLI when shipped, else the app (which answers
 # --version before opening a window).
 smoke_bin() {
-  if [ "$HAS_CLI" = 1 ]; then echo figcraft-cli; else echo figcraft; fi
+  if [[ "$HAS_CLI" = 1 ]]; then echo figcraft-cli; else echo figcraft; fi
+  return 0
 }

 # Emit a GitHub Actions warning (plain stderr outside Actions).
@@ -68,31 +70,33 @@ retry() {
  local attempt
  for attempt in 1 2 3 4 5; do
    "$@" && return 0
-    [ "$attempt" = 5 ] || { echo "retrying ($attempt/5): $*" >&2; sleep 15; }
+    [[ "$attempt" = 5 ]] || { echo "retrying ($attempt/5): $*" >&2; sleep 15; }
  done
  return 1
 }

 warn() {
-  if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  return 0
 }

 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
  local dest="$1" f
  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE NOTICE COPYRIGHT; do
-    if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
+    if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
  done
  copy_font_licences "$dest"
+  return $?
 }

 # Builds made with craft-fonts (CRAFT_FONTS_DIR, all official releases) embed its fonts, which
 # are OFL-1.1: ship each font's licence as OFL-<family-dir>.txt. No-op without CRAFT_FONTS_DIR.
 copy_font_licences() {
  local dest="$1" lic fam
-  [ -n "${CRAFT_FONTS_DIR:-}" ] || return 0
+  [[ -n "${CRAFT_FONTS_DIR:-}" ]] || return 0
  for lic in "$CRAFT_FONTS_DIR"/fonts/*/OFL.txt; do
-    [ -f "$lic" ] || continue
+    [[ -f "$lic" ]] || continue
    fam="$(basename "$(dirname "$lic")")"
    cp "$lic" "$dest/OFL-$fam.txt"
  done
@@ -100,5 +104,7 @@ copy_font_licences() {

 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
-  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+  local file="$1"
+  if command -v sha256sum >/dev/null; then sha256sum "$file" | cut -d' ' -f1; else shasum -a 256 "$file" | cut -d' ' -f1; fi
+  return $?
 }
@@ -21,7 +21,7 @@ APP_ID=ai.storyteller.figcraft

 SKIP_BUILD=0
 DRY_RUN=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
  case "$1" in
    --skip-build) SKIP_BUILD=1; shift ;;
    --dry-run) DRY_RUN=1; SKIP_BUILD=1; shift ;;
@@ -37,7 +37,7 @@ case "$MACHINE" in
  arm64 | aarch64) ARCH=aarch64 ;;
  *) echo "unsupported architecture $MACHINE" >&2; exit 2 ;;
 esac
-if [ "$DRY_RUN" = 0 ] && [ "$(uname -s)" != FreeBSD ]; then
+if [[ "$DRY_RUN" = 0 ]] && [[ "$(uname -s)" != FreeBSD ]]; then
  echo "error: build on FreeBSD (or pass --dry-run to check the tree layout)" >&2
  exit 2
 fi
@@ -47,7 +47,7 @@ echo "==> FigCraft $VERSION for FreeBSD $ARCH"

 # The release VM has 12 GB; full parallelism on the biggest crates runs it out of memory.
 export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-4}"
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
  (cd "$ROOT" && cargo build --release --locked "${CARGO_PKGS[@]}")
 fi
 WORK="$CARGO_TARGET_DIR/freebsd-package"
@@ -57,7 +57,7 @@ mkdir -p "$WORK"

 BIN="$CARGO_TARGET_DIR/release"
 OUT_DIR="$DIST"
-if [ "$DRY_RUN" = 1 ]; then
+if [[ "$DRY_RUN" = 1 ]]; then
  # Stub binaries, and the tarball stays in the work dir so dist/ only ever holds real builds.
  BIN="$WORK/stub-bin"
  OUT_DIR="$WORK"
@@ -86,12 +86,12 @@ sed -e "s/@VERSION@/$VERSION/g" -e "s/@DATE@/$FIGCRAFT_BUILD_DATE/g" \
  "$LINUX/$APP_ID.metainfo.xml.in" >"$STAGE/share/metainfo/$APP_ID.metainfo.xml"
 cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/share/icons/"
 copy_docs "$STAGE/share/doc/figcraft"
-if [ -f "$ROOT/ATTRIBUTION.md" ]; then install -m 644 "$ROOT/ATTRIBUTION.md" "$STAGE/share/doc/figcraft/"; fi
+if [[ -f "$ROOT/ATTRIBUTION.md" ]]; then install -m 644 "$ROOT/ATTRIBUTION.md" "$STAGE/share/doc/figcraft/"; fi

 for f in "${BINS[@]/#/bin/}" "share/applications/$APP_ID.desktop" \
  "share/icons/hicolor/256x256/apps/$APP_ID.png" \
  share/doc/figcraft/LICENSE-MIT share/doc/figcraft/LICENSE-APACHE; do
-  if [ ! -e "$STAGE/$f" ]; then echo "error: $f is missing from the package" >&2; exit 1; fi
+  if [[ ! -e "$STAGE/$f" ]]; then echo "error: $f is missing from the package" >&2; exit 1; fi
 done

 # ---- .tar.gz ------------------------------------------------------------------------------------
@@ -100,7 +100,7 @@ tar -C "$WORK" -czf "$OUT_DIR/$BASENAME.tar.gz" "$BASENAME"
 echo "wrote $OUT_DIR/$BASENAME.tar.gz"

 "$STAGE/bin/$(smoke_bin)" --version
-if [ "$DRY_RUN" = 1 ]; then
+if [[ "$DRY_RUN" = 1 ]]; then
  echo "==> dry run: tarball contents"
  tar -tzvf "$OUT_DIR/$BASENAME.tar.gz"
 fi
@@ -37,10 +37,10 @@ fail() {

 # 1. Launch works and passes arguments through.
 out="$("$APPDIR/AppRun" open file.png)" || fail "AppRun exited non-zero"
-[ "$out" = "stub: open file.png" ] || fail "arguments not forwarded: $out"
+[[ "$out" = "stub: open file.png" ]] || fail "arguments not forwarded: $out"

 DESKTOP="$XDG_DATA_HOME/applications/$APP_ID.desktop"
-[ -f "$DESKTOP" ] || fail "desktop entry not installed"
+[[ -f "$DESKTOP" ]] || fail "desktop entry not installed"

 # 2. Exec rewritten to the AppImage (quoted, spaces intact), TryExec dropped,
 #    everything else preserved from the packaged entry.
@@ -55,15 +55,15 @@ fi

 # 3. Icons landed under the name the .desktop entry references.
 for f in "16x16/apps/$APP_ID.png" "256x256/apps/$APP_ID.png" "scalable/apps/$APP_ID.svg"; do
-  [ -f "$XDG_DATA_HOME/icons/hicolor/$f" ] || fail "icon missing: $f"
+  [[ -f "$XDG_DATA_HOME/icons/hicolor/$f" ]] || fail "icon missing: $f"
 done

 # 4. Idempotent: a second launch must not rewrite anything (inode unchanged).
 before="$(stat -c %i "$DESKTOP")"
 out="$("$APPDIR/AppRun")" || fail "second launch exited non-zero"
-[ "$out" = "stub: " ] || fail "second launch output: $out"
+[[ "$out" = "stub: " ]] || fail "second launch output: $out"
 after="$(stat -c %i "$DESKTOP")"
-[ "$before" = "$after" ] || fail "desktop entry rewritten although unchanged"
+[[ "$before" = "$after" ]] || fail "desktop entry rewritten although unchanged"

 # 5. Moving the AppImage refreshes Exec.
 mv "$APPIMAGE" "$TMP/moved.AppImage"
@@ -74,40 +74,40 @@ grep -Fxq "Exec=\"$(readlink -f "$APPIMAGE")\" %U" "$DESKTOP" || fail "Exec not
 # 6. Opt-out installs nothing.
 rm -rf "$XDG_DATA_HOME"
 FIGCRAFT_NO_DESKTOP_INTEGRATION=1 "$APPDIR/AppRun" >/dev/null || fail "opt-out launch exited non-zero"
-[ ! -e "$XDG_DATA_HOME" ] || fail "opt-out still integrated"
+[[ ! -e "$XDG_DATA_HOME" ]] || fail "opt-out still integrated"

 # 7. An unwritable data dir never blocks the launch.
 mkdir -p "$TMP/ro" && chmod a-w "$TMP/ro"
 out="$(XDG_DATA_HOME="$TMP/ro/data" "$APPDIR/AppRun" out.txt)" || fail "launch blocked by unwritable data dir"
-[ "$out" = "stub: out.txt" ] || fail "stub not run against unwritable data dir: $out"
+[[ "$out" = "stub: out.txt" ]] || fail "stub not run against unwritable data dir: $out"
 chmod u+w "$TMP/ro"

 # 8. No $APPIMAGE (extracted AppDir): launch only, nothing installed.
 rm -rf "$XDG_DATA_HOME"
 env -u APPIMAGE "$APPDIR/AppRun" >/dev/null || fail "extracted-AppDir launch exited non-zero"
-[ ! -e "$XDG_DATA_HOME" ] || fail "integrated without $APPIMAGE"
+[[ ! -e "$XDG_DATA_HOME" ]] || fail "integrated without $APPIMAGE"

 # 9. A path that would need Exec escaping (here a `$`): launch only, nothing installed.
 rm -rf "$XDG_DATA_HOME"
 odd="$TMP/odd\$(id).AppImage"
 : >"$odd"
 out="$(APPIMAGE="$odd" "$APPDIR/AppRun" x)" || fail "launch with an odd path exited non-zero"
-[ "$out" = "stub: x" ] || fail "odd path: $out"
-[ ! -e "$XDG_DATA_HOME" ] || fail "integrated an AppImage path that needs escaping"
+[[ "$out" = "stub: x" ]] || fail "odd path: $out"
+[[ ! -e "$XDG_DATA_HOME" ]] || fail "integrated an AppImage path that needs escaping"

 # 10. `cli <args>` runs figcraft-cli with the remaining arguments and integrates nothing.
 rm -rf "$XDG_DATA_HOME"
 out="$("$APPDIR/AppRun" cli mcp --attach 7979 2>&1)" && fail "cli ran without figcraft-cli in the AppDir"
-[ "$out" = "figcraft: this AppImage was built without figcraft-cli" ] || fail "missing cli: $out"
+[[ "$out" = "figcraft: this AppImage was built without figcraft-cli" ]] || fail "missing cli: $out"
 printf '#!/bin/sh\necho "cli stub: $*"\n' >"$APPDIR/usr/bin/figcraft-cli"
 chmod +x "$APPDIR/usr/bin/figcraft-cli"
 out="$("$APPDIR/AppRun" cli mcp --attach 7979)" || fail "cli launch exited non-zero"
-[ "$out" = "cli stub: mcp --attach 7979" ] || fail "cli arguments not forwarded: $out"
+[[ "$out" = "cli stub: mcp --attach 7979" ]] || fail "cli arguments not forwarded: $out"
 out="$("$APPDIR/AppRun" cli)" || fail "bare cli launch exited non-zero"
-[ "$out" = "cli stub: " ] || fail "bare cli output: $out"
-[ ! -e "$XDG_DATA_HOME" ] || fail "cli launch integrated the desktop"
+[[ "$out" = "cli stub: " ]] || fail "bare cli output: $out"
+[[ ! -e "$XDG_DATA_HOME" ]] || fail "cli launch integrated the desktop"
 # Only the first argument selects the CLI.
 out="$("$APPDIR/AppRun" file.figcraft cli)" || fail "app launch with a later cli argument exited non-zero"
-[ "$out" = "stub: file.figcraft cli" ] || fail "later cli argument hijacked the launch: $out"
+[[ "$out" = "stub: file.figcraft cli" ]] || fail "later cli argument hijacked the launch: $out"

 echo "AppRun desktop integration ok"
@@ -22,7 +22,7 @@ FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo

 TEST=1
 TARBALL=""
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
  case "$1" in
    --no-test) TEST=0; shift ;;
    -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
@@ -39,7 +39,7 @@ case "$ARCH" in
 esac
 BASENAME="figcraft-$VERSION-linux-$ARCH"
 TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}"
-[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
+[[ -f "$TARBALL" ]] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; }
 for tool in flatpak flatpak-builder; do
  command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; }
 done
@@ -50,7 +50,7 @@ WORK="$CARGO_TARGET_DIR/flatpak-bundle"
 rm -rf "$WORK"
 mkdir -p "$WORK/stage"
 tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1
-[ -x "$WORK/stage/bin/figcraft" ] || { echo "error: $TARBALL has no bin/figcraft" >&2; exit 1; }
+[[ -x "$WORK/stage/bin/figcraft" ]] || { echo "error: $TARBALL has no bin/figcraft" >&2; exit 1; }
 cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml"

 flatpak remote-add --user --if-not-exists flathub "$FLATHUB"
@@ -63,10 +63,10 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"

-if [ "$TEST" = 1 ]; then
+if [[ "$TEST" = 1 ]]; then
  flatpak install --user -y --noninteractive --reinstall "$OUT"
  flatpak info --user "$APP_ID"
-  if [ -x "$WORK/stage/bin/figcraft-cli" ]; then smoke=figcraft-cli; else smoke=figcraft; fi
+  if [[ -x "$WORK/stage/bin/figcraft-cli" ]]; then smoke=figcraft-cli; else smoke=figcraft; fi
  flatpak run --command="$smoke" "$APP_ID" --version
  flatpak run --command=sh "$APP_ID" -c 'ls /app/share/applications /app/share/metainfo /app/share/mime/packages /app/share/icons/hicolor/256x256/apps'
 fi
@@ -27,7 +27,7 @@ APP_ID=ai.storyteller.figcraft

 SKIP_BUILD=0
 FORMATS="appimage deb rpm tar"
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
  case "$1" in
    --skip-build) SKIP_BUILD=1; shift ;;
    --formats) FORMATS="$2"; shift 2 ;;
@@ -48,7 +48,7 @@ BASENAME="figcraft-$VERSION-linux-$ARCH"

 echo "==> FigCraft $VERSION for Linux $ARCH ($FORMATS; ${BINS[*]})"

-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
  (cd "$ROOT" && cargo build --release --locked "${CARGO_PKGS[@]}" ${CROSS_TARGET:+--target "$CROSS_TARGET"})
 fi
 BIN="$CARGO_TARGET_DIR/${CROSS_TARGET:+$CROSS_TARGET/}release"
@@ -78,7 +78,7 @@ if command -v appstreamcli >/dev/null; then
  appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
 fi

-has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+has() { local format="$1"; case " $FORMATS " in *" $format "*) return 0 ;; *) return 1 ;; esac; }

 # ---- .tar.gz ------------------------------------------------------------------------------------
 if has tar; then
@@ -96,7 +96,7 @@ if has deb || has rpm; then
  # nfpm expands env vars in fields like `version` and `arch`, but not in `contents[].src`.
  # Without the CLI, drop its `#cli` lines.
  cli_filter='/#cli$/d'
-  [ "$HAS_CLI" = 1 ] && cli_filter='s/ #cli$//'
+  [[ "$HAS_CLI" = 1 ]] && cli_filter='s/ #cli$//'
  sed -e "s|\${STAGE}|$STAGE|g" -e "$cli_filter" "$HERE/nfpm.yaml" >"$WORK/nfpm.yaml"
  for fmt in deb rpm; do
    if has "$fmt"; then (cd "$ROOT" && nfpm package -f "$WORK/nfpm.yaml" -p "$fmt" -t "$DIST/$BASENAME.$fmt"); fi
@@ -105,6 +105,23 @@ fi

 # ---- AppImage -----------------------------------------------------------------------------------
 if has appimage; then
+  APPIMAGETOOL_VERSION=1.9.1
+  case "$ARCH" in
+    x86_64) APPIMAGETOOL_SHA256=ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0 ;;
+    aarch64) APPIMAGETOOL_SHA256=f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158 ;;
+    *) APPIMAGETOOL_SHA256='' ;;
+  esac
+  # appimagetool otherwise fetches the unpinned type2-runtime `continuous` build and embeds it.
+  APPIMAGE_RUNTIME_VERSION=20251108
+  case "$ARCH" in
+    x86_64) APPIMAGE_RUNTIME_SHA256=2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d ;;
+    aarch64) APPIMAGE_RUNTIME_SHA256=00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444 ;;
+    *) APPIMAGE_RUNTIME_SHA256='' ;;
+  esac
+  if [[ -z "$APPIMAGE_RUNTIME_SHA256" ]]; then
+    echo "no pinned AppImage runtime for $ARCH; build the AppImage on x86_64 or aarch64" >&2
+    exit 2
+  fi
  APPDIR="$WORK/FigCraft.AppDir"
  cp -R "$STAGE" "$APPDIR"
  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
@@ -118,18 +135,37 @@ if has appimage; then
  ln -s "$APP_ID.png" "$APPDIR/.DirIcon"

  TOOL="${APPIMAGETOOL:-$(command -v appimagetool || true)}"
-  if [ -z "$TOOL" ]; then
-    TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
-    if [ ! -x "$TOOL" ]; then
-      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
-      chmod +x "$TOOL"
+  if [[ -z "$TOOL" ]]; then
+    if [[ -z "$APPIMAGETOOL_SHA256" ]]; then
+      echo "no pinned appimagetool for $ARCH; set APPIMAGETOOL or put appimagetool on PATH" >&2
+      exit 2
    fi
+    TOOL="$CARGO_TARGET_DIR/appimagetool-$APPIMAGETOOL_VERSION-$ARCH.AppImage"
+    if [[ ! -x "$TOOL" ]]; then
+      download="$TOOL.download"
+      curl --proto '=https' -fsSL -o "$download" \
+        "https://github.com/AppImage/appimagetool/releases/download/$APPIMAGETOOL_VERSION/appimagetool-$ARCH.AppImage"
+      printf '%s  %s\n' "$APPIMAGETOOL_SHA256" "$download" | sha256sum -c -
+      chmod 755 "$download"
+      mv "$download" "$TOOL"
+    fi
+    printf '%s  %s\n' "$APPIMAGETOOL_SHA256" "$TOOL" | sha256sum -c -
  fi
+  RUNTIME="$CARGO_TARGET_DIR/appimage-runtime-$APPIMAGE_RUNTIME_VERSION-$ARCH"
+  if [[ ! -f "$RUNTIME" ]]; then
+    download="$RUNTIME.download"
+    curl --proto '=https' -fsSL -o "$download" \
+      "https://github.com/AppImage/type2-runtime/releases/download/$APPIMAGE_RUNTIME_VERSION/runtime-$ARCH"
+    printf '%s  %s\n' "$APPIMAGE_RUNTIME_SHA256" "$download" | sha256sum -c -
+    mv "$download" "$RUNTIME"
+  fi
+  printf '%s  %s\n' "$APPIMAGE_RUNTIME_SHA256" "$RUNTIME" | sha256sum -c -
  # Absolute, because appimagetool runs in $DIST below (CARGO_TARGET_DIR or APPIMAGETOOL may be
  # relative, e.g. target/agent-<name>).
  OUT="$(cd "$DIST" && pwd)/$BASENAME.AppImage"
  APPDIR="$(cd "$APPDIR" && pwd)"
  TOOL="$(cd "$(dirname "$TOOL")" && pwd)/$(basename "$TOOL")"
+  RUNTIME="$(cd "$(dirname "$RUNTIME")" && pwd)/$(basename "$RUNTIME")"
  # A .zsync left by an earlier run would hide a missing zsyncmake and describe another file.
  rm -f "$OUT.zsync"
  # Update information: AppImageUpdate, AppImageLauncher and the like read it from the
@@ -141,18 +177,18 @@ if has appimage; then
  # Extract-and-run: works without FUSE (containers, CI). The output embeds the static runtime,
  # so users don't need libfuse2 either. With zsyncmake on the host (CI installs the zsync
  # package) appimagetool also writes the .zsync, into its working directory, hence the cd.
-  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT")
+  (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream --runtime-file "$RUNTIME" -u "$UPDATE_INFO" "$APPDIR" "$OUT")
  echo "wrote $OUT"
-  if [ -s "$OUT.zsync" ]; then
+  if [[ -s "$OUT.zsync" ]]; then
    echo "wrote $OUT.zsync"
  else
    warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it"
  fi
 fi

-if [ -z "${CROSS_TARGET:-}" ]; then
+if [[ -z "${CROSS_TARGET:-}" ]]; then
  "$STAGE/usr/bin/$(smoke_bin)" --version
-elif [ -n "${EMULATOR:-}" ]; then
+elif [[ -n "${EMULATOR:-}" ]]; then
  "$EMULATOR" "$STAGE/usr/bin/$(smoke_bin)" --version
 fi
 echo "==> done"
@@ -12,7 +12,7 @@ umask 077
 # shellcheck source=../env.sh
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"

-if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
  warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
  exit 0
 fi
@@ -36,13 +36,13 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS"
 security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')

 IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
-if [ -z "$IDENTITY" ]; then
+if [[ -z "$IDENTITY" ]]; then
  security find-identity -v -p codesigning "$KEYCHAIN" >&2
  echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
  exit 1
 fi
 echo "Imported signing identity $IDENTITY"
-if [ -n "${GITHUB_ENV:-}" ]; then
+if [[ -n "${GITHUB_ENV:-}" ]]; then
  { echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
 else
  echo "MACOS_SIGN_IDENTITY=$IDENTITY"
@@ -19,7 +19,7 @@ HERE="$ROOT/packaging/macos"

 ARCH=universal
 SKIP_BUILD=0
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
  case "$1" in
    --arch) ARCH="$2"; shift 2 ;;
    --skip-build) SKIP_BUILD=1; shift ;;
@@ -44,9 +44,9 @@ DMG="$DIST/figcraft-$VERSION-macos-$ARCH.dmg"
 CLI_ZIP="$DIST/figcraft-cli-$VERSION-macos-$ARCH.zip"

 NOTARIZE=0
-if [ "$IDENTITY" = "-" ]; then
+if [[ "$IDENTITY" = "-" ]]; then
  warn "macOS: ad-hoc signing (no MACOS_SIGN_IDENTITY); artifacts are not notarized"
-elif [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+elif [[ -n "${APPLE_ID:-}" ]] && [[ -n "${APPLE_PASSWORD:-}" ]] && [[ -n "${APPLE_TEAM_ID:-}" ]]; then
  NOTARIZE=1
 else
  warn "macOS: APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID incomplete; signed but not notarized"
@@ -55,7 +55,7 @@ fi
 echo "==> FigCraft $VERSION for macOS ($ARCH; ${BINS[*]}), identity: $IDENTITY, notarize: $NOTARIZE"

 # ---- build -------------------------------------------------------------------------------------
-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
  args=()
  for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
  (cd "$ROOT" && cargo build --release --locked "${CARGO_PKGS[@]}" "${args[@]}")
@@ -74,9 +74,9 @@ done
 sign() {
  # Hardened runtime + secure timestamp for a real identity; ad-hoc can't be timestamped.
  local ts=(--timestamp)
-  [ "$IDENTITY" = "-" ] && ts=(--timestamp=none)
+  [[ "$IDENTITY" = "-" ]] && ts=(--timestamp=none)
  local kc=()
-  [ -n "${MACOS_KEYCHAIN:-}" ] && kc=(--keychain "$MACOS_KEYCHAIN")
+  [[ -n "${MACOS_KEYCHAIN:-}" ]] && kc=(--keychain "$MACOS_KEYCHAIN")
  codesign --force --sign "$IDENTITY" ${kc[@]+"${kc[@]}"} "${ts[@]}" "$@"
 }

@@ -88,8 +88,8 @@ notarize() {
  echo "$out"
  id="$(printf '%s' "$out" | plutil -extract id raw -o - - 2>/dev/null || true)"
  status="$(printf '%s' "$out" | plutil -extract status raw -o - - 2>/dev/null || true)"
-  if [ "$status" != "Accepted" ]; then
-    if [ -n "$id" ]; then
+  if [[ "$status" != "Accepted" ]]; then
+    if [[ -n "$id" ]]; then
      xcrun notarytool log "$id" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" || true
    fi
    echo "error: notarization of $(basename "$file") failed (status: ${status:-unknown})" >&2
@@ -116,7 +116,7 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 cp "$WORK/bin/figcraft" "$APP/Contents/MacOS/FigCraft"
 cp "$WORK/FigCraft.icns" "$APP/Contents/Resources/FigCraft.icns"
 # Licences of the embedded craft-fonts fonts (only when built with CRAFT_FONTS_DIR).
-if [ -n "${CRAFT_FONTS_DIR:-}" ]; then
+if [[ -n "${CRAFT_FONTS_DIR:-}" ]]; then
  mkdir -p "$APP/Contents/Resources/Licenses"
  copy_font_licences "$APP/Contents/Resources/Licenses"
 fi
@@ -132,7 +132,7 @@ sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/
 sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP"
 codesign --verify --strict --deep --verbose=2 "$APP"

-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
  ditto -c -k --keepParent "$APP" "$WORK/FigCraft-notarize.zip"
  notarize "$WORK/FigCraft-notarize.zip"
  retry xcrun stapler staple "$APP"
@@ -154,7 +154,7 @@ hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
 rm -f "$WORK/raw.dmg"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
-if [ "$NOTARIZE" = 1 ]; then
+if [[ "$NOTARIZE" = 1 ]]; then
  notarize "$DMG"
  retry xcrun stapler staple "$DMG"
  retry xcrun stapler validate "$DMG"
@@ -162,7 +162,7 @@ if [ "$NOTARIZE" = 1 ]; then
 fi

 # ---- CLI ---------------------------------------------------------------------------------------
-if [ "$HAS_CLI" = 1 ]; then
+if [[ "$HAS_CLI" = 1 ]]; then
  echo "==> building $CLI_ZIP"
  CLI_DIR="$WORK/figcraft-cli-$VERSION-macos-$ARCH"
  mkdir -p "$CLI_DIR"
@@ -176,7 +176,7 @@ if [ "$HAS_CLI" = 1 ]; then
  ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"
  # notarytool accepts a zip of the bare binary. A bare Mach-O can't carry a stapled ticket, so
  # Gatekeeper looks the notarization up online when a quarantined copy first runs.
-  if [ "$NOTARIZE" = 1 ]; then notarize "$CLI_ZIP"; fi
+  if [[ "$NOTARIZE" = 1 ]]; then notarize "$CLI_ZIP"; fi
  "$WORK/bin/figcraft-cli" --version
 else
  warn "apps/figcraft-cli is not in this workspace: no CLI zip"
@@ -23,7 +23,7 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"

 ARCH=universal
-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
  case "$1" in
    --arch) ARCH="$2"; shift 2 ;;
    -h | --help) sed -n '2,20p' "$0"; exit 0 ;;
@@ -41,13 +41,13 @@ DMG="$DIST/figcraft-$VERSION-macos-$ARCH.dmg"
 CLI_ZIP="$DIST/figcraft-cli-$VERSION-macos-$ARCH.zip"
 IDENTITY="${MACOS_SIGN_IDENTITY:--}"
 STRICT=0
-if [ "$IDENTITY" != "-" ] && [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+if [[ "$IDENTITY" != "-" ]] && [[ -n "${APPLE_ID:-}" ]] && [[ -n "${APPLE_PASSWORD:-}" ]] && [[ -n "${APPLE_TEAM_ID:-}" ]]; then
  STRICT=1
 fi

 FAILED=0
 fail() {
-  if [ "$STRICT" = 1 ]; then
+  if [[ "$STRICT" = 1 ]]; then
    echo "error: $*" >&2
    FAILED=1
  else
@@ -58,22 +58,22 @@ fail() {
 # spctl's online ticket lookup can lag a few seconds behind notarytool's "Accepted".
 assess() {
  local out attempt tries=1
-  [ "$STRICT" = 1 ] && tries=5
+  [[ "$STRICT" = 1 ]] && tries=5
  for attempt in $(seq "$tries"); do
    if out="$(spctl "$@" 2>&1)"; then
      printf '%s\n' "$out"
      return 0
    fi
-    [ "$attempt" = "$tries" ] || sleep 10
+    [[ "$attempt" = "$tries" ]] || sleep 10
  done
  printf '%s\n' "$out"
  return 1
 }

 FILES=("$DMG")
-if [ "$HAS_CLI" = 1 ]; then FILES+=("$CLI_ZIP"); fi
+if [[ "$HAS_CLI" = 1 ]]; then FILES+=("$CLI_ZIP"); fi
 for f in "${FILES[@]}"; do
-  if [ ! -f "$f" ]; then
+  if [[ ! -f "$f" ]]; then
    echo "error: missing $f" >&2
    exit 1
  fi
@@ -83,11 +83,11 @@ WORK="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/figcraft-verify.XXXXXX")"
 trap 'rm -rf "$WORK"' EXIT

 # ---- CLI zip (when apps/figcraft-cli exists) ----------------------------------------------------
-if [ "$HAS_CLI" = 1 ]; then
+if [[ "$HAS_CLI" = 1 ]]; then
  echo "==> $(basename "$CLI_ZIP")"
  ditto -x -k "$CLI_ZIP" "$WORK/cli"
  CLI="$WORK/cli/figcraft-cli-$VERSION-macos-$ARCH/figcraft-cli"
-  if [ ! -x "$CLI" ]; then
+  if [[ ! -x "$CLI" ]]; then
    echo "error: $(basename "$CLI_ZIP") has no executable figcraft-cli-$VERSION-macos-$ARCH/figcraft-cli" >&2
    exit 1
  fi
@@ -111,7 +111,7 @@ if [ "$HAS_CLI" = 1 ]; then
    || fail "figcraft-cli is not signed with a Developer ID Application identity"
  printf '%s\n' "$details" | grep -q '^Timestamp=' \
    || fail "figcraft-cli signature has no secure timestamp"
-  if [ -n "${APPLE_TEAM_ID:-}" ]; then
+  if [[ -n "${APPLE_TEAM_ID:-}" ]]; then
    printf '%s\n' "$details" | grep -qx "TeamIdentifier=$APPLE_TEAM_ID" \
      || fail "figcraft-cli is signed by a different team"
  fi
@@ -129,25 +129,25 @@ fi
 # ---- DMG ---------------------------------------------------------------------------------------
 echo "==> $(basename "$DMG")"
 codesign --verify --strict --verbose=2 "$DMG"
-if [ "$STRICT" = 1 ]; then
+if [[ "$STRICT" = 1 ]]; then
  retry xcrun stapler validate "$DMG" || fail "no notarization ticket stapled to the DMG"
  assess --assess --type open --context context:primary-signature -vv "$DMG" \
    || fail "Gatekeeper rejects the DMG"
 fi

-if [ "$FAILED" != 0 ]; then
+if [[ "$FAILED" != 0 ]]; then
  echo "error: macOS artifacts failed verification" >&2
  exit 1
 fi

-if [ "$STRICT" = 1 ]; then
+if [[ "$STRICT" = 1 ]]; then
  result="signed (Developer ID, hardened runtime), notarized; DMG stapled"
 else
  result="signature intact; Developer ID and notarization not required (no signing secrets)"
 fi
 echo "==> verified: $result"
-if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
  names="\`$(basename "$DMG")\`"
-  if [ "$HAS_CLI" = 1 ]; then names="$names, \`$(basename "$CLI_ZIP")\`"; fi
+  if [[ "$HAS_CLI" = 1 ]]; then names="$names, \`$(basename "$CLI_ZIP")\`"; fi
  echo "- macOS $names: $result" >>"$GITHUB_STEP_SUMMARY"
 fi
@@ -10,7 +10,7 @@ WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 FAILED=0

-main() { bash "$HERE/install.sh" --caddy-main "$1" ops@example.com; }
+main() { local caddyfile="$1"; bash "$HERE/install.sh" --caddy-main "$caddyfile" ops@example.com; }
 fail() { printf 'FAIL: %s\n' "$*" >&2; FAILED=1; }

 # Missing: ours.
@@ -28,7 +28,7 @@ printf 'shop.example.com {\n\treverse_proxy 127.0.0.1:8080\n}\n' >"$WORK/theirs"
 cp "$WORK/theirs" "$WORK/run1"
 main "$WORK/run1" >"$WORK/run2"
 grep -q 'shop.example.com' "$WORK/run2" || fail "the operator's site is kept"
-[ "$(grep -c 'import figcraft-server.caddy' "$WORK/run2")" = 1 ] || fail "one import line is added"
+[[ "$(grep -c 'import figcraft-server.caddy' "$WORK/run2")" = 1 ]] || fail "one import line is added"
 main "$WORK/run2" >"$WORK/run3"
 cmp -s "$WORK/run2" "$WORK/run3" || fail "running again leaves a Caddyfile with other sites as it is"
 main "$WORK/run3" >"$WORK/run4"
@@ -39,5 +39,5 @@ main "$WORK/none" >"$WORK/ours1"
 main "$WORK/ours1" >"$WORK/ours2"
 cmp -s "$WORK/ours1" "$WORK/ours2" || fail "our own Caddyfile stays the same"

-if [ "$FAILED" = 0 ]; then echo "install.sh Caddyfile handling: ok"; fi
+if [[ "$FAILED" = 0 ]]; then echo "install.sh Caddyfile handling: ok"; fi
 exit "$FAILED"
@@ -41,7 +41,7 @@ SERVICE=figcraft-server
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # The source tree this script sits in (packaging/server/ of a copy or checkout), if any.
 LOCAL_SRC=""
-if [ -f "$HERE/../../Cargo.toml" ] && [ -d "$HERE/../../apps/figcraft-server" ]; then
+if [[ -f "$HERE/../../Cargo.toml" ]] && [[ -d "$HERE/../../apps/figcraft-server" ]]; then
  LOCAL_SRC="$(cd "$HERE/../.." && pwd)"
 fi

@@ -64,9 +64,9 @@ MARK="# figcraft-server (install.sh)"

 caddy_main() { # caddy_main FILE EMAIL: the main Caddyfile to install, on stdout
  local file="$1" email="$2"
-  if [ -f "$file" ] && grep -qE '^[[:space:]]*import[[:space:]]+figcraft-server\.caddy[[:space:]]*$' "$file"; then
+  if [[ -f "$file" ]] && grep -qE '^[[:space:]]*import[[:space:]]+figcraft-server\.caddy[[:space:]]*$' "$file"; then
    cat "$file" # it imports our site already: kept exactly as it is
-  elif [ ! -f "$file" ] || ! grep -qvE '^[[:space:]]*(#|$|:80|\{|\}|root|file_server)' "$file"; then
+  elif [[ ! -f "$file" ]] || ! grep -qvE '^[[:space:]]*(#|$|:80|\{|\}|root|file_server)' "$file"; then
    # Missing, or only the example site the package ships: ours, with the certificate email.
    printf '%s\n{\n\temail %s\n}\n\nimport figcraft-server.caddy\n' "$MARK" "$email"
  else
@@ -76,7 +76,7 @@ caddy_main() { # caddy_main FILE EMAIL: the main Caddyfile to install, on stdout
  fi
 }

-while [ $# -gt 0 ]; do
+while [[ $# -gt 0 ]]; do
  case "$1" in
    # For tests (packaging/server/install-test.sh): print the Caddyfile this script would write.
    --caddy-main) caddy_main "${2:-}" "${3:-}"; exit 0 ;;
@@ -95,7 +95,7 @@ while [ $# -gt 0 ]; do
  esac
 done

-[ "$(id -u)" -eq 0 ] || die "run it as root (sudo ./install.sh ...)"
+[[ "$(id -u)" -eq 0 ]] || die "run it as root (sudo ./install.sh ...)"
 # shellcheck source=/dev/null
 . /etc/os-release
 case " ${ID:-} ${ID_LIKE:-} " in
@@ -104,9 +104,9 @@ case " ${ID:-} ${ID_LIKE:-} " in
 esac

 ask() { # ask VAR "question" FLAG: read an answer from the terminal when the value wasn't given
-  local var="$1" question="$2" answer
-  if [ -z "${!var}" ]; then
-    [ -t 0 ] || die "give $3 (no terminal to ask on)"
+  local var="$1" question="$2" flag="$3" answer
+  if [[ -z "${!var}" ]]; then
+    [[ -t 0 ]] || die "give $flag (no terminal to ask on)"
    read -r -p "$question " answer
    printf -v "$var" '%s' "$answer"
  fi
@@ -115,6 +115,7 @@ ask HOST "DNS name people will use (e.g. figcraft.example.com):" "--host"
 ask EMAIL "Email for Let's Encrypt and the abuse contact shown to users:" "--email"
 case "$HOST" in
  "" | *[!A-Za-z0-9.-]* | .* | *. ) die "--host must be a DNS name like figcraft.example.com" ;;
+  *) ;;
 esac
 case "$EMAIL" in
  *@*.*) ;;
@@ -126,6 +127,7 @@ case "$TERMS" in
 esac
 case "$EMAIL$TERMS" in
  *[[:space:]\"\\]*) die "--email and --terms can't contain spaces, quotes or backslashes" ;;
+  *) ;;
 esac

 export DEBIAN_FRONTEND=noninteractive
@@ -138,6 +140,7 @@ ARCH="$(uname -m)"
 case "$ARCH" in
  amd64) ARCH=x86_64 ;;
  arm64) ARCH=aarch64 ;;
+  *) ;; # already a release name (x86_64, aarch64)
 esac

 # --- The binary -----------------------------------------------------------------------------
@@ -146,17 +149,17 @@ FILES="$HERE" # where the units and the Caddyfile come from

 from_release() { # download and check the release archive; sets NEW_BIN and FILES
  local version="$VERSION" name dir
-  if [ -z "$version" ]; then
-    version="$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' | head -n 1)" || return 1
-    [ -n "$version" ] || return 1
+  if [[ -z "$version" ]]; then
+    version="$(curl --proto '=https' -fsSL "https://api.github.com/repos/$REPO/releases/latest" | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' | head -n 1)" || return 1
+    [[ -n "$version" ]] || return 1
  fi
  name="figcraft-server-$version-linux-$ARCH"
  dir="$WORK/release"
  rm -rf "$dir"
  mkdir -p "$dir"
  say "Downloading $name"
-  curl -fsSL -o "$dir/$name.tar.gz" "https://github.com/$REPO/releases/download/v$version/$name.tar.gz" || return 1
-  curl -fsSL -o "$dir/SHA256SUMS.txt" "https://github.com/$REPO/releases/download/v$version/SHA256SUMS.txt" || return 1
+  curl --proto '=https' -fsSL -o "$dir/$name.tar.gz" "https://github.com/$REPO/releases/download/v$version/$name.tar.gz" || return 1
+  curl --proto '=https' -fsSL -o "$dir/SHA256SUMS.txt" "https://github.com/$REPO/releases/download/v$version/SHA256SUMS.txt" || return 1
  (cd "$dir" && grep " $name.tar.gz\$" SHA256SUMS.txt | sha256sum -c --quiet -) || die "the download doesn't match SHA256SUMS.txt"
  tar -C "$dir" -xzf "$dir/$name.tar.gz"
  NEW_BIN="$dir/$name/figcraft-server"
@@ -165,7 +168,7 @@ from_release() { # download and check the release archive; sets NEW_BIN and FILE

 SWAP=""
 cleanup() {
-  if [ -n "$SWAP" ]; then
+  if [[ -n "$SWAP" ]]; then
    swapoff "$SWAP" 2>/dev/null || true
    rm -f "$SWAP"
  fi
@@ -174,7 +177,7 @@ trap cleanup EXIT

 as_builder() { # run a command as the unprivileged build user, with its own toolchain
  local jobs=()
-  if [ -n "${CARGO_BUILD_JOBS:-}" ]; then jobs=("CARGO_BUILD_JOBS=$CARGO_BUILD_JOBS"); fi
+  if [[ -n "${CARGO_BUILD_JOBS:-}" ]]; then jobs=("CARGO_BUILD_JOBS=$CARGO_BUILD_JOBS"); fi
  runuser -u "$BUILDER" -- env HOME="$BUILD" RUSTUP_HOME="$BUILD/rustup" CARGO_HOME="$BUILD/cargo" \
    CARGO_TARGET_DIR="$BUILD/target" "${jobs[@]}" "$@"
 }
@@ -184,27 +187,27 @@ from_source() { # build the source tree around this script, else a fresh clone;
  apt-get install -y -qq build-essential git pkg-config >/dev/null
  id -u "$BUILDER" >/dev/null 2>&1 || useradd --system --home-dir "$BUILD" --shell /usr/sbin/nologin "$BUILDER"
  install -d -o "$BUILDER" -g "$BUILDER" -m 755 "$BUILD"
-  if [ ! -x "$BUILD/cargo/bin/cargo" ]; then
+  if [[ ! -x "$BUILD/cargo/bin/cargo" ]]; then
    as_builder sh -c "curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable --no-modify-path" >/dev/null
  else
    as_builder "$BUILD/cargo/bin/rustup" update stable >/dev/null
  fi
  # The source root installs files from is root's own (the copy beside this script, or root's
  # clone); the build user only ever builds a copy of it.
-  if [ -n "$LOCAL_SRC" ]; then
+  if [[ -n "$LOCAL_SRC" ]]; then
    src="$LOCAL_SRC"
    say "Building the source in $LOCAL_SRC: this takes a while"
  else
    src="$WORK/src"
-    if [ -d "$src/.git" ]; then
+    if [[ -d "$src/.git" ]]; then
      git -C "$src" fetch --quiet --tags origin
    else
      git clone --quiet "https://github.com/$REPO" "$src" ||
        die "can't clone $REPO (a private repository: copy the source to this machine and run its packaging/server/install.sh)"
    fi
-    if [ -z "$ref" ]; then
-      if [ -n "$VERSION" ]; then ref="v$VERSION"; else ref="$(git -C "$src" tag --list 'v*' --sort=-v:refname | head -n 1)"; fi
-      [ -n "$ref" ] || ref=main
+    if [[ -z "$ref" ]]; then
+      if [[ -n "$VERSION" ]]; then ref="v$VERSION"; else ref="$(git -C "$src" tag --list 'v*' --sort=-v:refname | head -n 1)"; fi
+      [[ -n "$ref" ]] || ref=main
    fi
    say "Building $ref from a clone: this takes a while"
    # A branch as it is upstream now, or a tag.
@@ -216,7 +219,7 @@ from_source() { # build the source tree around this script, else a fresh clone;
  tar -C "$src" --exclude=./target --exclude=./plugins/target --exclude=./.git -cf - . | as_builder tar -C "$copy" -xf -
  # The compiler needs about 2 GB: add a temporary swap file on smaller machines.
  mem_kb="$(awk '/^MemTotal:/ {print $2}' /proc/meminfo)"
-  if [ "$mem_kb" -lt 2000000 ] && [ -z "$(swapon --show --noheadings)" ]; then
+  if [[ "$mem_kb" -lt 2000000 ]] && [[ -z "$(swapon --show --noheadings)" ]]; then
    SWAP="$WORK/swapfile"
    say "Adding a temporary 2 GB swap file for the build"
    fallocate -l 2G "$SWAP" 2>/dev/null || dd if=/dev/zero of="$SWAP" bs=1M count=2048 status=none
@@ -237,19 +240,19 @@ from_source() { # build the source tree around this script, else a fresh clone;
  FILES="$src/packaging/server"
 }

-if [ -x "$HERE/figcraft-server" ] && [ "$FROM_SOURCE" = false ]; then
+if [[ -x "$HERE/figcraft-server" ]] && [[ "$FROM_SOURCE" = false ]]; then
  NEW_BIN="$HERE/figcraft-server" # run from an unpacked release archive
-elif [ -n "$LOCAL_SRC" ] && [ -z "$VERSION" ]; then
+elif [[ -n "$LOCAL_SRC" ]] && [[ -z "$VERSION" ]]; then
  from_source # the source copied to (or checked out on) this machine, as it is
-elif [ "$FROM_SOURCE" = true ] || ! from_release; then
-  [ "$FROM_SOURCE" = true ] || say "No release archive for linux-$ARCH: building from source instead"
+elif [[ "$FROM_SOURCE" = true ]] || ! from_release; then
+  [[ "$FROM_SOURCE" = true ]] || say "No release archive for linux-$ARCH: building from source instead"
  from_source
 fi
-[ -x "$NEW_BIN" ] || die "no figcraft-server binary to install"
+[[ -x "$NEW_BIN" ]] || die "no figcraft-server binary to install"
 # The units and the Caddyfile beside this script when it has them (a checkout or an archive).
-[ -f "$HERE/figcraft-backup.timer" ] && FILES="$HERE"
+[[ -f "$HERE/figcraft-backup.timer" ]] && FILES="$HERE"
 for f in figcraft-server.service Caddyfile figcraft-backup.service figcraft-backup.timer; do
-  [ -f "$FILES/$f" ] || die "$FILES/$f is missing"
+  [[ -f "$FILES/$f" ]] || die "$FILES/$f is missing"
 done

 # The server's own account runs the binary, from here on too (root never runs what was built).
@@ -267,7 +270,7 @@ fi
 # --- Data and settings ----------------------------------------------------------------------
 install -d -o figcraft -g figcraft -m 700 "$DATA"
 install -d -m 755 "$CONFIG_DIR"
-if [ ! -f "$CONFIG" ]; then
+if [[ ! -f "$CONFIG" ]]; then
  say "Writing $CONFIG"
  {
    printf '# figcraft-server settings (docs/server.md, "Configuration"). install.sh never overwrites this file.\n'
@@ -303,8 +306,9 @@ as_server "$BIN" --config "$CONFIG" check >/dev/null ||
  die "$CONFIG isn't right for this figcraft-server (see above; a release older than open hosting needs --from-source)"

 install_file() { # install_file SOURCE TARGET MODE: true when it changed
-  if cmp -s "$1" "$2"; then return 1; fi
-  install -m "$3" "$1" "$2"
+  local source="$1" target="$2" mode="$3"
+  if cmp -s "$source" "$target"; then return 1; fi
+  install -m "$mode" "$source" "$target"
 }

 # --- systemd --------------------------------------------------------------------------------
@@ -312,16 +316,16 @@ UNITS=false
 install_file "$FILES/figcraft-server.service" /etc/systemd/system/figcraft-server.service 644 && UNITS=true
 install_file "$FILES/figcraft-backup.service" /etc/systemd/system/figcraft-backup.service 644 && UNITS=true
 install_file "$FILES/figcraft-backup.timer" /etc/systemd/system/figcraft-backup.timer 644 && UNITS=true
-if [ "$UNITS" = true ]; then
+if [[ "$UNITS" = true ]]; then
  systemctl daemon-reload
  CHANGED=true
 fi
 systemctl enable --quiet "$SERVICE"
-if [ "$CHANGED" = true ] || ! systemctl is-active --quiet "$SERVICE"; then
+if [[ "$CHANGED" = true ]] || ! systemctl is-active --quiet "$SERVICE"; then
  say "Starting figcraft-server"
  systemctl restart "$SERVICE"
 fi
-if [ "$BACKUPS" = true ]; then
+if [[ "$BACKUPS" = true ]]; then
  systemctl enable --now --quiet figcraft-backup.timer
 fi

@@ -339,15 +343,15 @@ MAIN="$(mktemp)"
 caddy_main "$CADDYFILE" "$EMAIL" >"$MAIN"
 CADDY_CHANGED=false
 for f in "$CADDYFILE" "$SITE_FILE"; do
-  if [ -f "$f" ]; then cp -p "$f" "$f.before-figcraft"; else rm -f "$f.before-figcraft"; fi
+  if [[ -f "$f" ]]; then cp -p "$f" "$f.before-figcraft"; else rm -f "$f.before-figcraft"; fi
 done
 install_file "$SITE" "$SITE_FILE" 644 && CADDY_CHANGED=true
 install_file "$MAIN" "$CADDYFILE" 644 && CADDY_CHANGED=true
 rm -f "$SITE" "$MAIN"
-if [ "$CADDY_CHANGED" = true ]; then
+if [[ "$CADDY_CHANGED" = true ]]; then
  if ! caddy validate --config "$CADDYFILE" --adapter caddyfile >/dev/null 2>&1; then
    for f in "$CADDYFILE" "$SITE_FILE"; do
-      if [ -f "$f.before-figcraft" ]; then cp -p "$f.before-figcraft" "$f"; else rm -f "$f"; fi
+      if [[ -f "$f.before-figcraft" ]]; then cp -p "$f.before-figcraft" "$f"; else rm -f "$f"; fi
    done
    die "Caddy doesn't accept the new configuration (the old one is back; see: caddy validate --config $CADDYFILE)"
  fi
@@ -356,10 +360,10 @@ fi
 systemctl enable --now --quiet caddy

 # --- Firewall -------------------------------------------------------------------------------
-if [ "$FIREWALL" = true ]; then
+if [[ "$FIREWALL" = true ]]; then
  # The ports sshd really listens on (sudo doesn't pass SSH_CONNECTION on).
  SSH_PORTS="$(sshd -T 2>/dev/null | awk '/^port / {print $2}' | sort -u)"
-  [ -n "$SSH_PORTS" ] || SSH_PORTS=22
+  [[ -n "$SSH_PORTS" ]] || SSH_PORTS=22
  say "Firewall: SSH ($(echo "$SSH_PORTS" | tr '\n' ' ' | sed 's/ $//')), 80 and 443"
  for p in $SSH_PORTS; do ufw allow "$p/tcp" >/dev/null; done
  ufw allow 80/tcp >/dev/null
@@ -370,12 +374,12 @@ if [ "$FIREWALL" = true ]; then
    # Other services reachable from outside would be cut off by enabling ufw.
    OTHERS=""
    for a in $(ss -Hltn | awk '{print $4}'); do
-      case "$a" in 127.* | "[::1]:"* | ::1:*) continue ;; esac
+      case "$a" in 127.* | "[::1]:"* | ::1:*) continue ;; *) ;; esac
      port="${a##*:}"
      case " $(echo "$SSH_PORTS" | tr '\n' ' ') 80 443 " in *" $port "*) continue ;; esac
      OTHERS="$OTHERS $port"
    done
-    if [ -n "$OTHERS" ] && [ "$FIREWALL_ANYWAY" = false ]; then
+    if [[ -n "$OTHERS" ]] && [[ "$FIREWALL_ANYWAY" = false ]]; then
      warn "other services listen on port(s)$OTHERS: ufw was not enabled (rules added; allow those ports, then 'ufw enable', or run again with --firewall-anyway)"
    else
      ufw --force enable >/dev/null
@@ -395,7 +399,7 @@ cat <<EOF
 figcraft-server is running behind Caddy.

  Publish:   in FigCraft, Share > Publish to server..., address wss://$HOST/
-             $(if [ "$OPEN" = true ]; then echo "(open to the public: no key needed; each file gets an owner token)"; else echo "(with the key: $ADMIN key)"; fi)
+             $(if [[ "$OPEN" = true ]]; then echo "(open to the public: no key needed; each file gets an owner token)"; else echo "(with the key: $ADMIN key)"; fi)
  Check:     curl https://$HOST/healthz      (once DNS points here and Caddy has its certificate)
  Logs:      journalctl -u $SERVICE -f

@@ -25,11 +25,12 @@ ARCH="$(uname -m)"
 case "$ARCH" in
  arm64) ARCH=aarch64 ;;
  amd64) ARCH=x86_64 ;;
+  *) ;; # already a release name (x86_64, aarch64)
 esac
 NAME="figcraft-server-$VERSION-$OS-$ARCH"
 echo "==> figcraft-server $VERSION for $OS $ARCH"

-if [ "$SKIP_BUILD" = 0 ]; then
+if [[ "$SKIP_BUILD" = 0 ]]; then
  (cd "$ROOT" && cargo build --release --locked -p figcraft-server)
 fi
 WORK="$CARGO_TARGET_DIR/server-package"
@@ -11,13 +11,13 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
 HERE="$ROOT/packaging/web"

-if [ "${1:-}" != "--skip-build" ]; then
+if [[ "${1:-}" != "--skip-build" ]]; then
  command -v trunk >/dev/null || { echo "error: trunk not found (cargo install trunk --locked)" >&2; exit 1; }
  (cd "$ROOT/apps/figcraft-web" && trunk build --release)
 fi

 SITE="$ROOT/dist/web"
-[ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
+[[ -f "$SITE/index.html" ]] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
 # Paths must be relative so the site works under any prefix (public_url = "./" in Trunk.toml).
 if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
  echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
@@ -30,16 +30,16 @@ fi
 MAX_WASM_BYTES="${FIGCRAFT_WASM_MAX_BYTES:-25165824}" # 24 MiB
 WASM_COUNT=0
 for wasm in "$SITE"/*.wasm; do
-  [ -f "$wasm" ] || continue
+  [[ -f "$wasm" ]] || continue
  WASM_COUNT=$((WASM_COUNT + 1))
  size=$(wc -c <"$wasm" | tr -d ' ')
  echo "$(basename "$wasm"): $size bytes ($((size / 1048576)) MiB; limit $MAX_WASM_BYTES)"
-  if [ "$size" -gt "$MAX_WASM_BYTES" ]; then
+  if [[ "$size" -gt "$MAX_WASM_BYTES" ]]; then
    echo "error: $(basename "$wasm") is $size bytes, over the $MAX_WASM_BYTES-byte limit (Cloudflare's per-file cap is 25 MiB)" >&2
    exit 1
  fi
 done
-[ "$WASM_COUNT" -gt 0 ] || { echo "error: no .wasm in $SITE" >&2; exit 1; }
+[[ "$WASM_COUNT" -gt 0 ]] || { echo "error: no .wasm in $SITE" >&2; exit 1; }

 NAME="figcraft-web-$VERSION"
 WORK="$CARGO_TARGET_DIR/web-package"
@@ -56,8 +56,8 @@ if (-not $haveCert -and -not $haveAzure) {

 $script:SignTool = Find-SignTool
 $common = @('sign', '/v', '/fd', 'SHA256', '/td', 'SHA256', '/d', 'FigCraft', '/du', 'https://github.com/storytold/figcraft')
-$tmp = Join-Path ([IO.Path]::GetTempPath()) "figcraft-sign-$PID"
-New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+$tmp = Join-Path ([IO.Path]::GetTempPath()) "figcraft-sign-$([IO.Path]::GetRandomFileName())"
+New-Item -ItemType Directory -Path $tmp | Out-Null

 try {
  if ($haveCert) {
@@ -73,8 +73,15 @@ try {
    Write-Output "Signing with Azure Trusted Signing ($env:AZURE_SIGNING_ACCOUNT / $env:AZURE_CERT_PROFILE): $($Files -join ', ')"
    # The dlib authenticates with DefaultAzureCredential, which reads AZURE_TENANT_ID,
    # AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment.
+    $trustedSigningVersion = '1.0.95'
+    $trustedSigningSha256 = '3bfcf1e0a3cb42af1692f0a8ed45c15de070c2de86f28a59b2795d904d8a920f'
    $pkg = Join-Path $tmp 'trusted-signing.zip'
-    Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client' -OutFile $pkg
+    $uri = "https://api.nuget.org/v3-flatcontainer/microsoft.trusted.signing.client/$trustedSigningVersion/microsoft.trusted.signing.client.$trustedSigningVersion.nupkg"
+    Invoke-WebRequest -Uri $uri -OutFile $pkg
+    $actualHash = (Get-FileHash -Path $pkg -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actualHash -ne $trustedSigningSha256) {
+      throw "Microsoft.Trusted.Signing.Client $trustedSigningVersion checksum mismatch"
+    }
    Expand-Archive -Path $pkg -DestinationPath (Join-Path $tmp 'client') -Force
    $dlib = Get-ChildItem -Path (Join-Path $tmp 'client') -Recurse -Filter Azure.CodeSigning.Dlib.dll |
      Where-Object { $_.FullName -match '\\x64\\' } | Select-Object -First 1
@@ -0,0 +1,2 @@
+sonar.projectKey=storytold_figcraft
+sonar.organization=storytold
@@ -1,6 +1,7 @@
 //! Project tasks: `cargo xtask <task>`.
 //!
 //! - `ci`      fmt check, clippy -D warnings, tests, layers, assets, wasm check
+//! - `test`    the workspace tests (nextest when installed) and doctests
 //! - `layers`  crate dependency layering check
 //! - `assets`  every file under assets/ and docs/ has a row in ATTRIBUTION.md
 //! - `parity`  menu-catalog coverage → docs/parity-checklist.md
@@ -16,7 +17,7 @@
 mod icon;
 mod layers;

-use std::process::{Command, ExitCode};
+use std::process::{Command, ExitCode, Stdio};

 fn run(cmd: &mut Command) -> bool {
    eprintln!("$ {cmd:?}");
@@ -36,6 +37,7 @@ fn main() -> ExitCode {
    let task = args.first().map(String::as_str).unwrap_or("help");
    let ok = match task {
        "ci" => ci(),
+        "test" => test(),
        "layers" => layers::check(&root()),
        "assets" => assets(),
        "parity" => parity(),
@@ -45,7 +47,7 @@ fn main() -> ExitCode {
        "plugins" => plugins(),
        "bench" => bench(args.get(1).map_or("1000,10000,50000", String::as_str)),
        _ => {
-            eprintln!("tasks: ci, layers, assets, parity, version [set X.Y.Z], icon, wasm, plugins, bench [SIZES]");
+            eprintln!("tasks: ci, test, layers, assets, parity, version [set X.Y.Z], icon, wasm, plugins, bench [SIZES]");
            task == "help"
        }
    };
@@ -54,16 +56,31 @@ fn main() -> ExitCode {

 fn ci() -> bool {
    run(cargo().args(["fmt", "--all", "--check"]))
-        && run(cargo().args(["clippy", "--workspace", "--all-targets", "--", "-D", "warnings"]))
-        && run(cargo().args(["test", "--workspace"]))
+        && run(cargo().args(["clippy", "--workspace", "--all-targets", "--keep-going", "--", "-D", "warnings"]))
+        && test()
        && layers::check(&root())
        && assets()
        && wasm()
 }

+/// Unit and integration tests with nextest when it is installed (`cargo install cargo-nextest`),
+/// else with `cargo test`; then the doctests, which nextest does not run. Examples are not built:
+/// clippy's `--all-targets` already checks them.
+fn test() -> bool {
+    let nextest = cargo().args(["nextest", "--version"]).stdout(Stdio::null()).stderr(Stdio::null()).status().is_ok_and(|s| s.success());
+    let units = if nextest {
+        run(cargo().args(["nextest", "run", "--workspace", "--lib", "--bins", "--tests"]))
+    } else {
+        eprintln!("xtask: cargo-nextest not installed; running unit and integration tests with `cargo test`");
+        run(cargo().args(["test", "--workspace", "--lib", "--bins", "--tests"]))
+    };
+    units && run(cargo().args(["test", "--workspace", "--doc"]))
+}
+
 fn wasm() -> bool {
    run(cargo().args([
        "check",
+        "--keep-going",
        "--target",
        "wasm32-unknown-unknown",
        "-p",