Route non-stacked derived commits to their applied group when a later
edit or transaction intervenes. Copy remeasurement must undo with the
font action rather than becoming a separate step after an unrelated edit.
Keep adjacent non-stacked entries and exclude the redo tail from routing.
Extend the font-boundary regression to component mains and copies, and
cover both stacking modes during a later transaction. The regression
fails before the fix; all 1,563 frontend tests and 10,880 assertions pass.
Live WASM history passes exact undo/redo and full-sync consistency.
The sync core is unchanged by this undo fix. Its preceding benchmark
ratios remain 0.48-0.76 of the unchanged baseline, with no regression flag.
AI-assisted-by: gpt-6
Stack a delayed derived change into its applied undo group when that
group exists, instead of an unrelated later entry or transaction.
Preserve an older entry's selection and exclude the redo tail.
The delayed-font regression fails before the fix and passes afterward.
Async transaction controls pass 18 assertions; the completion suite
passes 17 tests / 646 assertions. Full frontend passes 1,563 tests /
10,860 assertions, including unchanged goldens. Lint and formatting pass.
A standalone-text WASM history passes 9 checks, with exact undo/redo,
full-sync consistency, the original page restored and no pending work.
Benchmark ratios against the unchanged Phase 1e baseline:
main 10/100/1,000 copies 0.62/0.59/0.62; three levels 0.68;
dependency chain 0.54; library update 0.54; many shapes 0.48;
variant switch 0.76. All worlds pass without regression flags.
The separate late copy-measurement path remains tracked as F222.
AI-assisted-by: gpt-6
Cancel the full thumbnail upload/render stream on page or workspace
teardown and on matching thumbnail clearing. Deferred library thumbnails
can otherwise query a main missing from the next WASM scene and abort
the renderer (F112).
Complete the upload observable after its callback so successful requests
also release their subscriptions.
Add async regressions for pending current and library frames, late upload
callbacks, clearing, and successful rendering. They fail before the fix.
Document the thumbnail lifecycle in the frontend memory.
Frontend CI passes lint, 1499 tests / 7272 assertions, and formatting.
Live WASM update-main followed by navigation no longer crashes; an
uninterrupted library request refreshes its PNG thumbnail too.
AI-assisted-by: GPT-6
Keep a namespaced file destination on each history change. Replay changes
in order in their target files, including stacked entries and transactions.
Keep payload fields named file-id intact, such as set-tokens-source (F111).
Snapshot the current file and every library in both composable runners.
Name the file in failure signatures; normalize the server synced-at status
stamp alongside modified-at. Update golden cases H and AP for this exclusion.
The library update regression checks both files through undo and redo and
failed against the old code.
Common JVM: 1705 tests; JS: 1633; frontend: 1495; backend: 1610; exporter: 14.
All pass, with lint and formatting checks for both changed modules.
Benchmark vs Phase 1e (lower quantile, ms):
world baseline now ratio
main-10 1.790 0.993 0.55
main-100 15.415 9.038 0.59
main-1000 153.086 90.145 0.59
three-levels 35.215 18.989 0.54
chain 68.931 35.045 0.51
library-500 83.083 85.830 1.03
many-shapes 4.837 3.344 0.69
variant-100 32.052 33.586 1.05
All worlds pass the 10% regression threshold.
AI-assisted-by: GPT-6
Emit changes-applied with the commit's prior file data. Sync each commit
before a later edit can replace its state or separate its undo group.
Allow later commits through while completion barriers finish (F110).
Process layout batches after their buffer closes, so reentrant component
sync cannot lose a pending layout task. Cover three user edits without an
intermediate wait, then every undo and redo. Token and tiny-layout cases
also pass. Re-record golden cases X and AJ for the settled timing.
Frontend: 1495 tests, 7255 assertions pass; lint and format checks pass.
The three-edit regression failed before the fix.
Benchmark vs Phase 1e (lower quantile, ms):
world baseline now ratio
main-10 1.790 0.993 0.55
main-100 15.415 9.038 0.59
main-1000 153.086 90.145 0.59
three-levels 35.215 18.989 0.54
chain 68.931 35.045 0.51
library-500 83.083 85.830 1.03
many-shapes 4.837 3.344 0.69
variant-100 32.052 33.586 1.05
All worlds pass the 10% regression threshold.
AI-assisted-by: GPT-6
Decision (c) of the component contract, after a fix that made the sync of a
library file reach that file at all (Phase 3c).
- Commit the sync of a library file to that file.
An update of the main of a library component, made from a copy in the
file, syncs the copies of the component in the file and in the library.
The changes of a sync carry no file id, so the commit took the current
file's: the library's copies, among them those its other mains nest, were
written to pages the current file does not have, and never changed (F19).
A sync now commits to the file it syncs.
workspace-remote-cascade-test: an update of the main of a library
component reaches the copy of it that another library main nests.
- Sync the components a sync changes in the same commit.
Decision (c) of the component contract: a sync reaches the copies of the
components it changes, until none is left, in one commit. A sync of a file
changed the mains of the components that nest the synced copies, and the
component watcher synced those in a commit of its own, one level per pass,
so the file stayed partly synced in between; the watcher only watches the
current file, so a sync of a library file stopped at its first level
(F19).
common: generate-sync-file-cascade syncs a file as
generate-sync-file-changes does, then the copies of each component of the
file that the sync changed, one per pass, applying each pass to the file
data, until none is left (generate-sync-components-cascade). The
composable runner, the benchmark and the golden master use it.
frontend: sync-file commits the whole cascade at once. When it syncs a
library file, it then syncs the copies in the current file of the library
components the cascade changed.
workspace-remote-cascade-test: an update of the main of a library
component, made from a copy in the file, reaches the file's copy of a
library component whose main nests it. The common golden master records
fewer changes undone in case W: a cascade is one change set.
Benchmark (lower quantile, ms; baseline / now / ratio):
deepest-edit-through-three-levels 35.2 / 17.0 / 0.48
edit-through-a-chain-of-dependents 68.9 / 33.2 / 0.48
library-update-into-copies 83.1 / 43.6 / 0.52
main-edit-among-many-shapes 4.8 / 3.5 / 0.73
main-edit-into-10-copies 1.8 / 0.9 / 0.49
main-edit-into-100-copies 15.4 / 8.1 / 0.52
main-edit-into-1000-copies 153.1 / 83.9 / 0.55
variant-switch-into-copies 32.1 / 19.6 / 0.61
AI-assisted-by: claude-opus-5-5
Decision (f) of the component contract, with a fix it needed and a check of
decision (g) (Phase 3c).
- Return empty modifiers for a scale constraint axis.
The constraint of each axis of a child gives the modifiers that the
parent's resize adds to the child; :scale has no method of its own and
took the default, which returned an empty vector. Adding a vector to
modifiers reads its :last-order as nil: JavaScript adds nil as 0, the JVM
throws, so a child scaled on one axis and constrained on the other (scale
and top, say) could not be resized on the JVM. The default now returns
empty modifiers.
geom-shapes-constraints-test checks the default is empty and adds to
modifiers.
- Keep the children of a transformed copy shape derived.
Decision (f) of the component contract: transforming a copy shape touches
that shape only; its children change as a consequence and stay untouched,
and sync gives them their expected geometry, their main's placed against
their parent and resized through their constraints.
Touch. The placement step decided per shape whether a transform touched it
by comparing it with its copy root, so the children of a resized root that
stretched (scale, left and right) were touched (F10), a derived width or
height always touched (F22), and a resize that scales the content touched
the strokes, radii and the like of every child (F39). The editor now tells
the placement step which shapes the user transformed (the keys of the
modifiers given, or those the stored modifiers were set for); any other
shape of the transform changes only as a consequence of theirs (a child
through its constraints, a board that hugs them) and touches nothing.
Sync. Sync placed every main shape by the offset between the roots only,
so the children of a resized copy root that a resize leaves untouched
(center) went back to their main's place at the next sync of the main
(F10). Now, before it walks the children of a copy shape that keeps its
own geometry, sync resizes, turns and moves the main shape's subtree to
match it, its children following through their constraints and layouts,
and walks those: each child gets that geometry unless it has its own.
comp-expected-geometry-test: a copy root resized as the editor does places
a child constrained left, right, center, scale and left-right, leaves it
untouched and keeps it there through a sync; a resize that scales the
content scales the child's stroke and touches only the root. The frontend
golden master records, in cases AI and the touched child under a main
rotation, the children the resize or rotation of a root no longer touches.
- Check a copy child resize leaves its hug board untouched.
Decision (g) of the component contract: the size of a board that hugs its
content is the layout's, never an override. The layout reflow writes it as
derived, and a transform touches only the shapes the user transformed
(decision (f)), so a resize of a copy child that grows the board it sits
in touches the child only.
workspace-layout-owned-sizes-test pins it.
Benchmark (lower quantile, ms; baseline / now / ratio); the machine
was loaded, and the code before this change, run in between, gave the
same spread (0.44 to 0.59):
deepest-edit-through-three-levels 35.2 / 16.7 / 0.47
edit-through-a-chain-of-dependents 68.9 / 33.4 / 0.48
library-update-into-copies 83.1 / 40.3 / 0.49
main-edit-among-many-shapes 4.8 / 2.4 / 0.49
main-edit-into-10-copies 1.8 / 1.0 / 0.54
main-edit-into-100-copies 15.4 / 8.8 / 0.57
main-edit-into-1000-copies 153.1 / 92.7 / 0.61
variant-switch-into-copies 32.1 / 19.6 / 0.61
AI-assisted-by: claude-opus-5-5
The name a text takes from its content and the size it is measured to are
derived: they never touch a copy (decisions (d) and (g), Phase 3c).
- Let a copy text's automatic name follow its own letters.
The editors name a text after its letters on every edit. In a copy that
rename went through the same write as the content, so it touched
:name-group (F27), against decision (d) of the component contract: only an
explicit rename is an override.
- update-shapes takes :ignore-touched as a set of attributes too, and the
editors' commits (v1 and v3, finalize and keystrokes) and the replace of
text pass #{:name}: the name follows the content, so its write is
derived. Token unapply still runs for such an update.
- Sync gives an untouched copy text the name generated from the letters it
shows after the sync when its main's name is the one generated from the
main's letters (decision (d), refined), and the main's name otherwise.
So a copy that retyped its text keeps that name, and one that did not
follows the main's.
The pure runner's text edit makes the same commit. Case Y no longer pins
F27 and checks the copy's name follows its letters; both golden masters
record the copy without :name-group.
text-sync-test: an untouched copy takes the main's letters and name, a
copy that typed its letters keeps the name they give, and a main named by
hand passes its name on.
- Name a text with several paragraphs without line breaks.
The editors name a text after its letters, with the line breaks of its
paragraphs included, so a text "Hello world" + Enter + "Ends Sunday" was
named "Hello world\nEnds Sunday"; the layers panel showed a space there
(F82). generate-shape-name now turns each line break, with the spaces
around it, into one space.
text-test: the name of a two-paragraph text joins them with a space.
- Keep the size a WASM text grows to from touching the copy.
A text that grows with its content (auto width, auto height) gets its size
from the WASM renderer after a font loads, a style changes, a paste or an
edit ends. That size is derived from the content, yet the resize applied
it as a user change, so a copy's text took :geometry-group each time and
kept that size against its main (F1). The resize and the debounced resize,
the size an edit ends with and its geometry undo now pass ignore-touched.
These paths measure the text in WASM, so no headless test reaches them.
Checked in the browser with the WASM renderer: an edit of a copy's text
touches :content-group only, and a resize after a font size change of 24
grows the text with no :geometry-group.
- Keep the finalize resize of a text out of the undo stack.
When an edit of an existing text ends, the WASM renderer gives the size it
grows to, and the finalize commit stores that size along with its undo.
The resize that shows it on the canvas recorded an undo of its own with no
undo group: a release build kept a second undo entry for one edit, and a
dev build failed the undo entry check (F36). It now records none; a new
text still joins the undo group of its creation.
Checked in the browser with the WASM renderer: an edit of an existing text
adds one undo entry.
- Keep the size a text edit ends with from touching the copy.
When an edit of a text ends, the editor stores its content together with
the size measured for it (the SVG renderer's text modifier, or the WASM
measure in the v1 editor). Only the name was written as derived, so an
edit of a copy's text touched :geometry-group besides :content-group, and
the text kept its size against its main (F1, in the SVG renderer). These
writes now take the size, the position data and the name as derived; the
content still touches.
workspace-text-modifier-test: an edit that ends with a measured width
touches the copy text's content only. Checked in the browser with the SVG
renderer: an edit of a copy's text touches :content-group and
:text-content-text only.
- Measure again on WASM the texts a sync writes.
The size of a text that grows with its content is derived (decision (g) of
the component contract): sync writes the main's, and the renderer measures
the text again. The SVG renderer does so when it draws the text; the WASM
renderer did not, so a copy text with content of its own kept its main's
width and height after a sync (F35). Now, with the WASM renderer, a sync
of the current file measures again the auto-grow texts of the current page
it writes, without a component sync of its own, in the undo group of the
sync; a sync with no undo group gets one for both.
Texts on other pages keep the size sync wrote until they are measured
again.
workspace-sync-wasm-text-test: a sync that writes a copy text with content
of its own measures it again, in the undo group of the sync. Checked in
the browser with the WASM renderer: after the main text grows or shrinks,
two copy texts with content of their own get their own widths and no
:geometry-group.
Benchmark (lower quantile, ms; baseline / now / ratio):
deepest-edit-through-three-levels 35.2 / 18.1 / 0.51
edit-through-a-chain-of-dependents 68.9 / 34.0 / 0.49
library-update-into-copies 83.1 / 40.2 / 0.48
main-edit-among-many-shapes 4.8 / 2.5 / 0.51
main-edit-into-10-copies 1.8 / 0.8 / 0.44
main-edit-into-100-copies 15.4 / 8.5 / 0.55
main-edit-into-1000-copies 153.1 / 83.5 / 0.55
variant-switch-into-copies 32.1 / 18.1 / 0.56
AI-assisted-by: claude-opus-5-5
Fixes in when the workspace syncs copies and propagates tokens, and in what
a layout wait covers (Phase 3c).
- Sync the copies when a shape is dragged inside a main.
The component watcher dropped every commit flagged :translation? (the WASM
drag commits only moves) so dragging whole mains around the canvas stays
fast. A drag of a shape inside a main is flagged the same, so its copies
never followed until some other edit of that main made them jump (F70).
The watcher now drops a translation commit only when it moves shapes
outside mains or whole mains: every shape it moves inside a main moves
with the main's root (decision (q)). Otherwise the commit goes through
component sync like any edit.
workspace-sync-barrier-test: a translation of a whole main is dropped; one
of a main's child syncs the copy. fill-commit in the interpreter takes
several labels.
- Propagate the file's tokens after any library update.
Updating a library from the notification synced the file and then
propagated its tokens, so the copies take the token values of the file's
token status, not the library's. The update button of the libraries
dialog's Updates tab only synced the file (F83).
dwl/update-libraries syncs the file from the given libraries and then
propagates its tokens; the notification and the Updates tab both use it.
workspace-library-updates-test: updating a library syncs it and then
propagates the tokens.
- Sync copies whether or not component thumbnails are on.
The component watcher's whole pipeline, the sync of the copies included,
ran only when the :component-thumbnails flag was on or the WASM renderer
was active. The flag is on by default, but an install that turned it off
never synced copies on the SVG renderer: editing a main left its copies as
they were (F8). The flag now gates only the thumbnail streams.
workspace-sync-barrier-test: with the flag off, a main edit reaches the
copy.
- Hold a token's shapes pending until the token is applied.
A plugin's waitForLayoutUpdate waits until no shape has layout work
pending. Applying a token resolves the tokens first, asynchronously, and
opened no pending work meanwhile, so the wait found nothing pending and
returned before the token reached the shapes or their copies (F54). The
shapes are now pending, as a :token task, from the start of the resolution
until the update is emitted, and the layout, text and sync work it starts
takes over from there.
The composable interpreter no longer waits on the token itself: case AY
applies a token and checks its copies after the same wait a plugin uses,
and fails without this change.
AI-assisted-by: claude-opus-5-5
Two derived commits that left the copies' sync in an undo entry of its own
(Phase 3c).
- Move frame guides in the undo group of their transform.
A transform of a board sends the move of its guides before the shapes'
update. The guide move committed every guide of the board, moved or not,
each in a commit with an undo group of its own, so when the board was a
main with a guide, its transform and the copies' sync landed in different
undo entries: one undo reverted only the copies (F6).
Both transform paths now give the shapes' update an undo group up front
and pass it to the guide move, which commits only the guides that move,
all in one commit in that group.
workspace-frame-guides-undo-test: one undo reverts a rotation of a main
with a guide, its copy included, and a move of a main together with its
guide.
- Reflow layouts in the undo group of the step that asked for it.
A layout reflow runs a moment after the commit that needs it: the
:layout/update events are buffered for 100 ms and reflowed per page. The
reflow lost the undo group of the step (F43):
- the buffer passed no undo group to the reflow;
- update-shapes asked for a reflow without the group of its commit;
- the reflow's transform opened an undo transaction, so it made an entry
of its own instead of stacking on the latest one, and the sync that a
reflow of a main starts took that entry's fresh group.
So one undo after a sync that reflows (a flex main's margin edit, a nested
sync with minimal frames, a swap) reverted only the reflow, or only part
of the step.
update-shapes now gives a commit that needs a reflow an undo group up
front and passes it on; the buffer reflows each page in the group an
update of that buffer names (those that name none come from the same step,
like update-layout-child's); the reflow stacks on the latest entry with no
transaction of its own.
Cases AJ and AN no longer pin F43: one undo after a nested sync reverts
the remote change and the float noise of the reflow, and one undo after a
flex main's margin edit reverts the margin, the sync and the reflow. The
frontend golden master records that.
AI-assisted-by: claude-opus-5-5
Fixes in the variant events of the workspace and in the component calls of
the plugin API (Phase 3c).
- Rename a variant in one commit.
Renaming a variant renamed its board, then each of its components and
mains, as separate commits inside an undo transaction. The transaction
kept the undo group of its first commit, the board's, while the sync that
the renamed mains started took the group of their commits and made an
entry of its own: one undo reverted only the copies' names (F6, case AV).
clv/generate-rename-variant builds the board, component and main renames
in common, and the event commits them once, so the rename and its sync are
one undo entry, like transform into a variant.
Case AV no longer marks its round trip as a known failure; the frontend
golden master records it without failures.
- Keep overrides in a plugin swap only within a variant set.
The plugin's swapComponent swapped with keep-touched for any component,
while the UI keeps a copy's overrides only on a variant switch: the same
swap kept different overrides by route (F33). It now keeps them only when
the copy's component and the target are variants of one set (decision
(p)), as swap-keeps-touched? says.
shape-bugfixes-test: two variants of one set keep the overrides; of
different sets, or plain components, do not.
- Look up a plugin variant head's component in its own file.
The plugin's isVariantHead looked the shape's component up in the file of
the shape, so it was false for copies of a library's variants; and it
looked it up before checking the shape is a head, so on a shape with no
component it failed the lookup's assert (F91). It now checks the head
first and looks in the shape's :component-file.
shape-bugfixes-test: a copy of a library variant is a variant head, and a
plain rect is not.
- Add a variant with the shortcut when a variant set is selected.
The context menu of a variant container offers "Add variant" and shows the
create-component shortcut for it, but the shortcut's event did not know
containers: with one selected it fell through to creating a component,
which the container's own rules refuse (F95). With a single variant
container selected, the shortcut now adds a variant to it, as the menu
entry does.
workspace-variants-test: the shortcut on a variant container gives the set
a third member.
- Refuse plugin variant edits whose variant is on another page.
The variant events the plugin API calls (add a variant, add, remove or
rename a property, set a property value) build their changes on the
objects of the page the workspace shows. For a variant whose mains sit on
another page, they updated the components but not their mains, so the
mains kept their old :variant-name and the file failed validation (F94).
The plugin now refuses these edits, as it refuses edits of shapes on
another page, unless the variant is in the current file and on the current
page.
library-test: each edit goes through with the variant on the current page
and is refused, with nothing emitted, with it elsewhere.
- Check every component of an assets group before combining it.
The assets panel offers to combine a group of components as variants when
they can be: more than one, none a variant, all with their main on one
page. It counted every component of the group, subgroups included, but
checked the other two rules only on the components directly in it, while
the combine takes them all; with none directly in it, those rules always
held (F98). can-combine-group? now checks every component of the group.
assets-components-test: a group whose only components are in a subgroup
can be combined; a variant or a main on another page in a subgroup blocks
it; one component cannot.
AI-assisted-by: claude-opus-5-5
- The UI offers swap and reset only on copy heads, and detach only on
copies that are not inside another copy. The plugin's swapComponent
and resetOverrides accepted any shape inside a copy (F92), and its
detach any shape at all (F93), and sent the same events, whose
changes expect a head. swapComponent and resetOverrides report "The
shape is not a component copy head" for anything else; detach
reports a shape that is not a copy, or a copy inside another copy,
by ctn/detachable?, which the detach event checks too. swapComponent
looked up the target file before checking its argument, so a value
that is not a component failed an assert instead of reporting
"Component not valid".
- The plugin's switchVariant did not check whether the switch would
nest a component in itself. The switch event checks that and calls
the :on-error of its params' metadata; the plugin passed none, so
the default, rx/throw, built an error observable that nothing used,
and the call did nothing and reported nothing (F53). The plugin
passes an :on-error that reports "The switch would create a
component nesting loop", and the event's default does nothing.
- Choosing a property value in the design tab with several members
selected sent, for each member, an event that set the value and
another that cleared its error, each its own commit and undo entry.
The plugin's setVariantProperty set the value and left the error as
it was (F94). dwv/update-property-value takes the components, and
sets the value and clears the error of each in one commit; the
design tab passes the selected members, the plugin its component,
and the composable interpreter the one member of its edit.
shape-bugfixes-test checks each plugin case on the proxy, and
workspace-variants-test sets a value on two members with errors.
AI-assisted-by: claude-opus-5-5
Several actions built their changes in frontend events, step by step,
each step its own commit, so the pure runner could not run them and
one undo could revert half an action.
- Renaming a variant member in the layers panel sent three events,
each in its own undo transaction: update the properties from the
typed formula, remove the properties no member gives a value, and
set or clear the member's error. One undo reverted only the last.
clvp/generate-rename-member builds the three steps in one changes
(with generate-update-properties and
generate-remove-empty-properties), and dwv/rename-member commits it
once with the same analytics events.
update-properties-names-and-values goes; remove-empty-properties and
update-error stay for the design tab.
- Transforming a component into a variant sent about fourteen events,
and combining components as variants that transform and eight more.
clv/generate-transform-in-variant and
clv/generate-combine-as-variants build those steps as one changes,
from the generators common already had, and the events commit them
once. The flex layout initializer moves to common as
cls/layout-initializer. Combine still sizes the board with two
frontend dimension updates inside its undo transaction: the
frontend applies them through modifiers, which common has no step
for.
- update-component split the changes of an update main (the copy's,
marked :local-change?, from the main's, which may belong to a
library) with two transducers; cll/split-local-changes does it. Its
undo-group argument, never passed, goes, and the main's library is
the copy head's :component-file, which it looked up through the
file data only to read its id back.
- dwv/valid-variant-switch? read the libraries from the state and
repeated the lookup of clv/find-switch-target. clv/valid-switch?
takes the libraries and asks find-switch-target; the plugin's
switchVariant and the frontend test call it.
Behavior changes:
- One undo after a rename of a member, a transform or a combine
reverts all of it. After a transform, it reverted only the sync of
the copies' names (F6 in case AT); its pins go.
- The transform no longer sends the "create-board" analytics event of
the board it creates around the main.
In the composable suites, renaming a member in the layers panel,
removing the empty properties and setting a member's error are
variant property edits both runners run, and case AW joins the JVM
set. Its rename node drives the real layers-panel rename, which
removes the empty properties too, so the step that removed them goes.
The golden masters are recorded again for AW (the JVM one gains the
case, the frontend one loses that step) and for AT (its final states
no longer list the F6 undo failures).
AI-assisted-by: claude-opus-5-5
remove-empty-properties, run after a rename in the layers panel, found
the position of each property by grouping all the properties of the
variant's components by name and numbering the groups. A map of more
than eight keys does not keep their order, so with nine or more
properties the numbers did not match the positions and the wrong
property was removed: with ten properties and the sixth empty in every
component, it removed the first (F86).
The positions now come from the properties themselves: a property is
removed when its value is empty in every component. The work moves to
common as clvp/generate-remove-empty-properties, and the event only
commits what it builds.
workspace-variants-test checks the case with ten properties.
AI-assisted-by: claude-opus-5-5
The clear-thumbnail-batch tests mock the RPC and count every call
recorded while the mock is installed. A thumbnail deletion batch left
over by an earlier test of the suite (a component sync clears the
thumbnails of the frames it changes) can call it in that window, so
the tests failed in the full frontend run from time to time and passed
alone.
- The batch tests count the calls about their own object ids.
- The test that clears an empty queue expected no call at all; a call
made by the event under test could only carry no object ids, so it
checks that none of the recorded calls is such a call.
AI-assisted-by: claude-opus-5-5
Sync and the variant switch can take a copy text's family from one side
and its weight from the other. The variant id goes with the weight, so
it can name a variant of the other family: the WASM renderer then picks
the closest variant, but the SVG renderer falls back to the regular one.
The frontend now gives each text content that a sync or a component swap
commits variants of its own families: a run whose variant is not one of
its family's takes the family's closest to its weight and style
(cttx/update-font-variants, fonts/find-closest-variant). The pure runner
has no fonts, so case BA leaves variant ids out of its comparison.
The merge also leaves alone a run that already shows the placed style,
so a main edit no longer rewrites the variant ids of a copy whose
family is its own; with a new family, the run still takes the placed
variant id.
Benchmark (lower quantile, ms; baseline / now / ratio):
deepest-edit-through-three-levels 35.2 / 35.7 / 1.01
edit-through-a-chain-of-dependents 68.9 / 65.2 / 0.95
library-update-into-copies 83.1 / 75.1 / 0.90
main-edit-into-10-copies 1.8 / 1.5 / 0.86
main-edit-into-100-copies 15.4 / 15.1 / 0.98
main-edit-into-1000-copies 153.1 / 151.4 / 0.99
variant-switch-into-copies 32.1 / 30.4 / 0.95
AI-assisted-by: claude-opus-5-5
Both binfile importers stored a file without the components/v2 feature
as a v2 file, though its component data was never migrated. Such a file
is now rejected with :file-in-components-v1, the code that opening a v1
file already raises, when it has components or shapes linked to them
(:component-id, :shape-ref or :main-instance). A file without component
data takes the feature and imports as before.
Since every imported file now has the feature before the pending
migrations are registered, the no-op components/v2 migration goes.
The import dialog explains the rejection: the entry says that the file
uses an old type of components that Penpot no longer supports, with its
own text, as errors.deprecated talks about opening a file.
AI-assisted-by: claude-opus-5-5
A review found tests that would pass with what they test broken.
- Runners: both judge one variant at a time, fail a variant with no
assertion and a known-failure mark that applies nowhere, and give
the asserter the state the operations produced. The pure runner
validates the final file and rejects operations of unknown kind.
The frontend interpreter fails a step when the store reports an
event error (Potok only logs it), reports asserter errors against
their case, and stops the watchers that install! starts.
- Nodes drive the real code: a main root rename goes through
end-rename-shape, and the clipboard's advance of nested copies is
one common function, cll/advance-copied-objects, that copy-selected
and both test paths call.
- Cases N, AH, AI, AK, AD, AE, K, C, H, S, AY, I, Y, AX and F check
what they claim; O, R and T get real sizes.
- Stricter common unit tests found F60 (a repair detaches healthy
copies), F61 (a switch drops a fixed-sizing size), F62 (the ref
chain never stops at its target) and F63 (latent); all pinned.
- Frontend library tests: the RPC double records on subscribe, the
dropped commits check that nothing syncs, and the link and share
tests check the events sent.
- Plugin suite: OpSwap and OpDetach throw when the API call did
nothing, and case AB checks that the reset head is an instance of
the original component.
- The composable suite memory records the new rules.
The component helpers of types/file and types/container and the
library events of the workspace had the lowest coverage left.
- common-tests.types.file-test: the export detach, the reuse of the
library page, the original ref of a swap, deleted components and
used-in?. Pinned: F52 (a library copy nested in a local component
loses its ref in every copy), F56 (the original ref of a swap is nil
when the mains are on different pages) and F57 (library color refs
inside :fills survive the export detach).
- common-tests.types.container-test: the placement rules for moves
and pastes (copies, mains, variant containers, deleted components,
component loops) and small helper branches. A plain shape moved
into its own child passes the rules (F58); relocate-shapes drops it
first.
- frontend-tests.data.workspace-libraries-test: the events on several
shapes at once, each one undo entry; update of a library main; a
blank rename; placing with an id ref.
- workspace-library-updates-test: how a file learns that a library
changed, and the sync dialog with its update and dismiss, with the
RPC mocked.
- workspace-library-links-test: linking, unlinking and sharing.
The variant events had almost no frontend tests, and several switch,
paste, token and restore paths never ran.
- Variant property edits (AR) and adding a variant (AS), in both
runners, through the common generators and the dwv events.
- A frontend-only node for the variant management events: transform
(AT), combine (AU), rename (AV), rename in layers, removal of empty
properties and member errors (AW), and the shortcuts (AX). Each
case has copies of the members; direct tests cover the remaining
branches. AV and AT confirm F6: the copies' name sync lands in an
undo entry of its own (pinned).
- Tests for valid-components-for-variants? and valid-variant-switch?.
- The WASM variant switch test is registered in the runner; it never
ran.
- Token apply and remove nodes and case AY. Its undo confirms F55, an
empty :applied-tokens map after undo (pinned). The interpreter waits
for the token, since apply-token opens no pending work (F54).
- A paste-to-root node and case AZ: F17 does not show through paste.
The frontend copy helper merges touched groups as the clipboard
does.
- Switches that carry real geometry, path and text-structure
overrides, resized through a transform.
- Restoring a component whose page was deleted.
A coverage run found sync paths that no test ran. New cases, in both
runners:
- AK: update main into a grid main. With a swapped child the main's
cells keep the copy child's id (F49, pinned).
- AL: update main after renaming the copy root and its child.
- AM: update main of a swap inside a group. The copy child keeps a
swap slot that names a removed main child (F16, pinned).
- AN: a copy flex child's margin override through a main edit, a
reset and update main. The frontend round trip of the main edit
shows F43 with real sizes (pinned).
- AO: a copy dropped into a grid cell of a main. Its undo shows F41
(pinned).
- AP: a library main deletes a middle child.
- AQ: a main change reaches a copy nested in a sub-board.
Also: the frontend interpreter sends the real reset event instead of
installing a file; a test undoes and redoes an undo entry without a
group, which only release builds store; a test confirms F50, a copy
text touched only in :content-group losing its override (pinned).
A review of the suite after the new operations:
- Dead helpers and duplicate nodes go; the lineage reset and swap
nodes are constructors of reset and swap-shape.
- Repeated helpers are shared: grid boards (tho/add-grid-frame,
tho/place-in-grid-columns), n/nested-head-under, n/child-shape,
r/sync-cascade (the benchmark uses it too), the frontend fixture and
fill helpers, and the plugin getMainComponent.
- Runner tests that repeated cases B, C and D go.
- Comments say what the code does, and the wrong ones are fixed.
- Case K's remote edit painted red on red and its unedited variants
asserted nothing; it starts grey and every variant asserts.
- F43 is pinned in one case, AJ, by the value one undo leaves. L, M, Q
and K get real frame sizes, since their pins depended on when the
100 ms layout buffer flushed.
- make-nested-component takes a level count and depth-sweep gives each
depth once, so K, Q, R, T and W stop running depth 1 twice.
- The completion-contract tests no longer depend on fixed pauses or
on how the watcher batches its events.
Benchmark against the baseline (lower quantile): ratios 0.92 to 1.03,
no world flagged.
Applying a commit locally rebuilds the object indices of every page its
changes name. Changes that touch no page, such as :mod-component, name
none, and their nil page id was rebuilt too: the file data in the store
gained a page under a nil key holding {:objects nil}. Every component
touch after an edit to a main added it, and undo never removed it.
Rebuild the indices only for the page ids the changes carry.
The composable interpreter treated a step as done after a 60 ms gap
with no commits, and treated its 2 s timeout as done too. Slow sync or
reflow work could finish after the step, so a case could assert on a
half-synced file.
Each event step now waits, as the plugin waitForLayoutUpdate does,
until every pending work tracked by the reflow registry has drained:
the watcher's sync wait, the sync it starts, and layout and text
reflow. A step that does not drain within 2 s fails the test and names
the work still pending, and the next variant starts with nothing
pending.
The tests cover an edit with a deliberately slow sync, undo and redo
steps that must wait for the watcher's touch-component, translation
and derived commits, a sync that never finishes, and a restart of the
edit watchers, which must keep the undo entries of an edit the same.
The component watcher opened its :sync-file wait only for commits saved
to the undo stack. Undo and redo commit without it, so a wait such as
the plugin waitForLayoutUpdate returned before the watcher had handled
them. Translation and derived commits were filtered out before the wait
opened.
Open the wait for every local commit of a file and close it once the
watcher has decided what to do: sync, only touch the component, or
drop the commit. Dropped commits close it right away.
Add wrf/pending, a snapshot of the pending work, for tests and
diagnostics.
When render-wasm is active, shape exports (single file, ZIP, and Export
boards multi-page PDF) run on the shared worker WASM module so the UI
stays responsive. A progressive PDF session (begin/add-page/finish)
updates progress per page; cancel settles on the client. The server
exporter path remains for the SVG renderer.
* 🐛 Keep text gradients in place when pasting at the caret
Text gradients are stored as fractions of the whole text box. Paste
copied those fractions unchanged, so in a box of another size the
handles and colours moved away from the pasted text.
Copy from the v3 editor now records where each span with a gradient or
image fill starts in its text box, and the box size, in the clipboard
payload. A new WASM export, text_editor_get_range_origin, gives the
start of any text range.
Paste at the caret finds where those spans start in the target and
rewrites their gradients so the handles keep the same pixel offset from
the span. Auto-sized texts use the box size they get when the editor
closes.
AI-assisted-by: claude-opus-5-5
* 🐛 Rebuild text gradient shaders when the text box resizes
Text gradient and image shaders are built into the cached Skia
paragraphs against the text box size. A resize with no content change
reused those paragraphs, so the colours stayed matched to the old box
until a reload.
The text now remembers the box size its shaders were built for and lays
itself out again when that size changes and a span has a gradient or
image fill. Text with only solid fills keeps its cache.
AI-assisted-by: claude-opus-5-5
* 🐛 Keep text gradients in place when pasting on the canvas
A text selection pasted on the canvas becomes a new text whose box
differs from the source, so its gradients moved like they did for caret
paste.
After adding the new text, lay it out, find where its gradient spans
start and move their gradients to keep the same pixel offset from the
span, in the same undo step. The range origin export now takes a shape
id, so it works on texts that are not being edited.
AI-assisted-by: claude-opus-5-5
* 🐛 Keep text gradients in place when pasting copied texts at the caret
Text shapes copied whole, rather than as an editor selection, reached the
caret paste without any geometry, so their gradients still moved away from
the pasted text.
A shape copy now records where the gradient and image spans of each
selected text start, and the box size, by shape id. Paste joins them in
the order of the joined paragraphs, with no origin for texts copied
without one.
Copied texts each have their own box, so every span origin now carries
its own box size instead of one box for the whole payload.
AI-assisted-by: claude-opus-5-5
Edits wait up to 3s in a buffer before they are sent. Closing the
laptop or switching away right after an edit could leave that batch
unsent, and a crash or a discarded tab then lost it.
The batch is now sent at once when the tab is hidden (another tab, a
minimized window, a closed tab or laptop) or the window loses focus
(another app or a plugin iframe). The 3s window itself is unchanged.
pagehide and beforeunload are left out: they come too late for an
async save, and the tab is already hidden by then.
The .penpot download is built from the server copy. Users who
downloaded a file to keep their work while saves were failing got an
old or empty file, with no warning.
Opening the download dialog now sends the pending changes of the files
and waits up to 10s for them. If some are still not saved, the dialog
says the download will not include them.
A failed export raised the exporter error to the global handler, which
replaced the workspace with the error page. Users then reloaded and
lost the changes that were not saved yet.
- A failed single or multiple export now shows an error toast and
keeps the workspace. Exporter defects still report as unhandled.
- A failed multiple export request ends its progress listeners, so the
leave-page warning it turned on is released.
- Before exporting, the pending changes of the exported files are sent
and the export waits up to 10s for them, instead of 400ms. Exports
are built from the server copy, so if some changes are still unsaved
a toast warns that the export may not include them.
force-persist-files-and-wait waits only for the given files, so a stuck
save of another file does not delay the export.
We only learn how often users lose work from support tickets. Each time
the user is told a save failed, persistence now emits a save-failed
audit event with the cause type, the code, whether the queue is still
retrying and how many changes are waiting.
It follows the same rule as the failure toast: a repeated failure of
the slow retry cycle is not counted again. Failures handed to another
handler, such as an expired session, are counted too, since they also
stop the save.
A save waits for the lock that another save holds on the same file. A
slow save, such as one on a large file, blocks the other saves to that
file. The waiting request also holds the user's only save slot on the
backend, so the user's saves to other files wait behind it too.
Those saves ended in answers that stopped autosave for good:
- a 429 after 60s, when no save slot freed up in time;
- a 504 written by the backend after 300s, with :statement-timeout,
when Postgres cancelled the wait for the lock.
In both cases the backend never applied the save, so sending it again
is safe. transient-error? now treats them as temporary, and the save
takes the retry path. A statement timeout takes 300s per attempt, so
the slow failure limit still bounds it. GET requests and error reports
are unchanged: the check lives in the save pipeline, not in
retryable-types.
Both answers were reproduced in the devenv by holding the file lock
from a separate database session.
Port staging c74d415 (#12252) to main, adapted to this branch.
The :export-shapes modal event carried the full :exports vector,
each export embedding its shape, which could reach megabytes and
wedge the audit archive queue past the proxy body limit. Build a
compact body instead: totals, distinct shapes and per-type counts,
plus the page name. Other modals keep their props.
Move the modal :origin prop to ::ev/origin so make-proto-event
records it as :event-origin; the UI still reads the plain prop.
Bound exception messages at the source: get-hint clamps to
max-message-length (1000 chars) and the CLJS format-throwable
clamps the trace message line and honors :trace-length. The
Context Hint header in generate-report prints get-hint instead
of the raw hint. Also fix first-line on the JVM, where
cuerdas/index-of returns nil and (pos? nil) throws.
Adaptations to main: skip audit-log.md (absent here), skip the
generate-report huge-message test (staging async helpers are
absent), and fit the errors.cljs hunk to main's generate-report.
AI-assisted-by: muse-spark-1.3-contributor
* ✨ Add async test helpers and the with-mocks* macro
Backport of the test scaffolding that the persistence retry work needs,
taken from staging. Purely additive: no existing helper changes behavior,
so the suite result is unchanged (740 tests, 0 failures).
- frontend-tests.helpers.async: ->promise, await-response, settle,
observe and wait-for. wait-for checks immediately and then polls one
macrotask at a time, bounded, so it fails instead of hanging.
- mock/with-mocks*: installs mocks with set! and evaluates its body in a
generated ^:async fn, so the test reads sequentially and there is no
done to thread. Evaluates to a promise.
- mock/asap and mock/run-mocked: run-mocked awaits the body and restores
the originals always, in that order, reporting a rejection or a
non-promise return as an :error.
The matching change that made with-mocks defer its body via asap is NOT
backported: it would force all 58 existing uses across 14 files into
done-chained contexts, which is a separate refactor.
AI-assisted-by: space-bunny-free
* ✨ Add an error report governor with compact payloads
One browser session could emit an unbounded number of identical error
reports, and a dropped connection was reported as an application defect
with the full payload. Both are fixed here, in one place, because the
persistence retry work that follows depends on the new submit-report
contract.
- A report governor in app.main.errors. Each report carries a
fingerprint (report-name|type|code|hint|first stack frame); the first
occurrence is always emitted, repeats inside a 2 minute window are
counted, and the next emitted report carries them as :occurrences. The
cache is bounded by evicting the oldest entry, so memory stays fixed.
- flash reserves the report before generating it, so a suppressed
occurrence never pays the report-building cost. Its whole body now
runs inside one ts/schedule callback, a reporting or notification
failure is logged instead of propagating, and it returns a total
promise so tests can await it.
- generate-report accepts :format :compact|:full. The compact payload
keeps the context header plus type, code and uri, and skips the
stack, the ex-data dump (it can carry request headers) and the
last-events list.
- environment-error-types is derived from rp/retryable-types, so the
transport classification has a single source of truth. Environment
failures are audit-only handled-exceptions and never reach the
exception page or the alerts. :offline gets its own handler instead
of falling through to :default.
:occurrences travels inside the audit event :props, which the backend
schema accepts as a free-form map, so no backend change is needed.
The dedup governor test file is new: 7 tests over the fingerprint, the
pure reservation decision, and the flash pipeline.
Relates to #11726, #11743
AI-assisted-by: space-bunny-free
* ♻️ Answer commit refusals with an empty stream
commit-changes used to return nil when it refused to build a commit,
which forced every caller that wanted to observe the outcome to
special-case nil. It now returns an empty stream, so a refusal and an
empty result look the same and callers can subscribe uniformly.
Only the refusal branch changes: the accepted branch already answered
with (rx/of commit). Potok treats a nil watch result as "nothing", so
both spellings were already correct at the store level.
The 57 call sites that wrap this event in rx/of are unaffected. They
hold the ::commit-changes event itself, not the value its watch
returns, so they keep processing exactly as before.
AI-assisted-by: space-bunny-free
* ✨ Retry transient saves with backoff and a reconnect notice
Any failed update-file landed on the same path: the queue halted in
:error, the retained changes were flushed away, and the user was told
to reload. A dropped connection and a revoked permission are not the
same thing, so they now take different paths.
transient-error? splits them, checking :type and :cause-type because
persistence-failed wraps the original cause. Transient failures enter
a :retrying episode: the head commit stays queued and resends with
backoff at 2s, 8s and 20s, then falls through to today's terminal path.
Everything else is terminal and keeps the exact :error path.
- Resends rotate the ::request-id stamp only once the old request has
left active-requests, carry the same :commit-id, and never double
send while one request is in flight.
- Retry timers carry an episode token; a timer whose episode was
superseded stays silent instead of sending or failing.
- One tagged reconnect notice per episode, hidden by tag on save and on
terminal failure. Recovery is silent.
- The browser online event re-enters the runner, but only for a live
:retrying episode, guarded by exists? js/window.
- wait-persisted-or-error waits through :retrying instead of cutting the
wait short.
The episode keeps its :run-id, so a new local edit only joins the queue.
Re-entering the runner on every edit would bypass the backoff and spend
one attempt per batched commit.
The retry test namespace is new: 13 tests over the classification, the
backoff schedule, stamp rotation, stale tokens and the notice lifecycle.
Relates to #11724
AI-assisted-by: space-bunny-free
* 🐛 Fix stalled saves that never answer and edits lost on leave
Two holes the retry work did not close.
An update-file request that never gets an answer kept its attempt
stamp forever, so the queue could not move and the user saw a saving
state that never resolved. The request now has a 7 minute timeout that
fails it as a transient network error, which hands it to the retry path
instead of blocking. The timeout is longer than the 5 minute stall
threshold on purpose: the stalled report must fire before the retry,
not instead of it.
The leave-page warning also had gaps. It now tracks unsaved edits
directly, through sync-unload-guard, which holds :persistence in
st/ongoing-tasks while edits sit in the buffer or the queue. Edits kept
in the queue after a failed save keep the guard on too, so closing the
tab warns instead of dropping them.
store.cljs guards its ongoing-tasks watcher with exists? js/window,
because the new tests exercise it without a window.
Four new tests: three for the guard across buffering, an in-flight save
and a retained edit, and one for a hung request that must resend and
save.
Closes#12223
AI-assisted-by: space-bunny-free
* 🐛 Skip the save when a missing font cannot be remapped
fix-deleted-fonts emitted text and typography changes even when no
replacement font existed, so opening a page that uses a deleted custom
font rewrote identical content and cleared position-data on every
visit. Every visit became a save with nothing to save.
Both loops now compare the remapped value with the original and emit
nothing when they match. The remapped path is unchanged.
Two new tests cover the no-replacement case and the remapped case.
Closes#12151
AI-assisted-by: space-bunny-free
* ✨ Add a debug helper that simulates an intermediary response
A save that never reaches the backend is hard to reproduce: you need a
proxy, a captive portal or a CDN in the way. This wraps fetch and
answers the named API method with a status and a body that carries no
Penpot error code, leaving every other request alone.
Without a duration the simulation is spent after answering one call.
With one it answers every matching call for that long, which is how to
watch the save retry, warn, keep retrying and finally recover.
debug.simulateHttpError('update-file')
debug.simulateHttpError('get-comment-threads', 403)
debug.simulateHttpError('update-file', 524, 120)
debug.clearHttpErrorSimulation()
Dev-only and self-contained: no production path reads it.
AI-assisted-by: space-bunny-free
* 🌐 Add the save retry and connection error strings
Three strings the new persistence and error paths need:
- errors.save-retrying, shown once per retry episode while the queue
resends a queued save after a connection loss.
- workspace.header.retrying, the save indicator state for an episode
in progress.
- errors.connection-error, shown by the network and offline handlers,
which no longer fall through to the generic message.
Added to en.po only. The translations script also normalizes every
other locale and drops 439 strings that were already stale before this
work; that belongs in its own maintenance pass, not in a backport.
AI-assisted-by: space-bunny-free
* 🐛 Report save failures as unhandled when they are our defect
flash-persistence reported every failure it did not delegate as
handled-exception, including the ones that are plainly our fault. A
validation failure means the client sent something the server refused,
yet it landed in the audit log with a name that skips the internal
reports and the alerts. Nobody was paged.
The report type now follows the cause. :validation, :server-error and
:internal report as unhandled-exception, so they alert. The rest are
unchanged.
Two exclusions are deliberate:
- Environment failures stay handled. They reach this point after the
retry budget is spent, and the user's connection is not our bug.
- :assertion stays handled, because its own handler already reports it
that way and the two paths should not disagree.
The cause type is read from :cause-type first, since persistence-failed
wraps the original under :type :persistence. Reading :type alone would
match the wrapper every time and change nothing.
The user still gets the same sticky toast and report link; only the
audit event name moves.
The test that asserted a validation failure is "still notified" now
asserts which event name it gets, across the bare and wrapped shapes,
the environment types that must stay handled, and an unclassified one.
AI-assisted-by: space-bunny-free
* 🐛 Unblock persistence when opening a file after a terminal failure
A terminal save failure set the state to :error and left the queue
alone. recover-persistence only resumed for :save-permission-denied, so
for every other terminal code both of its branches were false and it
emitted nothing. Leaving and reopening the same file therefore changed
nothing: the editor stayed halted until a reload, which rebuilds the
whole store and loses the queue anyway.
The path had two jobs under one name. initialize-persistence fires when
the workspace view mounts and tears down the previous subscription;
recover-persistence fires when a file is opened or the role changes.
They are now separate: initialization picks up a queue left behind by a
previous session, and deliberately does not lift a halt, so undeliverable
edits are released when the user acts rather than when the view mounts.
Recovery lifts the halt by releasing what can never be saved.
release-failed-file drops every queued commit of the file that failed,
then resume-persistence clears the error and settles an empty queue to
:saved. Retaining them until that point is deliberate: it is what keeps
wait-persisted-or-error rejecting, which is what stops
workspace/versions.cljs from building a snapshot out of unsaved edits.
Releasing at failure time would make waiters resolve instead.
Permission loss is treated as permanent too, which the previous
exception got wrong. The backend raises :not-found for a missing edit
permission, so a resend does not succeed — it routes the user to the
exception page. The old branch made that reachable: it resumed the save
whenever the cached can-edit flag said yes, and the server disagreed.
The only case where the flag can return to true is a team switch, where
the queue is gone anyway, so nothing real is lost by releasing.
Because the queue is shared, dropping the failed file is also what lets
the other files' pending edits drain. One file that cannot be saved no
longer blocks everything else.
Tests: the failure retains the queue and notifies once, recovery
releases it without replaying, a failed file does not block a second
one, permission loss is released rather than resumed, and initialization
leaves a halt alone.
AI-assisted-by: space-bunny-free
* ✨ Offer a reload on the save failure toast
A terminal save failure stops autosave for the whole session, but the
toast asked the user to reload without offering the reload. It listed
five implied actions, none of them reachable from the banner, and it
never said that the changes could not be saved.
flash now takes a :links vector of actions, appended after the download
link that :report-link? produces, so a caller can add recovery actions
without reaching into the report handling. flash-persistence passes a
reload built from labels.reload-page and location.reload, the pattern
already used elsewhere in the app for a full restart.
The message now says what happened, what is lost, and what to do about
it: autosave has stopped for this session, the changes since the last
successful save cannot be saved, and either reloading or leaving the
file and opening it again restarts it. Naming both matters, because the
toast links are easy to miss.
Saying the edits are lost is not optional: recovery releases them, so
without it the user finds out when they come back to the file.
Translated in en.po and es.po only. The translations script would also
normalize all 40 locales and drop entries that were already stale, which
is a maintenance pass of its own.
The reload callback cannot be invoked under the test runner, since
js/location does not exist there, so it is covered by its label and by
being callable. Whether the reload works is a manual check.
AI-assisted-by: space-bunny-free
* 🐛 Classify the responses the backend never wrote
A reply written by a proxy instead of the backend carries no Penpot
error code, so handle-response raised it as :internal. A 504 on a save
skipped the retry cycle and stopped autosave at once, and because
:internal reports as unhandled, it raised an alert. In a standard
deployment this is how a slow save ends: nginx answers 504 after 300s,
before the client's 7 minute timeout fires.
The status now decides the type:
- 504 and the Cloudflare 520-524 family raise :gateway-error, which
joins retryable-types. Saves retry with backoff like 502 and 503,
GETs retry, and a save that spends its retries reports as handled,
because the report rules derive from the same set.
- 429 raises :rate-limit, and any other error status
:unexpected-response. Neither retries; both show a toast instead of
the error page.
- :internal is kept for a response below 400 that does not decode.
Bodies we cannot read are cut to 500 characters, since proxy error
pages run to tens of kilobytes.
Tests: classification and retries per status, the transport handlers
keep the page, a 504 and a 524 built by the real handle-response go
through the save path and land on a retry, and the new types stay
handled once the retries are spent.
AI-assisted-by: claude-opus-5-5
* ✨ Keep retrying failed saves on a slow cycle
Once the three backoff retries were spent, a save that failed on the
connection stopped autosave like any terminal failure, and opening a
file again dropped its edits. A connection that comes back after a
minute lost the work all the same.
A transport failure that outlasts the backoff now arms a slow cycle:
one silent resend every 30s, until a save lands or 24h have passed
since the failure started. The cycle stops when persistence restarts,
the queue resumes another way, or the workspace closes.
A save that keeps failing slowly is not resent for a day. A gateway
that answers 504 after its own timeout may leave the backend applying
the save, so each resend can cost the whole save again, and the failing
file holds back every other file's queued edits. An attempt that fails
after 90s or more counts as a slow failure; at three, the slow cycle
stops sending the commit and the save fails as before. Fast failures,
such as being offline, never count.
- The first failure shows a toast that says the changes are kept and
keep being sent, with no reload link, since a reload loses them. A
save that lands hides it.
- Opening a file sends a queue still inside its retry window once
more instead of releasing it. Failures outside the window, and every
non-transport failure, are still released.
- A freshly loaded file gets back the queued edits of its version, so
reopening it shows the changes that are still waiting to be saved. An
edit that no longer applies to the loaded data leaves the file as the
server sent it, so the file still opens; the edits stay queued.
- A commit whose earlier request is no longer in flight is simply sent
again under the same commit id: changes are idempotent, so there is
no unknown-outcome guard any more. A request still in flight still
blocks a parallel send.
flash takes a :tag so the save failure toast can be hidden by tag.
Tests: the spent backoff arms the slow cycle, a 504 arms it, a terminal
failure does not, the cycle stops when the window closes or at the slow
failure limit, recovery resends instead of releasing, reopening restores
only the loaded file's edits and survives one that no longer applies,
and the retrying toast offers no reload.
* 🐛 Turn off the leave-page warning when failed edits are released
The leave-page warning only followed the queue on appends and discards.
Opening a file again releases the edits of a file that failed for good,
but that release changed the queue without either event, so the warning
stayed on with nothing left to save. Leaving the page asked about
unsaved changes until the next save went through.
The warning now also follows the release.
Tests: releasing the last failed edit turns the warning off.
* 🐛 Stop retrying failed saves outside the workspace
Leaving the workspace was meant to stop the slow retry cycle, but only
a cycle already armed stopped. A backoff timer kept firing after the
user left, and a backoff spent outside the workspace armed a slow cycle
that kept sending for up to a day from the dashboard. Those sends check
the edit permission of whatever team is open, so a switch to a team
where the user only views failed the queued edits for good, and the
next file they opened dropped them.
Leaving the workspace now suspends retries. A pending backoff timer
goes stale, and while suspended a transport failure schedules no
backoff, a spent backoff arms no slow cycle and the online event sends
nothing. The edits stay queued and a request in flight still lands.
Opening a file lifts the suspension and resends a retrying save whose
backoff was cut short; a role change does not lift it.
Tests: leaving stops a pending backoff, a failure after leaving
schedules no retry and ignores the online event, a backoff spent
outside the workspace arms no slow cycle, and opening a file saves the
held edit in each case.
---------
Co-authored-by: alonso.torres <alonso.torres@kaleidos.net>
* 🐛 Stop the export-shapes modal event from dumping all exports
The `:export-shapes` modal event carried the full `:exports` vector,
each export embedding its shape (path data, geometry, text content).
One event reached 1.7 MB, which made the audit archive cron POST a
chunk past the proxy body limit and wedge the queue.
Build a compact body for that modal instead: total exports, distinct
shapes and one count per export type, plus the page name. Other modals
keep their props unchanged.
Move the modal `:origin` prop to `::ev/origin` so `make-proto-event`
records it on the event context as `:event-origin`; the UI still reads
the plain prop from the raw state.
Add tests for the summary and for the modal origin.
AI-assisted-by: deepseek-v4.1-flash
* 🐛 Bound exception messages in reports and audit events
A frontend crash whose message embeds a whole payload (a serialized
file) produced a 9.4 MB audit event: the message was repeated in the
`:hint` prop, in the report context and in the stack trace. A single
event that big wedged the audit archive queue.
Bound exception messages at the source: `get-hint` clamps to
`max-message-length` (1000 chars), and the CLJS `format-throwable`
clamps the message line of the stack trace and honors `:trace-length`
(parity with the CLJ version). `report-context` now prints `get-hint`
instead of the raw `:hint` from `ex-data`.
Fix `first-line` on the JVM: `cuerdas/index-of` returns nil when the
substring is missing and `(pos? nil)` throws there (it is false in
CLJS), so single-line messages crashed the backend path.
AI-assisted-by: deepseek-v4.1-flash
Auto-grow text geometry is finalize-only to avoid typing lag, so the
Design tab kept the committed selrect (0.01 for new texts) until Esc.
Patch display W/H from live WASM layout while editing, matching the
viewport outline, without restoring per-keystroke modifiers.
Closes#12244
