feat: restore-all session recovery, ?file= deep links, offline PWA

Session recovery: more than one pending snapshot adds a 'Restore all'
button to the Recover Drawing modal — every snapshot goes through the
exact same guarded path as a single restore (deleted only after its
own open succeeds). The open-tab list and active tab persist to
localStorage on web (open/save/close) and the remembered tab is
re-selected once a restore batch settles; the modal notes how many
drawings the session had. Nothing is auto-opened.

Deep links: ?file=<url|name> opens a drawing at boot. http(s) URLs
must end in .dwg/.dxf and are fetched with the same streaming,
64 MB-capped, 8 s-deadline reader the remote images use, then go
through the guarded open queue; cross-origin opens announce the
origin first. Bare names resolve from the browser's recent storage,
with a hint when absent. Everything else (file:, javascript:, drive
letters, non-drawing tails) is refused with a console note.

Offline PWA: the app was installable (manifest) but downloaded its
55 MB bundle on every visit. A cache-first service worker now serves
the whole bundle from Cache Storage after one online visit —
navigations network-first so updates land, hashed assets
stale-while-revalidate, non-GET/cross-origin passthrough, old caches
cleaned on activate, and the waiting-worker update flow documented.
The Pages workflow stamps the cache version from the bundle hash and
fails if sw.js is missing or unstamped.

(cherry picked from commit 5f9b345e)

Ported onto main (#1717 review): the cache-version stamp moved from the
skipped build-web.sh wrapper into the Pages workflow; the tab-close hook
lands in main's on_tab_close, which also cancels pinned control requests.

src/app/update/command.rs

@@ -219,6 +219,10 @@ impl OpenCADStudio {
         if let Some(tab_id) = tab_id {
             v4_support::on_tab_closed(tab_id);
         }
+        // The tab list just shrank: refresh the remembered session list
+        // (web session memory).
+        #[cfg(target_arch = "wasm32")]
+        self.persist_web_session();
         Task::none()
     }
 

src/app/update/dialog.rs

@@ -225,6 +225,10 @@ impl OpenCADStudio {
                 // last selection. #21.
                 self.sync_ribbon_layers();
                 self.sync_ribbon_from_selection();
+                // The tab list just shrank: refresh the remembered
+                // session list (web session memory).
+                #[cfg(target_arch = "wasm32")]
+                self.persist_web_session();
                 return Task::batch([close_win, self.continue_tab_close_queue()]);
             }
             Some(crate::app::PendingClose::Quit) => {

src/app/update/file.rs

@@ -2248,6 +2248,10 @@ impl OpenCADStudio {
                 .set(crate::app::OPEN_PHASE_FINALIZING, 10000, 1, 1);
         }
         self.opening.take();
+        // The tab list just changed (and the active tab with it): remember
+        // it for the next boot's restore flow (web session memory).
+        #[cfg(target_arch = "wasm32")]
+        self.persist_web_session();
         let pending_open_task = if let Some(report) = recovery_report {
             self.recovery_report = Some(report);
             self.active_modal = Some(crate::app::ModalKind::Recovery);
@@ -2803,6 +2807,9 @@ impl OpenCADStudio {
         );
         self.tabs[i].scene.document.version = version;
         self.tabs[i].recovery_save_as_required = false;
+        // A save may have renamed the tab (Save As): refresh the remembered
+        // session list (web session memory).
+        self.persist_web_session();
         let snapshot_is_current = self.tabs[i].scene.geometry_epoch == geometry_epoch
             && self.tabs[i].edit_revision == edit_revision
             && self.tabs[i].scene.camera_generation == camera_generation;
@@ -3962,12 +3969,16 @@ impl OpenCADStudio {
     /// restore prompt (behind any already-queued startup modal). An empty
     /// scan — a fresh profile, or everything already cleaned up — must not
     /// surface an empty "Recover Drawing" modal, so the prompt is only
-    /// queued when there is something to offer.
+    /// queued when there is something to offer. The remembered session list
+    /// is loaded right after the scan: it never opens anything itself, it
+    /// only names what the session had (a line in the restore modal) and
+    /// picks the active tab once restores complete.
     #[cfg(target_arch = "wasm32")]
     pub(super) fn on_web_autosaves_scanned(
         &mut self,
         result: Result<Vec<crate::io::web_autosave::WebAutosaveEntry>, String>,
     ) -> Task<Message> {
+        self.web_session = crate::io::web_session::load();
         let Ok(mut entries) = result else {
             // Best-effort feature: no storage access, no prompt.
             return Task::none();
@@ -4004,6 +4015,44 @@ impl OpenCADStudio {
         )
     }
 
+    /// "Restore all": the whole pending list goes through the exact same
+    /// guarded path as a single restore — one read per snapshot, then
+    /// `enqueue_restore` with its own key, and the 50 ms poll opens them
+    /// sequentially. Nothing about consumption changes: each snapshot is
+    /// still deleted only when its own open succeeds (matched by open id),
+    /// and any failure (unreadable, parse error, cancel) keeps that
+    /// snapshot in OPFS for the next boot. The batch counts its settles in
+    /// `web_autosave_restore_all_remaining`; every settle path funnels
+    /// through `queue_next_web_autosave_prompt`, so the countdown — and the
+    /// remembered session's tab selection when it hits zero — needs no
+    /// extra bookkeeping sites.
+    #[cfg(target_arch = "wasm32")]
+    pub(super) fn on_web_autosave_restore_all(&mut self) -> Task<Message> {
+        // Fewer than two pending: this is just Restore.
+        if self.web_autosave_pending.len() < 2 {
+            return self.on_web_autosave_restore();
+        }
+        let entries = std::mem::take(&mut self.web_autosave_pending);
+        self.web_autosave_restore_all_remaining = entries.len();
+        self.close_active_modal();
+        self.command_line.push_info(
+            crate::tf!("Restoring {} drawing(s)…", entries.len()).as_ref(),
+        );
+        let reads = crate::io::web_autosave::restore_all_plan(&entries)
+            .into_iter()
+            .map(|(open_name, key)| {
+                // Same contract as the single restore: the key travels with
+                // the bytes so the deletion marker is recorded by open id.
+                let read_key = key.clone();
+                Task::perform(
+                    async move { crate::io::web_autosave::read(&read_key).await },
+                    move |result| Message::WebAutosaveBytes(open_name, key, result),
+                )
+            })
+            .collect::<Vec<_>>();
+        Task::batch(reads)
+    }
+
     /// The recovered drawing opened: its autosave snapshot — held back until
     /// now — can finally be deleted, and the next queued snapshot can be
     /// offered. The caller already matched the marker to this open's id.
@@ -4097,14 +4146,79 @@ impl OpenCADStudio {
     }
 
     /// Re-offer the remaining boot snapshots once the current one settled.
-    /// No-op when none are left (or the modal is already queued).
+    /// No-op when none are left (or the modal is already queued). This is
+    /// also the single funnel every restore settle runs through (opened,
+    /// failed, cancelled, unreadable, or queue-rejected), so a Restore-all
+    /// batch counts down here — and when its last snapshot settles, the
+    /// remembered session decides which tab ends up active.
     #[cfg(target_arch = "wasm32")]
     pub(super) fn queue_next_web_autosave_prompt(&mut self) {
+        if self.web_autosave_restore_all_remaining > 0 {
+            self.web_autosave_restore_all_remaining -= 1;
+            if self.web_autosave_restore_all_remaining == 0 {
+                // Applied at the next message boundary: the last restore's
+                // settle (`web_autosave_opened`) runs BEFORE its own open
+                // inserts the tab, so focusing here could not see it yet.
+                self.web_session_focus_pending = true;
+            }
+        }
         if !self.web_autosave_pending.is_empty() {
             self.queue_autosave_restore_prompt();
         }
     }
 
+    /// A Restore-all batch has fully settled: focus the tab the crashed
+    /// session remembered as active, if it actually came back (or is open
+    /// under its own name). Restored tabs carry the "(recovered)" marker —
+    /// `recovered_name` maps the remembered name onto it idempotently. A
+    /// no-op without remembered memory, or when the remembered tab did not
+    /// return; the last-opened tab then stays active, which is fine. Called
+    /// from the after-message hook (`web_session_focus_pending`), so the
+    /// whole settle batch — including the last tab insertion — is done.
+    #[cfg(target_arch = "wasm32")]
+    pub(super) fn select_remembered_session_tab(&mut self) {
+        let Some(session) = self.web_session.as_ref() else {
+            return;
+        };
+        let Some(remembered) = session.tabs.get(session.active) else {
+            return;
+        };
+        let recovered = crate::io::web_autosave::recovered_name(remembered);
+        let Some(index) = self.tabs.iter().position(|tab| {
+            let name = tab.tab_display_name();
+            name == remembered.as_str() || name == recovered
+        }) else {
+            return;
+        };
+        self.active_tab = index;
+        // The active tab changed under the ribbon; re-sync its chips like
+        // every other tab switch does (#21).
+        self.sync_ribbon_layers();
+        self.sync_ribbon_styles();
+        self.sync_ribbon_from_selection();
+    }
+
+    /// Remember the open-tab list (names + active index) in localStorage —
+    /// the web session memory the next boot's restore flow consults. Cheap
+    /// by design: a small `Vec<String>` + index, rewritten in full. Called
+    /// on every save/open/close; the Start tab is not a drawing and is
+    /// skipped, with the active index remapped onto the filtered list.
+    #[cfg(target_arch = "wasm32")]
+    pub(super) fn persist_web_session(&self) {
+        let mut names: Vec<String> = Vec::new();
+        let mut active = 0;
+        for (index, tab) in self.tabs.iter().enumerate() {
+            if tab.is_start {
+                continue;
+            }
+            if index == self.active_tab {
+                active = names.len();
+            }
+            names.push(tab.tab_display_name());
+        }
+        crate::io::web_session::persist(&names, active);
+    }
+
     /// Delete the `.sv$` autosave recovery files for all open drawings. They
     /// exist only to survive a crash, so a clean save or exit removes them.
     pub(in crate::app) fn cleanup_autosaves(&mut self) {

src/app/update/mod.rs

@@ -481,6 +481,14 @@ impl OpenCADStudio {
             self.graphic_attributes.retain_selection(&selected);
         }
         self.show_next_startup_modal();
+        // A Restore-all batch finished settling on this message: now that
+        // the last restored open has inserted its tab, focus the tab the
+        // remembered session had active (web session memory).
+        #[cfg(target_arch = "wasm32")]
+        if self.web_session_focus_pending {
+            self.web_session_focus_pending = false;
+            self.select_remembered_session_tab();
+        }
         self.sync_open_command_history();
         // Close the document-level first-touch transaction started by
         // push_undo_snapshot at this message boundary.
@@ -1401,11 +1409,27 @@ impl OpenCADStudio {
                 }
             },
 
+            // The `?file=` boot deep link settled. Queued bytes are drained by
+            // the control poll's drop queue like any drop — nothing to say
+            // until that open starts (or its parse error surfaces there).
+            #[cfg(target_arch = "wasm32")]
+            Message::WebLinkSettled(outcome) => {
+                use crate::io::web_link::LinkOutcome;
+                match outcome {
+                    LinkOutcome::Queued => {}
+                    LinkOutcome::Info(text) => self.command_line.push_info(&text),
+                    LinkOutcome::Error(text) => self.command_line.push_error(&text),
+                }
+                Task::none()
+            },
+
             #[cfg(target_arch = "wasm32")]
             Message::WebAutosavesScanned(result) => self.on_web_autosaves_scanned(result),
             #[cfg(target_arch = "wasm32")]
             Message::WebAutosaveRestore => self.on_web_autosave_restore(),
             #[cfg(target_arch = "wasm32")]
+            Message::WebAutosaveRestoreAll => self.on_web_autosave_restore_all(),
+            #[cfg(target_arch = "wasm32")]
             Message::WebAutosaveDiscard => self.on_web_autosave_discard(),
             #[cfg(target_arch = "wasm32")]
             Message::WebAutosaveDefer => self.on_web_autosave_defer(),